PaperlayerView exact revision on arXiv

Source-linked AI summary

From Routing Delay Shifts to Silent Data Corruption: Neutron-Induced SEU Effects in AXI-Based Zynq UltraScale+ MPSoCs

Mostafa Darvishi

arXiv:2609.30538v1eess.SYcs.ARcs.ETcs.SYphysics.acc-phphysics.space-ph

TL;DR

Prior work had not experimentally established whether routing-delay shifts and AXI failures are linked under neutron irradiation. This study combines routing sensors, AXI monitoring, neutron exposure, and frame-level fault injection on ZCU104; neutron exposure produced measurable delay events, some temporally associated with AXI failures including silent corruption.

  • Problem

    The cross-layer link between routing-delay shifts and AXI failure manifestations under neutron irradiation on a modern MPSoC remains experimentally unvalidated.

    Source: §II · p. 3

  • Method

    The study combines routing-delay sensors, AXI transaction monitoring, frame-aware fault injection, and neutron irradiation on a fully operational ZCU104-based system.

    Source: §VII · p. 22

  • Results

    Neutron exposure produced measurable routing-delay events, some temporally associated with AXI failures; SDC events completed without explicit protocol errors while returning incorrect data.

    Source: §VII · p. 22

  • Takeaways & Limitations

    The findings suggest that AXI-based FPGA mitigation should consider routing isolation, frame-aware monitoring, transaction replay, and golden-reference detection of silent corruption.

    Source: §VII · p. 22

    The conclusions apply most directly to designs with similar shared AXI structures, routing-resource concentration, and configuration-memory organization.

    Source: D. Scope and Limitations · p. 21

Abstract

from arXiv · show

SRAM-based FPGA system-on-chip devices are vulnerable to single-event upsets (SEUs) in configuration memory, which may perturb programmable routing resources and degrade communication fabrics. In modern Zynq UltraScale+ MPSoCs, such routing disturbances can introduce small propagation delay shifts that remain logically transparent yet compromise AXI-based data transfers and lead to silent data corruption. Although routing delay degradation and AXI interconnect failures have been studied independently, their experimental correlation under neutron irradiation has not been established. This work presents a cross-layer investigation on a ZCU104 platform integrating routing-dominated delay sensors with an AXI interconnect benchmark comprising replicated accelerators. Neutron irradiation experiments were conducted on the fully operational system, while a frame-level configuration fault injector implemented via the internal configuration access port enables controlled upset emulation. Measured routing delay events are statistically correlated with communication failures, and cross-sections for both timing shifts and AXI malfunctions are derived. The results experimentally demonstrate how neutron-induced routing perturbations propagate into system-level silent data corruption in UltraScale+ MPSoCs, providing insight for resilience-oriented AXI-based design in neutron-rich environments.

I. INTRODUCTION

The paper addresses the untested relationship between routing-delay shifts and AXI failures under neutron irradiation. It combines timing observability, AXI monitoring, neutron exposure, and controlled fault injection to investigate that cross-layer link.

II. BACKGROUND AND RELATED WORKS

  • The unresolved gap is whether routing-delay shifts are experimentally linked to AXI failures under neutron irradiation in a fully operational SoC.Prior timing studies did not connect delay degradation to communication failures, while AXI fault-injection studies lacked particle-beam exposure and concurrent timing observability.Source: §I · pp. 1–2, §II · p. 3

I. INTRODUCTION

  • The study combines routing-dominated delay sensors and a replicated-accelerator AXI benchmark on ZCU104 with neutron irradiation and ICAP-based frame-level upset emulation.The system remains fully operational during irradiation, enabling simultaneous observation of timing and communication behavior.Source: §I · p. 2
  • Measured routing-delay events are correlated with AXI transaction failures to establish an experimental link between configuration-level routing disturbances and system-level communication degradation.The study derives cross-sections for routing shifts and communication failure categories and analyzes temporal proximity to SDC events.Source: §I · p. 2

