Transient Fault Injection Research Articles

Lightning: Leveraging DVFS-induced Transient Fault Injection to Attack Deep Learning Accelerator of GPUs

Graphics Processing Units (GPU) are widely used as deep learning accelerators because of its high performance and low power consumption. Additionally, it remains secure against hardware-induced transient fault injection attacks, a classic type of attacks that have been developed on other computing platforms. In this work, we demonstrate that well-trained machine learning models are robust against hardware fault injection attacks when the faults are generated randomly. However, we discover that these models have components, which we refer to as sensitive targets, that are vulnerable to faults. By exploiting this vulnerability, we propose the Lightning attack, which precisely strikes the model’s sensitive targets with hardware-induced transient faults based on the Dynamic Voltage and Frequency Scaling (DVFS). We design a sensitive targets search algorithm to find the most critical processing units of Deep Neural Network (DNN) models determining the inference results, and develop a genetic algorithm to automatically optimize the attack parameters for DVFS to induce faults. Experiments on three commodity Nvidia GPUs for four widely-used DNN models show that the proposed Lightning attack can reduce the inference accuracy by 69.1% on average for non-targeted attacks, and, more interestingly, achieve a success rate of 67.9% for targeted attacks.

TFI-FTS: An efficient transient fault injection and fault-tolerant system for asynchronous circuits on FPGA platform

Designing VLSI digital circuits is challenging tasks because of testing the circuits concerning design time. The reliability and productivity of digital integrated circuits are primarily affected by the defects in the manufacturing process or systems. If the defects are more in the systems, which leads the fault in the systems. The fault tolerant systems are necessary to overcome the faults in the VLSI digital circuits. In this research article, an asynchronous circuits based an effective transient fault injection (TFI) and fault tolerant system (FTS) are modelled. The TFI system generates the faults based on BMA based LFSR with faulty logic insertion and one hot encoded register. The BMA based LFSR reduces the hardware complexity with less power consumption on-chip than standard LFSR method. The FTS uses triple mode redundancy (TMR) based majority voter logic (MVL) to tolerant the faults for asynchronous circuits. The benchmarked 74X-series circuits are considered as an asynchronous circuit for TMR logic. The TFI-FTS module is modeled using Verilog-HDL on Xilinx-ISE and synthesized on hardware platform. The Performance parameters are tabulated for TFI-FTS based asynchronous circuits. The performance of TFI-FTS Module is analyzed with 100% fault coverage. The fault coverage is validated using functional simulation of each asynchronous circuit with fault injection in TFI-FTS Module.

FERNANDO: A Software Transient Fault Tolerance Approach for Embedded Systems Based on Redundant Multi-Threading

As semiconductor technology scales, modern microprocessors are more vulnerable to transient faults. Software-level fault tolerance schemes are promising because they can improve reliability effectively without extra hardware. Redundant Multi-threading (RMT) uses off-the-shelf cores as redundancy to achieve error resilience. Latest software RMT fault-tolerance models do not effectively cope with transient faults occurring on multiple components during the application execution, resulting in a large number of silent data corruptions (SDC). To address this challenge, we propose FERNANDO, a software-level RMT runtime fault tolerance scheme which provides enhanced error detection and comprehensive error recovery by Triple-Modular Redundancy (TMR). On an ARM Cortex-A57 like simulated microprocessor, we performed probability model transient fault injection experiments in different components of all cores. The results demonstrate that, compared to the state-of-the-art technique, FERNANDO can reduce the SDC rate by about 86.67 percent and optimize the execution time overhead by about 19.64 percent.

