Recent advancements in the space domain focus on integrating Artificial Intelligence (AI) solutions into safety-critical systems, necessitating highly dependable and interpretable AI due to the unique challenges of the demanding space environment, including stringent reliability requirements, constrained resources, and limited intervention capabilities, which, in turn, require increased transparency, explainability, and trust. This work provides an overview of the traditional challenges associated with deploying AI in space, emphasizing critical applications where elevated levels of trust are essential. We outline the classical requirements for trustworthy AI, linking them to emerging international legislative frameworks that aim to regulate this complex and evolving field. Furthermore, we consider an onboard anomaly detection use case and propose a novel design approach to provide an explainable AI solution. Our approach is intended to enhance the reliability of anomaly detection by leveraging both advanced AI techniques and conventional components of the onboard Fault Detection, Isolation and Recovery (FDIR) subsystem, while not significantly impacting on the required computational resources. Aligned with the principles of fault tolerance and system dependability, this special session aims to foster trust in autonomous AI technologies by promoting the development of high-performing, transparent, and accountable solutions essential for next-generation electronic systems.
Soft errors, typically caused by cosmic rays and particle strikes, have become a reliability challenge of modern electronics in aerospace, automotive, and high-performance computing. In advanced nodes with billions of transistors, a single strike can propagate errors, disrupting critical operations. As a result, traditional methods for estimating Soft Error Rate (SER), such as TCAD simulations and arithmetic formulas, are accurate but have become computationally expensive. In order to alleviate the computational burden, we propose a Model Order Reduction (MOR) approach to analyze charge collection dynamics induced by ionizing particles. More specifically, we start from the physics-based model of the diffusion-collection mechanism, then we discretize the fundamental equations in the 3D space, and formulate the system as a high-dimensional state-space problem. Finally, by applying the Extended Krylov Subspace (EKS) combined with Moment Matching (MM) techniques, we reduce computational overhead while maintaining accuracy. Experimental results demonstrate significant computational speedups while maintaining the accuracy of the full model.
This study examines the vulnerability of modern embedded GPUs—specifically the NVIDIA Jetson Orin NX and Xavier NX System-on-Modules (SoMs)—to Single-Event Effects (SEEs) under heavy ion irradiation. Originally developed for safety-critical environments such as automotive systems, these high-performance SoMs integrate advanced computing capabili-ties with built-in functional safety, positioning them as promising candidates for deployment in radiation-prone domains like space. We assess SEE behavior across various ion energy levels, focusing on the central System-on-Chip (SoC), which includes the CPU, GPU, and peripheral components. Our evaluation covers both the runtime and boot-time phases, providing a comprehensive view of fault susceptibility and its implications for system uptime and reliability in space conditions. The paper presents an in-depth analysis of error signatures observed in both the CPU and GPU due to ion strikes, contrasting these with outcomes from previous proton-based studies. Additionally, we compare the two NVIDIA platforms in terms of SEE types—including Single-Event Latch-up (SEL)—to evaluate their relative robustness and inform their potential adoption in space-grade applications.
In recent years, the increasing interest in space exploration has brought a significant change in the design of avionic systems. The growing complexity required a shift from using only low-performance, space-grade components to more performant Commercial Off-The-Shelf (COTS) components. These systems are, however, more susceptible to radiation-induced effects, and as such, require the engineers to implement advanced techniques of hardening-by-design or by software to increase the tolerance to Single Event Upset induced faults. Traditional scrubbing mechanisms for RAM with ECC encoding operate under the assumption that the entire memory space must be continuously checked for errors. However, this approach proves inefficient for complex space missions with varying mission scenarios, as it unnecessarily consumes resources by checking unused memory regions while potentially allowing errors to accumulate in critical areas. The need for more efficient error mitigation strategies becomes particularly crucial as space missions become more sophisticated and resource-constrained. This work proposes an innovative memory profiling-based scrubbing mechanism leveraging Hardware-Software Co-Design principles. Our approach introduces a specialized scrubber designed around the memory system, which interfaces with a register file accessible as a memory-mapped peripheral. The methodology involves a three-stage process: initial application compilation, memory profiling to determine occupation patterns, and application modification to program the register file with profiling results. This targeted approach ensures that only actively used memory regions are scrubbed, significantly improving efficiency while maintaining robust error protection in critical memory areas. The proposed solution offers a practical balance between system reliability and resource utilization, particularly valuable for modern space missions where optimizing both performance and radiation tolerance is essential.
