Paper deep dive
An Empirical Fault Vulnerability Exploration of ReRAM-based Process-in-Memory CNN Accelerators
Aniseh Dorostkar, Hamed Farbeh, Hamid R. Zarandi
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 10/7/2026, 8:26:20 AM
Summary
This paper investigates the fault vulnerability of ReRAM-based Processing-in-Memory (PIM) accelerators used for Deep Convolutional Neural Networks (CNNs). The authors developed a fault injection framework to analyze the impact of stuck-at high (SaH) and stuck-at low (SaL) faults on classification accuracy at both software and hardware levels. Key findings indicate that vulnerability depends on fault type, layer depth, and parameter location, with SaL faults causing significantly greater accuracy degradation than SaH faults.
Entities (8)
Relation Signals (6)
PIM → accelerates → CNN
confidence 95% · ReRAM-based PIM accelerator is a promising platform for processing... neural networks... Deep Convolutional Neural Networks (Deep CNNs)
ReRAM → implements → PIM
confidence 95% · ReRAM-based Processing-in-Memory (PIM) accelerator is a promising platform...
Crossbar → maps → CNN parameters
confidence 93% · we map the CNN learning parameter to the ReRAM crossbar and inject faults into crossbar arrays.
SaL → causes → accuracy degradation
confidence 92% · Specifically, we show that SaL further reduces classification accuracy than SaH.
SaH → causes → accuracy degradation
confidence 90% · The proposed framework analyzes the impact of stuck-at high (SaH)... faults... SaL further reduces classification accuracy than SaH.
VGG → isexampleof → CNN
confidence 90% · VGG [3] as another well-known CNN model...
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Resistive random-access memory (ReRAM)-based Processing-in-Memory (PIM) accelerator is a promising platform for processing massively memory intensive matrix-vector multiplications of neural networks in parallel domain, due to its capability of analog computation, ultra-high density, near-zero leakage current, and non-volatility. Despite many advantages, ReRAM-based accelerators are highly error-prone due to limitations of technology fabrication that lead to process variations and defects. These limitations degrade the accuracy of Deep Convolutional Neural Networks (Deep CNNs) running on PIM accelerators. While these CNNs accelerators are widely deployed in safety-critical systems, their vulnerability to fault is not well explored. In this paper, we have developed a fault injection framework to investigate the vulnerability of large-scale CNNs at both software- and hardware-level of inference phases. Faulty ReRAM devices are another reliability challenges due to significant degradation of classification accuracy when CNN parameters are mapped to the accelerators. To investigate this challenge, we map the CNN learning parameter to the ReRAM crossbar and inject faults into crossbar arrays. The proposed framework analyzes the impact of stuck-at high (SaH) and stuck-at low (SaL) fault models on different layers and locations of CNN learning parameters. By performing extensive fault injections, we illustrate that the vulnerability behavior of ReRAM-based PIM accelerator for CNNs is greatly impressible to the types and depth of layers, the location of the learning parameter in every layer, and the value and types of faults. Our observations show that different models have different vulnerabilities to faults. Specifically, we show that SaL further reduces classification accuracy than SaH.
Tags
Links
- Source: https://arxiv.org/abs/2610.07029v1
- Canonical: https://arxiv.org/abs/2610.07029v1
Trouble viewing inline? Open PDF directly →
Full Text
74,437 characters extracted from source content.
Expand or collapse full text
IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 20241 An Empirical Fault Vulnerability Exploration of ReRAM-based Process-in-Memory CNN Accelerators Aniseh Dorostkar , Hamed Farbeh, Hamid R. Zarandi, member, IEEE, Abstract—Resistive random-access memory (ReRAM)-based Processing-in-Memory (PIM) accelerator is a promising platform for processing massively memory intensive matrix-vector multi- plications of neural networks in parallel domain, due to its capa- bility of analog computation, ultra-high density, near-zero leakage current, and non-volatility. Despite many advantages, ReRAM- based accelerators are highly error-prone due to limitations of technology fabrication that lead to process variations and defects. These limitations degrade the accuracy of Deep Convolutional Neural Networks (Deep CNNs) running on PIM accelerators. While these CNNs accelerators are widely deployed in safety- critical systems, their vulnerability to fault is not well explored. In this paper, we have developed a fault injection framework to investigate the vulnerability of large-scale CNNs at both software- and hardware-level of inference phases. Faulty ReRAM devices are another reliability challenges due to significant degradation of classification accuracy when CNN parameters are mapped to the accelerators. To investigate this challenge, we map the CNN learning parameter to the ReRAM crossbar and inject faults into crossbar arrays. The proposed framework analyzes the impact of stuck-at high (SaH) and stuck-at low (SaL) fault models on different layers and locations of CNN learning parameters. By performing extensive fault injections, we illustrate that the vulnerability behavior of ReRAM-based PIM accelerator for CNNs is greatly impressible to the types and depth of layers, the location of the learning parameter in every layer, and the value and types of faults. Our observations show that different models have different vulnerabilities to faults. Specifically, we show that SaL further reduces classification accuracy than SaH. Index Terms—Convolutional neural networks (CNNs), fault vulnerability,hardwareaccelerators,processing-in-memory (PIM), resistive random-access memory (ReRAM). I. INTRODUCTION I N RECENT years, deep neural networks (DNNs) and particularly convolutional neural networks (CNNs) have been increasingly deployed in many fields, including safety- critical systems, e.g., healthcare, autonomous vehicles, and space applications [1]. The need for high classification ac- curacy leads to an increase in the complexity of CNN models and the number of parameters as well as the computation Manuscript received 07 March 2023; revised 11 March 2024; accepted 15 May 2024. (Corresponding author: Hamed Farbeh (Email: farbeh@aut.ac.ir).) Aniseh Dorostkar, Hamed Farbeh, and Hamid R. Zarandi are with Amirk- abir University of Technology (Tehran Polytechnic), Tehran, Iran (Email: a dorostkar@aut.ac.ir, farbeh@aut.ac.ir, hzarandi@aut.ac.ir) Digital Object Identifier 10.1109/TR.2024.3405825 demand of neural networks. Meanwhile, energy consumption and memory/storage occupation significantly increased. As CNN depth increases, computational/memory resources and interconnections face severe challenges, e.g., there are about 635,200 interconnections in a fully-connected two-layer deep CNN to classify the MNIST dataset [2]. VGG [3] as another well-known CNN model has the order of million param- eters [4]. Conventional CPUs and Graph Processing Units (GPUs) are not able to efficiently process such a large-scale computation with enormous memory resources owing to power wall and memory wall bottlenecks. A novel way to tackle these challenges is the processing-in-memory (PIM) approach, which moves a majority of computation into memory and augments the memory to execute computing tasks directly within its arrays. Conventional memory technologies such as dynamic random-access memory (DRAM) and emerging non- volatile memories such as spin-transfer torque magnetic RAM (STT-MRAM), resistive random-access memory (ReRAM), and phase change memory (PCM), are capable of doing logical and arithmetic computations beyond data storage [5]. Among these technologies, ReRAM has advantages of higher density, lower power consumption, higher speed, and better scalability. Moreover, the capability of operating in both analog and digital domains and high-density storage makes this technology a promising candidate for accelerating big data processing and increasing the efficiency of CNNs computations. The analog-based PIMs [6], [7] perform parallel Vector- Matrix Multiplications (VMM) using the natural multiply-and accumulate feature of ReRAM crossbars, which are extremely energy efficient, have a lower delay, and are less accurate than non-analog PIMs. Meanwhile, non-analog PIMs [8] perform massively parallel Boolean operations, which compromises accuracy for energy efficiency and delay. ReRAM-based PIM accelerator is a promising platform for processing neural networks. Due to the characteristics of neural networks, existing ReRAM-based accelerators, e.g., ISAAC [6], PRIME [5], ZARA [9], PipeLayer [10], and FORMS [11], can reduce time and energy consumption com- pared to their CMOS-based counterparts and von-Neumann processors. These improvements are due to the crossbar architecture of ReRAM, which can perform vector-matrix operations in the analog domain and eliminate transmission of neural network data such as weights between the computing unit and memory [12]. The crossbar array of ReRAM can 1558-1721 © 2024 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See https://w.ieee.org/publications/rights/index.html for more information. arXiv:2610.07029v1 [cs.AR] 4 Oct 2026 IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 20242 perform neural network’s main operations, i.e., VMM and reduce the time complexity of VMM operations from O(n 2 ) to O(n) and even in the best case to