Performance Analysis of Transient Fault-Injection and Fault-Tolerant System for Digital Circuits on FPGA

A Fault-Tolerant System is necessary to improve the reliability of digital circuits with the presence of Fault Injection and also improves the system performance with better Fault Coverage. In this work, an efficient Transient Fault-Injection system (FIS) and Fault-Tolerant System (FTS) are designed for digital circuits. The FIS includes Berlekamp Massey Algorithm (BMA) based LFSRs, with fault logic followed by one – hot-encoder register, which generates the faults. The FTS is designed using Triple-Modular-Redundancy (TMR) and Dual Modular- Redundancy (DMR). The TMR module is designed using the Majority Voter Logic (MVL), and DMR is designed using Self-Voter Logic (SVL) for digital circuits such as synchronous and asynchronous circuits. The four different MVL approaches are designed in the TMR module for digital circuits. The FIS-FTS module is designed on Xilinx-ISE 14.7 environment and implemented on Artix-7 FPGA. The synthesis results include chip area, gate count, delay, and power are analyzed along with fault tolerance, and coverage for given digital circuits. The fault tolerance is analyzed using Modelsim-simulator. The FIS-FTS module covers an average of 99.17% fault coverage for both synchronous and asynchronous circuits.

Evaluation of transient errors in GPGPUs for safety critical applications: An effective simulation-based fault injection environment

General Purpose Graphics Processing Units (GPGPUs) are increasingly adopted thanks to their high computational capabilities. GPGPUs are preferable to CPUs for a large range of computationally intensive applications, not necessarily related to computer graphics. Within the high performance computing context, GPGPUs must require a large amount of resources and have plenty execution units. GPGPUs are becoming attractive for safety-critical applications where the phenomenon of transient errors is a major concern. In this paper we propose a novel transient error fault injection simulation methodology for the accurate simulation of GPGPUs applications during the occurrence of transient errors. The developed environment allows to inject transient errors within all the memory area of GPGPUs and into not user-accessible resources such as in streaming processors combinational logic and sequential elements. The capability of the fault injection simulation platform has been evaluated testing three benchmark applications including mitigation approaches such as Duplication With Comparison, Triple Modular Redundancy and Algorithm Based Fault Tolerance. The amount of computational costs and time measured is minimal thus enabling the usage of the developed approach for effective transient errors evaluation.

Emulation-based fault analysis on RFID tags for robustness and security evaluation

This paper presents an FPGA (field-programmable gate array) based fault emulation system for analysis of fault impact on security and robustness of RFID (radio frequency identification) tags. This emulation system that deals with any RFID protocol consists of two tag-reader pairs, a fault injection module and an emulation controller all implemented in a single FPGA. The designed approach performs single event upset (SEU) and single event transient (SET) fault injection and permits with high flexibility to set communication scenarios and related parameters. Moreover, we propose a classification of produced errors to evaluate fault impacts and identify most sensitive tag flip-flops causing large number of failures and security concerns. The proposed fault injection approach provides suitable means to increase tags' security and robustness. In our experimentation campaign, an ultra-high frequency (UHF) tag architecture has been exposed to intensive SEU and SET fault injections. The duration of the campaign including results analysis is 30min in where 6,215,316 faults are experimented. Our results have shown that the tag has tolerated 61.82% of SEUs and 67.83% of SETs. The flip-flops that constitute the tag FSM (finite state machine) have been identified as the most sensitive parts causing large number of failures.

A Low-Cost, Radiation-Hardened Method for Pipeline Protection in Microprocessors

The aggressive scaling of semiconductor technology has significantly increased the radiation-induced soft-error rate in modern microprocessors. Meanwhile, due to the increasing complexity of modern processor pipelines and the limited error-tolerance capabilities that previous radiation hardening techniques can provide, the existing pipeline protection mechanisms cannot achieve complete protection. This paper proposes a complete and cost-effective pipeline protection mechanism using a self-checking architecture. The radiation-hardened pipeline is achieved by incorporating soft-error- and timing-error-tolerant flip-flop (SETTOFF)-based self-checking cells into the sequential cells of the pipeline. A replay recovery mechanism is also developed at the architectural level to recover the detected errors. The proposed pipeline protection technique is implemented in an OpenRISC microprocessor in a 65-nm technology. A gate-level transient fault-injection and analysis technique is used to evaluate the error-tolerance capability of the proposed hardened pipeline design. The results show that compared with the techniques such as triple modular redundancy, the SETTOFF-based self-checking technique requires over 30% less area and 80% less power overheads. Meanwhile, the error-tolerant and self-checking capabilities of the register allow the proposed pipeline protection technique to provide a noticeably higher level of reliability for different parts of the pipeline compared with the previous pipeline protection techniques.