As digital systems become increasingly integrated into radiation-prone environments, such as aerospace, automotive, and edge computing platforms, their ability to operate reliably under radiation-induced faults is essential. These faults, ranging from transient disruptions to permanent errors, can affect various system layers. In this work, we present an investigation into such challenges, combining simulation-based fault analysis with experimental validation. We introduce a novel methodology for modeling Single Event Transients (SETs) in clock distribution networks, enabling precise evaluation of Flip-Flop (FF) sensitivity. Additionally, a cross-layer framework is introduced to analyze how low-level hardware faults affect inference behavior in Dynamic Neural Networks (DyNNs), highlighting the unique reliability challenges posed by adaptive neural architectures. Finally, we present neutron irradiation results from a soft-core fault-tolerant RISC-V SoC implemented on an SRAM-based FPGA, revealing the critical role of architectural mitigation strategies for Single-Event Upsets (SEUs) and preserving system functionality.
In this paper, we target intermittent computing with dataflow networks. In this context, we propose a memory circuit that mitigates the latency overhead typically incurred when backing up internal states upon power loss and recovery, which could greatly impact processing speed and energy consumption. A novel memory cell design is presented supporting both volatile and non-volatile operating modes at a fine granular level. This memory cell is based on ferroelectric FeMFET technology and integrated into a system-level design flow to synthesize dataflow networks to hardware. We describe the circuit and protocol to backup volatile data into the non-volatile storage upon reception of a shutdown signal and restore the state when asserting a wakeup signal. This hybrid cell is subsequently characterized, and its reliability w.r.t. process variations and operating conditions fluctuations evaluated. Finally, the cell is compared against a scan-chain-based retention technique in terms of power and latency savings, achieving up to 47% in power savings.
This paper presents a circuit solution for a Radiation-Hardening-by-Design (RHBD) Triple Modular Redundancy (TMR) flip-flop (FF) with self-correction (SC). The baseline TMR is enhanced with additional structures to filter transients and consists of modified latch stages that enable self-correction. Moreover, special spacings are introduced at layout-level to maintain the radiation hardness. The internal states of the triplicated flip-flops are compared and potential bit-flips are detected, internally corrected even though the clock activity has stopped. Thus, the proposed cell supports clock gating (CG) and stores the data reliably as discussed and confirmed by transistor-level simulation results. The novel self-correcting RHBD TMR flip-flop is arranged as a compatible standard cell and is optimized for a low overhead in power, area, and delay which is close to the performance of the standard unhardened counterpart. A prototype chip with special self-correcting test registers is fabricated in a 130 nm BiCMOS technology. As radiation experiments have shown, the proposed RHBD TMR flip-flop is robust up to an LET above 52.5 MeV cm2 mg-1.
Graphics processing units (GPUs) are a common choice as the underlying platform to run AI-based tasks in Autonomous Driving (AD) due to their high performance and programmability. However, AI-based tasks in AD often inherit high-integrity requirements, which imposes the use of diverse redundancy in accordance with ISO 26262 functional safety standard for road vehicles. Since commercial G PU s lack explicit support for diverse redundancy, it must be realized by software-only means making redundant tasks use disjoint sets of computing resources. Recently, we have shown avenues to achieve that goal for NVIDIA and Intel GPUs. However, both solutions are fragile since they depend on (i) splitting the work into a specific number of software threads and on (ii) whether the hardware scheduling policy follows a perfect round-robin scheme. In this paper, we provide a software-only solution to enforce redundant kernels to use disjoint computing resources removing the aforementioned constraints, we realize it in an Intel GPU, and show that our solution preserves performance close to that of a pure redundant (with no diversity control) execution scheme.
