Effectiveness of Fault Detection Mechanisms in Static and Dynamic Operating System Designs

Abstract

Abstract-Developers of embedded (real-time) systems can choose from a variety of operating systems. While some embedded operating systems provide very flexible APIs, e.g., a POSIXcompliant interface for run-time management, others have a completely static structure, which is generated at compile time by utilizing detailed application knowledge. A prominent example for the latter class from the domain of automotive operating systems is OSEK/OS and its successor AUTOSAR/OS. As we have shown in previous work, the design of the operating system has a strong impact on its vulnerability for system failure caused by hardware faults. This observation is gaining importance, because there is an ongoing trend towards low-power and low-cost, yet less reliable, hardware. This work quantifies the difference in vulnerability for soft errors in main memory of a flexible (dynamic) operating systems (eCos) and a static system (CiAO), which has an OSEK-compliant structure. We also analyze the additional degree of robustness that is achieved by hardening an operating system with software-based and hardware-based faulttolerance measures and the corresponding costs. Covering this design space gives developers a better chance for good design decisions with respect to the trade-off between fault tolerance, resource consumption, and interface convenience. Our results indicate that with a combination of hardware-and softwarebased fault-tolerance measures, silent data corruptions in both operating systems can be reduced to below one percent (compared to eCos). However, the analyzed fault-tolerance mechanisms are expensive for the dynamic system, whereas the statically designed operating system can be hardened at much lower price.

dOSEK: the design and implementation of a dependability-oriented static embedded kernel

“…However, we already see that the SDCs in registers are significantly decreased compared to ERIKA -an effect of the avoidance of indirections. As already observed in previous work [14], the usage of an MPU does not improve the overall dependability significantly, when a pointer-less design was applied beforehand. Nevertheless, utilizing the MPU still decreases the instruction pointer errors by 72 percent.…”

“…Watchdog concepts and MPUs play an important role for safety-related aspects. To a large extent, transient faults can be contained within individual components and reveal a significant amount of possible SDCs, as also shown in previous evaluations [14]. Consequently, dOSEK integrates the underlying architecture's mechanisms into its system design, leveraging a coarse-grained fault detection among tasks and the kernel.…”

“…We could show in recent work [14] that static tailoring generally leads to a higher inherent robustness of the resulting system due to the reduction of vulnerable run-time state. The dependability-oriented tailoring in dOSEK minimizes such vulnerable state even further by also condensing control-flow state within the kernel.…”

“…For instance, we could show in previous work [14] that, without any dependability-oriented measures, a static OSEK-like RTOS (i.e., all resources are allocated at compile time) already exhibits a five times lower number of SDCs than a more dynamic POSIX-like RTOS (i.e., all resources are allocated at run time). So what are the general design principles and implementation concepts that support such inherent robustness against transient faults and what are those that impair it?…”

“…Here, we revive a setup, already presented in previous work [14], resembling a real-world safety-critical embedded system in terms of a quadrotor helicopter control application (cf. Figure 4).…”