II. BACKGROUND AND RELATED WORKS

  • Radiation studies measured routing-delay shifts, while injection-based studies examined AXI failures; neither line established their cross-layer relationship under neutron exposure.Prior mitigation work on placement and routing isolation also left its effects on irradiation-driven timing perturbations unresolved.Source: §II · pp. 2–3
  • AXI studies report availability failures and silent corruption, including completed transfers with incorrect data that may evade timeout- or protocol-based detection.Earlier work also found that replicated accelerators can share a vulnerable interconnect, so accelerator replication alone does not remove correlated communication risk.Source: §II · p. 2

III. PHYSICAL AND ARCHITECTURAL FOUNDATIONS

This section traces how a configuration upset can perturb routing, erode timing margin, and produce communication errors without disconnecting the path. The physical and architectural stages are distinct, so the paper treats delay events as an intermediate observable state.

III. PHYSICAL AND ARCHITECTURAL FOUNDATIONS

  • The framework links configuration-memory upsets to routing changes, signal-delay perturbations, timing-margin erosion, and possible availability degradation or silent data corruption.It distinguishes physical timing phenomena from architectural communication failures to ground the later experimental analysis in a propagation chain.Source: §III · p. 3

A. Configuration Upsets and Routing Perturbation Mechanisms in UltraScale+ Devices

  • Activating an unintended PIP can add a parasitic branch while preserving the primary path, increasing capacitive loading and propagation delay.The delay shift depends on the activated segment’s electrical characteristics and may be measurable at picosecond resolution without immediately disrupting logical correctness.Source: A. Configuration Upsets and Routing… · p. 3, Figure 1 · p. 4

B. Timing Margin Erosion and Critical Path Sensitivity

  • A routing-delay shift reduces setup margin; if it pushes data into the setup window, a receiving register may capture an incorrect value.The perturbation can remain below the violation threshold initially, while increasing susceptibility to voltage variation, clock jitter, or additional radiation-induced perturbations.Source: B. Timing Margin Erosion and Critical… · p. 4
  • Timing-induced corruption can be intermittent and data-dependent, allowing AXI transactions to complete with incorrect values rather than causing an obvious disconnection or stall.The paper identifies simultaneous observation of routing timing and transaction correctness as necessary to establish this link.Source: B. Timing Margin Erosion and Critical… · p. 4

C. Architectural Vulnerability of AXI Interconnect Fabrics

AXI accelerators often share routing and interconnect resources, making timing perturbations in that fabric relevant to system correctness. The section distinguishes physical delay events from communication outcomes and defines how temporally associated events are classified.

C. Architectural Vulnerability of AXI Interconnect Fabrics

  • Multiple AXI slaves commonly share one interconnect backbone, concentrating communication paths in routing resources whose integrity matters to system correctness.An upset may affect shared routing and thereby influence communication paths to multiple peripherals.Source: C. Architectural Vulnerability of AXI… · pp. 4–5
  • A routing upset that changes delay without severing connectivity may disrupt AXI timing while transactions still complete and deliver corrupted data without explicit protocol errors.By contrast, disabling a required segment may produce a stall, bus error, or system hang.Source: C. Architectural Vulnerability of AXI… · p. 5, Figure 2 · p. 5

D. Event Taxonomy and Observable Categories

  • A routing-delay event is a statistically significant deviation in measured propagation delay from the monitored structure’s nominal baseline.It can occur independently of immediate functional disruption.Source: D. Event Taxonomy and Observable… · p. 5
  • The taxonomy separates availability failures, silent data corruption, and detectable protocol errors, then defines a correlated event as a communication failure within a predefined interval after a routing-delay event.This temporal definition supports conditional-probability evaluation and cross-section estimation.Source: D. Event Taxonomy and Observable… · p. 5

E. Statistical Framework and Cross-Section Formulation

The framework normalizes event counts by neutron fluence to estimate susceptibility and uses a temporal association window to assess whether communication failures follow routing-delay events. It treats event classes separately and interprets conditional metrics as statistical associations, not proof of causality.