Forecasting the Effects of Electromagnetic Fault Injections on Embedded Cryptosystems

ABSTRACTThis work deals with the electromagnetic pulses (EMP) injection of transient faults into embedded cryptosystems. The purpose of this study is to deepen the understanding of the interaction of an electromagnetic (EM) field and a logic circuit (ASIC or FPGA). In this direction, a sign-off power analysis and a voltage (IR) drop analysis can be useful to localize possible circuit weaknesses and identify the most vulnerable regions to EMP attacks. The preliminary results of a sign-off power analysis conducted on a real circuit are provided and discussed. The long-term objective is the development of a model able to predict the effects of an EMP on a cryptosystem.

A New Recovery Scheme Against Short-to-Long Duration Transient Faults in Combinational Logic

This paper presents a new recovery scheme for dealing with short-to-long duration transient faults in combinational logic. The new scheme takes earlier into account results of concurrent error detection (CED) mechanisms, and then it is able to perform shorter recovery latencies than existing similar strategy. The proposed scheme also requires less memory resources to save input contexts of combinational logic blocks. In addition, this work also proposes a taxonomy of CED techniques. It allows pointing out which are the necessary recovery resources as well as identifying which are the types of CED mechanisms that can be used with the new recovery scheme of this paper. The effectiveness of the proposed scheme was evaluated through electrical-level simulations. For all short-to-long duration transient-fault injections, it was never slower than state-of-art similar strategy, and indeed its recovery latency was faster for 34 % of the simulated faulty scenarios.

Rapid transient fault insertion in large digital systems

This paper presents a technique for rapid transient fault injection, regarding the CPU time, to perform simulation-based fault-injection in complex System-on-Chip Systems (SoCs). The proposed approach can be applied to complex circuits, as it is not required to modify the top-level modules of a design; moreover, it is capable to inject a wide range of fault models in a design and finally a competitive reduction in terms of CPU time will be achieved. The root of our method is based on the usage of simulator-commands along with partial code modification techniques. To prove the efficiency of the proposed method, it has been implemented on two case studies, a pre-synthesized netlist of an AVR microcontroller from ATMEL and a post placed-and-routed Verilog netlist of a high performance reconfigurable processor in 90-nm UMC technology, Xentium processor from Recore Systems. Experimental results show that our technique is able to reduce the CPU time by a factor ranging from 27% to 67% compared with typical simulation-based fault-injection approaches and by a factor of 10% compared with rapid simulation-based techniques.

Transient and Permanent Fault Injection in VHDL Description of Digital Circuits

The ability to evaluate the testability of digital circuits before they are actually implemented is critical for designing highly reliable systems. This feature enables designers to verify the fault detection capability of online as well as offline testable digital circuits for both permanent and transient faults, during the design stage of the circuits. This paper presents a technique for transient and permanent fault injection at the VHDL level description of both combinational and sequential digital circuits. Access to all VHDL blocks a system is straight forward using a specially designed single fault injection block. This capability of inserting transient and permanent faults should help in evaluating the testability of a digital system before it is actually implemented.

Designing fault-tolerant network-on-chip router architecture

In this article, a fault-tolerant network-on-chip (NoC) router architecture is introduced. This article reports a comprehensive fault study of a NoC router through a simulation-based method. The evaluation of single-event transient (SET), crosstalk and single-event upset (SEU) fault injections shows that up to 53% of the injected faults cause a system failure. About 45% of them are replaced by new values before turning into errors and almost 1% of them are treated as latent errors. According to the experimental results, routing units and switch components are known as the two most unstable elements with regard to transient injected faults, with failure rates of 60% and 55%, respectively. Moreover, the effects of SETs are greater in all components. The SEUs also have a tangible effect on the functionality of the routing unit. Using column parity row selection method as an SEU-tolerant one in the routing unit and an innovative SET-crosstalk-tolerant technique in the switch components has mitigated the total failure rate down to 38%. The synthesis of fault-tolerant architecture requires almost 22% more area than the non-tolerant architecture. The proposed fault-tolerant method consumes almost 27% less dynamic power than a Hamming triple modular redundancy method.

