Providing Integrity in Real-Time Networks-on-Chip

Abstract

Mixed-critical real-time systems must meet strict integrity, resilience and timing constraints, as specified by safety standards. Due to the increasing threat of random hardware faults, efficiently achieving high reliability and dependability calls for cross-layer fault-tolerance solutions. This work introduces the Advanced Integrity Q-service (AIQ), a mechanism to ensure the integrity and predictability of on-Chip communication under random hardware faults. Devised for cross-layer and hierarchical fault-tolerance solutions, AIQ realizes low-overhead error detection in hardware and delegates error handling to arbitrary strategies in software. Experimental evaluation featuring benchmark applications and an industrial avionics use case shows that AIQ operates with high reliability and availability and low hardware and performance overheads. In a many-core mixed-critical platform under expected real-time scenarios, AIQ performs with execution time overhead between 1.4% and 7.1%.

The information processing factory

“…In IPF systems, the current generation of TAL uses AP or equivalent implementation as a verification hardware [15], accompanying a model transformation from the well-known timed automata (TA)based requirement model to an AP-based model and uses it for verification. In the experiment, TAL with the pacemaker and collision avoidance examples, we achieved 100 % error detection rate using only 3 % of the resources of AP, providing the root cause of the errors.…”

“…An example is the redundant software execution with hardware-supported error detection [13], where the software can be protected with replication in space or time combined with efficient error detection in hardware. The approach can be additionally coupled with other error detection mechanisms to increase coverage and resilience while ensuring integrity [14]. Nonetheless, the industry still relies on costly hardware modular redundancy approaches, such as diverse dual modular redundancy (DMR) or triple modular redundancy (TMR) with lock-step execution [6].…”

“…Integrity is paramount in safety-critical systems [7,14]. Although the maximum hazard handling time with the proactive self-diagnosis ( A in Figure 8) is not as critically short as the maximum reaction time in reactive approaches ( B in Figure 8), integrity continues being a paramount system requirement.…”

“…The system must be aware of all errors in it and cannot allow them to affect its service, which would result in the unacceptable risk of an uncontrolled failure. The system must detect all errors; it can handle or tolerate some; when it cannot handle or tolerate an error, it must indicate failure before it becomes a hazard [14]. Conventional, reactive techniques can ensure integrity by only allowing data to be consumed or an output to be made after the possibility of error has been ruled out [13]; or, less strictly, by detecting the error and reacting to it in time to contain its propagation [14].…”

“…The system must detect all errors; it can handle or tolerate some; when it cannot handle or tolerate an error, it must indicate failure before it becomes a hazard [14]. Conventional, reactive techniques can ensure integrity by only allowing data to be consumed or an output to be made after the possibility of error has been ruled out [13]; or, less strictly, by detecting the error and reacting to it in time to contain its propagation [14]. In contrast, the proactive self-diagnosis detects imminent hazards before the error occurs and relies on IPF's self-organization to handle it before it propagates and becomes a hazard.…”