AssemblyLevel Preinjection Analysis for Improving Fault Injection Efficiency

1
Assembly-Level Pre-injection Analysis for
Improving Fault Injection Efficiency

• Raul Barbosa, Jonny Vinter, Peter Folkesson and
  Johan Karlsson
• Department of Computer Science and Engineering
• Chalmers University of Technology
• Göteborg, Sweden
• Fifth European Dependable
• Computing Conference

2
Fault Injection

• Effective technique for the experimental
  dependability evaluation
• Single bit-flip is a common fault model
• Faults are usually chosen randomly
• Typically the fault-space consists of
  time/location pairs

3
Fault Injection

• Drawbacks of random fault selection
• Most of the faults do not disturb the system
• The targeted resource is never used
• The error gets overwritten
• Much of the time is spent on irrelevant
  experiments

4
Random Fault Injection

• Typical results
• Majority of errors is overwritten, masked by the
  program or the resource is never used.

5
Understanding Fault Activation

• For a bit-flip in data to be activated it has to
  be injected within a data life-cycle.
• Start of a data life-cycle
• The resource is initialized (write access).
• End of a data life-cycle
• The resource is read for the last time
• before a new write access.

6
Understanding Fault Activation

• r12 written ? addi r12,r1,-16
• lis r11,17200
• stw r11,8(r1)
• r12 read ? lfd f0,0(r12)
• r12 read ? xoris r10,r12,512
• stw r10,4(r1)
• lfd f11,8(r1)
• r12 written ? addi r12,r1,16

Valid points for fault injection in r12
7
Optimizing Fault Injection

• Inject the fault just before the target resource
  is read, and nowhere else.
• Requires an automated pre-injection analysis to
  be practical.

8
Optimizing Fault Injection

• r12 written ? addi r12,r1,-16
• lis r11,17200
• stw r11,8(r1)
• r12 read ? lfd f0,0(r12)
• r12 read ? xoris r10,r12,512
• stw r10,4(r1)
• lfd f11,8(r1)
• r12 written ? addi r12,r1,16

Time points in the optimized fault-space for r12
9
Optimizing Fault Injection

• Requires
• Assembly code of the application
• Program Counter trace over time
• Assembly-level knowledge of the target system
• Effective addresses for memory reads

10
Optimizing Fault Injection

• Produces a list of time/location pairs
• Instruction address and timing
• Resource and bits that can be targeted
• Faults are then sampled from this reduced
  fault-space.

11
Example
12
Implementation

• GOOFI fault injector - plug-in for Nexus-based
  fault injection
• Motorolas MPC565 microcontroller
• Targets the automotive and the avionics
  industries
• Implements the PowerPC instruction standard
• Workloads
• Jet engine controller
• Quicksort implementation
• 25.000 fault injection experiments

13
Experimental Setup
14
Results

• The optimization reduced the fault-space
  (time/location pairs)
• Two orders of magnitude for registers
• Three orders of magnitude for memory
• The optimization increased fault effectiveness
  one order of magnitude.

15
Results

• Processor registers

Non-optimized (5700 injected faults)
Optimized (1500 injected faults)
16
Results

• Memory data segments

Non-optimized (6600 injected faults)
Optimized (2600 injected faults)
17
Results

• Memory code segment

Non-optimized (600 injected faults)
Optimized (3300 injected faults)
18
Results

• Small difference in the results concerning
  effective faults

Non-optimized (250 injected faults)
Optimized (600 injected faults)
19
Conclusions

• Faults with no possibility of activation are
  eliminated.
• The optimization significantly reduces the number
  of non-effective faults.
• Program-level error masking still renders most
  activated faults non-effective.

20
Future Directions

• Study the reason for the non-effectiveness of
  activated faults.
• Combine pre-injection with post-injection
  analysis to refine the selection of faults.
• Develop automatic analysis of error propagation
  to further improve the
• fault effectiveness.

21
Assembly-Level Pre-injection Analysis for
Improving Fault Injection Efficiency

• Raul Barbosa, Jonny Vinter, Peter Folkesson and
  Johan Karlsson
• Department of Computer Science and Engineering
• Chalmers University of Technology
• Göteborg, Sweden
• Fifth European Dependable
• Computing Conference

22
Assembly-Level Pre-injection Analysis for
Improving Fault Injection Efficiency

• Raul Barbosa, Jonny Vinter, Peter Folkesson and
  Johan Karlsson
• Department of Computer Science and Engineering
• Chalmers University of Technology
• Göteborg, Sweden
• Fifth European Dependable
• Computing Conference