Functional verification techniques, particularly assertion-based verification, play a critical role in ensuring both correctness and security of modern hardware designs. In this paper, we propose and integrate a spectrum of formal and assertion-driven methods that extend conventional functional verification to address emerging security threats-ranging from stealthy Hardware Trojans (HTs) to adversarial cyber-attacks and cache side-channel exploits. First, we review traditional formal verification approaches such as SAT, BDD, and SCA, and discuss their adaptation to approximate computing and resource-bounded contexts. Next, we present an assertion-driven HT-detection paradigm at RTL, using control-flow graph matching and LTL-based specification mining with a hybrid similarity metric. We then demonstrate three complementary assertion- based methodologies for uncovering hardware secu-rity vulnerabilities: (1) deriving countermeasure assertions from an extracted finite-state machine model of an HT trigger; (2) automatically mining ISA-aware temporal assertions for RISC- V processors to detect embedded Trojans; and (3) mining temporal assertions from vehicle-dynamics traces to detect adversarial cyber attacks in autonomous vehicles. Finally, we propose a formal assertion-generation framework for securing RTL designs against cache side-channel attacks and HT insertions-generating security assertions for both cache memory and RISC-V processor implementations, and validating their efficacy against known CSCAs and Trojan benchmarks. Through these case studies, we demonstrate that assertion-based verifi-cation not only enhances functional correctness guarantees but also provides a high-fidelity, scalable mechanism for detecting and locallzing a diverse range of hardware security threats.
In recent years, the impact of hardware-induced faults on neural networks performing image classification tasks has gained a lot of attention. Specifically, failures have been directly associated with wrong classifications. When it comes to different tasks, this association is less explicit. For example, the critical impact of hardware-induced faults on image segmentation tasks is less interpretable. In this work, we propose a novel technique for detecting critical permanent faults, relying on a dataset profiling phase to extract four metrics. These metrics are designed to assess and monitor the area, position, symmetry, and shape of prediction patterns across the output mask at the pixel level. Validation was performed through a statistical fault injection campaign on Fast-SCNN model trained on Cityscapes. To evaluate the effectiveness of the proposed method, a Faulty Output Dataset (FOD) was developed and employed to compare state-of-the-art (SOTA) metrics, such as Pixel Accuracy (PA) and mean Intersection over Union (mIoU), with the proposed one. The results show a high capability to detect critical faults, with an accuracy greater than 99%, comparable to SOTA methods, but with the advantage that the proposed method does not require a golden mask, increasing its applicability in real-world scenarios.
As Deep Neural Networks (DNNs) are increasingly deployed in safety-critical applications, ensuring their reliability and security is essential. Fault tolerance techniques enhance DNN resilience to hardware-induced errors but may unintentionally introduce new security vulnerabilities by introducing redundancy to systems. This paper addresses a critical question in this regard: Does fault tolerance safeguard DNNs against security threats? In this work, an open-source tool is proposed that applies multiple model-level fault tolerance techniques to mitigate the impact of soft errors in parameters. Then, we apply a state-of-the-art bitflip attack to the hardened DNNs. The results indicate that the hardened DNNs are more resilient to intended bitflips, yet they can fail with a few bitflips. The results suggest that fault tolerance does not guarantee the security of DNNs, and a dedicated security-aware design is necessary along with fault tolerance.
The paper describes a systematic approach for the automatic introduction of data redundancy in a safety-critical application. The transformations aim to make the program capable of detecting potential soft errors caused by transient faults that may alter the program's data. The approach is based on an automated system that leverages the polymorphism features offered by the Rust programming language. Rust is focused on speed, safety, and concurrency, and it also provides powerful high-level abstractions at zero cost. The paper proposes a technique for hardening source code by creating redundant code through an automatic data redundancy system, achieved by defining a trait that enables data duplication and the detection of potential errors. The use of a trait allows the compiler to generate optimized code, without introducing abstraction-related overhead and with minimal programmer effort for boilerplate code generation. Preliminary experimental results are presented, showing the fault coverage achieved by the method, as well as some data related to the performance overhead and the increase in code size.