E. Statistical Framework and Cross-Section Formulation

  • Each event-class cross-section is the observed event count divided by accumulated neutron fluence, with routing-delay and communication-failure categories reported separately.Availability failures and SDC are examples of distinct architectural-failure categories.Source: E. Statistical Framework and… · pp. 5–6
  • Poisson event-count modeling provides confidence intervals for cross-section estimates, including when narrowly defined event counts are small.The model assumes rare, stochastic, independent upset occurrences during a fixed fluence.Source: E. Statistical Framework and… · p. 6
  • A failure is temporally associated with a routing-delay event when it occurs within a predefined window afterward, enabling estimation of conditional failure probability.The estimate is considered alongside the experiment-wide baseline failure probability.Source: E. Statistical Framework and… · pp. 6–7

IV. IMPLEMENTED SYSTEM AND EXPERIMENTAL SETUP

The experimental platform uses two ZCU104 boards to observe routing perturbations and AXI communication outcomes in an irradiated DUT. Distributed routing-dominated ring oscillators and frame mapping localize measured timing changes around the interconnect.

A. Dual-Board Architecture Overview

  • The irradiated ZCU104 DUT contains the AXI fabric, ring-oscillator sensors, correctness-checking IP, and SEM infrastructure; a second, non-irradiated board supervises and provides a reference.The boards exchange data and synchronized event reports over an FMC interface.Source: A. Dual-Board Architecture Overview · p. 7, §IV · p. 7

B. Functional Roles of the Two Boards

  • The external supervisory board generates deterministic traffic, checks DUT responses against a golden reference, and continues logging if the DUT becomes unstable.Its unirradiated timing structures also provide a reference for distinguishing step-like delay shifts from environmental drift.Source: B. Functional Roles of the Two Boards · p. 7

C. Distributed Routing-Dominated Ring Oscillator Array and Frame Mapping

  • Each two-LUT ring oscillator routes its feedback loop through multiple switch matrices so measured frequency changes primarily reflect routing-resource perturbations.An upset can activate an inactive PIP, adding parasitic loading and delay without necessarily breaking logical connectivity.Source: C. Distributed Routing-Dominated Ring… · pp. 8–9
  • Mapping distributed oscillators to localized configuration-frame regions links frequency deviations to frame regions around the AXI interconnect.This mapping supports per-frame or per-region analysis of routing events and communication outcomes.Source: C. Distributed Routing-Dominated Ring… · p. 9

D. AXI Interconnect Benchmark and Transaction-Level Correctness Monitoring

The benchmark continuously exercises replicated AXI peripherals through the shared interconnect while pairing routing-delay sensing with transaction correctness monitoring. An independent supervisory board verifies results and classifies communication outcomes using a golden reference.

D. AXI Interconnect Benchmark and Transaction-Level Correctness Monitoring

  • The DUT checker records returned data, AXI responses, completion status, and timeouts, then sends timestamped event records to the non-irradiated supervisory board.The supervisory board independently checks outcomes against an external golden reference.Source: D. AXI Interconnect Benchmark and… · p. 9
  • A transaction is SDC when it completes nominally without an explicit error but returns data that differs from the golden reference.Availability failures instead involve timeout or loss of forward progress; detectable protocol errors carry an explicit AXI error or other observable protocol fault.Source: D. AXI Interconnect Benchmark and… · p. 10
  • Synchronized event records align RO measurements, SEM status, frame or injection identifiers, AXI logs, timestamps, and neutron fluence for cross-layer analysis.This alignment allows communication events to be examined alongside routing-delay and configuration status.Source: D. AXI Interconnect Benchmark and… · p. 10
  • The AXI benchmark and distributed ring oscillators jointly observe frame-localized routing-delay perturbations and whether the communication fabric delivers correct transaction results.The benchmark concentrates transaction activity in the same routing region monitored by the oscillators.Source: D. AXI Interconnect Benchmark and… · pp. 9–10

E. Frame-Level Configuration Fault Injection Infrastructure

Frame-level injection complements neutron irradiation by enabling controlled, repeatable perturbations in selected interconnect regions. During beam exposure, synchronized monitoring records routing, configuration, and AXI outcomes, with recovery and post-run checks preserving event context.

