AULT tolerance and reliability are important issues for flight vehicles such as aircraft, space-shuttles, and satellites. A self-stabilizing system recovers automatically following disturbances that force the system to an arbitrary state. The self-stabilization concept is an essential property of any autonomous control/computing system. Important branches of distributed computing theory were initiated because of the need for fault-tolerance of aircraft computing devices. The Byzantine fault model, for example, was a creation of the NASA SIFT project of more than a couple of decades ago. The Byzantine fault model is an elegant abstraction of faults where it is assumed that faulty parts behave as adversaries. The idea is to use redundancy—for instance, in the number of processors—in order to overcome the behavior of faulty processors. This line of thinking fits the common practice in engineering in which the design of critical parts is done independently by several design teams to make sure that there is no mistake in the calculations. Analogously, in the Byzantine fault model, some processors are simultaneously computing the same calculations for implementing a robust flight controller; thus the flight controller can function well in spite of the faulty behavior of several of the processors. Faulty behavior cannot be anticipated, the most severe behavior is therefore assumed—one that is reminiscent of the behavior of an adversary in the Byzantine court, in which backstabbing was common. A formal impossibility proof shows that, in order to ensure the correct behavior of the system, less than one-third of the processors may be of the Byzantine type. The task examined is the agreement, or consensus, for which processors need to decide on the same output, which is the input of one of the processors. The decision can be viewed as choosing the common result among the results of the design teams in the engineering example. The intuition behind the impossibility result is as follows: assume you have met two persons, Alice and Bob, one of which is honest while the other is not. You may try to decide what to do by speaking with each of them. Because you do not know which of the two is honest, you have to find this out. You may try a direct question to Alice asking who among them is not honest; Alice will answer Bob, and Bob, if asked, will obviously answer Alice. Each of them may also describe the conversations he/she had with the other, knowing that no one listened to the communication between them. This symmetry in the weights of the answers of Alice and Bob make it impossible to decide. It is possible to formally prove that agreement can be achieved if, and only if, less than one-third of the processors are Byzantine (e.g. Ref. 7). Systems that tolerate Byzantine faults are designed for flight devices, which need to be extremely robust. In such a device, the assumptions made for reaching agreement can be violated: Is it reasonable to assume that, during any period of the execution, less than one-third of the processors are faulty? What happens if, for a short period, more than a third are faulty, or perhaps experience a weaker fault than a Byzantine fault (say, caused by a transient electric spark)? What happens if messages sent by non-faulty processors are lost in one instant of time? Seven years prior to the introduction of the Byzantine fault model, Edsger W. Dijkstra suggested an important fundamental fault tolerance property called self-stabilization; 3 that is, to design the system as if there were no (yesterday) past history—a system that can be started in any possible state of its state space. It would therefore not be assumed that consistency was maintained from the fixed initial state by always executing steps according to the program of the processors. Self-stabilizing systems thus overcome transient faults. Temporary violations of the assumptions made by the algorithm designer can be viewed as leaving the system in an arbitrary initial state from which the system resumes. Self-stabilizing systems work correctly when started in any initial system state. Thus, even if the system loses its consistency due to an unexpected temporary violation of the assumptions made, it converges to legal behavior once the assumptions start to hold again. Self-stabilization is a strong fault tolerance property for systems; it ensures automatic recovery once faults stop occurring. A self-stabilizing system is designed to start in any possible state where its components—e.g., processors, processes, communication links, communication buffers—are in an arbitrary state; i.e., arbitrary variable values,

Self-stabilization

This work presents several approaches for designing self-stabilizing operating systems. The first approach is based on periodical automatic reinstalling of the operating system and restart. The second, reinstalls the executable portion of the operating system and uses predicates on the operating system state (content of variables) to ensure that the operating system does not diverge from its specifications. The last approach presents an example of a tailored self-stabilizing very-tiny operating system. Prototypes using the Intel Pentium processor were composed.

