I Introduction
The proliferation of lowlatency applications necessitate the implementation of Deep Neural Network (DNN) accelerators on Internetofthings (IoT) edge devices to enhance system performance. In this direction, researchers have come up with specialpurpose accelerators [1, 2] to expedite the computationally exhaustive MultiplicationAccumulation (MAC) operation of a DNN, which manifests itself as a performance bottleneck. This has been efficiently circumvented by the concept of systolic array, which is an arrangement of data processing units in a twodimensional homogeneous grid [3]. Google leveraged this concept to develop Tensor Processing Unit (TPU) as their high performing DNN accelerator [1]. TPU uses a 256 256 systolic arraybased matrix multiplication unit, furnishing 15–30 higher performance and 30–80 higher performanceperwatt over contemporary CPUs and GPUs [1]. In this paper, this TPU architecture from Google is used as a standard baseline design, although our analysis can be extended to any systolic arraybased DNN accelerator.
Any Integrated Circuit (IC) is susceptible to manufacturing defects. Faults in a system can be permanent, which result in an unexpected inference outcome. Fault analysis on an accelerator is a fundamental pillar towards calculating error probability. Prior works on faults in systolic arraybased hardware designs were discussed in
[4, 5, 6], where the authors injected faulty MAC units in the systolic array and demonstrated intense performance penalty of the network under faults. Fault mitigation approaches were also explored, either by compromising classification accuracy or by increasing area overhead. However, none of these articles focus on a formal analysis to estimate the terminating error probability.
This article focuses on developing a formal model using the DiscreteTime Markov Chain (DTMC) formalism that captures the behavior of a permanent fault in a TPU. The proposed model is analyzed using the probabilistic model checking (PMC) [7] technique to reason about the probability of misclassified outcomes. PMC is a formal verification technique that furnishes numerically exact answers to the temporal logic queries by virtue of its exhaustive analysis, in contrast to discreteevent simulations. The quantitative analysis using our model shows that the type of permanent faults (stuckat1 vs. stuckat0), the position of the permanent faults, and the number of layers in the neural network directly impact the classification accuracy of the DNN accelerator. Such analysis can aid in approximating the sensitivity of the hardware under various fault parameters, and thus can help the designers to adopt the proper fault mitigation techniques, thereby increasing the yield. To the best of our knowledge, this is the first work that proposes a formal modeling and quantitative analysis of permanent faults in DNN accelerators.
The rest of the paper is organized as follows. In Section II, the background information on a systolic arraybased TPU is presented. Section III presents the modeling of stuckat faults in the MAC array, and their propagation through the accelerator to the output. Section IV explains the experimental results and validation of our proposed model. Finally, Section V concludes the paper.
Ii Background
A neural network consists of multiple computation layers that extract relevant features from raw input data to perform prediction via the complex analytical architecture. Each layer comprises multiple neurons that perform matrix multiplication, followed by a nonlinear activation function. The complex computation of DNNs is efficiently implemented using a systolic array architecture, which is a
homogeneous grid of densely connected MAC units in commercial accelerators like TPU [1]. represents a MAC unit at the intersection of row and column. Layers are mapped onto the systolic array grid, where each column represents a neuron in a distinct layer. At first, the weight matrix is loaded into the systolic array through the weight memory and the activation inputs are loaded into the activation memory. In the first clock cycle, the unit computes the product between weight element and the corresponding activation input, after which the result is transferred vertically to and the activation input is transferred horizontally to the . In the second clock stage, the and the computes the corresponding product. This process is replicated until the accumulators finally add up the products from each column, following which the results move into the activation block to be fed into the subsequent quantization phase to meet specific hardware constraints. The quantized output is eventually provided as activation to the subsequent layer in the network.Iii Modeling
Let FTPU be a TPU whose systolic array has rows and columns while one of its MAC units has a permanent fault. Let this faulty MAC unit be denoted as , which is positioned at row and column of the systolic array. Also, let NFTPU be another TPU which has the same attributes as FTPU, but without a permanent fault. We consider a Neural Network (NN) whose attributes and related functions are given below.