O(1) [13]. Despite the mentioned advantages, ReRAM-based accelera- tors are highly error-prone due to the limitations of technology fabrication. Accordingly, they suffer from Process Variations (PVs), limited write endurance, the discrete and limited num- ber of conductance states, transient and permanent faults, sources of noises, and non-linearity of current-voltage charac- teristics [13]–[15]. ReRAM cells are susceptible to many types of hardware faults both in the manufacturing and operational phases. Considering the capability of employing ReRAM as both storage and logic elements, its storage application is more sensitive to faults than their logical counterpart. Variations in the resistance of cells directly cause error occurrence in the result of VMM and reduction of computational accuracy. Therefore, PVs and defects in fabrication process of ReRAM technology not only reduce the yield of the memory devices, but also degrade the accuracy of CNNs running on the PIM- accelerators [16]. Learning parameters of neural networks, represented as the conductance of ReRAM memory cells, can be easily altered by faults in ReRAM technology. CNN inference application continuously processes many safety-critical inference tasks where their correctness is more important than its training phase in this domain. Even one single fault in the ReRAM crossbar causes error occurrence in the inference application that can affect the reliability of whole system. Therefore, to design a CNN model for safety-critical systems, this makes it necessary to explore the behavior of each layer against fault to guarantee designing a robust model. It is necessary to investigate the vulnerability of CNN models based on ReRAM-based PIM accelerator characteristics. A few prior studies analyzed CNNs reliability and vul- nerability to permanent and transient faults based on several CNNs for different hardware platforms, e.g., CPUs, GPUs, Tensor Processing Units (TPUs), Field Programmable Gate Arrays (FPGAs), and Application-Specific Integrated Circuits (ASICs) [1], [17], [18]. Nevertheless, still, no attention was paid to investigating the vulnerability of ReRAM-based PIM accelerators for CNN-type algorithms. In addition, there are some studies on the sensitivity of CNNs to changing their learning parameters and occurrence of the faults in neurons, weights, or data path of CNNs [19]–[25]. None of the pre- vious works investigated the effects of changing the value of learning parameters in a specified location and perusing permanent faults, such as stuck-at maximum and minimum values separately in weights and kernels of CNNs. In this paper, the vulnerability of different CNN models to faults and the causes of faults in ReRAM crossbar arrays as well as their effects on the classification accuracy of CNNs, are investigated. We have demonstrated that decreasing the classification accuracy of CNNs highly depends upon the location of corrupted weights or, on the other hand, in which crossbars the corrupted weights are mapped. We have developed a framework for fault injection into both software- and hardware-level of CNNs accelerators. At the software- level, the vulnerability of the CNN models is explored by changing the hardware-independent learning parameters or without considering the source of faults. At hardware-level fault injection, the vulnerability of CNN models is investigated by considering the hardware specification, and permanent faults are injected into ReRAM cells of the accelerator. Hence, we deeply investigate the wide range of diversity changes in the learning parameters of CNN models with different topologies. We also examine the vulnerability of different layers in several models of CNNs with specific topologies. The main contributions of this paper are as follows: 1) Both single and multiple faults are injected into the software-level of CNN models to investigate and study their vulnerability to different fault behaviors. We com- prehensively analyze the behavioral simulation of stuck- at faults by injecting maximum and minimum values to investigate the vulnerability of CNNs against to stuck-at high resistance (SaH) and stuck-at low resistance (SaL) faults respectively. 2) Hardware-level fault injection for ReRAM-based PIM accelerator is also performed. It helps to investigate the effect of hardware faults on the output of CNNs. To this aim, we map the learning parameters of the inference phase as conductance of ReRAM crossbars and then inject SaH and SaL faults into crossbar cells. 3) Through extensive simulations and analysis, we reveal that the output of large-scale CNNs highly depends on the type and value of faults, topology models, types and the number of layers, and distance of layers from output. 4) By performing extensive fault injection experiments, we illustrate that the behavior of SaH and SaL faults differ- ently affects the output of CNNs, and the degradation in classification accuracy due to the occurrence of SaL is significantly higher than that of SaH. The rest of this article are organized as follows. Section I provides background on neural networks, ReRAM devices, and reliability factors of ReRAM-based CNN accelerators. The complete analyses and results of the vulnerability investigation are provided in Section I. In Section IV, the summary of investigations and simulation results and detailed analysis are provided. A comprehensive discussion of related work is provided in Section V. Finally, Section VI concludes this article. I. PRELIMINARIES A. Neural Networks As one of the most prominent Artificial Neural Networks (ANNs), Convolutional Neural Networks (CNNs) have been made of convolutional layers (CONV ), pooling layers (POOL), fully-connected layers or classification layers (FC or DENSE), and some other custom layers like BatchNorm [6]. These lay- ers, have some parameters, e.g., weights, kernel or filter, and bias, that must be adjusted and learned in the training phase and are called learning parameters. CNNs usually consist of a group of CONV and POOL layers sequentially placed at that end with some FC or classification layers (usually less than three layers). The main computations performed in CNNs contain multi-dimensional convolutional and VMM. In FC IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 20243 Top Electrode Conductive Filament Dielectric layer Bottom Electrode RESET SET (a) Bit-line (b) Fig. 1. ReRAM structure. a) ReRAM cell and b) ReRAM crossbar structure. layers, VMM operation is performed in each neuron, by the following equation: y j = n X i=0 x i w ij + b j (1) where y j is the output of j th neuron, x i is the input of j th neuron (output of i th neuron in the previous layer), w ij is the weighted synapses corresponding to each input, and b j is the bias of each neuron. The result is given to the activation function of σ, which can be either sigmoid, ReLU, or tanh, and the output of the neuron is calculated. In addition, a convolutional operation in CONV layers is performed for each kernel and its corresponding Input Feature Map (IFM) to extract the Output Feature Map (OFM) as y j = σ C in X i=0 C W X dx=0 C H X dy=0 IFM(i,x + dx,y + dy) ∗ K n (i,dx,dy) + B i , 1≤ n≤ C out (2) where IFM is the input feature map, C in is the number of feature maps, C out is the number of output feature maps, K is the kernel matrix of CONV layers, K n (i,dx,dy) is the n th filter matrix for input i th layer, and B i is the bias array of each kernel. B. ReRAM Memory and Crossbar Structure ReRAM is a nonvolatile memory that stores data with variable resistant states. ReRAM is constructed with three layers containing a metal-insulator oxide (dielectric) layer sandwiched between an electrochemically active metal top electrode and an electrochemically inert metal bottom elec- trode. The schematic of ReRAM is shown in Fig. 1a. By controlling the external ‘set’ and ‘reset’ voltage, the state of the cell is switched between the low resistant state (LRS or logical ‘1’) and the high resistant state (HRS or logical ‘0’), which is caused by the formation and rupture of the conductive filament in the dielectric layer. To read data from the ReRAM cell, a small voltage referred to as the read voltage is applied to identify whether the state of the cell is in the HRS (logical ‘0’) or the LRS (logical ‘1’) state. This low voltage will not disturb the current state of the cell. Using multiple cells of ReRAM, a ReRAM crossbar struc- ture is constructed, as shown in Fig. 1b. By storing matrix elements as conductance on the ReRAM crossbar array, and applying a vector as input voltage signals, the ReRAM cross- bar can perform matrix-vector multiplication in the analog domain. Gmin Gmax - 1 + 1 0 Gij Wij Weight Conductance Weights U nr oll Matrix Partitioning Mapping Weight to Conductance G Scale Input to Voltage Placement Fig. 2. General process of mapping and placement of learning parameters to ReRAM crossbar. 1R (one-resistor) and 1T1R (one-transistor-one-resistor) crossbar structures are two commonly used structures for ReRAM crossbars. In 1R structure, each ReRAM cell consists of one resistor as a storage element whereas in 1R1T structure, each cell consists of an access transistor to select and control each cell and a resistor as a storage element. However, 1R structure is simpler than other structures and has a higher density. 