E. Frame-Level Configuration Fault Injection Infrastructure

  • Frame-aware injection targets selected AXI-interconnect regions while the RO array and AXI benchmark remain active, capturing routing response, transaction correctness, and configuration status.The SEM-assisted infrastructure uses ICAP for frame-level access and records injection-specific event data.Source: E. Frame-Level Configuration Fault… · p. 11, Figure 8 · p. 12
  • After each injection, configuration is restored or the DUT reset to a known baseline, preventing ambiguity from accumulated configuration changes.Persistent stalls or loss of forward progress are logged before recovery.Source: E. Frame-Level Configuration Fault… · p. 11
  • Controlled injection complements neutron exposure by probing selected frame regions repeatedly and distinguishing severe structural failures from smaller timing perturbations that preserve logical connectivity.The authors describe injection as complementary to, not a replacement for, beam testing.Source: E. Frame-Level Configuration Fault… · p. 11

F. Neutron Irradiation Procedure and Synchronized Data Acquisition

  • Before beam exposure, the system establishes RO frequency baselines and verifies correct AXI transactions; the baseline showed no routing event or AXI failure.During exposure, the workload, RO measurements, SEM monitor, and supervisory acquisition remain active, with outcomes time-aligned to fluence and timestamps.Source: F. Neutron Irradiation Procedure and… · pp. 11–12, Figure 10 · p. 14
  • After exposure, RO frequencies and AXI correctness are rechecked, while event and SEM logs help distinguish transient disturbances from persistent configuration effects.Recovery actions are timestamped; the procedure supports extracting routing-delay and AXI-failure cross-sections and temporal-correlation metrics.Source: F. Neutron Irradiation Procedure and… · pp. 12–13

V. EXPERIMENTAL RESULTS

Baseline measurements establish stable routing-sensor behavior and error-free AXI transactions before neutron exposure or fault injection. They set the reference band and operating state used to identify later deviations.

A. Baseline Characterization of RO Sensors and AXI Workload

  • RO frequency traces stayed within the predefined baseline noise band, so no routing-delay event was detected during nominal operation.The no-event band was ±0.005 and served as the threshold for identifying later candidate events.Source: A. Baseline Characterization of RO… · p. 14
  • All baseline AXI transactions were classified as correct, with no availability failures, protocol errors, or silent data corruption during the pre-beam interval.The characterization verified the interconnect, replicated IPs, checker, transfer path, and golden-reference classification logic.Source: A. Baseline Characterization of RO… · pp. 14–15
  • No configuration-event report associated with the monitored design region was expected during baseline monitoring, establishing a clean initial state for later experiments.This helps distinguish subsequent configuration observations from initialization artifacts or pre-existing inconsistencies.Source: A. Baseline Characterization of RO… · p. 15

B. Neutron-Induced Routing Delay Events

Neutron exposure produced localized RO frequency shifts and multiple AXI failure categories, including silent data corruption. The shifts can reflect increased routing delay without immediate logical disconnection, while failures varied in visibility and severity.

B. Neutron-Induced Routing Delay Events

  • Selected ROs showed abrupt frequency deviations beyond the baseline band, while others remained stable, indicating localized rather than uniform routing-delay response.The affected RO instances were interpreted as sensing neutron-induced configuration upsets in PIPs or related routing resources.Source: B. Neutron-Induced Routing Delay Events · p. 15
  • Dominant decreases in normalized RO frequency correspond to increases in effective propagation delay, consistent with added parasitic loading from routing changes.The delay shift need not produce immediate logical disconnection.Source: B. Neutron-Induced Routing Delay Events · p. 15
  • Some RO frequency offsets persisted after the initial event, whereas others partially recovered after a recovery or correction marker.Persistence suggests a changed configuration state; partial recovery indicates the effect can be reduced when the affected configuration or system state is restored.Source: B. Neutron-Induced Routing Delay Events · p. 16

