This thesis presents and evaluates how to select the data to be logged in an embedded realtime system so as to be able to give confidence that it is possible to perform an accurate identification of the fault(s) that caused any runtime errors. Several log-selection strategies were evaluated by injecting random faults into a simulated real-time system. An instrument was created to perform accurate detection and identification of these faults by evaluating log data. The instrument’s output was compared to ground truth to determine the accuracy of the instrument. Three strategies for selecting the log entries to keep in limited permanent memory were created. The strategies were evaluated using log data from the simulated real-time system. One of the log-selection strategies performed much better than the other two: it minimized processing time and stored the maximum amount of useful log data in the available storage space. / Denna uppsats illustrerar hur det blev fastställt vad som ska loggas i ett inbäddat realtidssystem för att kunna ge förtroende för att det är möjligt att utföra en korrekt identifiering av fel(en) som orsakat körningsfel. Ett antal strategier utvärderades för loggval genom att injicera slumpmässiga fel i ett simulerat realtidssystem. Ett instrument konstruerades för att utföra en korrekt upptäckt och identifiering av dessa fel genom att utvärdera loggdata. Instrumentets utdata jämfördes med ett kontrollvärde för att bestämma riktigheten av instrumentet. Tre strategier skapades för att avgöra vilka loggposter som skulle behållas i det begränsade permanenta lagringsutrymmet. Strategierna utvärderades med hjälp av loggdata från det simulerade realtidssystemet. En av strategierna för val av loggdata presterade klart bättre än de andra två: den minimerade tiden för bearbetning och lagrade maximal mängd användbar loggdata i det permanenta lagringsutrymmet.

In this dissertation, we study two new approaches to fault detection for autonomous robots. The first approach involves the synthesis of software components that give a robot the capacity to detect faults which occur in itself. Our hypothesis is that hardware faults change the flow of sensory data and the actions performed by the control program. By detecting these changes, the presence of faults can be inferred. In order to test our hypothesis, we collect data in three different tasks performed by real robots. During a number of training runs, we record sensory data from the robots both while they are operating normally and after a fault has been injected. We use back-propagation neural networks to synthesize fault detection components based on the data collected in the training runs. We evaluate the performance of the trained fault detectors in terms of the number of false positives and the time it takes to detect a fault.<p>The results show that good fault detectors can be obtained. We extend the set of possible faults and go on to show that a single fault detector can be trained to detect several faults in both a robot's sensors and actuators. We show that fault detectors can be synthesized that are robust to variations in the task. Finally, we show how a fault detector can be trained to allow one robot to detect faults that occur in another robot.<p><p>The second approach involves the use of firefly-inspired synchronization to allow the presence of faulty robots to be determined by other non-faulty robots in a swarm robotic system. We take inspiration from the synchronized flashing behavior observed in some species of fireflies. Each robot flashes by lighting up its on-board red LEDs and neighboring robots are driven to flash in synchrony. The robots always interpret the absence of flashing by a particular robot as an indication that the robot has a fault. A faulty robot can stop flashing periodically for one of two reasons. The fault itself can render the robot unable to flash periodically.<p>Alternatively, the faulty robot might be able to detect the fault itself using endogenous fault detection and decide to stop flashing.<p>Thus, catastrophic faults in a robot can be directly detected by its peers, while the presence of less serious faults can be detected by the faulty robot itself, and actively communicated to neighboring robots. We explore the performance of the proposed algorithm both on a real world swarm robotic system and in simulation. We show that failed robots are detected correctly and in a timely manner, and we show that a system composed of robots with simulated self-repair capabilities can survive relatively high failure rates.<p><p>We conclude that i) fault injection and learning can give robots the capacity to detect faults that occur in themselves, and that ii) firefly-inspired synchronization can enable robots in a swarm robotic system to detect and communicate faults.<p> / Doctorat en Sciences de l'ingénieur / info:eu-repo/semantics/nonPublished