1T1R structure has attracted significant attention due to its ability to reduce the sneak-path current issue happening in ReRAM crossbars. Moreover, in recent decades, 1T1R structures have also been used for implementing emerging applications such as PIM architectures and neuromorphic computing [5], [6], [11], [26]–[28]. The general process of mapping and placement of learning parameters, e.g., weight or kernel matrix and bias vector, on ReRAM-based PIM accelerators are shown in Fig. 2. At first, the learning parameters, including the weight matrix and bias vector of FC layers as well as kernel and bias vector of convolutional layers, must be converted to an appropriate matrix to perform VMM in crossbar architecture correctly. Then the converted matrix is mapped to the corresponding conductance value. Since the number of parameters and size of the matrix varies in each layer, the size of the converted matrix may be smaller/larger than the crossbar size. Therefore, based on the CNN model, an adequate placement mechanism should be done in a hierarchy of crossbars, tiles, and memory banks of the ReRAM accelerator. In general, learning parameters contain both positive and negative values whereas, the ReRAM cell stores the ab- solute values of the parameters as conductance. To solve this challenge, and map both positive and negative values, two crossbars containing a positive crossbar and a negative crossbar have been proposed [5], [26] (shown in Fig. 3). The absolute value of learning parameters is stored in the negative/positive crossbar and their corresponding cells in dual crossbar maps with G min . The conductance value of each cell is calculated by the following equation: G ∗ i,j,pos = ( G i,j ,if w i,j ≥ 0 G min , if w i,j < 0 , G ∗ i,j,neg = ( |G i,j |,if w i,j ≤ 0 G min , if w i,j > 0 (3) where G (i,j) is the base conductance that must be mapped to ReRAM cells and G ∗ i,j,pos and G ∗ i,j,neg are the absolute con- ductance values that map to positive and negative crossbars, respectively. IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 20244 SubtractorSubtractor . . . Ouputs . . .. . . . . . . . . . . . Inputs . . . . . . . . . . . . Inputs . . . Absolute Value of Weights Negative CrossbarPositive Crossbar . . . Fig. 3. Dual crossbar architecture to store positive and negative values. C. Reliability of ReRAM-based Accelerators for CNNs There is no comprehensive evaluation criterion for the reliability of the ReRAM-based analog PIM accelerator for processing CNNs. The classification accuracy of CNNs can be considered as a parameter to quantify the reliability criterion of a neural network [29]. In a ReRAM crossbar array, when the matrices are mapped into the conductance of the crossbar array and input values are scaled to the voltage of inputs, the output current value of each column is not exactly the same as the sum of all currents passing through each cell, however it is slightly different from its ideal value. In reality, due to non-ideal sources, this current value differs from the expected current value which itself causes an error in analog computations [30], leading to an error in the weight connected to neurons. Non-ideal behaviors have a significant effect on VMM calculation, and this itself is intensified due to the faults of the ReRAM cells [14], [15]. Consequently, non-ideal behaviors significantly reduce the classification accuracy of the neural network mapped onto the ReRAM accelerator. Various factors can affect the classification accuracy and reliability of ReRAM-based accelerators. In general, these factors can be divided into two categories: 1) data-dependent factors and 2) data-independent factors. Data-dependent fac- tors are related to the values of memory cells, their variations, and the way of conversion and calculation. These factors include the way of mapping weights or kernels and bias into conductance in the ReRAM crossbar and scaling the input data into voltage, the non-ideal behavior of ReRAM cells caused by PVs (cell-to-cell variations and cycle-to-cycle variations), resistance drift, quantization error, and the presence of faults (such as stuck-at faults). Data-independent factors are mainly caused by peripheral circuits and fabrication processes, e.g., access transistor or selector, Analog-To-Digital Converters (ADC), Digital-To-Analog Converters (DAC), resolution and sneak path current, and parasitic resistance [31]. High fault rates and PVs lead to accelerator reliability degradation. Meanwhile, to implement an extensive computing system with ReRAM-based PIM, the wire density becomes significantly high, and the reliability of read and write oper- ations decreases due to voltage drop and PVs. As the rate of ReRAM faults increases, the accuracy of the neural network decreases drastically. Learning parameters of neural networks, represented as the conductance of ReRAM memory cells, can be easily changed by the limitations of ReRAM technology. For example, PVs as well as thermal and electrical noise can limit the programming accuracy of ReRAM cells. The cell resistance variations di- rectly affect the VMM results, causing errors and reducing the classification of CNN’s accuracy [32]. Resistance drift disturbs the state of the memory cells and, in turn, it reduces the accuracy of calculations, efficiency, and stability of the system. Therefore, it is necessary to analyze and investigate the effects of faults in CNNs carefully. To this aim, the effect of fault sources in CNN models as well as ReRAM-based PIM accelerators should be investigated. The manufacturing process of ReRAM is not so mature as that of CMOS. As a result, ReRAM cells are susceptible to many types of hardware faults in both the manufacturing and data processing phases. ReRAM faults are divided into permanent and transient faults based on their temporal char- acteristics [17]. Transient faults may exist for a short period and are usually caused by external disturbances such as high energy particles hitting the electrical device (such as randomly changing cell values), temperature, resistance drift, process variations, and write/read disturbance [1], [33]–[35]. Transient faults in ReRAM memory change the resistance of the cells without physically damaging the cells. Read disturbances in ReRAM memory are considered as transient faults [36], [37]. Permanent faults are continuous and remain unchanged over time. These faults are usually due to irreversible physical damage such as limitation of manufacturing methods at the fabrication stage [37], e.g., oxide layer thickness, fluctua- tion, and decreasing feature size [30], or limitation in en- durance [38], [39]. When the cell is permanently faulty, the resistance of the ReRAM cell will not change, thus causing the write operation to fail. Defects in manufacturing time such as short defects and over-forming stage defects [37] cause the resistance of the cell to become stuck-at high (SaH) or stuck-at low (SaL). The metal oxide layer of ReRAM is sensitive to fabrication thickness and forming method, and it is challenging to avoid stuck-at faults during the fabrication stage [16]. Even though the ReRAM crossbar array passes the manufacturing test, faults can also happen during the time in use and data processing [39]. These faults can be attributed to the limitation of ReRAM writes endurance or to the use of several consecutive write-0 (or write-1) pulses [40]. SaH usually occurs due to short defects that cause part of the cell always to have high resistance. SaL occurs due to permanent cell failure or a broken selector or wire. Stuck-at faults are randomly distributed across the crossbar array [30]. In neural networks, the fault model is defined just based on the behavior of the neuron and independent of its phys- ical implementation. Finally, a digital platform is used to investigate the effect of a fault on neural computations. In the binary implementation, these two faults are modeled as stuck-at faults (SaL and SaH). Synapse faults are modeled as stuck-at values (SaV), where V is a number between [w min , w max ] where w min and w max are minimum and maximum values of weights, kernels and biases, respectively. Neuron body faults are typically saturated to positive or negative values modeled by Sa1 or Sa(-1) since the output value of the activation function is in this range. Stuck-at faults allow IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 20245 Fault injection Software-level Multiple faults with variance in learning parameter Single fault in each layer Multiple minimum and maximum faults in learning parameters Multiple SaL faults in crossbar array Multiple SaH faults in crossbar array Both SaL and SaH faults in crossbar array W e i g h t a n d b i a s o f m o d e l R e R A M c e l l s Hardware-level Fig. 4. Different phases of the proposed ReConFI faults injection framework. modeling faults at the behavioral level, independent of the implementation platform and the precise characteristics of the physical faults [40]. Since the processing unit of ReRAM accelerators is based on a crossbar array that performs multiplication and addition operations concurrently, the possibility of faults occurring in ReRAM cells is more significant than in conventional ReRAM memory/storage. Hence, the main focus of this research is on the presence of faults in ReRAM cells. For this purpose, in the following, faults in the synaptic weights of the CNNs and the conductance of ReRAM cells will be investigated and analyzed. The faults are modeled based on SaV, SaH, and SaL. I. RECONFI: THE PROPOSED FRAMEWORK FOR RELIABILITY INVESTIGATION IN CNNS The proposed fault injection framework, called Re RAM Convolutional Neural Network Fault Injector (ReConFI), per- forms fault injection at both software- and hardware-level and monitors the effect of faults. At software-level fault injection, the CNNs learning parameters are corrupted to study the CNN models behavior in the presence of faults without