Cost-effective safety and fault localization using distributed temporal redundancy

Abstract

Cost pressure is driving vendors of safety-critical systems to integrate previously distributed systems. One natural approach we have previous introduced is On-Demand Redundancy (ODR), which allows safety-critical and non-critical tasks, traditionally isolated to limit interference, to execute on shared resources. Our prior work has shown that relaxed dedication (RD), one ODR strategy which allows non-critical tasks (NCTs) to execute on idle critical task resources (CTRs), significantly increases NCT throughput. Unfortunately, there are circumstances under which, in spite of this opportunity, it is difficult to effectively schedule NCTs.In this paper, we introduce distributed temporal redundancy (DTR), which allows critical tasks, which traditionally execute in lockstep, to execute asynchronously. In doing so, DTR increases scheduling flexibility, resulting in systems that achieve much closer to the optimal NCT throughput than with relaxed dedication alone; in one set of experiments, DTR schedules no less 93% of the theoretical NCT cycles across a variety of synthetic benchmarks, outperforming RD by over 11%, on average. Furthermore, by distributing all redundant tasks across different resources, triple-modular redundancy, and therefore fault localization, can be achieved. We demonstrate that this can be accomplished with little additional cost and complexity: in practice, relatively few DTR tasks are in flight simultaneously, limiting the additional buffering needed to support DTR.

Trade-offs in execution signature compression for reliable processor systems

“…Separate lines are shown for signature widths M = 8, 16, 32, and 64, and for both CRC and Fletcher's checksum (FC). For both checksums, we evaluate all legal values of W (the number of input bits processed per cycle) in (4,8,12,16,24,32,48,64,128,256). (Recall that our CRC implementation can process any value of W ≥ M and our FC implementation requires 2W/M to be equal to a power of two ≥ 1.)…”

Software-only based Diverse Redundancy for ASIL-D Automotive Applications on Embedded HPC Platforms

“…Another family of solutions for high-performance CPUs builds upon thread redundancy inside a single core [8], [7], or across cores [9], [10], [11], even with only partial redundancy [6], [12]. However, those solutions require hardware support for thread synchronization, and differently to DCLS, do not guarantee diversity.…”

“…Strategy Target Diversity (CCF considered) Approaches HW CPU Yes [4], [5], [6] No [7], [8], [9], [10], [11], [12] GPU Partially [13] No [14], [15], [16], [17] SW-Only CPU…”

Trade-offs in execution signature compression for reliable processor systems

“…CRC is also used by Dynamic and Scalable DMR (DDMR, CRC-16) and Dynamic Core Coupling (DCC, 2x CRC-32) to compress state to support techniques that dynamically form pairs of redundant processors [17], [18]. Distributed temporal redundancy (DTR) also proposes to use CRC for fingerprint compression to allow statically scheduled safety-critical tasks to execute out of lockstep [8].…”

“…As a result, a number of techniques have emerged to make it easier to employ redundancy when needed but allow cores to execute in isolation otherwise, such as single-and multi-processor redundant threading [5], [6], and execution fingerprinting [7], [8]. These techniques utilize two or more threads executing on one or more processors for the purpose of redundancy checking, with an important caveat: unlike under lockstep execution, the threads need not execute at the same time, often yielding efficiencies.…”