Due to the advent of active safety features and automated driving capabilities, the complexity of embedded computing systems within automobiles continues to increase. Such advanced driver assistance systems (ADAS) are inherently safety-critical and must tolerate failures in any subsystem. However, fault-tolerance in safety-critical systems has been traditionally supported by hardware replication, which is prohibitively expensive in terms of cost, weight, and size for the automotive market. Recent work has studied the use of software-based fault-tolerance techniques that utilize task-level hot and cold standbys to tolerate fail-stop processor and task failures. The benefit of using standbys is maximal when a task and any of its standbys obey the placement constraint of not being co-located on the same processor. We propose a new heuristic based on a “tiered” placement constraint, and show that our heuristic produces a better task assignment that saves at least one processor up to 40% of the time relative to the best known heuristic to date. We then introduce a task allocation algorithm that, for the first time to our knowledge, leverages the run-time attributes of cold standbys. Our empirical study finds that our heuristic uses no more than one additional processor in most cases relative to an optimal allocation that we construct for evaluation purposes using a creative technique. We also extend our heuristic to support mixed-criticality systems which allow for overload operation. We have designed and implemented our software fault-tolerance framework in AUTOSAR, an automotive industry standard. We use this implementation to provide an experimental evaluation of our task-level fault-tolerance features. Finally, we present an analysis of the worst-case behavior of our task recovery features.

中文翻译：

---

软件容错的实际任务分配及其在嵌入式汽车系统中的实现

由于主动安全功能和自动驾驶功能的出现，汽车内嵌入式计算系统的复杂性不断增加。这种高级驾驶辅助系统 (ADAS) 本质上是安全关键，并且必须容忍任何子系统中的故障。然而，安全关键系统中的容错传统上由硬件复制支持，这在汽车市场的成本、重量和尺寸方面非常昂贵。最近的工作研究了基于软件的容错技术的使用，这些技术利用任务级热备用和冷备用来容忍故障停止处理器和任务故障。当一个任务和它的任何一个备用节点都遵守不在同一个处理器上共存的放置约束时，使用备用节点的好处是最大的。我们提出了一种基于“分层”放置约束的新启发式方法，并表明我们的启发式方法可以产生更好的任务分配，与迄今为止最著名的启发式方法相比，至少可以节省一个处理器多达 40% 的时间。然后，我们介绍了一种任务分配算法，据我们所知，该算法第一次利用冷备用的运行时属性。我们的实证研究发现，相对于我们使用创造性技术为评估目的构建的最佳分配，我们的启发式在大多数情况下使用的额外处理器不超过一个。我们还扩展了我们的启发式方法，以支持允许过载操作的混合临界系统。我们在汽车行业标准 AUTOSAR 中设计并实施了我们的软件容错框架。我们使用此实现对我们的任务级容错功能进行实验评估。最后，我们对我们的任务恢复功能的最坏情况行为进行了分析。