  Fail-operational systems are a prerequisite for autonomous driving. Without a
driver who can act as a fallback solution in a critical failure scenario, the
system has to be able to mitigate failures on its own and keep critical
applications operational. To reduce redundancy cost, graceful degradation can
be applied by repurposing hardware resources at run-time. Critical applications
can be kept operational by starting passive backups and shutting down
non-critical applications instead to make sufficient resources available. In
order to design such systems efficiently, the degradation effects on
reliability and cost savings have to be analyzed. In this paper we present our
approach to formally analyze the impact of graceful degradation on the
reliability of critical and non-critical applications. We then quantify the
effect of graceful degradation on the reliability of both critical and
non-critical applications in distributed automotive systems and compare the
achieved cost reduction with conventional redundancy approaches. In our
experiments redundancy overhead could be reduced by 80% compared to active
redundancy in a scenario with a balanced mix of critical and non-critical
applications using our graceful degradation approach Overall, we present a
detailed reliability and cost analysis of graceful degradation in distributed
automotive systems. Our findings confirm that using graceful degradation can
tremendously reduce cost compared to conventional redundancy approaches with no
negative impact on the redundancy of critical applications if a reliability
reduction of non-critical applications can be accepted. Our results show that a
trade-off between the impact of the degradation on the reliability of
non-critical applications and cost reduction has to be made.
