Exploiting the Background Debugging Mode in a Fault Injection system

This note1 describes a software-implemented Fault Injection system (Fig. 1) suited to be used with embedded microprocessor-based boards and based on some features available in the most recent microprocessors and microcontrollers. Although these features were originally introduced to easy code development and debugging, they are very well suited for supporting the implementation of efficient and barely intrusive Fault Injection Systems. In particular, our Fault Injection system exploits the Background Debugging Mode (BDM) [1], available in the last microprocessors and microcontrollers produced by Motorola. During the fault injection experiment, the application program is executed in debugging mode and BDM is in charge of resetting the system, downloading the application target program, executing the fault injection, and triggering possible time-out conditions. The tool is able to inject faults both in the memory image of the process (data and code) and in the internal registers of the processor. The adopted fault model is the single bit-flip transient fault, but the approach can be easily extended to different fault models such as permanent stuck-at, transient bridging, multiple bit-flip. Faults are injected at the assembly level. This means that the system inject every fault between one instruction and another, and it is not possible to inject a fault during the execution cycle of a single assembly instruction. The fault injection is controlled by the host processor, which sets a breakpoint in correspondence of a specified instruction; at the n-th execution of the specified instruction, the fault is injected by means of a debugging command that modifies a memory location or a user register. We developed a case study based on the LA-7902 tool by Lauterbach GmbH, which interfaces a host computer with a target board based on a MC68332 microcontroller. The behavior of such a board in presence of faults is evaluated using a prototypical implementation of our fault injection system.