[leftmargin=*]

The NN has layers, with neurons in each layer (), where represents any layer ranging from 1 to .

All layers in the network are fully connected and use the same set of weights from the matrix , where represents the weight at the intersection of row and column.

The activations provided to layer , , is defined as:
(1) where any is the activation of neuron at layer .

Let and be the row and column indices of . Also, let the multiplication result of the MAC unit loaded with be , and let the accumulation result of the same MAC unit be during the execution of layer . The activation of the next layer, , is calculated as follows:
(2) (3) (4) where is the activation function and
. We considered Rectified Linear Unit (
ReLU) as the activation function.
When a layer with neurons is being processed, only the MAC units inside the bottom leftmost square area receive and process activations. We call this zone of MAC units as the effective area. Any that satisfies the conditions and will be inside the effective area, where is defined as the inverse row number. As the effective area changes according to , the activation which arrives to a particular MAC unit also changes. To interpret which activation will be processed by a , we define a relative row number . A MAC unit, , calculates by multiplying with , and accumulates with to produce .
We focus on the problem of determining the probability of having errorfree output from FTPU if NN is feedforwarded through it. The proposed model is based on calculating and comparing the results of FTPU and NFTPU for all possible set of activations. The model exhaustively calculates the probabilities depending on the given probability distribution of each activation value inside
. We investigate this problem for three different hardware fault cases:Case 1: One bit is stuckat0 or 1 in the weight register of .
Case 2: One bit is stuckat0 or 1 in the accumulator of .
Case 3: One bit is stuckat0 or 1 in the multiplier of .
For all these three cases, we represent the index of the stuckat bit with , and type of the stuckat fault with which can be either 0 or 1. Also, we use to represent the stuckat mask.
The effect of should be expressed mathematically for each fault case in order to develop a solution to the problem. This effect is applied on all layers of individually as the systolic array is used repetitively for each layer. Let us consider Case 1. It is important to note that, when is not inside the effective area, or when the stuckat error does not change the weight loaded to it (which means masked), the stuckat fault won’t have any effect. Even if the fault changes the weight, the produced error might be masked after the activation function, or quantization.
The following equation expresses the fault effect for Case 1, , which is an integer added to after processing layer .
(5) 
The conditions in the expression represent:

(Effective area):

(Stuckat1 masked):

(Stuckat0 masked):
where , , and denotes the logicaland, logicalnegation, and bitwiseand operators, respectively. The condition states that is going to be inside the effective area. Depending on the value of , the fault can be masked inside , which is stated as condition for stuckat1, and for stuckat0.
Case 2 has two different effects. The first one is simply altering the value . The second effect can happen only if the accumulator of has stuckat1 fault. This effect is caused by triggering all MAC units with the same clock, which forces them to produce an output value at every cycle. produces a value equal to , unlike nonfaulty MAC units which produce a zero when they are not processing activations. The produced values go down through the column and the ones that reach to the bottom accumulator are added to . We define this as leaking effect.
The error representing Case 2, can be expressed as follows:
(6) 
Apart from , other conditions in the equation indicate:

(Upper effective area):

(Stuckat1 masked):

(Stuckat0 masked):
where represents logicalor operator. The condition represents an area of systolic array where does not process activation, but it effects the due to the leaking effect. Please note that, for neurons, TPU requires cycles to finish the systolic array operation. and represent the situation where stuckat fault does not change .
Lastly, we will discuss Case 3. The leaking effect behaves in the same way as in Case 2, since the output of multiplier is connected to the accumulator inside the MAC unit. The equation of the total error being produced for Case 3 defined as is as follows:
(7) 
The conditions and used in the expression denote:

(Stuckat1 masked):

(Stuckat0 masked):
Using the equations , , and , we model the FTPU and NFTPU in the presence of faults. The model has two main parts —input selection and result calculation. The input selection is modeled using a probabilistic automaton, specifically using DTMC formalism. The result calculation is modeled as a special case of probabilistic automaton to demonstrate respective deterministic behavior.
Definition 1 (ISDTMC). The process of selecting an input value for a single neuron of the first layer can be defined as a DTMC , where:

