Search

To enable reliable embedded systems, it is imperative to leverage the compiler and system software for joint optimization of functional correctness (i.e., vulnerability indexes) and timing correctness (i.e., deadline misses). This paper considers the optimization of the reliability-timing (RT) penalty, defined as a linear combination of the vulnerability and deadline misses. We propose a cross-layer approach to achieve reliable code generation and execution at compilation and system software layers for embedded systems. This is enabled by the concept of generating multiple versions for given application functions, with diverse performance and reliability tradeoffs, by exploiting different reliability-guided compilation options. As the execution time of a function is not fixed, the selection of the versions depends upon the execution behavior of the previous functions. Based on the reliability and execution time profiling of these versions, our reliability-driven system software decides the prioritization of the functions for determining their execution order and employs dynamic version selection to dynamically select a suitable version of a function. Specifically, our scheme builds a schedule table offline to optimize the RT penalty, and uses this table at run time to select suitable versions for the subsequent functions. A complex real-world application of “secure video and audio processing” composed of various functions is evaluated for reliable code generation and execution.

Wireless Sensor Networks (WSNs) are widely recognized as a promising solution to build next-generation monitoring systems. Their industrial uptake is however still compromised by the low level of trust on their performance and dependability. Whereas analytical models represent a valid mean to assess nonfunctional properties via simulation, their wide use is still limited by the complexity and dynamicity of WSNs, which lead to unaffordable modeling costs. To reduce this gap between research achievements and industrial development, this paper presents a framework for the assessment of WSNs based on the automated generation of analytical models. The framework hides modeling details, and it allows designers to focus on simulation results to drive their design choices. Models are generated starting from a high-level specification of the system and by a preliminary characterization of its fault-free behavior, using behavioral simulators. The benefits of the framework are shown in the context of two case studies, based on the wireless monitoring of civil structures.

The significance of redundant technologies for improving dependability and delay fault testability are growing. So, delay fault testing on two-rail logic circuits well known as a class of redundant technologies will become important. Two-rail logic circuits can be efficiently tested by noncodeword vector pairs. However, noncodeword vector pairs may sensitize some faults which affect neither normal operation nor strongly fault secure property of the two-rail logic circuits. It means that testing with noncodeword vector pairs may be overtesting. This paper presents a construction of robust path delay fault test sets for two-rail logic circuits. The proposed test sets do not lead to the overtesting. The amounts of test data for the proposed test sets are, on average, 28.2 percent less than those for the test sets, which are obtained by the existing construction for unate circuits and lead to the overtesting.

As failure rate keeps on increasing in large systems, applications running atop restart more frequently than ever. Existing research on checkpoint/restart mainly focuses on optimizing checkpoint operation, without paying much attention to the restart operation. As a result, application restart latency maybe substantial, which greatly threatens system dependability and performance. To attack the restart latency problem, in this paper, we present FREM, a fast restart mechanism for general checkpoint/restart protocols. By dynamically tracking the process data accesses after each checkpoint, FREM masks restart latency by overlapping application recovery with the retrieval of its checkpoint image. We have implemented FREM as a prototype system and tested it under Linux environments. Extensive experiments with real applications demonstrate that it can effectively reduce restart latency by over 50 percent on average, as compared to the conventional restart mechanisms.

The number of CPUs in chip multiprocessors is growing at the Moore's Law rate, due to continued technology advances. However, new technologies pose serious reliability challenges, such as more frequent occurrences of degraded or even nonoperational devices, and they threaten the cost-effectiveness and dependability of future computing systems. This work studies how to protect the on-chip coherence directory from fault occurrences. In a chip multiprocessor, cache coherence mechanisms such as directory memory are critical for offering consistent data view to all CPUs. We propose a novel online fault detection and correction scheme to enhance yield and resilience to runtime errors at a small performance cost. The proposed scheme uses smart encoding and coherence protocol adaptation strategies to salvage faulty directory entries. We also develop an online error recovery scheme that protects the directory memory from soft errors. We call our fault-tolerant directory memory architecture PERFECTORY. Evaluation results show that PERFECTORY achieves very high fault resilience: Over 99 percent chip yield at 0.05 percent hard error ratio and 1,934 years MTTF at 1,000 FIT using a 100-processor cluster configuration. PERFECTORY limits performance degradation to less than 1 percent at 0.05 percent hard error ratio and requires significantly smaller area overheads than existing redundancy approaches.

