Triple Modular Redundancy (TMR) is a common approach to mitigate the effects of Single-Event Upsets (SEUs) in SRAM-based Field-Programmable Gate Arrays (FPGAs), where these faults may cause changes in the configuration of logic or interconnect resources. Partial TMR aims at balancing SEU mitigation with redundancy costs. This work introduces a Design-Space Exploration (DSE) approach that automatically generates and evaluates cost-reliability-optimized, Pareto-optimal partial TMR configurations of modules in a hierarchical design. The approach is evaluated using a proof-of-concept implementation for AMD’s 7 Series FPGAs and five case-study designs, including the NEORV32 RISC-V CPU. Multiple fitness assignment variants – based on static bitstream analysis, (statistical) fault injection results, and a combined approach –-are compared regarding effectiveness and runtime. Comparing the hypervolumes of the generated Pareto fronts of the final generation and a randomly generated starting generation, the approach improves cost-effectiveness of the generated TMR solutions by 17%–52%, delivering an attractive benefit-cost-ratio. The presented approach effectively generates a diverse set of TMR solutions across a wide cost-reliability range, allowing the designer to choose a variant that best fulfills the application’s, mission’s, or mission phase’s cost-reliability requirements.

A significant portion of the configuration memory of modern SRAM-based FPGAs is dedicated to configuring the interconnect. Understanding the effects of interconnect-related Single-Event Upsets (SEUs) on the circuit's behavior is critical for developing accurate reliability prediction and efficient fault mitigation approaches. This work describes an approach to classify the effects of single-bit interconnect faults into well-known fault models, and to characterize the electrical effects of these modeled faults. An experimental fault characterization for two families of Xilinx and Lattice FPGAs shows that different types of single-bit interconnect faults exhibit significantly different criticality. This may serve as a partial explanation for the large discrepancies reported in literature between faults predicted to be critical by state-of-the-art methods (“essential bits”) compared to the numbers of actually critical bits determined experimentally and may be used to improve prediction accuracy or reliability-aware routing approaches.

The configurable interconnect of SRAM-based FPGAs makes up a significant portion of their configuration, and thus exposes a large attack surface to single-event upsets. A better understanding of the behavior of FPGA interconnects under the presence of these faults may allow fault injection campaigns and reliability estimation techniques to treat some interconnect faults as more serious than others. This work proposes an approach to (1) analyze the interconnect configuration of a given FPGA technology to deduce the logical effects caused by single-bit flips and (2) to characterize the effects of such faults on routes implemented on a given FPGA technology. These approaches are illustrated in case studies on two FPGA technologies: Xilinx 7 Series and Lattice iCE40. Characterization of interconnect faults on these devices revealed that certain subcategories of interconnect fault types are far more critical than others, allowing more focused fault injection campaigns. Applying this knowledge to three benchmark designs implemented on a Xilinx 7 Series device shows that fault injection effort can be significantly reduced by skipping bits that are unlikely to critically impact the design.

Systematic fault injection into the configuration memory of SRAM-based FPGAs promises to gain insight into the criticality of individual configuration bits. Current approaches implicitly assume that results obtained on one FPGA device can be generalized to all devices of that type and hence allow to parallelize fault injection. This work, to the best of our knowledge, is the first to challenge this assumption. To that end, a synthetic test design was subjected to systematic fault injection on 16 Xilinx Artix-7 as well as 10 Lattice iCE40 FPGAs for which bitstream documentation is publicly available. The results of these experiments indicate that the derived sets of critical configuration bits vary from device to device of the same type, especially if the interconnect is targeted. Furthermore, temperature is observed to influence the fault injection results on Artix-7. Suggestions for dealing with the implications in future fault injection experiments are provided.

Basic Linear Algebra Subprograms (BLAS) has emerged as a de-facto standard interface for libraries providing linear algebra functionality.The advent of powerful devices for Internet of Things (IoT) nodes enables the reuse of existing BLAS implementations in these systems.This calls for a discerning evaluation of the properties of these libraries on embedded processors.This work benchmarks and discusses the performance and memory consumption of a wide range of unmodified open-source BLAS libraries.In comparison to related (but partly outdated) publications this evaluation covers the largest set of opensource BLAS libraries, considers memory consumption as well and distinctively focuses on Linux-capable embedded platforms (an ARM-based SoC that contains an SIMD accelerator and one of the first commercial embedded systems based on the emerging RISC-V architecture).Results show that especially for matrix operations and larger problem sizes, optimized BLAS implementations allow for significant performance gains when compared to pure C implementations.Furthermore, the ARM platform outperforms the RISC-V incarnation in our selection of tests.

Distributed control systems relying on IEC 61499 are a common engineering approach for various application domains ranging from industrial control to the management and control of modern buildings. In this paper we propose a generic fault-injection concept to support the verification of applications. A potential use-case therefore is, for example, to stress measures that aim to improve their reliability.

