Fault injection for dependability validation: a methodology and some applications

Arlat, Jean; Aguera, M. Ángeles López; Amat, L.; Crouzet, Yves; Fabre, Jean-Charles; Laprie, Jean-Claude; Martins, Eliane; Powell, David

doi:10.1109/32.44380

Cited by 455 publications

(168 citation statements)

References 19 publications

Supporting

Mentioning

158

Contrasting

Unclassified

Order By: Relevance

“…It is defined by [36] as "the deliberate introduction of faults into a system." In order to execute a fault injection, failure hypotheses are needed, which are given by our formalization of failure modes.…”

Section: Assumption: "Multiple-point Failures Do Not Occur" or Altermentioning

confidence: 99%

Contract-Based Design of Embedded Systems Integrating Nominal Behavior and Safety

Kaiser¹,

Weber

Oertel

et al. 2015

J. Complex Syst. Inform. Model. Q.

View full text Add to dashboard Cite

Abstract. The distributed design process for safety-critical embedded systems has become an increasingly difficult challenge: Electronic Control Units (ECUs) in vehicles, for instance, participate in many vehicle functions, while each vehicle function, in turn, is spread across several ECUs. Many suppliers participate in systems design and many partial functions are reused from past projects, not always knowing the assumptions at the time of their development. In particular, efficient allocation of safety mechanisms and a sound safety case are difficult tasks for original equipment manufacturers (OEMs). Contractbased development has gained popularity as an approach for supporting distributed development by explicitly annotating assumptions and guarantees to components, but an integrated process covering specification of nominal behavior and safety has not been described so far. We present such an integrated development approach that encompasses the systematic breakdown of nominal system behavior using contracts, the consistent derivation of safety analysis by interpreting several types of contract violations as a specification for failure modes, and the subsequent integration of safety mechanisms that cover these failure modes through safety contracts. The approach equally fits hardware and software and is therefore applicable on the system level. We demonstrate it by an electric drive example. The extensibility of our approach towards Cyber Physical Systems, which compose themselves at runtime, is briefly outlined at the end of the article.

show abstract

Section: Assumption: "Multiple-point Failures Do Not Occur" or Altermentioning

confidence: 99%

Contract-Based Design of Embedded Systems Integrating Nominal Behavior and Safety

Kaiser¹,

Weber

Oertel

et al. 2015

J. Complex Syst. Inform. Model. Q.

View full text Add to dashboard Cite

show abstract

“…The main elements that characterize FI (experiments, or campaign) are: the set of faults to be injected (the Fault model), the system activities under which the faults are injected (the Activation), the Readouts of the experiment results, and the Measures evaluated, based on the readouts. These elements form the basis of the FARM [5] method to FI, similarly to other existing FI methods (see e.g., [6]). It is worth to mention that the measures, M, are defined first, since they guide the whole FI process, but their values are assessed in the last step, by processing information provided by the readouts.…”

Section: System Development Processmentioning

confidence: 99%

From Safety Analyses to Experimental Validation of Automotive Embedded Systems

Pintard

Fabre

Leeman

et al. 2014

2014 IEEE 20th Pacific Rim International Symposium on Dependable Computing

View full text Add to dashboard Cite

Abstract-Automotive embedded systems are becoming increasingly complex. Therefore verification activities are paramount to ensure safety. ISO 26262 is the first standard specifically dedicated to automotive safety systems. This standard requires introducing fault injection (FI) from the very early phases of the development process. Our work aims at developing an approach that will help integrate FI in the whole development process in a continuous way, from system requirements to the verification and validation phase. In this paper, we concentrate on exploring the benefits of safety analyses for experimental validation of the system. We propose an analogy between FI during the pre-implementation phase with safety analyses that are of common use during system design. We finally illustrate this approach on a case study from the automotive domain.

show abstract

“…This process is started automatically at boot time and simply tries to reboot the system after a specific timeout has triggered (currently four minutes). To define such a timeout is common practice for fault injection [Arlat et al, 1990;Durães and Madeira, 2006]. If this also fails a manual hardware reset is required by the evaluator.…”

Section: Experiments Managermentioning

confidence: 99%

“…MESSALINE [Arlat et al, 1990[Arlat et al, , 1993 injects faults at the pins to ICs of fault tolerant systems. Karlsson et.…”

Section: Fault Injectionmentioning

confidence: 99%

Robustness Evaluation of Operating Systems

Johansson

2008

Information Assurance

View full text Add to dashboard Cite

SummaryThe premise behind this thesis is the observation that Operating Systems (OS), being the foundation behind operations of computing systems, are complex entities and also subject to failures. Consequently, when they do fail, the impact is the loss of system service and the applications running thereon. While a multitude of sources for OS failures exist, device drivers are often identified as a prominent cause behind failures.In order to characterize the impact of driver failures, at both the OS and application levels, this thesis develops a framework for error propagation-based robustness profiling for an OS. The framework is first developed conceptually and then experimentally validated on a real OS, namely Windows CE .Net. The choice of Windows CE is driven by its representativeness for a multitude of OS's, as well as the ability to customize the OS components for particular needs.For experimental validation, fault injection is a prominent technique that can be used to simulate faults (or errors) in the system by inserting synthetic ones and study their effect. Three key questions with such a technique are where, what and when to inject faults. This thesis shows how injecting errors at the interface between drivers and the OS can be very effective in evaluating the effects driver faults can have.To quantify the OS's robustness, this thesis defines a series of error propagation measures, specifically tailored for device drivers. These measures allow for quantifying and comparing both individual services and device drivers on their susceptibility and diffusing abilities.This thesis compares three contemporary error models on their suitability for robustness evaluation. The classical bit-flip model is found to identify a higher number of severe failures in the system. It also identifies failures for more services than both other models, data type and fuzzing. However, its main drawback is that it requires substantially more injections than the other two. Fuzzing, even though not giving rise to as many failures is able to find new additional services with severe failures.A careful study of the injections performed with the bit-flip model shows that only a few bits are generally useful for identifying new services with robustness weaknesses. Consequently, a new composite model is proposed, combining the most effective bits of the bit-flip model with the fuzzing model's ability to identify new services, giving rise to new model without loss of important information and at the same time incurring a moderate number of injections.To answer the question of when to inject an error this thesis proposes a novel model of a driver's usage profile, focusing on high-level operations being carried out. It guides the injection of errors to instances when the driver is carrying out specific operations. Results from extensive fault injection experiments show that more service vulnerabilities can be discovered. Furthermore, a priori profiling of the drivers can show how effective the proposed approach will be. vi

show abstract

Fault injection for dependability validation: a methodology and some applications

Cited by 455 publications

References 19 publications

Contract-Based Design of Embedded Systems Integrating Nominal Behavior and Safety

Contract-Based Design of Embedded Systems Integrating Nominal Behavior and Safety

From Safety Analyses to Experimental Validation of Automotive Embedded Systems

Robustness Evaluation of Operating Systems

Contact Info

Product

Resources

About