We develop a continuous-time Markov chain model of a dependability system operating in a randomly changing environment and subject to probabilistic cascading failures. A cascading failure can be thought of as a rooted tree. The root is the component whose failure triggers the cascade, its children are those components that the root's failure immediately caused, the next generation are those components whose failures were immediately caused by the failures of the root's children, and so on. The amount of cascading is unlimited. We consider probabilistic cascading in the sense that the failure of a component of type i causes a component of type j to fail simultaneously with a given probability, with all failures in a cascade being mutually independent. Computing the infinitesimal generator matrix of the Markov chain poses significant challenges because of the exponential growth in the number of trees one needs to consider as the number of components failing in the cascade increases. We provide a recursive algorithm generating all possible trees corresponding to a given transition, along with an experimental study of an implementation of the algorithm on two examples. The numerical results highlight the effects of cascading on the dependability of the models.

We present an approach for analyzing the propagation and effect of data errors in modular software enabling the profiling of the vulnerabilities of software to find 1) the modules and signals most likely exposed to propagating errors and 2) the modules and signals which, when subjected to error, tend to cause more damage than others from a systems operation point-of-view. We discuss how to use the obtained profiles to identify where dependability structures and mechanisms will likely be the most effective, i.e., how to perform a cost-benefit analysis for dependability. A fault-injection-based method for estimation of the various measures is described and the software of a real embedded control system is profiled to show the type of results obtainable by the analysis framework.

This paper presents research work performed on the development and the verification of dependable reflective systems based on MetaObject Protocols (MOPS). We describe our experience, we draw the lessons learned from both a design and a validation viewpoint, and we discuss some possible future trends on this topic. The main originality of this work relies on the combination of both design and validation issues for the development of reflective systems, which has led to the definition of a reflective framework for the next generation of fault-tolerant systems. This framework includes: 1) the specification of a MetaObject Protocol suited to the implementation of fault-tolerant systems and 2) the definition of a general test strategy to guide its verification. The proposed approach is generic and solves many issues related to the use and evolution of system platforms with dependability requirements. Two different instances of the specified MOP have been implemented in order to study the impact of the MOP architecture in the development of a reflective fault-tolerant system. As far as the test strategy is concerned, a different testing level is associated with each reflective mechanism defined in the MOP. For each testing level, we characterize the test objectives and the required test environments. According to this experience, several new research challenges are finally identified.

Survivable systems-that is, systems that can continue to provide service despite failures, intrusions, and other threats-are increasingly needed in a wide variety of civilian and military application areas. As a step toward realizing such systems, this paper advocates the use of redundancy and adaptation to build survivable services that can provide core functionality for implementing survivability in networked environments. An approach to building such services using these techniques is described and a concrete example involving a survivable communication service is given. This service is based on Cactus, a system for building highly configurable network protocols that offers the flexibility needed to easily add redundant and adaptive components. Initial performance results for a prototype implementation of the communication service built using Cactus/C2.1 running on Linux are also given.

Building dependable distributed systems from commercial off-the-shelf components is of growing practical importance. For both cost and production reasons, there is interest in approaches and architectures that facilitate building such systems. The AQuA architecture is one such approach; its goal is to provide adaptive fault tolerance to CORBA applications by replicating objects. The AQuA architecture allows application programmers to request desired levels of dependability during applications' runtimes. It provides fault tolerance mechanisms to ensure that a CORBA client can always obtain reliable services, even if the CORBA server object that provides the desired services suffers from crash failures and value faults. AQuA includes a replicated dependability manager that provides dependability management by configuring the system in response to applications' requests and changes in system resources due to faults. It uses Maestro/Ensemble to provide group communication services. It contains a gateway to intercept standard CORBA IIOP messages to allow any standard CORBA application to use AQuA. It provides different types of replication schemes to forward messages reliably to the remote replicated objects. All of the replication schemes ensure strong, data consistency among replicas. This paper describes the AQuA architecture and presents, in detail, the active replication pass-first scheme. In addition, the interface to the dependability manager and the design of the dependability manager replication are also described. Finally, we describe performance measurements that were conducted for the active replication pass-first scheme, and we present results from our study of fault detection, recovery, and blocking times.

