The design process of digital logic has to account for many factors to ensure the production of a reliably functioning product. One such factor, especially crucial for devices meant to work in higher altitudes such as aerospace devices, is cosmic radiation: clusters of particles (protons, electrons and ions) originating from deep space or the Sun. With how small modern electronics have become, these cosmic particles can collide with structures inside microelectronics and cause, among other errors, a bit-flip - also called a single-event upset (SEU). Such errors can also occur due to other factors like electromagnetic interference, side-channel attacks, or hardware aging, to name a few.

SEUs pose a significant risk to electronic devices as they are impossible to be fully prevented. Techniques like Dual-core Lockstep (DCLS), which Antmicro has recently implemented into the CHIPS Alliance hosted VeeR EL2 core, or Triple Modular Redundancy (TMR), which we have a long history with, are designed to reduce the susceptibility of electronics to radiation-induced errors such as SEUs. With these, or any other techniques, it’s crucial to thoroughly test the designs in order to ensure that, should such an upset occur, the failsafe works and the SEU does not result in critical system failures.

To aid in this testing process, Antmicro created Faultergeist, a fault injection framework which injects bit-flips into a hardware design using Verilator, currently equipped with fault generation models meant to reflect the behavior of cosmic radiation particles upon hitting an electronic device. This article provides an overview of the tool and demonstrates its usage on a sample design.

Faultergeist

Generation and injection of faults

Faultergeist is an open source fault injection framework created for the purpose of testing electronic designs for vulnerability to SEUs. It consists of two primary tools: faultergeist-gen, and faultergeist-inject.

faultergeist-gen

Faultergeist-gen is responsible for generating the fault campaign (a sequence of faults) based on a model. Currently, Faultergeist is equipped with two statistical models that mimic SEUs which happen as a result of cosmic radiation: the Weibull model, which is used for the behavior of heavy ions, and the Bendel model, used for proton behavior. Both of these models calculate the probability of an SEU occurrence, as well as the intervals at which they happen. The models rely on physics equations, and were validated against data from irradiation experiments conducted on actual silicon - you can read the reports here (for data we used for the Weibull model) and here (for the Bendel model).

Both of the mentioned models receive inputs which characterize the particle stream, such as flux intensity, incident angle, or individual particle energy. The input data also includes parameters for the chip which is to later be injected. With this information, the models calculate an upset-effective cross section; that is, the surface area of the chip, interpreted as the probability of a particle hitting a specific cell in the chip and thus causing a bit-flip.

The stream of particles is modeled after a random Poisson process - so, the intervals between two subsequent events (in this case particle hits) are drawn from an exponential distribution. The calculated mean value of that distribution corresponds to the average SEU interval for each individual cell. After the particle stream is modeled, and the timings of the SEUs calculated, faultergeist-gen prints out a fault campaign.

At the moment, Faultergeist contains models aimed at mimicking the behavior of cosmic irradiation-induced SEUs. However, additional models can easily be created to extend its capabilities further, such as the ability to test for electromagnetic interference susceptibility or power supply errors, verify the functionality of ECCs, or for security research for side-channel access mitigation.

faultergeist-inject

The second element of Faultergeist is faultergeist-inject. It’s a VPI plugin which is linked into the simulation of the design; at runtime, it reads the fault campaign provided by faultergeist-gen, and flips the bits specified by it. The injection relies on VPI callbacks to flip the values of the specified bits during the simulation. It is only tested with Verilator, but in theory could be used by any VPI-capable simulator.

Injecting faults into a sample design

The example use case provided is ran on the worker core provided in the repository. In order to run this demonstration, make sure you have installed Verilator and Yosys.

Ensure you’re in the example directory.

cd example

Before using Faultergeist, configure and build the project:

cmake -B build -S .. -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
cmake --build build -j "$(nproc)"

Generate a netlist of signals to inject:

yosys <<EOF
  read_verilog worker/dff_worker.v
  proc
  rename -wire
  write_json netlist.json
  exit
EOF

Once the netlist is generated, you may proceed to execute faultergeist-gen in order to generate a fault campaign. For that, pass a config file to faultergeist-gen.

build/src/FaultGenerator/faultergeist-gen --config_file=config.json.in

The configuration file allows you to choose the desired model out of three possibilities; two we have already mentioned, Weibull and Bendel, as well as random, which is not physics-based, and, as the name suggests, generates SEUs completely randomly. Our example uses the Weibull model - if desired, other models may be used. To do so, adjust the config in accordance with the files from the test directory.

After passing the config, prepare the simulation code. In order for the faults to successfully be injected, Verilator requires extra arguments:

$VERILATOR \
    --binary -j "$(nproc)" \
    --vpi --public-flat-rw \
    worker/config.vlt worker/top.v worker/worker.v worker/comb_worker.v worker/dff_worker.v \
    ../src/FaultInjector/faultergeist-inject.sv \
    -LDFLAGS "-L$(pwd)/build/src/FaultInjector -lfaultergeist-inject" \
    -DFAULT_INJECTION_ENABLE \
    -DFAULT_INJECTION_CAMPAIGN_FILE="\"fault_campaign_out.csv\""

The exact explanation of each of them is provided in the GitHub repository.

Finally, run the simulation:

obj_dir/Vtop

Once it’s running, you should see the bit-flips impacting the design.

Extending testing possibilities in Verilator with custom tools

As an unavoidable phenomenon, an SEU can cause significant problems for electronics if the design does not have failsafes or protection in place. Because of that, testing for vulnerability to SEUs, visualizing the errors they may cause, and coming up with solutions is a crucial element of the design process of space-bound electronics. As a tool which bases its calculations on physics and real-life cosmic irradiation data, Faultergeist enables a thorough and permissively licensed workflow to help validate aerospace devices or critical equipment against cosmic radiation-induced errors. And due to the ability to add additional generation models, it can be easily adjusted for a variety of testing needs, such as ECC functionality, security, susceptibility to electromagnetic interference, and many more.

If you’re interested in working with Verilator, part of Antmicro’s services includes commercial support for Verilator, helping customers adjust it to their specific needs and implement it into their workflow, and be sure to come see us at ORConf 2026 in Ghent, Belgium (Sept 11-13), where we’ll talk about our ongoing work to add TMR to VeeR. For more information about our services relating to Verilator, or commissioning custom tools such as Faultergeist, reach out to us at contact@antmicro.com.