Open Access

Modern safety-critical embedded applications like autonomous driving need to be fail-operational. At the same time, high performance and low power consumption are demanded. A common way to achieve this is the use of heterogeneous multi-cores. When applied to such systems, prevalent fault tolerance mechanisms suffer from some disadvantages: Some (e.g. triple modular redundancy) require a substantial amount of duplication, resulting in high hardware costs and power consumption. Others (e.g. lockstep) require supplementary checkpointing mechanisms to recover from errors. Further approaches (e.g. software-based process-level redundancy) cannot handle the indeterminism introduced by multithreaded execution. This paper presents a novel approach for fail-operational systems using hardware transactional memory, which can also be used for embedded systems running heterogeneous multi-cores. Each thread is automatically split into transactions, which then execute redundantly. The hardware transactional memory is extended to support multiple versions, which allows the reproduction of atomic operations and recovery in case of an error. In our FPGA-based evaluation, we executed the PARSEC benchmark suite with fault tolerance on 12 cores.

To satisfy the enduring demand for increasing computational power, the processor manufacturers try to raise the performance per Watt of a chip, which can be achieved by minimizing the structure sizes of electronic circuits. However, the technological limits are about to be reached, and the further reduction of the supply voltages and rising frequencies will lead to increased error rates due to transient faults, which result from the miniaturization of transistors, and from the growing number of transistors on a chip. To mitigate such errors, techniques from dependable server systems and safety-critical embedded systems become attractive in commodity systems as well. However, the typically used cycle-by-cycle lockstep execution of a redundant processor is hardly feasible on a complex out-of-order CPU. Approaches that enable a loose coupling have been proposed, integrated in hardware as well as software-only approaches. Software mechanisms allow to run specific applications redundantly to detect errors on a COTS (commercial-off-the-shelf) processor without hardware modifications. In recent years, transactional memory gained interest in the research of fault-tolerant systems. Its property of isolation and the integrated checkpointing mechanism to guarantee atomicity spawned multiple approaches to utilize transactional memory for fault tolerance. With the availability of first hardware implementations, for example TSX in the more expensive processors of the Intel x86 Core family, software mechanisms that rely on hardware transactional for checkpointing became feasible. This thesis investigates a fail-operational execution with transactional memory on a COTS Intel CPU, based on loosely-coupled redundant execution. An instrumentation mechanism, which was developed as an optimization pass for the LLVM compilation toolchain, and a support library for POSIX compatible systems provide the functionality for error detection and recovery. The feasibility and the effectiveness of the approach were evaluated with benchmarks of the SPEC2017 benchmark suite. Results show that a fault-tolerant redundant execution can be achieved on an x86 CPU, and that specific enhancements to the hardware could further improve the overall performance. Multi-threaded applications require further consideration for redundant execution, since indeterminism can occur between redundant pairs of threads, due to diverging synchronization, for example on mutual exclusion. An interface to the Pthread synchronization functions is described, as well as an error recovery mechanism, to enable the redundant and fail-operational execution of multi-threaded applications. This was evaluated by means of benchmarks of the PARSEC suite to prove that redundant multi-threading is feasible on a COTS CPU. The impact of the additional layer on performance and speedup is shown to be minimal.

Background Lymph node staging of ductal adenocarcinoma of the pancreatic head (PDAC) by cross-sectional imaging is limited. The aim of this study was to determine the diagnostic accuracy of expanded criteria in nodal staging in PDAC patients. Methods Sixty-six patients with histologically confirmed PDAC that underwent primary surgery were included in this retrospective IRB-approved study. Cross-sectional imaging studies (CT and/or MRI) were evaluated by a radiologist blinded to histopathology. Number and size of lymph nodes were measured (short-axis diameter) and characterized in terms of expanded morphological criteria of border contour (spiculated, lobulated, and indistinct) and texture (homogeneous or inhomogeneous). Sensitivities and specificities were calculated with histopathology as a reference standard. Results Forty-eight of 66 patients (80%) had histologically confirmed lymph node metastases (pN+). Sensitivity, specificity, and Youden’s Index for the criterion “size” were 44.2%, 82.4%, and 0.27; for “inhomogeneous signal intensity” 25.6%, 94.1%, and 0.20; and for “border contour” 62.7%, 52.9%, and 0.16, respectively. There was a significant association between the number of visible lymph nodes on preoperative CT and lymph node involvement (pN+, p = 0.031). Conclusion Lymph node staging in PDAC is mainly limited due to low sensitivity for detection of metastatic disease. Using expanded morphological criteria instead of size did not improve regional nodal staging due to sensitivity remaining low. Combining specific criteria yields improved sensitivity with specificity and PPV remaining high.