Many previous studies have analyzed the issues of dependability in the physical layers of future nanoarchitectures. Here we consider the upper layers and especially the contribution of communications to reinforcing the dependability of general-purpose nanoarchitectures (GPN). We adhere to the idea that a GPN should be viewed as a single-chip massive multiprocessor system, consisting in immersing a few high-performance processors in a grid of medium-performance processors to enable efficient execution of both parallelizable and not parallelizable applications. We especially discuss the operation of the communication layer and introduce the mechanism of "blind" task allocation through a contract network protocol. In the framework of this GPN sketch, we show that the communication layer could dramatically contribute to improving the dependability of massively-faulty GPNs by tolerating the increasing number of defective nodes expected with the reduction of dimensions, so that chips with as much as 30% of defective nodes could be validated for deployment.

This paper presents first the context and motivation for dealing with soft errors. In order to be able to account for the various issues involved, a concerted reflection has been carried out including embedded system integrators, manufacturers, and academic researchers. The authors have summarized the main outcomes of this effort. Finally, the various contributions that are meant to address the several factors that characterize the problem posed by soft errors and provide solutions was introduced to mitigate their effects.

This paper presents a dependability benchmark for general-purpose operating systems and its application to six versions of Windows operating system and four versions of Linux operating system. The benchmark measures are: operating system robustness (as regards possible erroneous inputs provided by the application software to the operating system via the application programming interface), reaction and restart times in the presence of faults. The workload is PostMark, a file system performance benchmark for operating systems.

The aim of this paper is to compare the dependability of three operating systems (Windows NT4, Windows 2000 and Windows XP) with respect to erroneous behavior of the application layer. The results show a similar behavior of the three OSs with respect to robustness and a noticeable difference in OS reaction and restart times. They also show that the application state (mainly the hang and abort states) significantly impacts the restart time for the three OSs.

We propose a dependability benchmark suitable for a general purpose operating system (OS). The specifications of the benchmark components are presented and illustrated on a benchmark prototype dedicated to Windows 2000. The important novelty, as regards OS dependability benchmarking, is threefold. First, it lies on a comprehensive and structured set of measures: outcomes are considered both at the OS level and at the application level. Second, these measures include not only robustness measures (e.g., the distribution among the observed outcomes for the OS and the application: error codes, exceptions, workload correct or erroneous completion, OS and application hang), but also the related temporal measures in the presence of faults (e.g., system call and workload execution times, as well as operating system restart time). Finally, we are considering a realistic workload (namely, TPC-C client), instead of a synthetic workload.

This paper addresses the issue of characterizing the respective impact of fault injection techniques. Three physical techniques and one software-implemented technique that have been used to assess the fault tolerance features of the MARS fault-tolerant distributed real-time system are compared and analyzed. After a short summary of the fault tolerance features of the MARS architecture and especially of the error detection mechanisms that were used to compare the erroneous behaviors induced by the fault injection techniques considered, we describe the common distributed testbed and test scenario implemented to perform a coherent set of fault injection campaigns. The main features of the four fault injection techniques considered are then briefly described and the results obtained are finally presented and discussed. Emphasis is put on the analysis of the specific impact and merit of each injection technique.

The main goal of the experimental stud), reported in this paper is to investigate to what extent distinct fault injection techniques lead to similar consequences (errors and failures). The target system we are using to carry out our investigation is the Linux kernel as it provides a representative operating system. It is featuring full controllability and observability thanks to its open source status. Three types of software-implemented fault injection techniques are considered, namely: i) provision of invalid values to the parameters of the kernel calls, ii) corruption of the parameters of the kernel calls, and iii) corruption of the input parameters of the internal functions of the kernel. The workload being used for the experiments is tailored to activate selectively each functional component. The observations encompass typical kernel failure modes (e.g., exceptions and kernel hangs) as well as a detailed analysis of the reported error codes.

The application of fault injection in the context of dependability benchmarking is far from being straightforward. One decisive issue to be addressed is to what extent injected faults are representative of actual faults. This paper proposes an approach to analyze the effects of real and injected faults.

