Watchdog Processor Research Articles

Approach to functional safety-compliant ECU design for electro-mechanical brake systems

In this paper, we propose a design approach to a functional safety-compliant ECU for an electro-mechanical brake (EMB) control system or an electronic wedge brake (EWB) control system. Brake actuators in a brake-by-wire (BBW) system such as EMB or EWB are characterized by the safety-critical functions which are now executed by using many electric and electronic devices with application software. Based on hazard analysis and risk assessments of the automotive functional safety standard ISO 26262, the proposed EMB control system should be ASIL-D-compliant, which is the highest ASIL level. To this end, a hardware and a software design method is introduced to implement functionl safety-oriented monitoring functions which are based on an asymmetric dual-core architecture with an external watchdog processor. It is shown by using EMB hardware-In-the-Loop-Simulation (HILS) that the proposed ECU design approach is very effective when a hardware fault or software execution faults occur in the EMB ECU, moreover, this functional safety-compliant design can be well combiled with the sensor fault-tolerant control logic.

CFCET: A hardware-based control flow checking technique in COTS processors using execution tracing

This paper presents a behavioral-based error detection technique called control flow checking by execution tracing (CFCET) to increase concurrent error detection capabilities of commercial off-the-shelf (COTS) processors. This technique traces the program jumps graph (PJG) at run-time and compares it with the reference jumps graph to detect possible violations caused by transient faults. The reference graph is driven by a preprocessor from the source program. The idea behind the CFCET is based on using an external watchdog processor (WDP) and also the internal execution tracing feature available in COTS processors to monitor the addresses of taken branches in a program, externally. This is done without any modification of application programs, thus, the program overhead is zero. This technique is analytically evaluated based on three different fault models. The results show that the error detection coverage varies between 79.74% and 96.43% depending on the different workload programs. The errors are detected with about zero latency. The external hardware overhead is about 3% using the Altera flex 10K30 FPGA and the execution time overhead is between 33.26% and 140.81% for different workload programs. The overheads have been measured experimentally by executing the workloads on a Pentium system.

Error Detection Enhancement in COTS Superscalar Processors with Performance Monitoring Features

Increasing use of commercial off-the-shelf (COTS) superscalar processors in industrial, embedded, and real-time systems necessitates the development of error detection mechanisms for such systems. This shows an error detection scheme called committed instructions counting (CIC) to increase error detection in such systems. The scheme uses internal performance monitoring features and an external watchdog processor (WDP). The performance monitoring features enable counting the number of committed instructions in a program. The scheme is experimentally evaluated on a 32-bit Pentium/spl reg/ processor using software implemented fault injection (SWIFI). A total of 8181 errors were injected into the Pentium/spl reg/ processor. The results show that the error detection coverage varies between to 90.92% and 98.41%, for different workloads.

FPGA-based concurrent watchdog for real-time control systems

A straightforward and efficient implementation of a custom concurrent watchdog processor for real-time control systems is presented. Emphasis is given to the techniques used for on-line checking the main processor activity without adding overhead, and to the advantages of a field programmable gate array implementation.

Control-flow checking by software signatures

This paper presents a new signature monitoring technique, CFCSS (control flow checking by software signatures); CFCSS is a pure software method that checks the control flow of a program using assigned signatures. An algorithm assigns a unique signature to each node in the program graph and adds instructions for error detection. Signatures are embedded in the program during compilation time using the constant field of the instructions and compared with run-time signatures when the program is executed. Another algorithm reduces the code size and execution time overhead caused by checking instructions in CFCSS. A fault injection experiment was performed with benchmark programs. Without CFCSS, an average of 33.7 % of the injected branching faults produced undetected incorrect outputs; however, with CFCSS, only 3.1 % of branching faults produced undetected incorrect outputs. Thus it is possible to increase error detection coverage for control flow errors by an order of magnitude using CFCSS. The distinctive advantage of CFCSS over previous signature monitoring techniques is that CFCSS is a pure software method, i.e., it needs no dedicated hardware such as a watchdog processor for control flow checking. A watchdog task in multitasking environment also needs no extra hardware, but the advantage of CFCSS over a watchdog task is that CFCSS can be used even when the operating system does not support multitasking.

An optimal number of microprocessor units with watchdog processor

A large number of microprocessors ( μPs) have been widely used in many practical fields. A watchdog processor (WDP) is the most convenient coprocessor to monitor the behavior of a μP since it is simple and low-priced. This paper considers a system with N μP units, where each μP unit consists of μP and WDP. When errors of a μP have occurred, a WDP detects them and resets a μP to an initial state. The reset number is checked at constant time T. If more than K resets have been made at time T, a μP becomes permanently faulty and one of other μP units in standby begins to operate. The mean time and the expected cost until system failure are derived. An optimal number N ∗ which minimizes the expected cost is discussed.