We propose a BICS-only method for concurrent error detection (CED) where a built-in current sensor (BICS) is solely responsible for detecting faults and errors. Due to the wide applicability of the BICS, this approach can be applied directly to combinational circuits, sequential circuits, and even some analog circuits. A dependability model was developed to study the effectiveness of the proposed BICS-only method. The unsafe probability of the BICS-only design is sensitive to both fault coverage and testability of the BICS. When used in a duplicated CED system for fault masking, the system reliability is sensitive to the fault coverage, but not to the testability of the BICS. Next, we show that a dramatic increase in unsafe probability is possible if the BICS cannot perform detection at every system clock cycle. A higher testability for BICS will, contrary to our intuition, make the unsafe probability higher. For duplicated CED applications, the reliability will be even lower than that of a nonredundant system. Therefore, the design criteria for BICS in the BICS-only method, in the order of importance, are: operating speed, fault coverage, and testability.

The commercial offer concerning microkernel technology constitutes an attractive alternative for developing operating systems to suit a wide range of application domains. However, the integration of commercial off-the-shelf (COTS) microkernels into critical embedded computer systems is a problem for system developers, in particular due to the lack of objective data concerning their behavior in the presence of faults. This paper addresses this issue by describing a prototype environment, called MAFALDA (Microkernel Assessment by Fault injection AnaLysis and Design Aid), that is aimed at providing objective failure data on a candidate microkernel and also improving its error detection capabilities. The paper first presents the overall architecture of MAFALDA. Then, a case study carried out on an instance of the Chorus microkemel is used to illustrate the benefits that can be obtained with MAFALDA both from the dependability assessment and design-aid viewpoints. Implementation issues are also addressed that account for the specific API of the target microkemel. Some overall insights and lessons learned, gained during the various studies conducted on both Chorus and another target microkemel (LynxOS), are then depicted and discussed. Finally, we conclude the paper by summarizing the main features of the work presented and by identifying future research.

Describes our experience using coordinated atomic (CA) actions as a system structuring tool to design and validate a sophisticated and embedded control system for a complex industrial application that has high reliability and safety requirements. Our study is based on an extended production cell model, the specification and simulator for which were defined and developed by FZI (Forschungszentrum Informatik, Germany). This "fault-tolerant production cell" represents a manufacturing process involving redundant mechanical devices (provided in order to enable continued production in the presence of machine faults). The challenge posed by the model specification is to design a control system that maintains specified safety and liveness properties even in the presence of a large number and variety of device and sensor failures. Based on an analysis of such failures, we provide details of: (1) a design for a control program that uses CA actions to deal with both safety-related and fault tolerance concerns and (2) the formal verification of this design based on the use of model checking. We found that CA action structuring facilitated both the design and verification tasks by enabling the various safety problems (involving possible clashes of moving machinery) to be treated independently. Even complex situations involving the concurrent occurrence of any pairs of the many possible mechanical and sensor failures can be handled simply yet appropriately. The formal verification activity was performed in parallel with the design activity, and the interaction between them resulted in a combined exercise in "design for validation"; formal verification was very valuable in identifying some very subtle residual bugs in early versions of our design which would have been difficult to detect otherwise.

This study deals with model-based dependability transient analysis of phased mission systems. A review of the studies in the literature showed that several aspects of multiphased systems pose challenging problems to the dependability evaluation methods and tools. To attack the weak points of the state-of-the-art we propose a modeling methodology that exploits the power of the class of Markov regenerative stochastic Petri net models. By exploiting the techniques available in the literature for the analysis of the Markov Regenerative Processes, we obtain an analytical solution technique with a low computational complexity, basically dominated by the cost of the separate analysis of the system inside each phase. Last, the existence of analytical solutions allows us to derive the sensitivity functions of the dependability measures, thus providing the dependability engineer with additional means for the study of phased mission systems.

