[Back]

P Tummeltshammer:
"Analysis of Common Cause Faults in Dual Core Architectures";
Supervisor, Reviewer: A. Steininger, Z. Kotasek; Institut für Technische Informatik, 2009; oral examination: 2009-10-20.

Duplication and comparison has proven to be an e±cient method for error detection us-
ing increased redundancy. Based on this generic principle dual core processor architectures
with output comparison are used for safety critical applications. Placing two instances of
the same (arbitrary) processor on one die yields a very cost e±cient single chip imple-
mentation of this principle. At the same time, however, the physical coupling of the two
replica creates the potential for certain types of faults to a®ect both cores in the same
way, such that the mutual checking will fail. This class of malicious coupling results is
called common cause failures (CCFs), which constitutes a major factor when calculating
a redundant system's probability of failure. Due to the fact, that major safety standards
predict very high CCF rates for single chip architectures, the question is how reasonable
these rates are when using an extremely fast error detection mechanism as found on the
presented dual core architecture.
One key motivation is to ¯nd out how this type of coverage leakage relates to other
imperfections of the duplication and comparison approach that would also be found using
two cores on separate dies (such as coupling over a common power supply or clock). To this
end, the thesis' aims are (i) ¯nding a suitable model which can describe the e®ect of CCFs
on a dual core architecture using fast error detection, (ii) ¯nding ways to quantify this
model through analysis or experiment data by splitting the problem into di®erent coupling
factors and (iii) ¯nd possible countermeasures against said CCFs.
First, this thesis elaborates a model and analyzes several of the relevant physical cou-
pling mechanisms to decompose the genesis of a common cause fault into several steps.
This model is derived from the well known beta factor model found in literature and
amended by said coupling mechanisms and error detection mechanisms. The model serves
as a starting point for quantifying the risk of CCFs on a dual core processor.
As a next step, an experimental evaluation is done on the probability of error detection
after a fault has coupled into both cores of the dual core architecture. Gate level fault
injection is used for injecting points in both cores using a de¯ned time o®set. These
experiments show, that very tight local and temporal coincidence of the fault e®ect in
both replica is a crucial prerequisite for a common cause fault. Based on this quantitative
input it can be seen from the decomposition model that the risk of common cause faults
is low for physical coupling mechanisms with relatively slow propagation speed, such as
thermal and mechanical e®ects.
Furthermore electrical faults showing immediate coupling are analyzed using power
supply disturbance fault injection. The experiments are ¯rst carried out on an FPGA
architecture for an in-depth analysis of fault e®ects, and then on an ASIC architecture
for showing the general validity of the approach. The fault injection experiments show, that delay faults occurring at the critical path are the most dangerous class of faults.
Furthermore, several countermeasures such as time diversity, parity protection, voltage
monitor and increased timing margins are analyzed.
Finally those countermeasures are brought into context with the coupling mechanisms
determined for the CCF model. In a practical application these countermeasures serve as
a starting point for a solution strategy on defying CCFs on single chip solution.

Dual Core Architectures, Common Cause Faults

http://publik.tuwien.ac.at/files/PubDat_184408.pdf

Project Head Andreas Steininger:
Bosch