considering the hardware platform specification. In hardware-level fault injection, the hardware specification of the accelerator is considered, and the faults are injected into ReRAM cells and the conductance of cells which denotes as learning parameters of CNN models are changed. Then, the effects of changing conductance on the output of CNN models are obtained. To investigate the behavior of faults in CNNs and analyze their vulnerability, a three-phase fault injection has been performed at the software-level. In the first phase, single faults are injected into the learning parameters of weights, kernels, and biases at the algorithm-level without considering the processing platform. Ten million fault injection experiments, consisting of 1000 faults for 10000 input images, are injected at random locations of weights, kernels, and biases in each layer. In the second phase of fault simulation in CNN models, the focus is on stuck-at value (SaV) faults, in such a way that different numbers of weights, kernels, and biases are stuck-at a specific value. Multiple faults with the magnitude of 0.05x to 10x of golden value are added to the corresponding learning parameters. In the third phase, to investigate the vulnerability of each layer against stuck-at faults, SaH and SaL faults are modeled in synapsis weights at the software-level. More than one fault with the value of the maximum and minimum amount has been injected into the weights, kernels, and bias matrices. The maximum and minimum values indicate SaH resistance and SaL resistance, respectively. In the hardware-level fault injection, learning parameters are mapped to the conductance of cells, and inputs are scaled to the voltage range. Then, SaH and SaL faults are injected into the ReRAM-based accelerator platform after mapping the learning parameters of CNN to the conductance of ReRAM cells. Multiple SaH faults, and SaL faults, and their combina- tions are separately injected into ReRAM cells that contain the value of learning parameters. Different phases of the proposed fault injection framework are shown in Fig. 4. A. Simulation Platform and Neural Network Models Different neural networks have different topologies, the type of which can affect error propagation. In this paper, fault injection has been done for different types of CNNs, and fault injection is investigated for different layers. Moreover, different CNNs have different layers, in terms of position, type, number of each type, and the total number of layers. The occurrence of a fault in the weight or kernel of each layer can have a different effect on the output and accuracy of the network. To inject faults and analyze the vulnerability of the CNNs, first, the well-known SimpleNet, LeNet5, AlexNet, ResNet18, and VGG19 neural networks, whose architectures are shown in Fig. 5 are trained using the PyTorch [41] framework for the MNIST [2] and CIFAR10 [42] datasets based on the parameters in Table I. LeNet5 and SimpleNet are used to classify the MNIST dataset and AlexNet, ResNet18, and VGG19 are used to classify the CIFAR10 dataset. MNIST and CIFAR10 contain 60000 images for the training set and 10000 images for the test set. Top-1 accuracy is used as an evaluation parameter. Top-1 accuracy represents the percentage of test data instances correctly classified by the algorithm, with the highest predicted IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 20246 Image 224×224×3 3x3 CONV, 64 3x3 CONV, 64 3x3 CONV, 128 3x3 CONV, 128 3x3 CONV, 256 3x3 CONV, 256 CH_S: 32×32 MaxPool, /2, 64 MaxPool, /2, 128 3x3 CONV, 256 3x3 CONV, 256 MaxPool, /2, 256 3x3 CONV, 512 3x3 CONV, 512 3x3 CONV, 512 3x3 CONV, 512 MaxPool, /2, 512 3x3 CONV, 512 3x3 CONV, 512 3x3 CONV, 512 3x3 CONV, 512 MaxPool, /2, 512 FC, 10 Avgpool, 512 CH_S: 16×16 CH_S: 16×16 CH_S: 8×8 CH_S: 8×8 CH_S: 4×4 CH_S: 4×4 CH_S: 2×2 CH_S: 2×2 CH_S: 1×1 CH_S: 1×1 Image 32×32×3 VGG19 CH_S: 16×16 CH_S: 8×8 CH_S: 8×8 CH_S: 8×8 CH_S: 4×4 CH_S: 4×4 CH_S: 4×4 CH_S: 2×2 CH_S: 2×2 CH_S: 2×2 CH_S: 32×32 5x5 CONV, 20 5x5 CONV, 50 CH_S: 24×24 2x2 MaxPool, 20 2x2, MaxPool, 50 CH_S: 12×12 CH_S: 4×4 Image 28×28×1 SimpleNet FC, 500 FC, 10 CH_S: 8×8 CONV: Convolutional Layer FC: Fully Connected Layer AvgPool : Average Pool CH_S: Output Channel Size 3x3 CONV, 512 Kernel/filter size Layer Type # Output Channel 5x5 CONV, 6 5x5 CONV, 16 CH_S: 28×28 2x2 MaxPool, 6 2x2, MaxPool, 16 FC, 120 CH_S: 14×14 CH_S: 5×5 Image 28×28×1 LeNet5 FC, 84 FC, 10 CH_S: 10×10 11x11 CONV, 64 5x5 CONV, 192 3x3 CONV, 384 CH_S: 55×55 3x3 MaxPool, 64 2x2, MaxPool, 192 3x3 CONV, 256 3x3 CONV, 256 3x3 MaxPool, 256 FC, 4096 CH_S: 27×27 CH_S: 13×13 CH_S: 13×13 CH_S: 6×6 CH_S: 6×6 AlexNet FC, 4096 FC, 10 6x6 AvgPool, 256 CH_S: 27×27 CH_S: 13×13 CH_S: 13×13 3x3 CONV, 64 3x3 CONV, 64 3x3 CONV, 64 3x3 CONV, 64 3x3 CONV, 64 3x3 CONV, 128 3x3 CONV, 128 1x1 CONV, 128 3x3 CONV, 128 3x3 CONV, 128 3x3 CONV, 256 3x3 CONV, 256 1x1 CONV, 256 3x3 CONV, 256 3x3 CONV, 256 Image 32×32×3 ResNet18 3x3 CONV, 512 3x3 CONV, 512 1x1 CONV, 512 3x3 CONV, 512 3x3 CONV, 512 4x4 Avgpool, 512 FC, 10 CH_S: 32×32 CH_S: 32×32 CH_S: 32×32 CH_S: 32×32 CH_S: 32×32 CH_S: 16×16 CH_S: 16×16 CH_S: 16×16 CH_S: 16×16 CH_S: 16×16 CH_S: 8×8 CH_S: 8×8 CH_S: 8×8 CH_S: 8×8 CH_S: 8×8 CH_S: 4×4 CH_S: 4×4 CH_S: 4×4 CH_S: 4×4 CH_S: 4×4 CH_S: 1×1 Fig. 5. Different convolutional neural network architectures for image classification. TABLE I CONVOLUTIONAL NEURAL NETWORK SPECIFICATION FOR IMAGE CLASSIFICATION. ModelSimpleNet [41]LeNet5 [2]AlexNet [42]ResNet18 [43]VGG19 [3] DataSetMNISTMNISTCifar10 ctsCifar10Cifar10 Imagesize1×28×281×28×283×224×2243×32×323×32×32 # of Classes1010101010 Total Size (MB)1.760.3226.5553.8983.64 Total Parameters431,08044,42657,044,81011,173,96220,040,522 Parameter size (MB)1.640.17217,6142.6376.45 # of CONV Layer2252016 Filter size553,11,51,33 # of in channel1,201,63,2563-5123-512 # of Filters [min, max][20,50][6,16][3,256][64,512][64,512] Stride111,2,41,21,2 # of Parameters25,5702,5722,469,69611,168,83220,035,392 # of FC Layers23311 # of Parameters405,51041,85454,575,1145,1305,130 Accuracy99.42%99.26%86.82%89.42%88.40% class being the same as the true class. We have developed our fault injection framework in Python using the PyTorch framework. All simulations are done on an Intel Core i7, 3.2 GHz processor with an NVIDIA GeForce GTX 2080Ti GPU. After training the CNN models, the trained model is placed in the inference phase, and fault injection is done in its parameters. Then again, for each fault injected, the top-1 accuracy of the test dataset for the defective network is calculated. B. Fault Injection in Software-Level of Inference Phase In this section, both single and multiple faults are injected at the software-level of CNN models in three phases to investigate the vulnerability of CNN model to different values of faults. In the first phase, the effects of single faults in each layer are investigated. In the second phase, the effect of variance in the weight of each layer is analyzed. In the third phase, we analyze behavioral simulation of stuck-at faults by injecting maximum and minimum values, to investigate the vulnerability of CNN to SaH and SaL faults. 1) Effect of each fault in each layer: In the first phase, 10 million faults consisting of 1000 faults for 10000 input images are injected at random locations of weights, kernels, and biases of each layer at the algorithmic level to determine the sensitivity of each layer to faults. The maximum, minimum, and average top-1 classification accuracies of 1000 repetitions of the 10000 images of the test case for the different models are given in figures 6 through 8. IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 20247 conv1.weight conv1.bias conv2.weight conv2.bias fc1.weight fc1.bias fc2.weight fc2.bias Layers Name 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) MNIST - SimpleNet - Weights, Kernels and Biases Min-Acc Max-Acc Avg-Acc (a) conv1.weight conv1.bias conv2.weight conv2.bias fc1.weight fc1.bias fc2.weight fc2.bias fc3.weight fc3.bias Layers Name 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) MNIST - LeNet - Weights, Kernels and Biases Min-Acc Max-Acc Avg-Acc (b) features.0.weight features.0.bias features.3.weight features.3.bias features.6.weight features.6.bias features.8.weight features.8.bias features.10.weight features.10.bias classifier.1.weight classifier.1.bias classifier.4.weight classifier.4.bias classifier.6.weight classifier.6.bias Layers Name 70 80 90 Accuracy (%) CIFAR10_cts - AlexNet - Weights, Kernels and Biases Min-Acc Max-Acc Avg-Acc (c) Fig. 6. The effect of single fault in different layers of several CNNs in (a) SimpleNet, (b) LeNet5, and (c) AlexNet. conv1 layer1.0.conv1layer1.0.conv2layer1.1.conv1layer1.1.conv2layer2.0.conv1layer2.0.conv2 layer2.0.shortcut.0layer2.0.shortcut.1 layer2.1.conv1layer2.1.conv2layer3.0.conv1layer3.0.conv2 layer3.0.shortcut.0layer3.0.shortcut.1 layer3.1.conv1layer3.1.conv2layer4.0.conv1layer4.0.conv2 layer4.0.shortcut.0layer4.0.shortcut.1 layer4.1.conv1layer4.1.conv2 linear Layers Name 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) CIFAR10 - ResNet18 - Weights and Kernels Min-Acc Max-Acc Avg-Acc (a) bn1 layer1.0.bn1layer1.0.bn2layer1.1.bn1layer1.1.bn2layer2.0.bn1layer2.0.bn2layer2.1.bn1layer2.1.bn2layer3.0.bn1layer3.0.bn2layer3.1.bn1layer3.1.bn2layer4.0.bn1layer4.0.bn2layer4.1.bn1layer4.1.bn2 Layers Name 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) CIFAR10 - ResNet18 - Weights of BachNorm Min-Acc Max-Acc Avg-Acc (b) bn1 layer1.0.bn1layer1.0.bn2layer1.1.bn1layer1.1.bn2layer2.0.bn1layer2.0.bn2 layer2.0.shortcut.1 layer2.1.bn1layer2.1.bn2layer3.0.bn1layer3.0.bn2 layer3.0.shortcut.1 