We propose a new method to obtain bounds of dependability, performance or performability measures concerning complex systems modeled by a large Markov model. It extends previously published techniques mainly designed to the analysis of dependability measures only and working under more restrictive conditions. Our approach allows us to obtain tight bounds of performance measures on certain cases and, in particular, on models having an infinite state space. We illustrate the method with some analytically intractable open queuing networks, as well as with large dependability models.

Systems with global spares, in which a spare can replace any of multiple identical primary modules, are widely used. We present efficient algorithms for approximating the probability distribution of performance level (number of working modules) in systems with global spares and arbitrary module failure distribution. For nondegradable systems with global spares and arbitrary module failure distribution, our algorithms provide the first efficient solution for reliability. For degradable systems with global spares, our algorithms can be used to produce upper and lower bounds on various dependability measures.

Embedded systems employed in critical applications demand high reliability and availability in addition to high performance. Hardware-software co-synthesis of an embedded system is the process of partitioning, mapping, and scheduling its specification into hardware and software modules to meet performance, cost, reliability, and availability goals. In this paper, we address the problem of hardware-software co-synthesis of fault-tolerant real-time heterogeneous distributed embedded systems. Fault detection capability is imparted to the embedded system by adding assertion and duplicate-and-compare tasks to the task graph specification prior to co-synthesis. The dependability (reliability and availability) of the architecture is evaluated during co-synthesis. Our algorithm, called COFTA (Co-synthesis Of Fault-Tolerant Architectures), allows the user to specify multiple types of assertions for each task. It uses the assertion or combination of assertions which achieves the required fault coverage without incurring too much overhead. We propose new methods to: 1) Perform fault tolerance based task clustering, which determines the best placement of assertion and duplicate-and-compare tasks, 2) Derive the best error recovery topology using a small number of extra processing elements, 3) Exploit multidimensional assertions, and 4) Share assertions to reduce the fault tolerance overhead. Our algorithm can tackle multirate systems commonly found in multimedia applications. Application of the proposed algorithm to a large number of real-life telecom transport system examples (the largest example consisting of 2,172 tasks) shows its efficacy. For fault secure architectures, which just have fault detection capabilities, COFTA is able to achieve up to 48.8 percent and 25.6 percent savings in embedded system cost over architectures employing duplication and task-based fault tolerance techniques, respectively. The average cost overhead of COFTA fault-secure architectures over simplex architectures is only 7.3 percent. In case of fault-tolerant architectures, which cannot only detect but also tolerate faults, COFTA is able to achieve up to 63.1 percent and 23.8 percent savings in embedded system cost over architectures employing triple-modular redundancy, and task-based fault tolerance techniques, respectively. The average cost overhead of COFTA fault-tolerant architectures over simplex architectures is only 55.4 percent.

Point availability and expected interval availability are dependability measures respectively defined by the probability that a system is in operation at a given instant and by the mean percentage of time during which a system is in operation over a finite observation period. We consider a repairable computer system and we assume, as usual, that the system is modeled by a finite Markov process. We propose in this paper a new algorithm to compute these two availability measures. This algorithm is based on the classical uniformization technique in which a test to detect the stationary behavior of the system is used to stop the computation if the stationarity is reached. In that case, the algorithm gives not only the transient availability measures, but also the steady state availability, with significant computational savings, especially when the time at which measures are needed is large. In the case where the stationarity is not reached, the algorithm provides the transient availability measures and bounds for the steady state availability. It is also shown how the new algorithm can be extended to the computation of performability measures.

In an open system standards environment, a formal specification can be shared by all of its implementations, which results in the sharing of development cost. This paper presents a specification-based adaptive test case generation (SBATCG) method for generating validation test cases and a specification-based adaptive consistency check generation (SBACCG) method for generating on-line consistency checks for implementations developed from a model-based specification. The SBATCG (SBACCG) method first derives test cases (consistency checks) through rigorous exploration of a model-based specification, adapts the test cases (consistency checks) to the program structure of a particular implementation, and then produces test cases (consistency checks) that are particularly suitable for the implementation. Testing does not guarantee a program's freedom from faults. The results of the fault-injection experiment show that the SBACCG method can complement the SBATCG method.