De nombreuses applications comme les cartes bancaires manipulent des données confidentielles. A ce titre, les circuits microélectroniques qui les composent, font de plus en plus l'objet d'attaques représentant des menaces pour la sécurité. De plus, un grand nombre des circuits électroniques portables et fonctionnant sur batterie demandent que la consommation électrique soit toujours plus réduite. Les concepteurs de circuit doivent donc proposer des solutions sécurisées, tout en limitant la consommation.Ce travail présente l'évaluation sécuritaire et la conception de contre-mesures pour des architectures à triple-caisson dédiées à la réduction de la consommation. Ces recherches, liées au contexte, se sont focalisées sur l'évaluation de cette architecture face à des injections de fautes Laser. Dès le début de ce manuscrit, l’état de l’art de l’injection de fautes est développé, en se focalisant sur les effets physiques d’un faisceau laser. Les architectures à double et triple-caisson sont ensuite analysées dans le but de comparer leur robustesse. Cette démarche permet d’appréhender d’éventuels effets physiques induits par le laser à l’intérieur des caissons de polarisations Nwell, Pwell et des transistors MOS. Suite à cette analyse des phénomènes physiques, des modélisations électriques des portes CMOS ont été développées pour des architectures à double et triple-caisson. De bonnes corrélations ont pu être obtenues entre les mesures et les simulations électriques. Pour conclure, ce travail a permis d'extraire de potentielles règles de conception permettant d’améliorer la robustesse sécuritaire des portes CMOS et de développer des moyens de détections d’attaques lasers. / In many applications such as credit cards, confidential data is used. In this regard, the systems-on-chip used in these applications are often deliberately attacked. This puts the security of our data at a high risk. Furthermore, many SoC devices have become battery-powered and require very low power consumption. In this context, semiconductor manufacturers should propose secured and low-power solutions.This thesis presents a security evaluation and a countermeasures design for a low-power, triple-well architecture dedicated to low-power applications. The security context of this research focuses on a Laser sensitivity evaluation of this architecture.This paper first presents the state of the art of Laser fault injection techniques, focusing on the physical effects induced by a Laser beam. Afterward, we discuss the different dual-and triple-well architectures studied in order to compare their security robustness. Then, a physical study of these architectures as substrate resistor and capacitor modeling highlights their impact on security. This evaluation lets us anticipate the phenomena potentially induced by the Laser inside the biasing well (P-well, N-well) and the MOS transistors.Following the analysis of the physical phenomena resulting from the interaction between the laser and the silicon, electrical modeling of the CMOS gates was developed for dual and triple-well architectures. This enabled us to obtain a good correlation between measurements and electrical simulations.In conclusion, this work enabled us to determine possible design rules for increasing the security robustness of CMOS gates as well as the development of Laser sensors able to detect an attack.