C. AXI Communication Failure Observations

  • 2,480,000 correct transactions accompanied 21 availability failures, 14 detectable protocol errors, and 18 silent data corruption events during irradiation.Silent data corruption denotes completed transactions returning incorrect data without timeout or explicit protocol-level error indication.Source: Figure 12 · p. 16, C. AXI Communication Failure… · p. 16
  • Availability failures interrupted communication, protocol errors carried explicit fault indications, and silent data corruption completed transactions with incorrect data but no explicit warning.Silent corruption can pass incorrect data to higher software or system layers as though the transaction were valid.Source: C. AXI Communication Failure… · pp. 16–17
  • The three AXI failure categories form distinct architectural outcomes that were time-aligned with RO events in the subsequent correlation analysis.The categories distinguish loss of service, signaled malfunction, and undetected corruption.Source: C. AXI Communication Failure… · p. 17

D. Temporal Correlation Between Routing Delay Events and AXI Failures

The analysis aligns timestamped RO delay events with AXI outcomes and tests whether failures fall within a defined post-event window. A subset of failures, including SDC, was temporally associated with routing shifts, but the relationship is neither universal nor deterministic.

D. Temporal Correlation Between Routing Delay Events and AXI Failures

  • Some AXI failures fell within the association windows following routing-delay events, and SDC appeared near several RO frequency-shift transitions.These SDC events indicate that corruption can coincide with routing perturbations without a hard interconnect failure.Source: D. Temporal Correlation Between… · pp. 17–18
  • Not every routing-delay event matched an AXI failure, and not every AXI failure was preceded by a detected RO event.RO coverage is spatially sampled, so some monitored regions may not lie on active or timing-critical paths and some routing resources are not covered.Source: D. Temporal Correlation Between… · p. 18
  • The conditional failure metric counts AXI failures within the association window after a delay event, separately for availability failures, protocol errors, and SDC.This provides a statistical bridge between measured timing behavior and communication correctness.Source: D. Temporal Correlation Between… · p. 18
  • The results support routing-delay events as measurable indicators of AXI vulnerability, with temporal association for a subset of failures rather than proof that every event causes another.The evidence connects selected interconnect frame regions to a subset of architectural failures in the operational MPSoC.Source: D. Temporal Correlation Between… · p. 18

E. Cross-Section Extraction and Conditional Correlation Metrics

Fluence-normalized event counts quantify routing and AXI susceptibility, while conditional metrics quantify temporal association. Frame-level injection complements neutron exposure by exposing region-specific sensitivity and recovery behavior under controlled perturbations.

E. Cross-Section Extraction and Conditional Correlation Metrics

  • 1.33 × 10^-10 cm^2 was the routing-delay-event cross-section for eight detected RO frequency-shift events in monitored interconnect regions.The value represents susceptibility of the monitored routing region to measurable neutron-induced timing perturbations.Source: E. Cross-Section Extraction and… · p. 18
  • 3.50 × 10^-10 cm^2, 2.33 × 10^-10 cm^2, and 3.00 × 10^-10 cm^2 were the cross-sections for availability failures, detectable protocol errors, and SDC, respectively.The corresponding conditional metrics were 0.375, 0.250, and 0.500; the table summarizes the event counts, cross-sections, and conditional metrics.Source: E. Cross-Section Extraction and… · p. 18, Table III · p. 19
  • Injected perturbations in RO0 and RO4 shifted RO frequency while AXI transactions remained correct, whereas RO3 showed a large neutron-observed delay event and an injection-induced availability failure requiring reset.RO1 and RO6 produced SDC during injection and recovered after correction or reinitialization.Source: E. Cross-Section Extraction and… · p. 19, Figure 14 · p. 20
  • The injection campaign separated structural sensitivity from stochastic exposure and agreed with neutron-observed delay activity in several monitored regions.Only a subset of frame regions produced both measurable routing-delay perturbation and AXI degradation; recovery behavior helps distinguish benign shifts from more severe consequences.Source: E. Cross-Section Extraction and… · p. 20

VI. DISCUSSION

The discussion connects localized routing-delay perturbations with AXI communication failures while emphasizing that their observed association is not universal. It interprets silent data corruption as a difficult-to-detect outcome and argues for mitigation combining configuration recovery with architectural, physical, and runtime measures.