This paper presents a dependability study of high-speed, switched Local Area Networks (LANs) using Myrinet as an example testbed (with theoretical speeds of 2.56 Gbps). The study uses results of two fault injection methods, simulated fault injection and software-implemented fault injection (SWIFI), to analyze the application-level impact of transient faults injected into the network interface hardware. These results include a number of errors, such as dropped or corrupt messages, host interface or host resets, and local or remote host interface hangs. The paper presents the study in two parts: First, the results from the SWIFI method in the real system are used as a basis to validate the simulation and identify the major factors leading to differences between the methods. A comparison between the two injection methods shows that they agree for 83 percent of the fault injections. The results, however, vary greatly, depending on the fault type considered. The study also presents an analysis of the effects of varying workload intensity, host platform, and interface function targeted by the injection. An example of this analysis is to show that the function targeted has a significant impact on the fault activation rate. Finally, the study identifies two mechanisms by which faults may propagate from the interface to other parts of the network; in one example, this propagation caused the interface's host computer to reboot, while another caused a remote interface in the network to hang.

The paper presents the rationale for a functional simulation tool, called DEPEND, which provides an integrated design and fault injection environment for system level dependability analysis. The paper discusses the issues and problems of developing such a tool, and describes how DEPEND tackles them. Techniques developed to simulate realistic fault scenarios, reduce simulation time explosion, and handle the large fault model and component domain associated with system level analysis are presented. Examples are used to motivate and illustrate the benefits of this tool. To further illustrate its capabilities, DEPEND is used to simulate the Unix-based Tandem triple-modular-redundancy (TMR) based prototype fault-tolerant system and to evaluate how well it handles near-coincident errors caused by correlated and latent faults. Issues such as memory scrubbing, re-integration policies, and workload dependent repair times, which affect how the system handles near-coincident errors, are also evaluated. Unlike any other simulation-based dependability studies, the accuracy of the simulation model is validated by comparing the results of the simulations with measurements obtained from fault injection experiments conducted on a production Tandem machine.

Real-time applications typically operate under strict timing and dependability constraints. Although traditional data replication protocols provide fault tolerance, real-time guarantees require bounded overhead for managing this redundancy. This paper presents the design and evaluation of a window-consistent primary-backup replication service that provides timely availability of the repository by relaxing the consistency of the replicated data. The service guarantees controlled inconsistency by scheduling update transmissions from the primary to the backup(s); this ensures that client applications interact with a window-consistent repository when a backup must supplant a failed primary. Experiments on our prototype implementation, on a network of Intel-based PCs running RT-Mach, show that the service handles a range of client loads while maintaining bounds on temporal inconsistency.

The size and complexity of modern dependable computing systems has significantly compromised the ability to accurately measure system dependability attributes such as fault coverage and fault latency. Fault injection is one approach for the evaluation of dependability metrics. Unfortunately, fault injection techniques are difficult to apply because the size of the fault set is essentially infinite. Current techniques select faults randomly resulting in many fault injection experiments which do not yield any useful information. This research effort has developed a new deterministic, automated dependability evaluation technique using fault injection. The primary objective of this research effort was the development and implementation of algorithms which generate a fault set which fully exercises the fault detection and fault processing aspects of the system. The theory supporting the developed algorithms is presented first. Next, a conceptual overview of the developed algorithms is followed by the implementation details of the algorithms. The last section of this paper presents experimental results gathered via simulation-based fault injection of an Interlocking Control System (ICS). The end result is a deterministic, automated method for accurately evaluating complex dependable computing systems using fault injection.

In order to analyze dependability measures in a fault tolerant system, we generally consider a nonstate space or a state space type model. A fault tree with repeated events (FTRE's) presents an important strategy for the nonstate space model. The paper deals with a conservative assessment to complex fault tree models, henceforth called CRAFT, to obtain an approximate analysis of the FTRE's. It is a noncutset, direct, bottom-up approach. It uses failure probability or failure rate as input and determines a bound on the probability of occurrence of the TOP event. CRAFT generalizes the concept of a cutting heuristic that obtains the signal probabilities for testability measurement in logic circuits. The method is efficient and solves coherent and noncoherent FTRE's having AND, OR, XOR, and NOT gates. In addition, CRAFT considers M/N priority AND, and two types of functional dependency, namely OR and AND types. Examples such as the Cm* architecture and a fault-tolerant software based on recovery block concept are used to illustrate the approach. The paper also provides a comparison with approaches such as SHARPE, HARP, and FTC. >

