Efficient type and memory safety for tiny embedded systems

Abstract

We report our experience in implementing type and memory safety in an efficient manner for sensor network nodes running TinyOS: tiny embedded systems running legacy, C-like code. A compiler for a safe language must often insert dynamic checks into the programs it produces; these generally make programs both larger and slower. In this paper, we describe our novel compiler toolchain, which uses a family of techniques to minimize or avoid these run-time costs. Our results show that safety can in fact be implemented cheaply on low-end 8-bit microcontrollers.

Efficient memory safety for TinyOS

“…We note that this bug was first discovered with our previous work, a CCured-based version of Safe TinyOS [22]. We have verified that our current Deputy-based toolchain also finds this error.…”

“…Nevertheless, we plan to continue working toward further optimizing Safe TinyOS applications. Consider for example that for the previous version of our toolchain [22], which was based on CCured and TinyOS 1, safe optimized applications actually had lower duty cycles, on average, than the original unsafe applications. We attribute our prior success largely to the fact that TinyOS 1 was coded much less tightly than TinyOS 2 is.…”

“…Safe TinyOS builds upon our earlier work [22] which was based on CCured [20] rather than Deputy. In addition, Condit et al [3] present a one-paragraph summary of early experiences using Deputy with TinyOS.…”

Interface contracts for TinyOS

“…We found that adding contract checking code to the nesC compiler's output invalidated its inlining decision (by making functions larger), resulting in large code size blowup (often by 400% or more) when the application with contract checks was compiled. In previous work [2,12] we developed an inliner for C code that is followed up by a strong dead code elimination pass. Our inliner makes its decisions based on code size after contracts are added, enabling it to make good decisions.…”

“…Sympathy appears to be almost perfectly complementary to our contract work: it could be used to log contract failure events and relay them to a base station. t-kernel [5], SoS [13], Virgil [14], and our type-safe version of TinyOS [12] all use language-based protection to avoid memory safety violations in sensornet applications. This kind of protection is perfectly complementary to interface contract checking.…”