/pdf/toward-self-stabilizing-operating-systems-32d6uy6hoa.pdf

Toward self-stabilizing operating systems

The trends in technology scaling and the reduction in supply voltages have significantly improved the performance and energy consumption in modern microprocessors. Microprocessors are being built with higher degrees of spatial parallelism and deeper pipelines to improve performance, which, however, makes them more susceptible to transient faults. Radiation causes "transient faults” or "single-event transients” in logic, which, once propagated and latched, become full cycle errors or soft errors. If radiation hits memory elements, this is usually called an "single-event upset” or "soft error” as it can further propagate as a full cycle error. The problem of soft errors is further exacerbated in large multiprocessors employed in servers in which reliability is a key concern. In the past, the technique of lockstep execution of the original and the duplicate instructions has been used for error detection in multiprocessors. However, the execution of redundant threads in the on-chip multiprocessor (CMP) provides error detection at lower overheads, since the branch outcomes of the leading thread can be exploited during the execution of the trailing thread, and also because the interprocessor communication latency is a key concern for lockstepping. In this paper, we show that by mining various redundancies inherent within a single core, the interprocessor communication can be brought down to a minimum. Toward this, we propose techniques based on 1) temporal redundancy, 2) data value redundancy, and 3) information redundancy for error detection in multicore designs. We exploit temporal redundancy by using the "latency slack cycles” (LSC) of an instruction, which we define as the number of cycles before the computed result from the instruction becomes the source operand of a subsequent instruction. The value-based detection technique is explored by exploiting the width of the operands with small data values and information redundancy is exploited by the generation of residue code check bits for the source operands. We show that with a clustered core multiprocessor, the interprocessor communication overhead can be significantly reduced. In our proposed multicore design, when a soft error is detected, error correction is achieved by rolling back the execution to a previous checkpoint state and re-executing the instructions. The proposed techniques have been implemented on the RSIM simulation framework and validated using the SPLASH benchmarks. Experimental results indicate that the soft error detection schemes proposed in this work, can be implemented, on the average, with less than 10 percent increase in CPI on modern multicore designs.

Redundancy Mining for Soft Error Detection in Multicore Processors

Classic distributed computing abstractions do not match well the reality of digital logic gates, which are the elementary building blocks of Systems-on-Chip (SoCs) and other Very Large Scale Integrated (VLSI) circuits: Massively concurrent, continuous computations undermine the concept of sequential processes executing sequences of atomic zero-time computing steps, and very limited computational resources at gate-level make even simple operations prohibitively costly. In this paper, we introduce a modeling and analysis framework based on continuous computations and zero-bit message channels, and employ this framework for the correctness & performance analysis of a distributed fault-tolerant clocking approach for Systems-on-Chip (SoCs). Starting out from a “classic” distributed Byzantine fault-tolerant tick generation algorithm, we show how to adapt it for direct implementation in clockless digital logic, and rigorously prove its correctness and derive analytic expressions for worst case performance metrics like synchronization precision and clock frequency. Rather than on absolute delay values, both the algorithm’s correctness and the achievable synchronization precision depend solely on the ratio of certain path delays. Since these ratios can be mapped directly to placement & routing constraints, there is typically no need for changing the algorithm when migrating to a faster implementation technology and/or when using a slightly different layout in an SoC.

/pdf/reconciling-fault-tolerant-distributed-computing-and-systems-46y9280gxg.pdf

Reconciling fault-tolerant distributed computing and systems-on-chip

This paper proposes an analytical model to assess Reliability Factor of an NoC based System-on-Chip design. Reliability Factor is the probability that faults in the NoC infrastructure can be recovered without any effect on system functionality. The proposed method classifies switch faults of an NoC according to their impact on system functionality. Based on this classification, the contribution of each transient fault lowering the reliability of the NoC is calculated. This model can be used to decide which fault tolerant techniques cause more improvement on system reliability.