A major step toward the development of fault-tolerant computer systems is the validation of the dependability properties of these systems. Fault/error injection has been recognized as a powerful approach to validate the fault tolerance mechanisms of a system and to obtain statistics on parameters such as coverages and latencies. This paper describes the methodology and guidelines for the design of flexible software based fault and error injection and presents a tool, FERRARI, that incorporates the techniques. The techniques used to emulate transient errors and permanent faults in software are described in detail. Experimental results are presented for several error detection techniques, and they demonstrate the effectiveness of the software-based error injection tool in evaluating the dependability properties of complex systems. >

Interval availability is a dependability measure defined by the fraction of time during which a system is operational over a finite observation period. The computation of its distribution allows the user to ensure that the probability that its system will achieve a given availability level is high enough. The system is assumed to be modeled as a Markov process with countable state space. We propose a new algorithm to compute the interval availability distribution. One of its main advantages is that, in some cases, it applies even to infinite state spaces. This is useful, for instance, in case of models taking into account contention with unbounded buffers. This important feature is illustrated on models of multiprocessor systems, subject to breakdowns and repair. When the model is finite, we show through a numerical example that the new technique can perform very well. >

A measurement-based analysis of error data collected from a DEC VAXcluster multicomputer system is presented. Basic system dependability characteristics such as error/failure distributions and hazard rate are obtained for both the individual machine and the entire VAXcluster. Markov reward models are developed to analyze error/failure behavior and to evaluate performance loss due to errors/failures. Correlation analysis is then performed to quantify relationships of error/failures across machines and across time. It is found that shared resources constitute a major reliability bottleneck. It is shown that for measured system, the homogeneous Markov model, which assumes constant failure rates, overestimates the transient reward rate for the short-term operation, and underestimates it for the long-term operation. Correlation analysis shows that errors are highly correlated across machines and across time. The failure correlation coefficient is low. However, its effect on system unavailability is significant. >

The authors describe a dependability evaluation method based on fault injection that establishes the link between the experimental evaluation of the fault tolerance process and the fault occurrence process. The main characteristics of a fault injection test sequence aimed at evaluating the coverage of the fault tolerance process are presented. Emphasis is given to the derivation of experimental measures. The various steps by which the fault occurrence and fault tolerance processes are combined to evaluate dependability measures are identified and their interactions are analyzed. The method is illustrated by an application to the dependability evaluation of the distributed fault-tolerant architecture of the Esprit Delta-4 Project. >

Based on the measurements from two DEC VAX-cluster multicomputer systems, the issue of correlated failures is addressed. In particular, the characteristics of correlated failures, their impact and their modelling on dependability, are discussed. It is found from the data that most correlated failures are related to errors in shared resources and propagate from one machine to another. Comparisons between measurement-based models and analytical models that assume failure independence show that the impact of correlated failures on dependability is significant. Two validated models. the c-dependent model and the p-dependent model, are developed to evaluate the dependability of systems with correlated failures. >

The authors present a unified framework for simulating Markovian models of highly dependable systems. It is shown that a variance reduction technique called importance sampling can be used to speed up the simulation by many orders of magnitude over standard simulation. This technique can be combined very effectively with regenerative simulation to estimate measures such as steady-state availability and mean time to failure. Moveover, it can be combined with conditional Monte Carlo methods to quickly estimate transient measures such as reliability, expected interval availability, and the distribution of interval availability. The authors show the effectiveness of these methods by using them to simulate large dependability models. They discuss how these methods can be implemented in a software package to compute both transient and steady-state measures simultaneously from the same sample run. >

The results of several experiments conducted using the fault-injection-based automated testing (FIAT) system are presented. FIAT is capable of emulating a variety of distributed system architectures, and it provides the capabilities to monitor system behavior and inject faults for the purpose of experimental characterization and validation of a system's dependability. The experiments consists of exhaustively injecting three separate fault types into various locations, encompassing both the code and data portions of memory images, of two distinct applications executed with several different data values and sizes. Fault types are variations of memory bit faults. The results show that there are a limited number of system-level fault manifestations. These manifestations follow a normal distribution for each fault type. Error detection latencies are found to be normally distributed. The methodology can be used to predict the system-level fault responses during the system design stage. >