layer3.1.bn1layer3.1.bn2layer4.0.bn1layer4.0.bn2 layer4.0.shortcut.1 layer4.1.bn1layer4.1.bn2 linear Layers Name 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) CIFAR10 - ResNet18 - Biases Min-Acc Max-Acc Avg-Acc (c) Fig. 7. The effect of single fault in different layers of several CNNs in ResNet18. a) Filters of CONV s and FC, b) Weights of BachNorms and c) Biases of BachNorms and FC. TABLE I ACCURACY OF FAULTY MODELS AND NUMBER OF EXPERIMENTS AFFECTED BY FAULTS IN DIFFERENT CNN MODELS IN THE SENSE OF SINGLE FAULTS. CNN Models Baseline Accuracy (%) Average accuracy of all Faulty Layers (%) Accuracy Degradation (%) Degraded Accuracy (%) Improved Accuracy (%) Unchanged Accuracy (%) SimpleNet99.4297.412.0165.13727.88 LeNet599.2697.252.0172.68.918.5 AlexNet86.8286.610.2160.8820.6918.44 ResNet1889.4156.8732.5480.817.2911.9 VGG1988.457.7230.6872.7713.6113.62 By injecting faults into the learning parameters, the classi- fication accuracy of CNNs is altered depending on the type and depth of layers and the location of faults. Interestingly, the effect of faults on CNNs is not always in the direction of degrading accuracy. Since the value of the learning parameter changes over an optimal local value in the training phase, it is probable that changing the parameter after the training phase improves classification accuracy, which rarely happens in different experiments. For example, in the SimpleNet model, fault injections in the Conv1 layer in 2% of experiments improve the accuracy, while 80% of experiments decrease the accuracy and in 18% of experiments, no change in the accuracy of faulty models is observed. Table I contains two sections: The first shows the average accuracy, lesser accuracy, and equal accuracy of faulty layers when it comes to classification accuracy degradation. It also shows how many smaller, greater, and equal simulations were run with baseline accuracy. The result of injecting faults into different layers of Sim- pleNet, LeNet5, and AlexNet is shown in Fig. 6. Injecting faults in weights of FC layers and kernels of CONV layers, and also learning parameters of BachNorm for ResNet18 and VGG19 is done as shown in Fig. 7 and Fig. 8, respectively. As shown, in the CONV layer, occurring a fault in the value of kernels causes all the values of the corresponding output channel to be erroneous. This event in the first layers causes a large number of the output value of subsequent layers to change, as the error is propagated to the subsequent layers and increases the probability of final error in the output of CNN. However, the occurrence of a fault in the last CONV layers has less effect on the final accuracy of the network than in FC layers. As we go into the depth of the neural network, the IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 20248 features.0.weightfeatures.3.weightfeatures.7.weight features.10.weightfeatures.14.weightfeatures.17.weightfeatures.20.weightfeatures.23.weightfeatures.27.weightfeatures.30.weightfeatures.33.weightfeatures.36.weightfeatures.40.weightfeatures.43.weightfeatures.46.weightfeatures.49.weight classifier.weight Layers Name 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) CIFAR10 - VGG19 - Weights and Kernels Min-Acc Max-Acc Avg-Acc (a) features.0.biasfeatures.3.biasfeatures.7.bias features.10.biasfeatures.14.biasfeatures.17.biasfeatures.20.biasfeatures.23.biasfeatures.27.biasfeatures.30.biasfeatures.33.biasfeatures.36.biasfeatures.40.biasfeatures.43.biasfeatures.46.biasfeatures.49.bias classifier.bias Layers Name 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) CIFAR10 - VGG19 - Biases Min-Acc Max-Acc Avg-Acc (b) features.1.weightfeatures.4.weightfeatures.8.weight features.11.weight features.15.weightfeatures.18.weightfeatures.21.weightfeatures.24.weightfeatures.28.weightfeatures.31.weightfeatures.34.weightfeatures.37.weightfeatures.41.weightfeatures.44.weightfeatures.47.weightfeatures.50.weight Layers Name 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) CIFAR10 - VGG19 - Weights of BachNorms Min-Acc Max-Acc Avg-Acc (c) features.1.biasfeatures.4.biasfeatures.8.bias features.11.bias features.15.biasfeatures.18.biasfeatures.21.biasfeatures.24.biasfeatures.28.biasfeatures.31.biasfeatures.34.biasfeatures.37.biasfeatures.41.biasfeatures.44.biasfeatures.47.biasfeatures.50.bias Layers Name 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) CIFAR10 - VGG19 - Biases of BachNorms Min-Acc Max-Acc Avg-Acc (d) Fig. 8. The effect of single faults in different layers of several CNNs in VGG19. a) Filters of CONVs and FC, b) Bias of CONVs and FC, c) Weights ofBachNorms, and d) Bias of BachNorms. sensitivity of CNN to faults in the CONV layers decreases, and it increases the accuracy in the DENSE or FC faulty layers. It is observed that as the number of FC layers increases, the vulnerability of neural networks to faults increases as well. On the other hand, some of the faults are masked in these layers. For example, in the AlexNet model, in Fig. 7c with 3 FC layers and 54 million parameters in these layers, there is just 0.21% accuracy degradation compared to the baseline model. Shortcut connections in the ResNet18 model cause more errors propagation to the next block of ResNet18 or other layers (Fig. 7). As reported in Table I, ResNet18 and VGG19 networks, with a significantly larger number of parameters and CONV layers than AlexNet and just one FC layer, are more vulnerable to faults. Shortcut connections in ResNet cause error propa- gation to subsequent layers. Changing the learning parameter of the BachNorm layer significantly reduces the classification accuracy in ResNet18 and VGG19. As mentioned, any error in the value of a learning parameter of the CNN changes the network’s output. It is probable in some scenarios that some input samples correctly predicted in the baseline model are predicted incorrectly in the faulty model, or conversely, the samples that were wrongly predicted in the baseline model are correctly predicted in the presence of faults. In this regard, to more accurately evaluate the performance of the neural network in the presence of faults and fault-free conditions, the confusion matrix has been used, which specifies the predicted output and the actual output for the test datasets. Each row specifies the actual label of the class, and each column specifies the number of predicted examples in that class. The value of the main diameter repre- sents the correctly predicted samples, and the value outside the main diameter represents the incorrectly predicted classes. The confusion matrix of faults for the baseline model, maximum accuracy, and minimum accuracy in the first layer of the three models are shown in Fig. 9. 2) Effect of variance in weights: In the second phase of software-level fault injection in CNN models, the focus is on stuck-at value faults (SaV) in such a way that different numbers of weights, kernels, and biases are stuck-at a specific value. To this aim, values of weights or kernels and bias are randomly changed at different times from 0.05X to 10X of the golden value. It means that X times the value has been added to it. The accuracy of the different numbers of elements and different ranges of changes for SimpleNet and LeNet5 are shown in Fig. 10 and Fig. 11, respectively. As shown, by increasing the number of faults and larger deviations from the golden value, classification accuracy decreases significantly. The first layers have great vulnerability to faults, even in small number of faults. By increasing the fault rate, successive layers will expose their vulnerability to faults. As shown in these figures, by 20% faults and data change range of 80%, the accuracy degrades to 7%-20%, which is extremely less than a random and untrained network. IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 20249 Min Accuracy: 28.66% Max Accuracy: 99.44% Baseline Accuracy: 99.42% (a) Min Accuracy: 12.59% Max Accuracy: 89.43% Baseline Accuracy: 89.41% (b) Min Accuracy: 12.59% Max Accuracy: 89.43% Baseline Accuracy: 89.41% (c) Fig. 9. Confusion matrix of baseline accuracy compared with minimum and maximum accuracy of faulty CNN. Classification of (a) MNIST dataset with SimpleNet model, (b) MNIST dataset with LeNet5, and (c) Cifar10 dataset with ResNet18. 3) Effect of multiple SaH and SaL faults in each layer: In the third step, to study the sensitivity to multiple SaH and SaL faults, more than one fault with the value of the maximum and minimum amounts have been injected into the weight, kernel, and bias matrices. The maximum and minimum values indicate SaH resistance and SaL resistance, respectively. For this reason, a portion of the learning parameter has been modified at random positions in each layer of the LeNet5 and SimpleNet models to either the maximum or minimum value, or a combination of both. The results of injecting SaL and SaH faults in different layers of LeNet5 and SimpleNet models are shown in Fig. 12 and Fig. 13, respectively. Fig. 12a and 13a show the accuracy of networks resulting from injection of the SaL faults, and Fig. 12b and Fig. 13b show the results of injecting SaH faults. In these figures, each line shows the accuracy of injecting faults in different iterations of experiments in its corresponding layers while the other layers are fault-free. In each fault rate, maximum, minimum, and average fault injection experiments are denoted by a specific line. As shown, by increasing the number of faulty cells, the accuracy of the neural network decreases drastically. In addition, the effect of SaL faults on accuracy degradation is significantly higher than that of SaH faults. Fig. 14 shows that the results of the combination of SaL and SaH faults are almost similar to the results of Fig. 12a and 13a, which indicates the greater vulnerability of the neural network to SaL faults. C. Fault Injection in Hardware-Level of Inference Phase Fault injection in the processing platform of the ReRAM- based accelerator is done by changing the MemTorch sim- ulator [13] which models ReRAM-based accelerators. This IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 202410 0 10 20 30 40 50 60 70 80 90 100 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 Fault Rate: 0.0001Fault Rate: 0.002Fault Rate: 0.005Fault Rate: 0.01Fault Rate: 0.02Fault Rate: 0.1Fault Rate: 0.2Fault Rate: 0.5 Accuracy (%) Fault Values (Ranging from 0.05X to 10X) conv1.weightconv1.biasconv2.weightconv2.biasfc1.weight fc1.biasfc2.weightfc2.biasfc3.weightfc3.bias (a) 0 10 20 30 40 50 60 70 80 90 100 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 Fault Rate: 0.0001Fault Rate: 0.002Fault Rate: 0.005Fault Rate: 0.01Fault Rate: 0.02Fault Rate: 0.1Fault Rate: 0.2Fault Rate: 0.5 Accuracy (%) Fault Values (Ranging from 0,05X to 10X) conv1.weightconv1.biasconv2.weightconv2.biasfc1.weight fc1.biasfc2.weightfc2.biasfc3.weightfc3.bias (b) Fig. 10. CNN accuracy under different number of faults injected to weights and kernels by different value in LeNet5. (a) Minimum accuracy and, (b) Average accuracy. 