Restart-Based Fault-Tolerance: System Design and Schedulability Analysis
This work addresses the need for verified safety guarantees in embedded systems without requiring full platform software verification, which is particularly relevant for safety-critical domains.
The paper proposes a safe-by-design approach for embedded systems that uses a small verified software core to handle faults via full platform restart, ensuring timing constraints are met. Schedulability analysis for four restart-tolerant task models is derived and evaluated via simulation.
Embedded systems in safety-critical environments are continuously required to deliver more performance and functionality, while expected to provide verified safety guarantees. Nonetheless, platform-wide software verification (required for safety) is often expensive. Therefore, design methods that enable utilization of components such as real-time operating systems (RTOS), without requiring their correctness to guarantee safety, is necessary. In this paper, we propose a design approach to deploy safe-by-design embedded systems. To attain this goal, we rely on a small core of verified software to handle faults in applications and RTOS and recover from them while ensuring that timing constraints of safety-critical tasks are always satisfied. Faults are detected by monitoring the application timing and fault-recovery is achieved via full platform restart and software reload, enabled by the short restart time of embedded systems. Schedulability analysis is used to ensure that the timing constraints of critical plant control tasks are always satisfied in spite of faults and consequent restarts. We derive schedulability results for four restart-tolerant task models. We use a simulator to evaluate and compare the performance of the considered scheduling models.