Detecting latent defects and reducing defective parts per million (DPPM) are crucial for improving semiconductor test quality and reliability. Good Die in Bad Neighborhood (GDBN) identifies and eliminates potentially defective dies, even if they pass standard tests. We propose a multi-modal attention-based framework that uses wafer-level defect visual patterns along with numerical test parametric data to improve GDBN identification. Experiments using the industrial semiconductor wafer dataset WM-811K demonstrate multi-modal fusion with an attention-based model captures more test escapes & a 22 % greater reduction in DPPM compared to existing GDBN methods.
The increasing adoption of Multiprocessor System-on-Chip (MPSoC) architectures in space applications demands highly reliable interconnection solutions resilient to radiation-induced faults. This paper evaluates the reliability of the eXtensible Interconnect Network Architecture (XINA), a fault-tolerant Network-on-Chip (NoC) featuring a robust, AXI-compatible Network Interface (NI), specifically designed to maintain reliable communication under harsh environmental conditions. XINA incorporates Triple Modular Redundancy (TMR) and Hamming Error-Correcting Codes (ECC) to enhance the robustness of both NoC routers and NI components, while remaining fully compatible with standard AMBA AXI IP cores. Using a simulation-based fault injection methodology applied to a large-scale 100-core MPSoC implementation, we quantify the fault tolerance provided by both the NoC and its NI, and analyze their combined impact on performance, area, and power consumption. Four design variants combining different protection levels were evaluated. Results demonstrate the system sustained a peak global throughput of 2.12 Gbps in the unprotected baseline configuration, while the fully protected configuration reduced error occurrences at the cost of increased resource utilization and reduced operating frequency.
This work analyses the robustness of the recent AMD RISC-V processor: MicroBlaze-V. We study the TMR fault tolerant version of the MicroBlaze-V architecture, implemented in an SRAM-based FPGA. The architecture has been evaluated with fault injection and irradiation campaigns using 15 and 230 MeV proton beams. Experimental results show that AMD TMR MicroBlaze-V architecture offers a fast and flexible design process with good error mitigation of faults in the configuration memory. The results obtained show a good correlation between fault injection and proton irradiation campaigns, which may be used for error-rate estimations and precise error mitigation strategies. Overall, AMD TMR MicroBlaze-V has an error detection rate of around 99.84%. Approximately 1% of failures are not warned beforehand, although experimental data show that these errors are related to the memory, which is triplicated. It is calculated that, under the evaluated conditions, the mean time for a system failure is twice the mean time for a non-fatal error to happen. The cross-section is estimated to be 47 and 65 times better for failures with a previous warning compared to failures without warning in experiments with protons of 15 MeV and 230 MeV respectively.
Computing-in-memory (CIM) has gained immense traction owing to the benefits it provides in power, performance, and area. CIM can be done on a large variety of memory elements like SRAM, DRAM, RRAM, etc. In this work, we focus on the techniques using RRAM for the computations. First, we explain the stateful and non-stateful techniques to perform Logic-in-Memory (Li$M$) operations using RRAM crossbars. We discuss the methods that are used to guarantee the correctness of the mapping/micro-operations obtained from mapping tools like SIMPLE-MAGIC. Second, we discuss the flow-based computing techniques that alleviate the write operations when performing the Li$M$ operations and use the sneak-path currents to perform the computations. We discuss the formal verification strategies developed to guarantee the correctness of the logic operations using flow-based computing. Lastly, we discuss the techniques that have been developed to enable reliable computations using RRAM devices even in the presence of variations, such as error suppression and error reduction techniques. Finally, we explain a technique employing basis vectors to reduce the necessity to reprogram RRAM-based crossbars.