La perception est une entrée fondamentale des systèmes robotiques, en particulier pour la localisation, la navigation et l'interaction avec l'environnement. Or les données perçues par les systèmes robotiques sont souvent complexes et sujettes à des imprécisions importantes. Pour remédier à ces problèmes, l'approche multi-capteurs utilise soit plusieurs capteurs de même type pour exploiter leur redondance, soit des capteurs de types différents pour exploiter leur complémentarité afin de réduire les imprécisions et les incertitudes sur les capteurs. La validation de cette approche de fusion de données pose deux problèmes majeurs.Tout d'abord, le comportement des algorithmes de fusion est difficile à prédire,ce qui les rend difficilement vérifiables par des approches formelles. De plus, l'environnement ouvert des systèmes robotiques engendre un contexte d'exécution très large, ce qui rend les tests difficiles et coûteux. L'objet de ces travaux de thèse est de proposer une alternative à la validation en mettant en place des mécanismes de tolérance aux fautes : puisqu'il est difficile d'éliminer toutes les fautes du système de perception, on va chercher à limiter leurs impacts sur son fonctionnement. Nous avons étudié la tolérance aux fautes intrinsèquement permise par la fusion de données en analysant formellement les algorithmes de fusion de données, et nous avons proposé des mécanismes de détection et de rétablissement adaptés à la perception multi-capteurs. Nous avons ensuite implémenté les mécanismes proposés pour une application de localisation de véhicules en utilisant la fusion de données par filtrage de Kalman. Nous avons finalement évalué les mécanismes proposés en utilisant le rejeu de données réelles et la technique d'injection de fautes, et démontré leur efficacité face à des fautes matérielles et logicielles. / Perception is a fundamental input for robotic systems, particularly for positioning, navigation and interaction with the environment. But the data perceived by these systems are often complex and subject to significant imprecision. To overcome these problems, the multi-sensor approach uses either multiple sensors of the same type to exploit their redundancy or sensors of different types for exploiting their complementarity to reduce the sensors inaccuracies and uncertainties. The validation of the data fusion approach raises two major problems. First, the behavior of fusion algorithms is difficult to predict, which makes them difficult to verify by formal approaches. In addition, the open environment of robotic systems generates a very large execution context, which makes the tests difficult and costly. The purpose of this work is to propose an alternative to validation by developing fault tolerance mechanisms : since it is difficult to eliminate all the errors of the perceptual system, We will try to limit impact in their operation. We studied the inherently fault tolerance allowed by data fusion by formally analyzing the data fusion algorithms, and we have proposed detection and recovery mechanisms suitable for multi-sensor perception, we implemented the proposed mechanisms on vehicle localization application using Kalman filltering data fusion. We evaluated the proposed mechanims using the real data replay and fault injection technique.

This document is especially aimed at web services technologies and testing them using fault injection methods. The work deals with Service-Oriented Architecture, used as a standard for web service implementation, and with software testing in general. Practical part of the project includes the design and realization of a tool, which is able to test the most common types of web services according to setup criteria. To demonstrate its functionality, some of the sample and public web services were tested.

FPGAs are frequently used in network systems to provide the performance and flexibility that is required of modern computer networks while allowing network vendors to bring products to market quickly. Like all electronic devices, FPGAs are vulnerable to ionizing radiation which can cause applications operating on an FPGA to fail. These low-level failures can have a wide range of negative effects on the performance of a network system. As computer networks play a larger role in modern society, it becomes increasingly important that these soft errors are addressed in the design of network systems.This work presents a framework for testing the soft-error reliability of FPGA-based networking systems. The framework consists of the NetFPGA development board, a custom traffic generator, and a custom high-speed JTAG configuration device. The NetFPGA development board is versatile and can be used to implement a wide range of network applications. The traffic generator is used to exercise the network system on the NetFPGA and to determine the health of that system. The JTAG configuration device is used to manage reliability experiments, to perform fault injection into the FPGA, and to monitor the NetFPGA during radiation tests.This thesis includes soft-error reliability tests that were performed on an Ethernet switch network system. Using both fault injection and accelerate radiation testing, the soft error sensitivity of the Ethernet switch was measured. The Ethernet switch design was then mitigated using triple module redundancy and duplication with compare. These mitigated designs were also tested and compared against the baseline design. Radiation testing shows that TMR provides a 5.05x improvement in reliability over the baseline design. DWC provides a 5.22x improvement in detectability over the baseline design without reducing the reliability of the system.