COMPUTER architecture is a wide active research field that spans all aspects of computer systems design. Dependability the trustworthiness of a computing system which allows reliance to be justifiably placed on the service it delivers has always been a key aspect of computer architecture and has been extensively investigated since the first days of computing. Traditionally, dependable computer architectures are utilized in high-end computing systems or computing systems for critical applications, where continuous, uninterrupted operation is among the most important requirements and systems are characterized by high reliability, availability, and maintainability (wellknown measures to quantify dependability). The time has now come for the wealth of concepts and methodologies in the field of dependable (also known as fault-tolerant) computer architecture that have been proposed during the last several decades, to be adopted and extended in mainstream, general-purpose computing systems. Dependable operation of computing systems is a mandatory requirement in virtually all application fields (at lower or higher costs), due to the increasing reliance of everyday human activities on computers or microprocessor-based systems in general. Unfortunately, this ubiquitous computing revolution comes in hand with hard-tosolve technological issues that are closely related to dependable operation of a computing system. Integrated circuits are implemented today in miniaturized and inherently unreliable technologies that render circuits more vulnerable to both temporary disturbances leading to transient (or soft) errors and to permanent (or hard) errors. Soft errors in silicon-based circuits are caused by alpha particles from integrated circuit package decay or by cosmic rays that create high energy neutrons and protons. Hard errors, on the other side, appear either because of manufacturing defects that escape high-volume production manufacturing testing or because of material aging and wearout mechanisms during the system’s life cycle that are exacerbated by the high clock frequencies of modern circuits. Computing systems are getting constantly more complex (in particular with the recent turn toward multicore processors and high performance memory systems) while on the same time strict time-to-market constraints demand for extremely short design, verification, and validation intervals. The net outcome of all the previous factors is that dependable operation of computing systems in the field should be a first level design consideration in all application domains, obviously at different cost points. This special section of IEEE Transactions on Computers focuses on architectural techniques that enhance dependability of different components of a computing system. A total number of 27 high-quality manuscripts were submitted to the special section from academic and industrial research groups worldwide, and a large set of more than 140 reviews from a strong group of expert reviewers was required to make final decisions. This special section published in the current issue of IEEE Transactions on Computers includes seven of the papers; roughly one fourth of the submitted papers on this topic. The seven papers of the special section on Dependable Computer Architecture cover a wide spectrum of subsystems of mainstream architectures: processors (in particular CMP), cache memories, flash, and disk storage, but also a paper on probabilistic (stochastic) architectures is included. Methodologies are proposed for effective handling of both hard and soft errors and the papers of the special section comprehensively discuss all major tradeoffs between dependability and other design aspects such as performance, cost, yield, energy/power. The first paper entitled “StageNet: A Reconfigurable Fabric for Constructing Dependable CMPs”, by Shantanu Gupta, Shuguang Feng, Amin Ansari, and Scott Mahlke from the University of Michigan, Ann Arbor, opens the special section dealing with tolerance of progressively higher defect densities due to aging in massively parallel chip multiprocessors (CMPs). The authors present StageNet, a reconfigurable CMP architecture that is primarily designed to provide fault tolerance and extend the lifetime of the system which gracefully degrades as the number of permanent faults increases. The subsequent three papers focus on different aspects of cache memories with respect to dependability. The second paper of the special section entitled “Reliability-Driven ECC Allocation for Multiple Bit Error Resilience in Processor Cache”, by Somnath Paul, Fang Cai, Xinmiao Zhang, and Swarup Bhunia, from Case Western Reserve University, discusses a non-uniform, variable ECC allocation scheme to effectively tolerate multiple bit errors in cache memories. The method utilizes post-fabrication characterization information to provide different ECC allocation depending on the relative vulnerability of cache memory blocks. IEEE TRANSACTIONS ON COMPUTERS, VOL. 60, NO. 1, JANUARY 2011 3