An Approach to Cost-Efficient Fault Tolerance in Inherently Redundant Fail-Operational Systems

Embedded systems in safety-critical environments are often subject to strict reliability requirements. This holds particularly true for modern fail-operational systems. In order to deliver a guaranteed minimum functionality at all times, these systems are often based on expensive fault tolerance mechanisms. In this work, we consider fail-operational systems with inherent redundancy. This property describes the presence of multiple hardware components, each of which is underutilized to a certain degree and thus able to serve as a fallback for one of the other components. We propose an off-chip fault tolerance mechanism for a pair of inherently redundant execution units that requires no further replication of these expensive resources. The key component of this concept is a lightweight proxy unit that handles faults of one execution unit by dynamically migrating the safety-critical portion of its functionality to its redundant counterpart. We present a prototypical implementation of this concept and evaluate the fault handling time of the resulting system experimentally. The results show that for an exemplary, processor-based control system with 256 bits of internal state, a cycle time of four milliseconds, and 64 bits of payload data that are read from or written to attached devices per cycle, the presented implementation is able to detect the failure of a unit, activate a fallback functionality on the complementary unit, and restore the internal state variables within five milliseconds.