https://users.encs.concordia.ca/~ymzhang/publications/ARC32-2-98Zhang_pp.229-252.pdf

Bibliographical review on reconfigurable fault-tolerant control systems

Fault injection is important to evaluating the dependability of computer systems. Researchers and engineers have created many novel methods to inject faults, which can be implemented in both hardware and software. The contrast between the hardware and software methods lies mainly in the fault injection points they can access, the cost and the level of perturbation. Hardware methods can inject faults into chip pins and internal components, such as combinational circuits and registers that are not software-addressable. On the other hand, software methods are convenient for directly producing changes at the software-state level. Thus, we use hardware methods to evaluate low-level error detection and masking mechanisms, and software methods to test higher level mechanisms. Software methods are less expensive, but they also incur a higher perturbation overhead because they execute software on the target system.

/pdf/fault-injection-techniques-and-tools-67yktshngr.pdf

Fault injection techniques and tools

The latest advances in electric and electronic aircraft technologies from the point of view of an "all-electric" aircraft are presented herein. Specifically, we describe the concept of a "more electric aircraft" (MEA), which involves removing the need for on-engine hydraulic power generation and bleed air off-takes, and the increasing use of power electronics in the starter/generation system of the main engine. Removal of the engine hydraulic pumps requires fully-operative electrical power actuators and mastery of the flight control architecture. The paper presents a general overview of the electrical power generation system and electric drives for the MEA, with special regard to the flight controls. Some discussion regarding the interconnection of nodes and safety of buses and protocols in distributed systems is also presented

/pdf/moving-towards-a-more-electric-aircraft-yt1pxk9bb6.pdf

Moving towards a more electric aircraft

This paper presents a new signature monitoring technique, CFCSS (control flow checking by software signatures); CFCSS is a pure software method that checks the control flow of a program using assigned signatures. An algorithm assigns a unique signature to each node in the program graph and adds instructions for error detection. Signatures are embedded in the program during compilation time using the constant field of the instructions and compared with run-time signatures when the program is executed. Another algorithm reduces the code size and execution time overhead caused by checking instructions in CFCSS. A "branching fault injection experiment" was performed with benchmark programs. Without CFCSS, an average of 33.7 % of the injected branching faults produced undetected incorrect outputs; however, with CFCSS, only 3.1 % of branching faults produced undetected incorrect outputs. Thus it is possible to increase error detection coverage for control flow errors by an order of magnitude using CFCSS. The distinctive advantage of CFCSS over previous signature monitoring techniques is that CFCSS is a pure software method, i.e., it needs no dedicated hardware such as a watchdog processor for control flow checking. A watchdog task in multitasking environment also needs no extra hardware, but the advantage of CFCSS over a watchdog task is that CFCSS can be used even when the operating system does not support multitasking.

Control-flow checking by software signatures

The authors address the problem of validating the dependability of fault-tolerant computing systems, in particular, the validation of the fault-tolerance mechanisms. The proposed approach is based on the use of fault injection at the physical level on a hardware/software prototype of the system considered. The place of this approach in a validation-directed design process and with respect to related work on fault injection is clearly identified. The major requirements and problems related to the development and application of a validation methodology based on fault injection are presented and discussed. Emphasis is put on the definition, analysis, and use of the experimental dependability measures that can be obtained. The proposed methodology has been implemented through the realization of a general pin-level fault injection tool (MESSALINE), and its usefulness is demonstrated by the application of MESSALINE to the experimental validation of two systems: a subsystem of a centralized computerized interlocking system for railway control applications and a distributed system corresponding to the current implementation of the dependable communication system of the ESPRIT Delta-4 Project. >

Fault injection for dependability validation: a methodology and some applications