Deadlocks are a common problem that might arise when dealing with parallel processes or multiple threads, where locks are used to handle shared resources and implement process synchronization. Commonly used methods for handling deadlocks within systems are (i) deadlock detection, (ii) deadlock prevention, or (iii) deadlock avoidance. Most existing static and dynamic deadlock detection tools focus on specific lock class types (e.g., pthread locks) and require an instrumentation of the code. This paper proposes a library termed dpthread - a dynamic deadlock detection wrapper library that avoids code instrumentation. The library wraps the pthread library and provides the ability to register additional lock classes. In essence, it builds up a resource allocation graph and searches this graph using the Tarjan algorithm. An evaluation of the dpthread library using various well known deadlock scenarios revealed that deadlocks can be reliably detected without reporting false positives or negatives. The library by itself incurs only a small performance penalty and comes with a small memory footprint.

In practice, software is often deployed with several hidden bugs despite various test processes and static analyses. Such bugs often cause a phenomenon called software aging that refers to the accumulation of errors occurring in long running software systems that results in a decrease of performance and an increases of the probability to crash the entire system. This paper presents a mechanism to detect memory leaks in embedded systems software at runtime that can be used to counter software aging. In particular, it presents and compares two measurement based algorithms to identify memory leaks on Embedded Linux devices at runtime. Both algorithms have been implemented and evaluated using an industrial room controller targeting building automation. Based on this approach we were able to identify an existing memory leak we were unaware of beforehand.

Nowadays, multiple sensor nodes are often incorporated into technical solutions forming distributed sensor systems. Herein, advanced detection mechanisms are often realised by using data from multiple sensors in such a network. However, sometimes active sensors - like Time-Of-Flight cameras - interfere with each other. To solve this problem and assist in data correlation, a clock synchronisation method, like IEEE1588, can be adapted. Although, if the sensor nodes have not been developed with this in mind they have to be refitted. An optimal refit of a system is the one that needs the least modifications necessary to achieve the desired goal. This paper lists the impact - in terms of jitter and asymmetry - that different components of a system have on IEEE1588 synchronisation precision and methods to eliminate or alleviate jitter and asymmetry sources in order to enable respective sensor fusion.

Model checking of assembly code is a promising approach to satisfy the demand for verification in nowadays ultra-high reliable embedded systems software. Frequent interaction with its environment, e.g., by sending or reading data over the microcontrollers I/O lines, lies in the nature of embedded systems. Thus, making the long-standing problem of explicit-model checking even worse, namely the state-explosion problem. This paper presents a concept to tackle these difficulties by using a 3-valued logic in the state representation and showing its benefits in terms of state-space savings whenever logic operations are executed by the target microcontroller. To highlight the effectiveness of this approach, termeddelayednondeterminismwithlookahead, an embedded program exemplifying typical microcontroller source code is analyzed and the resulting state space sizes are discussed. The introduced abstraction technique is implemented in the MCS-51 simulator component for the[mc]squaremodel checker which is developed by the RWTH Aachen University.

The introduction of computer-controlled intelligent safety and comfort features has turned cars into complex distributed computing systems. In such a system the proper operation of the communication backbone as well as the proper interaction of components from different vendors must be ensured for all configurations and operating conditions. This system-level test goes far beyond the (isolated) test of single components and represents a substantial problem, that seems to be still largely unsolved, although its solution is crucial for maintaining the consumers' trust in modern automotive electronics. In this paper we concentrate on the test of distributed systems based on FlexRay, the protocol that is envisioned as the communication backbone for future automotive systems. The cornerstones of our approach are a decomposition of the system into layers and mechanisms, and a versatile strategy for monitoring and stimulation under various conditions. Our concept can be adapted to diverse needs ranging from an early debugging with full access to the system, over non-intrusive online testing during interoperability tests, to maintenance testing that is restricted to a remote access only. We give detailed discussions of the requirements and present our solutions for the various issues involved. Selected use cases demonstrate the usefulness of the taken approach.

Time-triggered architectures are being introduced in safety-critical automotive systems ("X-by-wire") to cope with the growing complexity and the high safety demands. One of their merits is to provide a static operation schedule, thus largely reducing the complexity of (otherwise input-dependent) execution flow. This, however, comes for the price of increased configuration complexity: the FlexRay protocol that implements the time-triggered paradigm on the communication level requires several tens of configuration parameters. The product of their possible settings spans a space of more than 10M48(theoretical) configurations. This does not represent a problem as long as the configuration is known and fault-free. However, in many cases - ranging from debugging over conformance testing to maintenance - an identification of the configuration is desirable, but turns out extremely burdensome. This paper presents a systematic approach that facilitates parameter identification in such complex systems. Experimental results illustrate the usefulness of our approach and explore its limitations.

Embedded electronic communication systems play a vital role in the future development of automotive systems. For successful application developments new test and diagnosis solutions for these distributed systems are required. This paper presents solutions for the stimulus generation of test systems based on a remote test under the stringent constraints of the automotive industry. We elaborate a flexible and accurate method that enables a systematic and comprehensive test of data link layer related communication services. Furthermore, we discuss how this solution can be applied for various different test purposes (e.g. for verification, robustness, interoperability or maintenance tests) and demonstrate its application by use of an example that varies one fundamental protocol parameter of FlexRay

We present a systematic test strategy for the communication subsystem of a distributed automotive system. Key points are (1) system decomposition into layers and services and (2) integration of fault injection and monitoring within this framework