Synchronization of faulty processors in coarse-grained TMR protected partially reconfigurable FPGA designs

Kretzschmar, Uli; Gomez-Cornejo, Julen; Astarloa, Armando; Bidarte, Unai; Ser, Javier Del

doi:10.1016/j.ress.2015.12.018

Cited by 23 publications

(14 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, in prior research, faults are usually assumed to be isolated, side effect free, and local to an individual application thread [19] or transient [20], [21], entailing high performance [22] or resource overhead [23], [24]. More advanced proof-of-concepts [20], [25], however, attempt to address these limitations, and even show a modest performance overhead between 3% and 25%, but utilize checkpoint & rollback or restart mechanics [20], which make them unsuitable for spacecraft command & control applications.…”

Section: Background and Related Workmentioning

confidence: 99%

Fault-Tolerant Nanosatellite Computing on a Budget

Fuchs¹,

Murillo²,

Plaat³

et al. 2019

Preprint

View full text Add to dashboard Cite

We present an on-board computer architecture designed for small satellites (<50kg), which exploits software-fault-tolerance to achieve strong fault coverage with commodity hardware. Micro-and nanosatellites have become popular platforms for a variety of commercial and scientific applications, but today are considered suitable mainly for short and low-priority space missions due to their low reliability. In part, this can be attributed to their reliance upon cheap, low-feature size, COTS components originally designed for embedded and mobilemarket applications, for which traditional hardware-voting concepts are ineffective. Software-fault-tolerance has been shown to be effective for such systems, but have largely been ignored by the space industry due to low maturity, as most have only been researched in theory. In practice, designers of payload instruments and miniaturized satellites are usually forced to sacrifice reliability in favor of delivering the level of performance necessary for cutting-edge science and innovative commercial applications. Thus, we developed a set of software measures facilitating fault tolerance based upon thread-level coarse-grain lockstep, which we validated through fault-injection. To offer strong long-term fault coverage, our architecture is implemented as tiled MPSoC on an FPGA, utilizing partial reconfiguration, as well as mixed criticality. This architecture can satisfy the high performance requirements of current and future scientific and commercial space missions at very low cost, while offering the strong fault-coverage guarantees necessary for platform control even for missions with a long duration. This architecture was developed for a 4-year ESA project. Together with two industrial partners, we are developing a prototype to then undergo radiation testing.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Fault-Tolerant Nanosatellite Computing on a Budget

Fuchs¹,

Murillo²,

Plaat³

et al. 2019

Preprint

View full text Add to dashboard Cite

show abstract

“…In synchronous, the redundant devices have a common clock, and the voter should use that clock. In this kind of applications, the voting process is easier to perform, because the voter only needs to compare the inputs . However, when redundant modules work by their own clocks, it is necessary to implement an asynchronous voting algorithm.…”

Section: State Of the Artmentioning

confidence: 99%

“…Additionally, there are a few recommendations in order to improve the functionality of the system: Possibility to use third‐party modules: The people or companies that develop safety devices often are not aware of security issues. Thus, the use of third‐party devices is very helpful, because the company can focus on safety and outsource the security to other company with the expertise. Synchronized system: The system should be synchronized to facilitate the voting process …”

Section: System Analysismentioning

confidence: 99%

“…In this kind of applications, the voting process is easier to perform, because the voter only needs to compare the inputs. 13 However, when redundant modules work by their own clocks, it is necessary to implement an asynchronous voting algorithm. Such algorithms are more complex because of the differences between times of the results (generated by the redundant modules); therefore, mechanisms like extrapolation and waiting loops are used to create a common time for all the modules to be able to compare the results.…”

Section: Safety Mechanismsmentioning

confidence: 99%

See 1 more Smart Citation

Coexistence of safety and security: Synchronized redundant system with security enhancements

Valdivia

Adin

Añorga

et al. 2018

Quality & Reliability Eng

View full text Add to dashboard Cite

A malicious attack on a safety‐critical system can derive in an undesired behavior of the system that may result in a failure. In this case, the reliability of the device is decreased, and it might affect directly to safety. Therefore, the security is also an essential issue to consider in the design of safety‐critical systems. The main problem when safety and security are considered is to make them work together without interfering each other. A safety‐critical device needs to be certified following standards like IEC‐61508, and any security mechanisms must not affect this certification. This paper describes a system that integrates safety and security mechanisms to improve reliability without affecting safety certification. With the aim of reaching the required safety level, a redundant system is considered. This system is an n out of m distributed and synchronized voter. The synchronization method is based on the precision time protocol (IEEE‐1588) allowing that all devices on a local network have the same time.

show abstract

“…We avoid thread synchronization issues due to invasive lockstep mechanics [25] by merely reusing existing OS functionality without breaking existing ABI contracts. Therefore, we can continue relying upon pre-existing synchronization mechanics such as POSIX cancellation points 3 and their bare-metal equivalents (e.g., RTEMS_NO_PREEMPT in RTEMS's Classic API if used instead of newlib or the POSIX API).…”

Section: Stage 1: Short-term Fault Mitigationmentioning

confidence: 99%

Dynamic Fault Tolerance Through Resource Pooling

Fuchs

Murillo

Plaat

et al. 2018

2018 NASA/ESA Conference on Adaptive Hardware and Systems (AHS)

View full text Add to dashboard Cite

Miniaturized satellites are currently not considered suitable for critical, high-priority, and complex multi-phased missions, due to their low reliability. As hardware-side fault tolerance (FT) solutions designed for larger spacecraft can not be adopted aboard very small satellites due to budget, energy, and size constraints, we developed a hybrid FT-approach based upon only COTS components, commodity processor cores, library IP, and standard software. This approach facilitates fault detection, isolation, and recovery in software, and utilizes fault-coverage techniques across the embedded stack within a multiprocessor system-on-chip (MPSoC). This allows our FPGA-based proofof-concept implementation to deliver strong fault-coverage even for missions with a long duration, but also to adapt to varying performance requirements during the mission. The operator of a spacecraft utilizing this approach can define performance profiles, which allow an on-board computer (OBC) to trade between processing capacity, fault coverage, and energy consumption using simple heuristics. The software-side FT approach developed also offers advantages if deployed aboard larger spacecraft through spare resource pooling, enabling an OBC to more efficiently handle permanent faults. This FT approach in part mimics a critical biological system's ability to tolerate faults, adapt to permanent failure, and enables graceful aging of an MPSoC.

show abstract

Synchronization of faulty processors in coarse-grained TMR protected partially reconfigurable FPGA designs

Cited by 23 publications

References 33 publications

Fault-Tolerant Nanosatellite Computing on a Budget

Fault-Tolerant Nanosatellite Computing on a Budget

Coexistence of safety and security: Synchronized redundant system with security enhancements

Dynamic Fault Tolerance Through Resource Pooling

Contact Info

Product

Resources

About