Classification of Activated Faults in the FlexRay-Based Networks

FlexRay communication protocol is expected to become the de-facto standard for distributed safety-critical systems. This paper classifies the effects of transient single bit-flip fault injections into the FlexRay communication controller. In this protocol, when an injected fault is activated, this may result in one or more error types, i.e.: Boundary violation, Conflict, Content, Freeze, Synchronization, Syntax, and Invalid frame. To study the activated faults, a FlexRay bus network, composed of four nodes, was modeled by Verilog HDL; and a total of 135,600 transient faults was injected in only one node, called the target node. The results show that only 9,342 of the faults (about 6.9%) were activated and their effects were observed in the network nodes. The results also show that the Synchronization error is the widespread error with the occurrence rate of 70.1%. The Invalid frame, Boundary violation, Syntax, Content, Freeze, and Conflict errors have the occurrence rates of 51.1%, 32.4%, 24.6%, 20.6%, 17.3%, and 0.0%, respectively. Among the error types, the Freeze errors are the most critical errors as they mostly result in system failures. The results also show that most of the activated faults, about 75.3%, were observed simultaneously in the target node and a neighbor node. About 11.1% of the activated faults were observed only in the target node and about 13.5% only in the neighbor node.

A Case Study on Phase-Locked Loop Automatic Layout Generation and Transient Fault Injection Analysis

This paper reports a case study on the automatic layout generation and transient fault injection analysis of a Phase-Locked Loop (PLL). A script methodology was used to generate the layout based on transistor level specifications. Experiences were performed in the PLL in order to evaluate the sensibility against transient faults. The circuit was generated using the STMicroelectronics HCMOS8D process (0.18 μm). Results reveal the PLL sensitive points allowing the study and development of techniques to protect this circuit against transient faults.

Time-Resolved Scanning of Integrated Circuits With a Pulsed Laser: Application to Transient Fault Injection in an ADC

This paper presents an experimental system for integrated circuit testing with a pulsed laser beam. The system is fully automated and simultaneously provides interesting spatial and temporal resolutions for various applications like fault injection, radiation sensitivity evaluation, or default localization. In the presented application, the system is used to visualize signal propagation in an 8-bit half-flash analog-to-digital converter.

Multi-Level Fault Injections in VHDL Descriptions: Alternative Approaches and Experiments

The probability of transient faults increases with the evolution of technologies. There is a corresponding increased demand for an early analysis of erroneous behaviours. This paper discusses alternative approaches to perform transient fault injection in circuits described in a high level language such as VHDL. In the proposed analysis flow, a behavioural model is generated, allowing the designer to identify the detailed error propagation paths in the circuit. This paper also reports on results obtained with SEU-like fault injections in VHDL descriptions of digital circuits. Several circuit description levels are considered, as well as several fault modelling levels. These results show that an analysis performed at a very early stage in the design process can actually give a helpful insight into the response of a circuit when a fault occurs.

Evaluating processor-behavior and three error-detection mechanisms using physical fault-injection

An approach for assessing the impact of physical injection of transient faults on processor execution is described and evaluated. The fault injection is based on two complementary methods using: (1) heavy-ion radiation; and (2) power supply disturbances. 12000 transient faults were injected into the target microprocessor, a Motorola MC6809E 8-bit CPU, running 3 different workloads. In the evaluation, the control-flow errors were distinguished from those that had no effect on the correct flow of control. The errors that led to wrong results are separated from those that did not affect the correct results. The errors that affected neither the correct control flow nor the correct results are specified. Effects of errors on the registers and signals of the processor are characterized, Workload dependency on error rates is demonstrated. Three error-detection mechanisms, (2 software-based mechanisms and 1 watchdog timer) were combined and used to characterize the detected and undetected errors. More than 87% of all errors and 93% of the control-flow errors could be detected. In a different test, the efficiency of an isolated watchdog timer was evaluated. The coverage of the isolated watchdog timer was only 62%. The results indicate that fault-injection methods, workloads, and programming languages all differently affect the control flow, coverage, latency, and error rates. >