Artificial neural networks (ANNs) are used in many types of computing applications. Traditionally, ANNs have been implemented in software, executing on CPUs and even GPUs, which capitalize on the parallelizable nature of ANNs. More recently, FPGAs have become a target platform for ANN implementations due to their relatively low cost, low power, and flexibility. Some safety-critical applications could benefit from ANNs, but these applications require a certain level of reliability. SRAM-based FPGAs are sensitive to single-event upsets (SEUs), which can lead to faults and errors in execution. However there are techniques that can mask such SEUs and thereby improve the overall design reliability. This thesis evaluates the SEU reliability of neural networks implemented in SRAM-based FPGAs and investigates mitigation techniques against upsets for two case studies. The first was based on the LeNet-5 convolutional neural network and was used to test an implementation with both fault injection and neutron radiation experiments, demonstrating that our fault injection experiments could accurately evaluate SEU reliability of the networks. SEU reliability was improved by selectively applying TMR to the most critical layers of the design, achieving a 35% improvement reliability at an increase in 6.6% resources. The second was an existing neural network called BNN-PYNQ. While the base design was more sensitive to upsets than the CNN previous tested, the TMR technique improved the reliability by approximately 7× in fault injection experiments.

The transportation industry has been transforming because of rapid digitalization and autonomy. Because of this the demand for more connected and autonomous vehicles is increasing for both private individuals and businesses. Reducing human interaction emphasizes the need for higher road safety. Autonomous vehicles, in general, have different sources of faults which might lead to severe accidents and injuries. Testing and validating autonomous vehicles can be useful for avoiding such cases. Remote driving is a potential fallback option whenever autonomous vehicles fail. The remote operator can take direct or indirect control of the remotely-operated vehicle whenever the need arises. Tele-operated driving has three main parts - the vehicle, the remote operator, and communication between the two. Communication plays an important role in this feedback control system. Any communication disturbance in the video feed from the vehicle to the remote operator or in the commands from the operator to the vehicle can result in safety violations and even accidents. These disturbances can have different sources. This work presents a methodology to inject network disturbances to analyze the effect of these disturbances on vehicle manoeuvrability. A driving simulator, CARLA, was used as a vehicle model to solve this problem and to allow human-in-the-loop. NETEM was used to inject different faults on the outgoing traffic to emulate network disturbances. The implementation was done on LocalHost to avoid any delays that might occur due to the presence of physical devices in the network. It was concluded from the Time-to-Collision (TTC) results that road safety decreased whenever the fault was injected in a vehicle-following case. Another important insight was that the packet loss of 5% always showed a TTC violation for a 6-sec threshold. The highest steering reversal rate was also observed for 5% packet loss. It was observed from the results that the steering reversal rate (SRR) was consistently higher in the faulty run. This indicates that the drivers were more distracted. Based on the results, it is observed that network disturbances affected driving in a remote driving setup. The results can be further utilized for more comprehensive studies to understand how simulator-in-loop can be used for testing, verification, and validation. / Transportbranschen har förändrats på grund av snabb digitalisering och autonomi. Efterfrågan på mer uppkopplade och autonoma fordon ökar hos både privatpersoner och företag. Men minskad användarinteraktion ökar behovet av högre säkerhet hos fordonen. Autonoma fordon har i allmänhet olika felkällor som kan leda till allvarliga olyckor och skador. Att testa och validera autonoma fordon blir viktigt för att undvika sådana fall. Fjärrkörning är ett potentiellt komplement när autonoma fordon inte är tillräckligt säkra. Fjärroperatören kan ta direkt eller indirekt kontroll över det fjärrmanövrerade fordonet när behovet uppstår. Telestyrd körning har tre huvudkomponenter - fordonet, fjärroperatören och kommunikationen däremellan. Kommunikation spelar en viktig roll i detta återkopplade system. Varje störning i kommunikationen av videoflödet från fordonet till fjärroperatören eller i kommandon från operatören till fordonet kan resultera i bristande säkerhet och till och med olyckor. Dessa störningar kan ha olika källor. Detta arbete presenterar en metod för att injicera nätverksstörningar för att kunna analysera effekten av dessa på fordonets manövrerbarhet. En körsimulator, CARLA, användes som fordonsmodell och anpassades för att kunna styras av en mänsklig fjärroperatör. NETEM användes för att injicera olika fel på den utgående nätverkstrafiken för att efterlikna nätverksstörningar. Implementeringen gjordes på LocalHost för att undvika fördröjningar som kan uppstå på grund av närvaron av andra fysiska enheter i nätverket. Av TTC-resultaten drogs slutsatsen att trafiksäkerheten minskade när fel injicerades i ett fall där fjärroperatören följer att annat fordon. En annan viktig insikt var att en paketförlust på 5% alltid gav överträdelser med för låg TTC vid en gräns för lägsta tillåtna värde på 6 sekunder. Även de högsta observerade värdena på styrvändningstakt (steering reversal rate) observerades för 5% paketförlust. Resultaten visade att styrvändningstakten konsekvent var högre vid felinjicering. Detta tyder på att förarna var mer distraherade. Baserat på resultaten är en observeration att nätverksstörningar kan påverka säkerheten vid fjärroperation. Metodiken kan användas för mer omfattande studier för att förstå hur simulator-i-loopen kan användas för testning, verifiering och validering.