A. Physical-to-Architectural Fault Propagation

  • Routing-delay perturbations were measurable during exposure, and a subset were temporally associated with AXI communication failures.The distributed RO array captures localized timing changes while the AXI benchmark tests communication under the same exposure conditions.Source: A. Physical-to-Architectural Fault… · pp. 20–21
  • The observed association is not exhaustive: some delay events lack AXI failures, while some AXI failures lack a detected RO event.The RO array samples selected frame-localized regions, and affected paths may be unused, noncritical, or within timing margin.Source: A. Physical-to-Architectural Fault… · p. 21
  • Selected routing-delay events can indicate communication vulnerability, especially in frame regions associated with shared interconnect routing.Controlled fault injection reproduced RO frequency shifts and AXI failure modes in selected configuration regions.Source: A. Physical-to-Architectural Fault… · p. 21

B. Interpretation of Silent Data Corruption

  • Silent data corruption is especially consequential because transactions can complete with incorrect data and no explicit timeout or protocol-error response.The incorrect data may then propagate to software or downstream hardware as if valid.Source: B. Interpretation of Silent Data… · p. 21
  • A routing delay increase may erode setup margin without visibly disrupting AXI sequencing, allowing an incorrectly sampled signal to yield a completed but incorrect transaction.The authors present this as a plausible explanation for SDC rather than availability failure.Source: B. Interpretation of Silent Data… · p. 21

C. Mitigation Implications

  • Mitigation should combine configuration recovery with architectural and physical measures, while runtime RO monitoring should be paired with transaction-level checking.Suggested measures include frame-aware placement and routing, accelerator isolation, and monitor-triggered recovery actions; RO shifts alone are probabilistic indicators.Source: C. Mitigation Implications · p. 21

D. Scope and Limitations

Neutron exposure produced routing-delay events, with a subset temporally associated with AXI failures including silent data corruption; the conclusions are bounded by localized monitoring and the ZCU104 AXI-interconnect setting.

D. Scope and Limitations

  • The study focuses on the ZCU104 AXI-interconnect region, and its RO array monitors selected locations rather than every routing resource.Expanding RO coverage would improve observability but add resource overhead and could perturb benchmark placement and routing.Source: D. Scope and Limitations · pp. 21–22
  • Frame-level injection complements neutron irradiation but cannot reproduce physical charge deposition or all multi-bit upset patterns; limited beam time motivates longer, repeated campaigns.The authors identify such campaigns as future work to improve statistical confidence.Source: D. Scope and Limitations · p. 22

VII. CONCLUSION AND FUTURE WORK

  • Conditional correlation metrics are statistical associations, not deterministic causality proofs; the findings suggest mitigation beyond configuration-memory correction.Suggested measures include placement and routing isolation, frame-aware monitoring, transaction replay, and golden-reference-based detection of silent data corruption.Source: D. Scope and Limitations · p. 22, §VII · p. 22
  • Distributed routing-delay sensors and transaction-correctness monitoring enabled simultaneous observation and distinction of availability failures, protocol errors, and silent data corruption.The platform combined neutron irradiation with SEM-assisted frame-level fault injection on an operational ZCU104 system.Source: §VII · p. 22
  • Silent data corruption occurred with incorrect data returned despite completed AXI transactions, and some routing-delay events were temporally associated with communication failures.The authors interpret timing-margin erosion as potentially leading to architectural failure without a hard interconnect disconnection or system stall.Source: §VII · p. 22
  • Controlled frame-level perturbations reproduced several beam-observed behaviors, while vulnerability varied with frame location, active routes, timing-critical paths, and recovery mechanisms.Observed behaviors included RO frequency shifts, correct-but-delayed operation, silent data corruption, availability failure, and recovery-dependent behavior.Source: §VII · p. 22
  • Future evaluation will extend to additional workloads, clock frequencies, AXI topologies, and FPGA families, and assess mitigation schemes.Proposed schemes include isolation-aware placement, selective scrubbing, transaction replay, and adaptive clocking.Source: §VII · p. 22
Loading 2609.30538v1…