Describes a framework allowing the experimental verification of complex software-implemented fault-tolerance algorithms and mechanisms (FTAMs). This framework takes into account two of the most important aspects which are increasingly required in newly-developed fault-tolerant systems: the considerations of COTS (commercial off-the-shelf) based architectures and the compliance with severe safety certification procedures. The strategy proposed shows how a rigorous FTAM specification, based on a multiple-viewpoint architectural description, may help to mechanically monitor the verification of its implementation under real conditions. The proposed strategy has been instantiated using two mechanized techniques: model checking and fault injection. The preliminary conclusions of the application of this automated approach to a small part of a commercial fault-tolerant system help us clarify its usage and its suitability for validating complex dependable systems.

This study addresses the use of fault injection for explicitly removing design/implementation faults in complex fault-tolerance algorithms and mechanisms (FTAM), viz, fault-tolerance deficiency faults. A formalism is introduced to represent the FTAM by a set of assertions. This formalism enables an execution tree to be generated, where each path from the root to a leaf of the tree is a well-defined formula. The set of well-defined formulas constitutes a useful framework that fully characterizes the test sequence. The input patterns of the test sequence (fault and activation domains) then are determined to fewer specific structural criteria over the execution tree (activation of proper sets of paths). This provides a framework for generating a functional deterministic test for programs that implement complex FTAM. This methodology has been used to extend a debugging tool aimed at testing fault tolerance protocols developed by BULL France. It has been applied successfully to the injection of faults in the inter-replica protocol that supports the application-level fault-tolerance features of the architecture of the ESPRIT-funded Delta-4 project. The results of these experiments are analyzed in detail. In particular, even though the target protocol had been independently verified formally, the application of the proposed testing strategy revealed two fault-tolerance deficiency faults.

This paper addresses the problem of estimating the coverage of a fault tolerance mechanism through statistical professing of observations collected in fault injection experiments. A formal definition of coverage is given in terms of the fault and system activity sets that characterize the input space. Two categories of sampling techniques are considered for coverage estimation: sampling in the whole space and sampling in a space partitioned into classes. The estimators for each technique are compared by means of hypothetical examples. Techniques for early estimations of coverage are then studied. These techniques allow unbiased estimations of coverage to be made before all classes of the sampling space have been tested. Then, the "no-reply" problem that hampers most practical fault-injection experiments is discussed and an a posteriori stratification technique is proposed that allows the scope of incomplete tests to be widened by accounting for available structural information about the target system.>

The authors describe a dependability evaluation method based on fault injection that establishes the link between the experimental evaluation of the fault tolerance process and the fault occurrence process. The main characteristics of a fault injection test sequence aimed at evaluating the coverage of the fault tolerance process are presented. Emphasis is given to the derivation of experimental measures. The various steps by which the fault occurrence and fault tolerance processes are combined to evaluate dependability measures are identified and their interactions are analyzed. The method is illustrated by an application to the dependability evaluation of the distributed fault-tolerant architecture of the Esprit Delta-4 Project.>

The authors address the problem of validating the dependability of fault-tolerant computing systems, in particular, the validation of the fault-tolerance mechanisms. The proposed approach is based on the use of fault injection at the physical level on a hardware/software prototype of the system considered. The place of this approach in a validation-directed design process and with respect to related work on fault injection is clearly identified. The major requirements and problems related to the development and application of a validation methodology based on fault injection are presented and discussed. Emphasis is put on the definition, analysis, and use of the experimental dependability measures that can be obtained. The proposed methodology has been implemented through the realization of a general pin-level fault injection tool (MESSALINE), and its usefulness is demonstrated by the application of MESSALINE to the experimental validation of two systems: a subsystem of a centralized computerized interlocking system for railway control applications and a distributed system corresponding to the current implementation of the dependable communication system of the ESPRIT Delta-4 Project.>

The aim of this paper is to present an LSI circuit specially designed for fault-tolerant systems. The circuit in question is a self-testing detection processor named PAD (a french acronym meaning self-testing detection processor). The purpose of the circuit is to enable the user to easily design and realize a fault-tolerant system with off-the-shelf ICs. The major part of this paper focuses on the design specifications of the chip which result from a preliminary study of different possible architectures for a fault-tolerant system.

Self-checking approaches developed so far deal with a gate level representation of logical circuits. They do not account for constraints which may result from an implementation by integrated circuits. This paper is concerned with such practical problems and their respective significance.

At the end of an IC production line, integrated circuits are generally submitted to three kinds of tests: 1) parametric tests to check electrical characteristics (voltage, current, power consumption), 2) dynamic tests to check response times under nominal operating conditions, and 3) functional tests to check its logical behavior.