When is the Right Time to Inject an Error?

As software (SW) is progressing to play a crucial role in computer systems, its robustness will have a major impact on the system’s overall robustness. Being able to assess and improve SW robustness has been identified as an important field of research. In our research we target robustness evaluation and enhancement of a key component in SW based systems, namely the OS. Many techniques have been developed for this purpose and this paper deals with one of them, namely Fault Injection (FI). In FI the state of a system (memory, registers etc.) is intentionally corrupted and the behavior of the system is observed. Common types of FI include corruptions of memory or control path, corruption of function calls and their parameters. When conducting FI experiments there are many parameters that must be considered properly, such as the error model, the type of injection techniques and the measures that are to be taken. In this paper we focus on another important aspect of FI, namely the instance of injection1. The injection instance clearly plays a major role in the outcome of an experiment. As the state of the system changes over time, different injection instances might lead to injection into different system states. Therefore efforts have been spent on trying to minimize the difference between the states of different injection rounds. The most common approach is to restart the target cleanly before each experiment, e.g., for OSs typically by performing a reboot. Additionally, errors are often injected on first occurrence, i.e., on the first call to a certain function or instruction in the code [1, 2, 3, 5]. This is a reasonable approach to take, as it makes experiments more predictable and repeatable. However, the set of states that can be targeted is only a subset of the total state space, and some states might never be targeted. To get confidence in the experiments, one would like the FI experiment to cover as large part of the system state space as possible. Therefore, we believe that only considering first occurrence is insufficient for achieving high levels of confidence in the results of the experiments. Consequently, this