An Analytical Model for Reliability Evaluation of NoC Architectures

Soft errors are changes in memory value caused by external radiation or electrical noise. Decreases in computing feature sizes and power usages and shorting the microcycle period enhance the influence of soft errors. Self-stabilizing systems are designed to be started in an arbitrary, possibly a corrupted, state due to, say, soft errors, and to converge to a desired behavior. Self-stabilization is defined by the state space of the components and is essentially a well-founded, clearly defined form of the terms self-healing, automatic-recovery, automatic-repair, and autonomic-computing. To implement a self-stabilizing system, one needs to ensure that the microprocessor that executes the program is self-stabilizing. A self-stabilizing microprocessor copes with any combination of soft errors, converging to perform fetch-decode-execute in fault-free periods. Still, it is important that the microprocessor will avoid convergence periods if possible by masking the effect of soft errors immediately. In this work, we present design schemes for a self-stabilizing microprocessor and a new technique for analyzing the effect of soft errors. Previous schemes for analyzing the effect of soft errors were based on simulations. In contrast, our scheme computes a lower bound on microprocessor reliability and enables the microprocessor designer to evaluate the reliability of the design and to identify reliability bottlenecks. When analyzing the resiliency of digital circuits to soft errors, we examine the logical masking, i.e., errors in internal nodes of the circuits that are masked later by the computation. We show that the problem of computing the reliability of a circuit such that logical masking is taken into account is an NP-hard problem.

Self-stabilizing microprocessor: analyzing and overcoming soft errors

This position paper advocates the use of the well defined and provable self-stabilization property of a system, to achieve the goals of the self-* paradigms and autonomic computing. Several recent results starting from hardware concerns, continuing with the operating system, and ending in the applications, are integrated: the self-stabilizing microprocessor, with the self-stabilizing operating system, the self-stabilization preserving compiler, and the self-stabilizing autonomic recoverer for applications

Self-Stabilization as a Foundation for Autonomic Computing

Self-Stabilization is an elegant approach for designing fault tolerant systems. A system is considered self-stabilizing if, starting in any state, it converges to the desired behavior. Self-stabilizing algorithms were designed for solving fundamental distributed tasks, such as leader election, token circulation and communication network protocols. The algorithms were expressed using guarded commands or pseudo-code. The realization of these algorithms requires the existence of (self-stabilizing) infrastructure for their execution such as a self-stabilizing microprocessor and a self-stabilizing operating system. Moreover, the high-level description of the algorithms needs to be converted into machine language of the microprocessor. In this work, we present a design for a self-stabilization preserving compiler designed for programs written in a language similar to the abstract state machine (ASM). The compiler preserves the stabilization property of the high level program.

Self-stabilization preserving compiler

Self-stabilization is an elegant approach for designing fault tolerant systems. A system is considered self-stabilizing if, starting in any state, it converges to the desired behavior. Self-stabilizing algorithms were designed for solving fundamental distributed tasks, such as leader election, token circulation and communication network protocols. The algorithms were expressed using guarded commands or pseudo-code. The realization of these algorithms requires the existence of a (self-stabilizing) infrastructure such as a self-stabilizing microprocessor and a self-stabilizing operating system for their execution. Moreover, the high-level description of the algorithms needs to be converted into machine language of the microprocessor. In this article, we present our design for a self-stabilization preserving compiler. The compiler we designed and implemented transforms programs written in a language similar to the abstract state machine (ASM). The compiler preserves the stabilization property of the high level program.

Hardware and software components are suggested for enabling the creation of a self-stabilizing os on top of an off-the-shelf, non-self-stabilizing processor. Simple "watchdog" hardware called periodic reset monitor (prm) provides a basic solution. The solution is extended to a stabilization enabling hardware (seh) which removes any real time requirement from the os. A stabilization enabling system that extends the seh with some software components provides the user (the os designer) with a self-stabilizing processor abstraction. Adapting the current os code to be self-stabilizing is supported using a mechanism for enforcing the software configuration.

Yinnon Haviv

Papers

Self-stabilizing microprocessor: analyzing and overcoming soft errors

Self-Stabilization as a Foundation for Autonomic Computing

Self-stabilization preserving compiler

Self-stabilization preserving compiler

Stabilization enabling technology