Reliability of multi‐microprocessor system with complicated switching

Recently, the demand for high reliability of microprocessors (µP) has been increasing. As a means of monitoring the operating situation of µP, the watchdog processor (WDP) has been widely used. However, at present, it is not possible to detect all errors in the µP. Hence, it is highly desirable that the entire system, including the µP, have higher reliability. In particular, in online systems the configuration of a system with both high reliability and real-time processing is indispensable. In this paper, a triple modulator redundancy unit (TMR) is constructed with a µP and WDP such that the µP unit has a majority voting function. The problem of reliability is studied for a system with n standby redundancies. In general, as the number of units is increased, noncoincident detection and the amount of hardware for switching circuits increase, so that reliability is degraded. The reduction factor of the reliability due to the increase in the number of units is treated as the complexity, and this measure of complexity is introduced into the system. The mean time to system failure is derived using Markov renewal processes. Further, the optimum number of TMR units minimizing the expected cost until system failure is analytically derived and evaluated with several discussions. © 1999 Scripta Technica, Electron Comm Jpn Pt 3, 82(4): 10–17, 1999

Reliability analysis of microprocessor systems with watchdog processors

A large number of microprocessors (μPs) have been widely used in many practical fields and the demand for improvement of their reliabilities have recently increased. Watchdog processors (WDPs) are small and simple coprocessors that can detect errors by monitoring the behavior of μPs. This paper formulates three reliability models of μP systems with WDPs: model 1 considers the system where a main processor (MPu) has n WDPs with self checking. Next, model 2 considers the system with upper limit number of resets. Further, model 3 discusses the system with limit processing time. The expected costs of each model are derived and the optimal policies which minimize them are discussed analytically. Finally, the numerical examples are given.

ハイドロホン付光磁気ディスク型海底地震計（ＭＯＯＢＳ／Ｈ‐１）の開発

We developed a new digital ocean bottom seismometer with a hydrophone using a magneto optical storage device, called MOOBS/H (Magneto-Optical Ocean Bottom Seismometer with Hydrophone) -1. This unit is designed to intend equipping a large-amount data storage, higher accuracy for the data and the random access capability, and improving the reliability of data storage; those features were not realized by the first generation. By the use of the power on-off control of the slave CPU, the SCSI interface, and the MO unit, the total power is reduced to 1/100 compared to the full use. By the MOOBS/H-1, 2000-3000 earthquakes can be stored in an MO disk.The MOOBS/H-1 is composed of seismic sensors, amplifiers, a multiplexer, a 16-bit A/D, a watch-dog processor, a time-keeper, a data-transfer processor and a five inch MO storage. Two 8 bit CPUs are used : one for a watch-dog and the other for data I/O between the main memory and the MO unit. One 16-bit A/D device is used. Recording channels can be selected among 8 channels. Six channels out of 8 channels have amplifiers. The sampling rate of A/D can be selected among various frequencies from 1 to 800Hz. The recording mode is chosen among several modes such as continuous, time window, logical trigger, and amplitude trigger modes. The necessary parameters for each observation are set using external key-pad unit through a bus-connector. The key-pad unit can be removed after setting parameters.The maximum amount of the data storage is 320Mb. The maximum number of earthquake events are c.a. 2, 200 if 100Hz sampling, 4 channels and 3 minutes record length are used. In this case, the maximum record length for each event can be extendible up to more than 42 minutes. When lithium batteries are used, the recording life is roughly 2 months.The data in the MO disk are directly readable by an NEC-PC and can be transferred from the PC to a workstation for analysis. Software to use the MOOBS/H data was also developed.The usefulness of MOOBS/H was confirmed by a number of deep-sea observations in such as the Japan Trench, the Okinawa Trough, off Japan, the Mariana Trough and the TAG area of the Mid-Atlantic Ridge. Using frequency characteristics of hydrophone, amplifier and recording unit, the very low frequency behavior of hydrothermal vent was firstly observed.

