Placement of Runtime Checks to Counteract Fault Injections

Bitflips form an increasingly serious problem for the correctness and security of software and hardware, whether they occur inadvertently as soft errors or on purpose as fault injections. Error Detection Codes add redundancy and make it possible to check for faults during runtime, making systems more resilient to bitflips. Codes require data integrity to be checked regularly. Such checks need to be used sparingly, because they cause runtime overhead. In this paper, we show how to use static verification to minimize the number of runtime checks in encoded programs. We focus on loops, because this is where it is important to avoid unnecessary checks. We introduce three types of abstractions to decide correctness: depending on (i) whether we keep track of errors precisely or of their Hamming weights, (ii) how we check whether faults can still be detected, and (iii) whether we keep track of the data or not. We show that checks in loops induce simple and natural loop invariants that we can use to speed up the verification process. The abstractions let us trade verification time against the number of required runtime checks, allowing us to find efficient sets of integrity checks for critical program fragments in reasonable time. Preliminary experimental data shows that we can reduce the number of runtime checks by up to a factor of ten.