0 10 20 30 40 50 60 70 80 90 100 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 Fault Rate: 0.0001Fault Rate: 0.002Fault Rate: 0.005Fault Rate: 0.01Fault Rate: 0.02Fault Rate: 0.1Fault Rate: 0.2Fault Rate: 0.5 Accuracy (%) Fault Values (Ranging from 0,05X to 10X) conv1.weightconv1.biasconv2.weightconv2.bias fc1.weightfc1.biasfc2.weightfc2.bias (a) 0 10 20 30 40 50 60 70 80 90 100 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 0.05 0.20.8 148 Fault Rate: 0.0001Fault Rate: 0.002Fault Rate: 0.005Fault Rate: 0.01Fault Rate: 0.02Fault Rate: 0.1Fault Rate: 0.2Fault Rate: 0.5 Accuracy (%) Fault Values (Ranging from 0.05X to 10X) conv1.weightconv1.biasconv2.weightconv2.bias fc1.weightfc1.biasfc2.weightfc2.bias (b) Fig. 11. Accuracy of different number of faults injected to weight or kernel by different value in SimpleNet. (a) Minimum accuracy and, (b) Average accuracy. IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 202411 0.010.20.51.02.010.020.050.0 Number of Faults Injected (%) 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) MNIST - LeNet - Injecting SaL Faults conv1.weight conv1.bias conv2.weight conv2.bias fc1.weight fc1.bias fc2.weight fc2.bias fc3.weight fc3.bias (a) 0.010.20.51.02.010.020.050.0 Number of Faults Injected (%) 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) MNIST - LeNet - Injecting SaH Faults conv1.weight conv1.bias conv2.weight conv2.bias fc1.weight fc1.bias fc2.weight fc2.bias fc3.weight fc3.bias (b) Fig. 12. Injection of faults in different layers of LeNet5, (a) SaL and (b) SaH 0.010.20.51.02.010.020.050.0 Number of Faults Injected (%) 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) MNIST - SimpleNet - Injecting SaL Faults conv1.weight conv1.bias conv2.weight conv2.bias fc1.weight fc1.bias fc2.weight fc2.bias (a) 0.010.20.51.02.010.020.050.0 Number of Faults Injected (%) 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) MNIST - SimpleNet - Injecting SaH Faults conv1.weight conv1.bias conv2.weight conv2.bias fc1.weight fc1.bias fc2.weight fc2.bias (b) Fig. 13. Injection of faults in different layers of SimpleNet, (a) SaL and (b) SaH SaL:0.2, SaH:0.5 SaL:1, SaH:1 SaL:1, SaH:10 SaL:2, SaH:1 SaL:2, SaH:10 SaL:20, SaH:10 SaL:20, SaH:20 SaL:50, SaH:10 Number of Faults Injected (%) 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) MNIST - LeNet - Injecting SaL and SaH Faults conv1.weight conv1.bias conv2.weight conv2.bias fc1.weight fc1.bias fc2.weight fc2.bias fc3.weight fc3.bias (a) SaL:0.2, SaH:0.5 SaL:1, SaH:1 SaL:1, SaH:10 SaL:2, SaH:1 SaL:2, SaH:10 SaL:20, SaH:10 SaL:20, SaH:20 SaL:50, SaH:10 Number of Faults Injected (%) 0 10 20 30 40 50 60 70 80 90 100 Accuracy (%) MNIST - SimpleNet - Injecting SaL and SaH Faults conv1.weight conv1.bias conv2.weight conv2.bias fc1.weight fc1.bias fc2.weight fc2.bias (b) Fig. 14. Injection of combination of maximum and minimum faults in different layers of (a) LeNet5 and (b) SimpleNet IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 202412 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 0.010.20.512102050 Accuracy Degradation (%) Number of Faulty Cells (%) SimpleNet-SaL LeNet5-SaL SimpleNet-SaH LeNet5-SaH (a) 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% SaL:0.2, SaH:0.5 SaL:1, SaH:1 SaL:1, SaH:10 SaL:2, SaH:1 SaL:2, SaH:10 SaL:20, SaH:10 SaL:20, SaH:20 Accuracy Dergadation (%) Number of Faulty Cells (%) SimpleNetLeNet5 (b) Fig. 15. Accuracy degradation over injecting faults in LeNet5 and SimpleNet, (a) just SaL or SaH and (b) both SaL and SaH. simulator maps the network parameters as the conductance of the ReRAM crossbar array as (4) and inputs are scaled to [-0.3,+0.3], g[i,j] = (g max − g min )(w[i,j]− w min ) (|w| max − w min ) + g off (4) where w is the weight and kernel parameters and g is the conductance of ReRAM cells. |w| max and w min are the maximum of absolute value and minimum of learning param- eters, respectively. The positive values are mapped to positive ReRAM crossbar arrays and the negative values are mapped to the conductance of negative crossbar arrays. After mapping the learning parameters of CNN to the conductance of ReRAM crossbar cells, SaH and SaL faults are injected into random cells of the crossbar. Then, the faulty CNN is tested on the test dataset, and the top-1 classification accuracy is calculated. The simulation has been performed for different numbers of SaH, SaL, and a combination of both SaH and SaL faults. SaL=10 means that 10% of ReRAM cells are stuck to the low resistance state, and SaH=0.01 means that 0.01% of ReRAM cells are stuck to the high resistance state. The results of fault injection into LeNet5 and SimpleNet CNN models mapped to a ReRAM array are shown in Fig. 15. In Fig. 15a, the dashed line shows the accuracy degradation to the baseline model in the SimpleNet, and the solid line shows the accuracy degradation due to SaL and SaH in LeNet5 model faults. Fig. 15b shows accuracy degradation due to the occurrence of both SaL and SaH faults. As the number of faulty ReRAM cells increases, the CNN model will have more learning parameters altered, and there- fore the error of the CNNs will increase. When comparing Zero One Two Three four Five Six Seven Eight Nine Predicted label Zero One Two Three four Five Six Seven Eight Nine True label 542800129201053344 1396004652022340512 643610396631872886 044200286811593066 3351005359023526813 233400336301543033 336410336101443439 334510414203991925 132010318001873486 339400496702812123 Confusion Matrix - MNIST - LeNet5 0 100 200 300 400 (a) Zero One Two Three four Five Six Seven Eight Nine Predicted label Zero One Two Three four Five Six Seven Eight Nine True label 187182171084267338115077 18947188128107323415420452 163313551173245221229253 127292242423954209211865 15128188105120402716110557 141271551464884237412173 19727223915760458611359 1652216413185352222711166 1512017810541432311722373 14417212125105362512712890 Confusion Matrix - MNIST - SimpleNet 50 100 150 200 250 300 350 (b) Fig. 16. Confusion matrix by injecting 10% SaH and 20% SaL for classifi- cation of MNIST with (a) LeNet5 and, (b) SimpleNet Fig. 15a and Fig. 15b, it is clear that the degree of accuracy reduction is dependent on SaL faults, indicating that the neural network is more vulnerable to SaL resistance faults than SaH resistance faults. A recent study of ReRAM cells reported that 9.04% and 1.75% of ReRAM cells are stuck- at high and stuck-at low resistance states, respectively [37] indicating significantly higher occurrence probability of SaH. With this aforementioned assumption and according to the data in Fig. 15, this number of faults in ReRAM crossbar cells can reduce the accuracy of the CNNs between 50% and 70% in the presence of SaL and about 10% in the presence of SaH. Although the percentage of SaH faults is higher than SaL faults, the vulnerability of SaL is much higher, so tolerating SaL faults should be prioritized. Fig. 16 depicts a confusion matrix generated by running LeNet5 and SimpleNet on a ReRAM-based CNN accelerator when the crossbar array has 20% SaL and 10% SaH. In these matrices, most of the images are predicted in the wrong class. The classification accuracy of faulty networks are about 10.23% and 10% in LeNet5 and SimpleNet, respectively. IV. SUMMERY AND DISCUSSION Starting from the behavioral model of CNN under study, the following observations were obtained by injecting different fault models at the algorithm level and in the conductivity of IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 202413 ReRAM crossbar cells. According to these findings, efficient methods for designing a fault-tolerant architecture in ReRAM- based CNN accelerators can be proposed: 1) Different parameters have a different impact on classifi- cation accuracy. These parameters contain the topology of CNNs, the types and the number of each layer, the distance of each faulty layer from the output layer, and the value and types of faults. 2) The different parameters have different vulnerabilities. For example, bias parameters in CONV layers are more immune to faults, while weights in both CONV and DENSE layers have a high impact on accuracy. 3) As the deviation of the faulty value from the original value increases, the classification error increases more, and by increasing the number of faulty cells, the error propagates more in layers. 