Floating point fault tolerance with backward error assertions

The paper introduces an assertion scheme based on the backward error analysis for error detection in algorithms that solve dense systems of linear equations, Ax=b. Unlike previous methods, this backward error assertion model is specifically designed to operate in an environment of floating point arithmetic subject to round-off errors, and it can be easily instrumented in a Watchdog processor environment. The complexity of verifying assertions is O(n/sup 2/), compared to the O(n/sup 3/) complexity of algorithms solving Ax=b. Unlike other proposed error detection methods, this assertion model does not require any encoding of the matrix A. Experimental results under various error models are presented to validate the effectiveness of this assertion scheme. >

Watchdog processors in parallel systems

A watchdog processor (WDP) is a relatively simple coprocessor built for concurrent, information compaction based error detection in the main program control flow. A new algorithm called SEIS (Signature Encoded Instruction Stream) is presented for assigning signatures to high level-instructions. The main idea of this method is to embed the information necessary to the program flow check into the signatures themselves, thus avoiding large reference databases in the WDP and allowing high operational speed. Solutions for a fault-tolerant multiprocessing and multi-tasking implementation are described as well.

Hardware support for error detection in multiprocessor systems — a case study

A comparison of the most important methods for error detection in multiprocessor systems is presented based upon the experiences gained in the development of the fault-tolerant multiprocessor system MEMSY. A detailed comparison between watchdog processors and master-checker type duplication based fault tolerance is given, from the point of view of fault coverage, hardware and time overhead. It is shown that a simple multiplication in itself is insufficient to assure proper error detection features, especially if a low error latency time is required. Design guidelines are presented for the effective use of the duplication, based on the master-checker mode. Additionally a new general purpose watchdog processor architecture is proposed, which monitors the behaviour of the main processor by checking the control flow of processes using an extended signature integrity checking (ESIC) method. The watchdog processor is independent of the architecture of the main processor because it is linked to the main processor by a memory interface. The watchdog processor is convenient for multiprocessor systems based on standard components and a RISC/CISC processor with large cache as node processor.

A watchdog processor for concurrent error detection in multiple processor systems

This paper presents a simple, effective and general watchdog processor for detecting transient, intermittent and permanent errors in multiple processor systems using on-line signature analysis. The signatures are stored in the local memory of the watchdog processor, which we call the Checker, and verified according to a new approach called on-line signature verification. In this new approach the storage requirements for control flow information about the application programs are reduced to less than 2% of the signature overhead and the design of the watchdog processor is greatly simplified. The design and implementation of a prototype of this watchdog processor is also presented.

Dependability Evaluation of Watchdog Processors

Many control systems need a good safety level, this can be done with the help of a Watchdog Processor, that not involve a high increase in the system's cost compared with other fault tolerant structures.This paper presents Markov models for studying the safety, reliability and availability of a Watchdog Processor. To carry out a benefit analysis, the results of the models of the three systems: Simplex Systems, Reconfigurable Duplication Systems, and Stanby Sparing Systems, are cornpared.The influence of parameters, suchcoverage, permanent faults, fault rate, etc, in all models is considered. For solving the models in the transient mode, a program based in the randomization method is used.

Concurrent checking of program flow using single-chip microcomputers

This paper describes the use of universal off-the-shelve single-chip microcomputers as watchdog processors in embedded systems. The watchdog processor executes assertions about the process running on the checked system. The checking procedures include verification of the program control flow graph (interpreted and compiled graph tracing techniques), program execution time, reasonableness of calculations and I/O signals. The capability, limitations and the overhead of this approach are discussed.

Concurrent error detection using watchdog processors-a survey

Concurrent system-level error detection techniques using a watchdog processor are surveyed. A watchdog processor is a small and simple coprocessor that detects errors by monitoring the behavior of a system. Like replication, it does not depend on any fault model for error detection. However, it requires less hardware than replication. It is shown that a large number of errors can be detected by monitoring the control flow and memory-access behavior. Two techniques for control-flow checking are discussed and compared with current error-detection techniques. A scheme for memory-access checking based on capability-based addressing is described. The design of a watchdog for performing reasonable checks on the output of a main processor by executing assertions is discussed. >

A watchdog processor based general rollback technique with multiple retries

A common assumption in the existing rollback techniques is that transients, the cause of most failures, subside very quickly, implying that a single story retry of the program from the previous rollback point is sufficient. The authors discuss a general rollback strategy with n(n≥2) retries which takes into consideration multiple transient failures as well as transients of long duration. Ways of deriving practical values of n for a given program are also discussed. Furthermore, the authors propose the use of a watchdog processor as an error detection tool to initiate recovery action through rollback, since the watchdog processor offers low error latency. They also discuss the merging of the watchdog processor with rollback recovery technique for enhancing the overall system reliability.

Watchdog Processors and Structural Integrity Checking

The use of watchdog processors in the implementation of Structural Integrity Checking (SIC) is described. A model for ideal SIC is given in terms of formal languages and automata. Techniques for use in implementing SIC are presented. The modification of a Pascal compiler into an SIC Pascal preprocessor is summarized.