This paper introduces the concept of functional synchronization for the application where online testing is carried out by output comparison of identical logic blocks. Online testing by output comparison can be carried out when one logic block, $B_{0}$, participates in functional operation, and another identical one, $B_{1}$, is idle. After synchronizing $B_{1}$ to the state of $B_{0}$, the two logic blocks receive the same input sequences, and their output sequences are expected to be the same. An earlier synchronization process uses one or more periods where $B_{1}$ receives the input sequence of $B_{0}$, and values of selected state variables are copied from $B_{0}$ to $B_{1}$ to aid in synchronization. Functional synchronization removes the overheads of copying values of state variables from $B_{0}$ to $B_{1}$. Functional synchronization refers to synchronization that occurs during functional operation by input subsequences of limited lengths that determine the state of a logic block independent of its state at the beginning of the subsequence. The paper develops the concept of functional synchronization in an academic simulation environment and studies the amenability of benchmark circuits to functional synchronization.
The continuous drive toward the miniaturization of Integrated Circuits (ICs) is pushing the physical boundaries of device scaling. As transistor gate and interconnect dimensions shrink, several challenges emerge, including increased power density, thermal dissipation constraints, and quantum effects. Among these, electromigration—caused by the momentum transfer from high current densities to atoms—results in the displacement of material within interconnects, potentially leading to unintended open circuits or shorts. Similarly, manufacturing defects, environmental stresses, and aging effects further exacerbate these reliability issues, often manifesting as permanent faults, such as logic stuck-at-0 or stuck-at-1 conditions. To address these issues, Design-for-Test (DFT) infrastructure and Software-Based Self-Test (SBST) have been developed. While DFT is expensive in terms of area and performance, SBST is a cost-effective alternative that uses processor resources to test the chip. However, generating efficient test patterns with high fault coverage remains a challenge. In this paper, we propose a technique for optimizing testing software for SBST targeted towards specific components with uniform structures such as a RISC-V Register File. The method requires knowledge of the component structure and function, and uses fault simulation to verify fault coverage. The method achieved a fault coverage of 99% of functionally testable faults in the Register File.
Circuits implemented with micro- and nano-electromechanical (MEMINEM) relays have the benefit of being capable of operating in environments with high temperature as well as high radiation levels. However, due to potential defects in the NEM relays, circuits using this technology exhibit poor reliability. To address this issue, design techniques that incor-porate hardware redundancy are often implemented to improve reliability. A simple and well-established design technique in the domain of hardware redundancy is Triple Modular Redundancy (TMR). Systems with TMR perform a voting process on the outputs of replicated modules using a voting circuit. These voting circuits are usually unreliable because they are also susceptible to physical defects. Therefore, various voter designs have been proposed to increase the reliability of the voting circuit. However, conventional voter designs often fail when provided with inputs at undefined logic levels or significantly increase hardware overhead due to their high device count. This paper proposes a novel voter design utilizing NEM technology, leveraging the functionalities of NEM-based relays. Besides tolerating single faulty inputs, the voter can also handle single inputs at an undefined logic level. Experimental results based on digital simulations show that the proposed voter achieves a 72 % reduction in device count compared to the best-performing conventional voter design investigated, while maintaining a similar level of fault tolerance.
As embedded systems are increasingly deployed in safety-critical and harsh environments, ensuring their reliability in the presence of soft errors such as Single Event Upsets has become essential. While Software-Implemented Hardware Fault Tolerance (SIHFT) techniques provide a flexible solution for error detection and correction, they often incur significant overhead in code size and execution time. This paper investigates a hardware-assisted approach to mitigate these drawbacks by leveraging the extensibility of the open-source RISC- V instruction set architecture. We present a proof-of-concept RISC- V extension, Xpdetector, which introduces custom instructions and hardware support to implement the P-DETECTOR SIHFT technique. The extension includes four new instructions, two special-purpose registers, and a duplicated register file to enable efficient re- execution-based control-flow and data-flow protection. The Im-peras simulator results show that the Xpdetector-enhanced core achieves comparable fault detection capabilities to the baseline RISC- V while significantly reducing execution time and code size overhead. These findings suggest that custom RISC- V extensions offer a promising path toward efficient and reliable embedded system design.