4) Compared to other layers such as DENSE layers, con- volutional layers are more vulnerable to faults. As we go deeper into the CNNs, the vulnerability of the con- volutional layers decreases. 5) The learning parameters of the BachNorm layers are extremely vulnerable to the occurrence of faults. The classification accuracy of CNNs decreases significantly by changing the weights and biases of these layers. 6) Occurrence of shortcut connections in faulty layers propagates error in multiple layers and has high a impact on degradation of classification accuracy. 7) The number of DENSE layers affect the outputs of the faulty network. As the number of DENSE layers increases, the propagated errors in CONV layers de- crease in DENSE layers. Moreover, models with just one DENSE layer such as VGG19 and ResNet18 are more vulnerable to faults. 8) The occurrence of faults in the first layers of the convo- lutional layer causes error propagation in the networks and further reduces the accuracy of the CNNs. 9) There is a large variation in vulnerability to SaH and SaL faults. On the other hand, the probability of SaH and SaL is also different. Although the percentage of SaL cells in the crossbar array is lower than that of SaH, the vulnerability of neural networks to SaL faults is higher. It should be noted that as the number of layers increases, the computation time of exploration for different fault values and different numbers of faults in each layer will increase polynomially. Our current focus on simpler models allows us to perform more comprehensive exploration within the constraints of the study. However, a more extensive study using variable CNNs still appears to show the same trend. In addition, by utilizing time and resource efficient fault injection methods, we would use more complex CNNs as part of our future work. V. RELATED WORK Fault occurrence during neural network execution can cause errors in the output of the networks. For this reason, previous work has investigated and analyzed the types of faults and errors in these networks. The reliability of CNN accelerators such as GPU, FPGA, and ASIC against transient faults is analyzed in [1]. There is another gap in analyzing the type of faults in analog computational ReRAM. By injecting faults into different layers and parameters of the network, it is possible to understand the vulnerability of neural networks to faults. So far, several fault-injection tools have been proposed for different DNN models running on different accelerator platforms (GPU, TPU, and ASIC). Transistor-level fault sim- ulation is only done at the neuron level of spiking neural network (SNN) [43] or a small size network [44]. These models run on specific spiking-based hardware, which is for running just small and specific SNN or DNN models. In general, large-scale fault injection simulations require a fault model with a high level of abstraction. It also enables a higher level of reliability analysis that is independent of hardware implementation characteristics. For this purpose, experiments for fault injection have been performed in several aspects using the following: 1) the behavioral level of abstraction of faults in synapse or neuron of SNN [45], [46]; 2) permanent and transient bit-flip in the data path and memory to implement the CNN models [19]–[25]; 3) stuck-at fault at gate-level for TPU [18], in the resolution of activation in FPGA [17], and conductance of ReRAM crossbar cells [29]. The introduced tools deal with non-ReRAM accelerators or are for storage-based ReRAMs. The hardware methods consider fault injections for some specific small DNN models while the design of a ReRAM-based PIM accelerator requires novel methods able to capture thesystem vulnerability at a broader system level. TensorFi [25] is a fault injection tool based on the tensorflow framework, and pytorchFi [20] is based on PyTorch framework in algorithm-level proposed for fault injection in the neural network. TensorFi injects faults in the data path of neural networks and PyTorchFi changes the value of neurons and weights in specific locations. They are merely used to inject faults through random data changes without analyzing the vulnerability of different CNN models or taking the hardware platform into account. SASSIFI [23] and NVBITFI [24] are two tools for fault injection at the instruction-level of GPU can also be used for CNNs. A simulation is proposed in [19] to inject random faults into the data path of AlexNet, CaffeNet, NiN, and ConvNet for several data types of floating-point and fixed-point with differ- ent numbers of bits. Then, hardware and software methods are proposed for the Eyeriss N accelerator [47] to reduce silent data corruption (SDC) errors. In a typical application, SDC is the result of a failure when the output of the application is different from the expected output. The bit-by-bit comparison of the generated output and the original one is done to detect errors. However, the bit-by-bit comparison is meaningless in neural networks. Therefore, in this article, a new definition is presented for SDC which means that the predicted output class label is different from the desired input. It should be noted that the aforementioned tools, frame- works, and methods (described in detail in Table I) are IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 202414 TABLE I SUMMARY OF EXISTING FAULT INJECTION SCHEME. workImplementation Abstraction Level LocationPlatformFault ModelApplication Programing Language Data Type [43] HW RTLNeuronSpiking Neuron Circuit PermanentSNNsN/AN/A [44]RTLTransistorSpatially Expanded ANN Hardware PermanentSmall ANNs N/AN/A [18]Gate levelNeuronTPUPermanentDNNsN/AN/A [45]BehavioralNeuron/SynapseSpiking CircuitPermanentSNNsPythonN/A [46]BehavioralNeuronSpiking CircuitPermanentSNNsN/AN/A [17]BehavioralNeuron-Data PathFPGAPermanentQNNsN/AN/A [36]BehavioralReRAM cellsReRAM Accelerator TransientDNNsN/AN/A [25]SW/HWBehavioralWeight/Neuron- Rand/Zero/Bit flip General Python N/A TensorFlow [23], [24] SW ArchitecturalInstruction/ Register Files GPUSingle/Double bit flip AnyPython/CudaN/A [22]BehavioralWeights-PermanentCNNsPythonN/A [19]Behavioral (Algorithm) Data path/Inside and outside neuron -Permanent/ Transient DNNsC++Floating/Fix point [21] Behavioral WeightsGPUPermanentDNNsPythonFix point Application [20]BehavioralWeights/Neuron-PermanentDNNs Python Floating point PyTorch ReConFISW/HWBehavioralWeights/Kernels/bias ReRAM Accelerators PermanentCNNs Python Floating/Fix point PyTorch either intended to deal with software-level fault injection or are exclusively for non-ReRAM accelerators. Consequently, in this paper, the source of faults, errors, and reduction of accuracy in ReRAM-based PIM accelerators has been investi- gated and a detailed analysis of the effects of faults at different places of the neural network has been carried out based on the characteristics of the ReRAM accelerator. VI. CONCLUSION Convolutional Neural Networks (CNNs) are widely used in many areas, such as safety-critical systems, which need an efficient and reliable system to run. ReRAM-based PIM accelerators are a promising candidate for such applications due to their non-volatility, high density, low power usage, and, importantly, analog process-in-memory capability. Un- fortunately, ReRAM accelerators are prone to transient and permanent faults, which are unavoidable. A hardware and soft- ware approach is used in this paper to characterize the impact of permanent faults on ReRAM PIM accelerators that run large-scale CNNs. The fault injection is done in three different phases. In the first phase, the parameter changes through a range. In the second phase, maximum and minimum values are injected into different layers and different parameters of CNNs. In this phase, we observed that maximum and minimum values have different behaviors in different layers. In the third phase, SaH and SaL faults are simultaneously injected into ReRAM and the observations show that with the increasing number of faulty cells, the classification accuracy of CNNs degrades drastically. We illustrated that the output of large-scale CNNs depends on the type and value of faults, topology models, types, location, and the number of each layer, the distance of layers from the output, and types of learning parameters. We also demonstrated that the vulnerability of CNNs accuracy to SaL is significantly higher than SaH. These observations will help to optimize the design of fault-tolerant mechanisms and contribute to develop fault-tolerant ReRAM-based PIM accelerators for CNN algorithms. REFERENCES [1] Y. Ibrahim, H. Wang, J. Liu, J. Wei, L. Chen, P. Rech, K. Adam, and G. Guo, “Soft errors in DNN accelerators: A comprehensive review,” Microelectronics Reliability, vol. 115, p. 113969, 2020. [2] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE, vol. 86, no. 11, p. 2278–2324, 1998. [3] K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in International Conference on Learning Representations (ICLR), 2015. [4] W. Xu, J. Wang, and X. Yan, “Advances in memristor-based neural networks,” Frontiers in Nanotechnology, vol. 3, p. 645995, 2021. [5] P. Chi, S. Li, C. Xu, T. Zhang, J. Zhao, Y. Liu, Y. Wang, and Y. Xie, “Prime: A novel processing-in-memory architecture for neural network computation in ReRAM-based main memory,” ACM SIGARCH Computer Architecture News, vol. 44, no. 3, p. 27–39, 2016. [6] A. Shafiee, A. Nag, N. Muralimanohar, R. Balasubramonian, J. P. Stra- chan, M. Hu, R. S. Williams, and V. Srikumar, “ISAAC: A convolutional neural network accelerator with in-situ analog arithmetic in crossbars,” ACM