Testing software-intensive systems can be challenging, especially when safety requirements are involved. Property-Based Testing (PBT) is a software testing technique where properties about software are specified and thousands of test cases with a wide range of inputs are automatically generated based on these properties. PBT does not formally prove that the software fulfils its specification, but it is an efficient way to identify deviations from the specification. Safety-critical systems that must be able to deal with faults, without causing damage or injuries, are often tested using Fault Injection (FI) at several abstraction levels. The purpose of FI is to inject faults into a system in order to exercise and evaluate fault handling mechanisms. The aim of this thesis is to investigate how knowledge and techniques from the areas of FI and PBT can be used together to test functional and safety requirements simultaneously. We have developed a FI tool named FaultCheck that enables PBT tools to use common FI-techniques directly on source code. In order to evaluate and demonstrate our approach, we have applied our tool FaultCheck together with the commercially available PBT tool QuickCheck on a simple and on a complex system. The simple system is the AUTOSAR End-to-End (E2E) library and the complex system is a quadcopter simulator that we developed ourselves. The quadcopter simulator is based on a hardware quadcopter platform that we also developed, and the fault models that we inject into the simulator using FaultCheck are derived from the hardware quadcopter platform. We were able to efficiently apply FaultCheck together with QuickCheck on both the E2E library and the quadcopter simulator, which gives us confidence that FI together with PBT can be used to test and evaluate a wide range of simple and complex safety-critical software. / <p>This research has been funded through the PROWESS EU project (Grant agreement no: 317820), the KARYON EU project (Grant agreement no: 288195) and through EISIGS (grants from the Knowledge Foundation).</p> / PROWESS / KARYON

A fault injection tool has been created to emulate single event upset (SEU) behavior within the configuration memory of an FPGA. This tool is able to rapidly and accurately determine the dynamic sensitive cross section of the configuration memory for a given FPGA design. This tool enables the reliability of FPGA designs and fault tolerance schemes to be quickly and accurately tested. The validity of testing performed with this fault injection tool has been confirmed through radiation testing. A radiation test was conducted at Crocker Nuclear Laboratory using a proton accelerator in order to determine the actual dynamic sensitive cross section for specific FPGA designs. The results of this radiation testing were then analyzed and compared with similar fault injection tests, with results suggesting that the fault injection tool behavior is indeed accurate and valid. The fault injection tool can be used to determine the sensitivity of an FPGA design to configuration memory upsets. Additionally, fault mitigation techniques designed to increase the reliability of an FPGA design in spite of upsets within the configuration memory, can be thoroughly tested through fault injection. Fault injection testing should help to increase the feasibility of reconfigurable computing in space. FPGAs are well suited to the computational demands of space based signal processing applications; however, without appropriate mitigation or redundancy techniques, FPGAs are unreliable in a radiation environment. Because the fault injection tool has been shown to reliably model the effects of single event upsets within the configuration memory, it can be used to accurately evaluate the effectiveness of fault tolerance techniques in FPGAs.