Several concurrent error detection schemes suitable for a watch-dog processor were evaluated by fault injection. Soft errors were induced into a MC6809E microprocessor by heavy-ion radiation from a Californium-252 source. Recordings of error behavior were used to characterize the errors as well as to determine coverage and latency for the various error detection schemes. The error recordings were used as input to programs that simulate the error detection schemes. The schemes evaluated detected up to 79% of all errors within 85 bus cycles. Fifty-eight percent of the errors caused execution to diverge permanently from the correct program. The best schemes detected 99% of these errors. Eighteen percent of the errors affected only data, and the coverage of these errors was at most 38%. >

Evaluation of error detection schemes using fault injection by heavy-ion radiation

Two software-based techniques for online detection of control flow errors were evaluated by fault injection. One technique, called block signature self-checking (BSSC), checks the control flow between program blocks. The other, called error capturing instructions (ECIs), inserts ECIs in the program area, the data area, and the unused area of the memory. To demonstrate these techniques, a program has been developed which modifies the executable code for the MC6809E 8-b microprocessor. The error detection techniques were evaluated using two fault injection techniques: heavy-ion radiation from a californium-252 source and power supply disturbances. Combinations of the two error detection techniques were tested for three different workloads. A combination BSSC, ECIs, and a watchdog timer was also evaluated. >

Two software techniques for on-line error detection

An approach for assessing the impact of physical injection of transient faults on processor execution is described and evaluated. The fault injection is based on two complementary methods using: (1) heavy-ion radiation; and (2) power supply disturbances. 12000 transient faults were injected into the target microprocessor, a Motorola MC6809E 8-bit CPU, running 3 different workloads. In the evaluation, the control-flow errors were distinguished from those that had no effect on the correct flow of control. The errors that led to wrong results are separated from those that did not affect the correct results. The errors that affected neither the correct control flow nor the correct results are specified. Effects of errors on the registers and signals of the processor are characterized, Workload dependency on error rates is demonstrated. Three error-detection mechanisms, (2 software-based mechanisms and 1 watchdog timer) were combined and used to characterize the detected and undetected errors. More than 87% of all errors and 93% of the control-flow errors could be detected. In a different test, the efficiency of an isolated watchdog timer was evaluated. The coverage of the isolated watchdog timer was only 62%. The results indicate that fault-injection methods, workloads, and programming languages all differently affect the control flow, coverage, latency, and error rates. >

http://ieeexplore.ieee.org/iel1/24/9132/00406580.pdf

Evaluating processor-behavior and three error-detection mechanisms using physical fault-injection

Arbitrary faults of a single node In a time-triggered architecture (TTA) bus topology system may cause error propagation to correct nodes and may lead to inconsistent system states. This has been observed in validation work using software implemented fault injection (SWIFI) and heavy-ion fault injection techniques in a TTA cluster. In a TTA system, the membership and the clique avoidance algorithms detect state inconsistencies and force the nodes that do not have the same state with the state of majority of nodes, to restart. Changing the interconnection structure of the cluster to a star topology allows the use of star couplers that will isolate faults of a node, thus guaranteeing consistency, even in the presence of arbitrary node failures. The same SWIFI and heavy-ion fault injection experiments that caused error propagation in bus-based TTA clusters, were performed in the star configuration. No error propagation was observed in a TTA system with the star topology during the execution of SWIFI and heavy-ion experiments.

Evaluation of fault handling of the time-triggered architecture with bus and star topology

Mass produced products are becoming more and more complex, which forces the designers to model the functionality early in the design process. UML Use cases was found to be a useful method for this purpose at Volvo Cars and is currently used for modeling all functions implemented in the electrical network. When using Use cases in the design of complex safety critical systems, there is still an uncovered demand for early hazard analysis at a functional level. This work integrates a modified functional hazard assessment method and Use cases. The analysis generates valuable results used as design requirements and dependability analysis input. The methods results have exceeded our expectations. An example is included, showing how the method works.

Jan Torin

Papers

Evaluation of error detection schemes using fault injection by heavy-ion radiation

Two software techniques for on-line error detection

Evaluating processor-behavior and three error-detection mechanisms using physical fault-injection

Evaluation of fault handling of the time-triggered architecture with bus and star topology

Hazard analysis in object oriented design of dependable systems