SIGARCH Computer Architecture News, vol. 44, no. 3, p. 14–26, 2016. [7] S. Singh, X. Fan, A. K. Prasad, L. Jia, A. Nag, R. Balasubramonian, M. N. Bojnordi, and E. Shi, “Xcrypt: Accelerating lattice-based cryp- tography with memristor crossbar arrays,” IEEE Micro, vol. 43, no. 5, p. 45–54, 2023. [8] A. K. Prasad, M. Rezaalipour, M. Dehyadegari, and M. N. Bojnordi, “Memristive data ranking,” in 27th International Symposium on High- Performance Computer Architecture (HPCA), 2021, p. 440–452. IEEE TRANSACTIONS ON RELIABILITY, VOL. 74, NO. 1, JUNE 202415 [9] F. Chen, L. Song, H. H. Li, and Y. Chen, “ZARA: A novel zero-free dataflow accelerator for generative adversarial networks in 3D ReRAM,” in 56th Annual Design Automation Conference (DAC), 2019, p. 1–6. [10] L. Song, X. Qian, H. Li, and Y. Chen, “PipeLayer: A pipelined ReRAM- based accelerator for deep learning,” in International Symposium on High Performance Computer Architecture (HPCA), 2017, p. 541–552. [11] G. Yuan, P. Behnam, Z. Li, A. Shafiee, S. Lin, X. Ma, H. Liu, X. Qian, M. N. Bojnordi, Y. Wang, and C. Ding, “FORMS: Fine-grained polarized ReRAM-based in-situ computation for mixed-signal DNN accelerator,” in 48th Annual International Symposium on Computer Architecture (ISCA), 2021, p. 265–278. [12] S. A. Ghasemi, B. Jahannia, and H. Farbeh, “GraphA: An efficient ReRAM-based architecture to accelerate large scale graph processing,” Journal of Systems Architecture, vol. 133, p. 102755, 2022. [13] C. Lammie and M. R. Azghadi, “MemTorch: A simulation framework for deep memristive cross-bar architectures,” in International Symposium on Circuits and Systems (ISCAS), 2020, p. 1–5. [14] J. Li, M. Mao, and C. Chakrabarti, “Improving reliability of ReRAM- based DNN implementation through novel weight distribution,” in International Workshop on Signal Processing Systems (SiPS), 2019, p. 189–194. [15] I. Chakraborty, M. F. Ali, D. E. Kim, A. Ankit, and K. Roy, “GENIEx: A generalized approach to emulating non-ideality in memristive xbars using neural networks,” in 57th ACM/IEEE Design Automation Confer- ence (DAC), 2020, p. 1–6. [16] Z. Song, Y. Sun, L. Chen, T. Li, N. Jing, X. Liang, and L. Jiang, “ITT-RNA: Imperfection tolerable training for RRAM-crossbar-based deep neural-network accelerator,” IEEE Transactions on Computer- Aided Design of Integrated Circuits and Systems, vol. 40, no. 1, p. 129–142, 2020. [17] G. Gambardella, J. Kappauf, M. Blott, C. Doehring, M. Kumm, P. Zipf, and K. Vissers, “Efficient error-tolerant quantized neural network accel- erators,” in International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFT), 2019, p. 1–6. [18] J. J. Zhang, K. Basu, and S. Garg, “Fault-tolerant systolic array based accelerators for deep neural network execution,” IEEE Design & Test, vol. 36, no. 5, p. 44–53, 2019. [19] G. Li, S. K. S. Hari, M. Sullivan, T. Tsai, K. Pattabiraman, J. Emer, and S. W. Keckler, “Understanding error propagation in deep learning neural network (DNN) accelerators and applications,” in International Conference for High Performance Computing, Networking, Storage and Analysis (HPC), 2017, p. 1–12. [20] A. Mahmoud, N. Aggarwal, A. Nobbe, J. R. S. Vicarte, S. V. Adve, C. W. Fletcher, I. Frosio, and S. K. S. Hari, “PyTorchFI: A runtime perturbation tool for DNNs,” in 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W), 2020, p. 25–31. [21] B. Reagen, U. Gupta, L. Pentecost, P. Whatmough, S. K. Lee, N. Mul- holland, D. Brooks, and G.-Y. Wei, “ARES: A framework for quanti- fying the resilience of deep neural networks,” in 55th Annual Design Automation Conference, 2018, p. 1–6. [22] M. A. Neggaz, I. Alouani, S. Niar, and F. Kurdahi, “Are CNNs reliable enough for critical applications? an exploratory study,” IEEE Design & Test, vol. 37, no. 2, p. 76–83, 2019. [23] S. K. S. Hari, T. Tsai, M. Stephenson, S. W. Keckler, and J. Emer, “SASSIFI: An architecture-level fault injection tool for GPU applica- tion resilience evaluation,” in International Symposium on Performance Analysis of Systems and Software (ISPASS), 2017, p. 249–258. [24] T. Tsai, S. K. S. Hari, M. Sullivan, O. Villa, and S. W. Keckler, “NVBitFI: dynamic fault injection for GPUs,” in 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2021, p. 284–291. [25] Z. Chen, N. Narayanan, B. Fang, G. Li, K. Pattabiraman, and N. De- Bardeleben, “TensorFI: A flexible fault injection framework for ten- sorflow applications,” in 31st International Symposium on Software Reliability Engineering (ISSRE), 2020, p. 426–435. [26] Y. Sun, C. Ma, Z. Li, Y. Zhao, J. Jiang, W. Qian, R. Yang, Z. He, and L. Jiang, “Unary coding and variation-aware optimal mapping scheme for reliable ReRAM-based neuromorphic computing,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 40, no. 12, p. 2495–2507, 2021. [27] Q. Wang, Y. Wang, R. Luo, J. Wang, L. Ji, Z. Jiang, C. Wenger, Z. Song, S. Song, W. Ren, J. Bi, and G. Niu, “Ultrathin HfO2/Al2O3 bilayer based reliable 1T1R RRAM electronic synapses with low power consumption for neuromorphic computing,” Neuromorphic Computing and Engineering, vol. 2, no. 4, p. 044012, nov 2022. [28] M. N. Bojnordi and E. Ipek, “Memristive boltzmann machine: A hardware accelerator for combinatorial optimization and deep learning,” in 22nd International Symposium on High Performance Computer Architecture (HPCA), 2016, p. 1–13. [29] M. Zhao, B. Gao, J. Tang, H. Qian, and H. Wu, “Reliability of ana- log resistive switching memory for neuromorphic computing,” Applied Physics Reviews, vol. 7, no. 1, p. 011301, 2020. [30] I. Yeo, M. Chu, S.-G. Gi, H. Hwang, and B.-G. Lee, “Stuck-at-fault tolerant schemes for memristor crossbar array-based neural networks,” IEEE Transactions on Electron Devices, vol. 66, no. 7, p. 2937–2945, 2019. [31] G. Charan, A. Mohanty, X. Du, G. Krishnan, R. V. Joshi, and Y. Cao, “Accurate inference with inaccurate RRAM devices: A joint algorithm- design solution,” IEEE Journal on Exploratory Solid-State Computa- tional Devices and Circuits, vol. 6, no. 1, p. 27–35, 2020. [32] L. Xia, B. Li, T. Tang, P. Gu, P.-Y. Chen, S. Yu, Y. Cao, Y. Wang, Y. Xie, and H. Yang, “MNSIM: Simulation platform for memristor-based neuromorphic computing system,” IEEE Transactions on Computer- Aided Design of Integrated Circuits and Systems, vol. 37, no. 5, p. 1009–1022, 2017. [33] L. Xia, M. Liu, X. Ning, K. Chakrabarty, and Y. Wang, “Fault-tolerant training with on-line fault detection for RRAM-based neural computing systems,” in 54th Annual Design Automation Conference (DAC), 2017, p. 1–6. [34] E. Cheshmikhani, A. M. H. Monazzah, H. Farbeh, and S. G. Miremadi, “Investigating the effects of process variations and system workloads on reliability of STT-RAM caches,” in 12th European Dependable Computing Conference (EDCC), 2016, p. 120–129. [35] E. Cheshmikhani, H. Farbeh, and H. Asadi, “A system-level framework for analytical and empirical reliability exploration of STT-MRAM caches,” IEEE Transactions on Reliability, vol. 69, no. 2, p. 594–610, 2019. [36] L. Xia, W. Huangfu, T. Tang, X. Yin, K. Chakrabarty, Y. Xie, Y. Wang, and H. Yang, “Stuck-at fault tolerance in RRAM computing systems,” IEEE Journal on Emerging and Selected Topics in Circuits and Systems, vol. 8, no. 1, p. 102–115, 2017. [37] C.-Y. Chen, H.-C. Shih, C.-W. Wu, C.-H. Lin, P.-F. Chiu, S.-S. Sheu, and F. T. Chen, “RRAM defect modeling and failure analysis based on march test and a novel squeeze-search scheme,” IEEE Transactions on Computers, vol. 64, no. 1, p. 180–190, 2014. [38] K. Beckmann, J. Holt, H. Manem, J. Van Nostrand, and N. C. Cady, “Nanoscale hafnium oxide RRAM devices exhibit pulse dependent behavior and multi-level resistance capability,” Mrs Advances, vol. 1, no. 49, p. 3355–3360, 2016. [39] A. Grossi, E. Vianello, M. M. Sabry, M. Barlas, L. Grenouillet, J. Coignus, E. Beigne, T. Wu, B. Q. Le, M. K. Wootters et al., “Resistive RAM endurance: Array-level characterization and correction techniques targeting deep learning applications,” IEEE Transactions on Electron Devices, vol. 66, no. 3, p. 1281–1288, 2019. [40] S. Mittal, “A survey of ReRAM-based architectures for processing- in-memory and neural networks,” Machine learning and knowledge extraction, vol. 1, no. 1, p. 75–114, 2018. [41] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga et al., “PyTorch: An imperative style, high-performance deep learning library,” Advances in neural information processing systems, vol. 32, p. 8026–8037, 2019. [42] A. Krizhevsky, “Learning multiple layers of features from tiny images,” Tech. Rep., 2009. [43] S. A. El-Sayed, L. A. Camunas-Mesa, B. Linares-Barranco, and H.-G. Stratigopoulos, “Self-testing analog spiking neuron circuit,” in 16th In- ternational Conference on Synthesis, Modeling, Analysis and Simulation Methods and Applications to Circuit Design (SMACD), 2019, p. 81–84. [44] O. Temam, “A defect-tolerant accelerator for emerging high-performance applications,” in 39th Annual International Symposium on Computer Architecture (ISCA), 2012, p. 356–367. [45] E.-I. Vatajelu, G. Di Natale, and L. Anghel, “Special session: Reliability of hardware-implemented spiking neural networks (SNN),” in 37th VLSI Test Symposium (VTS), 2019, p. 1–8. [46] S. A. El-Sayed, T. Spyrou, A. Pavlidis, E. Afacan, L. A. Camunas- Mesa, B. Linares-Barranco, and H.-G. Stratigopoulos, “Spiking neuron hardware-level fault modeling,” in 26th International Symposium on On- Line Testing and Robust System Design (IOLTS), 2020, p. 1–4. [47] Y.-H. Chen, J. Emer, and V. Sze, “Eyeriss: A spatial architecture for energy-efficient dataflow for convolutional neural networks,” in 43rd Annual International Symposium on Computer Architecture (ISCA), 2016, p. 367–379.