Kevin R. Driscoll

Byzantine Fault Tolerance, from Theory to Reality

Since its introduction nearly 20 years ago, the Byzantine Generals Problem has been the subject of many papers having the scrutiny of the fault tolerance community. Numerous Byzantine tolerant algorithms and architectures have been proposed. However, this problem is not yet sufficiently understood by those who design, build, and maintain systems with high dependability requirements. Today, there are still many misconceptions relating to Byzantine failure, what makes a system vulnerable, and indeed the very nature and reality of Byzantine faults. This paper revisits the Byzantine problem from a practitioners perspective. It has the intention to provide the reader with a working appreciation of the Byzantine failure from a practical as well as a theoretical perspective. A discussion of typical failure properties and the difficulties in preventing the associated failure propagation is presented. These are illustrated with real Byzantine failure observations. Finally, various architectural solutions to the Byzantine problem are presented.

Coverage and the use of cyclic redundancy codes in ultra-dependable systems

A cyclic redundancy code (CRC), when used properly, can be an effective and relatively inexpensive method to detect data corruption across communication channels. However, some systems use CRCs in ways that violate common assumptions made in analyzing CRC effectiveness, resulting in an overly optimistic prediction of system dependability. CRCs detect errors with some finite probability, which depends on factors including the strength of the particular code used, the bit-error rate, and the message length being checked. Common assumptions also include a passive network inter-stage, explicit data words, memoryless channels, and random independent symbol errors. In this paper we identify some examples of CRC usage that compromise ultra-dependable system design goals, and recommend alternate ways to improve system dependability via architectural approaches rather than error detection coding approaches.

The Airplane Information Management System: an integrated real-time flight-deck control system

Honeywell is completing design and will build hardware for the new Boeing 777 integrated Airplane Information Management System (AIMS). AIMS functions have time constraints from hard real-time to non-real-time, and criticality levels from flight critical to nonessential. The challenge is that these functions share time, memory, and input/output (I/O) on a redundant, distributed multiprocessor. An innovative offline scheduling tool and table driven bus protocol control data transfers and Ada process synchronization with verifiable resource allocation, latency control, and performance.<<ETX>>

Gigabit switch using free-space and parallel optical data links for a PCI-based workstation cluster

Communication requirements in high-performance, parallel computing systems continue to increase as the processing nodes within these systems gain processing capability. To support these growing communication requirements, system architecture changes are needed. The use of switched networks rather than bus-based systems and the incorporation of optical interconnects are among proposed solutions to increase overall system performance. Under the VIVACE program, we combine both of these approaches to demonstrate a switched network of 12-Gb/s raw data bandwidth using a 4 Tbit/s bisection bandwidth free-space optically interconnected (FSOI) switch. The optical-interconnect based VIVACE network is accessed by compute nodes through the use of an electrical network interface card (NIC) which provides custom VIVACE protocol conversion in addition to the necessary electrical and optical conversions.

High-speed free-space scalable switching network for parallel computing

The system architecture and the first prototype demonstrator system for the VCSEL-based Interconnects in VLSI Architectures for Computational Enhancement (VIVACE) program is described. The main goal of the VIVACE program is to build a high bi-section bandwidth free-space optically interconnected switch and to demonstrate it in a system of multiple compute nodes running a distributed algorithm. The prototype demonstrator system developed is a stand alone first-generation VIVACE Optical Network Interface Card (VONIC) communicating to another VONIC through a parallel- data fiber link. This system was developed to test the signal integrity and Bit Error Rate between two VONICs.

Gigabit optical network interface card using parallel data fiber link for a free-space switched local area network system

We introduce a distributed parallel system, developed under VIVACE program which consists of eight host nodes connected through free-space optically interconnected (FSOI) switch with Terabit bi-section bandwidth. A PCI-based VIVACE optical network interface card (VONIC) with 12Gbps parallel data fiber link is the interface between the host and the FSOI switch. This paper describes the second generation VONIC and related testing results. At the center of the VIVACE system is a switch multi chip-module (MCM) consisting of sixteen CMOS ASICs integrated with two-dimensional GaAs VCSEL and photodetector arrays that are linked via free space using an opto-mechanical system.

Design of a multigigabit optical network interface card

High-speed optical data links enable local area networks (LANs) that operate at data rates above 10 Gb/s. Various network, protocol and switch architectures have been proposed that use these links. The optical network interface card (ONIC) is an important component for demonstrating efficient application of these architectures. In this paper, we describe the design of a programmable ONIC that interfaces a 12-channel gigabit parallel optical link module with a 64-bit/66-MHz PCI computer bus. Hardware programmability (using FPGAs) enables the ONIC to efficiently implement different communication protocols. For hardware testing, the ONIC hardware was programmed for bit error rate (BER) analysis. In continuous operation at 8 Gb/s for 30 days through a 1-m fiber, no errors occured. For application testing, a custom ONIC software driver was developed. We used this driver to demonstrate message passing between applications running on two ONIC-equipped servers. The ONIC design provides a low-cost solution that can be readily adapted for application and device specific requirements. The use of ONIC in a free-space optical switch system is described here.

Verification and validation of flight critical systems (VVFCS)

• NASA is sponsoring a multiple-area multi-year program for verification and validation of flight critical systems. • Objective — Provide advanced analytical, architectural, and testing capabilities to enable sound assurance of safety-critical properties

Maximizing fault tolerance in a low-s WaP data network

The BRAIN (Braided Ring Availability/Integrity Network) is a radically different type of data network technology that uses a combination of a braided ring topology and high-integrity message propagation mechanisms. The BRAIN was originally designed to tolerate two passive failures or one passive and one active failure (including a Byzantine failure). In recent developments, the BRAINs fault tolerance has been increased to the level where it can tolerate two active failures (including two Byzantine failures), as long as the two failures are not colluding. A colluding failure is an active failure that supports one or more other active failures to cause a system failure. To be effective, these active failures must be syntactically correct - i.e., cannot be detected by inline error detection, such as CRCs, checksums, physical encoding (e.g. 8B/10B), protocol rules, or reasonableness checks. The probability of colluding failures happening is so low that this new BRAIN, for all practical purposes, is a two-fault tolerant network. This improvement in fault tolerance comes at no additional cost. That is, it uses exactly the same minimal amount of hardware as the original BRAIN. As an example comparison, this new version of the BRAIN requires less size, weight, and power (SWaP) than a typical two-channel AFDX network, while tolerating more faults and more types of faults. The nodes used by the BRAIN, are simplex (they require no redundancy in themselves for integrity) and the fault tolerance provided by the BRAIN can be made transparent to all application software. The BRAIN can check that redundant nodes (e.g. pair-wise adjacent nodes) produce bit-for-bit identical outputs, without resorting to clock-step self-checking pair processing that is rapidly becoming technologically infeasible due to the higher speeds of modern processors. The BRAIN also simplifies the creation of architectures with dissimilar redundancy. The design of these BRAIN improvements were guided by the use of the Symbolic Analysis Laboratory (SAL) model-checker in a novel use of formal methods for exploratory development early in the design cycle of a new protocol.

Cyber safety and security for reduced crew operations (RCO)

Presents a collection of slides covering the following topics: aircraft safety; reduced crew operations; aircraft data communications; ground communications; and cryptography.