[leftmargin=*]

, where each represents an input ;

, is the initial state;

is a set of transition labels.

is a transition probability matrix such that , representing probability distribution of inputs.

is a function to label each state from the set of Atomic Propositions ;
Visual illustration of ISDTMC is given in Figure 1a, where state denotes that the input is not selected yet, and all other states represent the selected input values. Each transition has probability for selecting input , where . An ISDTMC will have transitions if
bits are used to represent the input neuron values in the TPU. The transition probabilities in a uniform distribution can be represented as
. A single neuron can be modeled using a ISDTMC model. To model number of neurons, number of ISDTMC models are required which are synchronized using the transition label. The selected input values are then passed to the output calculation part represented using the TPUFA (TPUFault Analysis) automaton.Definition 2 (TPUFA Automaton). The execution steps to analyze the outputs of NFTPU and FTPU can be defined as a special case of the probabilistic automaton where:

[leftmargin=*]

, represents the state of execution;

, is the initial state;

TL = {Init,SA,AF&Q,No Error,Error} is a set of transition labels;

is a transition probability matrix, where probabilities are set to 1, since the execution steps are deterministic.

is a function to label each state from the set of Atomic Propositions ;
The TPUFA automaton represents the execution cycle of a TPU as illustrated in Figure 1b. Firstly, it takes the transition to initialize inputs chosen by the ISDTMCs. At state , if the feedforward has not completed yet, it takes the transition SA (Systolic Array) to state and processes the next layer by doing the systolic array calculations for both the NFTPU and the FTPU. For calculating the result of FTPU, it uses the equations (5), (6) or (7), depending on the chosen fault case. Afterwards, it goes back to by transition while forwarding the results through the activation function followed by the quantization. When all the layers are processed, the TPUFA automaton compares the results of both TPUs in state . If the results are equal, then the automaton takes the transition leading to state , if not, then it takes the transition leading to .
For modeling and automated analysis of the proposed model, we use the probabilistic model checking (PMC) technique [8], more specifically, the PRISM model checker [7]. We are interested in analyzing the case where the outputs from NFTPU and FTPU are not equal. This property can be formalized in Probabilistic Computation Tree Logic (PCTL) [9] as , where “error” represents state and represent the eventually operator.
Iv Experimental Results
Iva Experimental Setup
In this section, we present the modeling results and validate them. For the experiments, we consider a systolic array prototype with a grid of MAC units. Each of the weight and the activation registers have a length of 4 bits, thereby furnishing a multiplier output of length 8 bits and an accumulator output of length 10 bits. For the DTMC model, the weights are chosen randomly for each neuron. Given a fixed width of weight and activation registers, the total number of states and transitions in the model (after the parallel composition) depends on the number of layers.
IvB Modeling Results
IvB1 Impact of Number of Layers on Error Probability
In this experiment, the probability of having an error in the output is observed for a model with incremental layers in the network, by inducing faults at individual bit positions of the weight register. Figure 1(a) and 1(d) exhibit consistent increase in error probability with the increase in number of layers from 1 to 5, as well as with the variation of stuckat positions in the weight from the Least Significant Bit (LSB) ‘0’ through the Most Significant Bit (MSB) ‘3’ for a distinct layer in the DNN model, for both stuckat0 and stuckat1 respectively. As the significance of the bit position increases from the LSB to the MSB, the deviation from the accurate value consistently enhances, thereby increasing the probability of an erroneous output. Furthermore, since all the layers in the model are fully connected, a single unmasked fault in a MAC unit of a particular layer affects all the connected nodes in the subsequent layers, thus enhancing output error probability.
IvB2 Impact of Faulty MAC Position on Error Probability
In this experiment, stuckat1 faults are introduced in each bit of the multiplier and accumulator for individual MAC units in rows one through four, all positioned in the first column of the systolic array.
Figure 1(c) and Figure 1(f) represent the variation of error probability for individual faulty MAC row locations, considering faults in the multiplier and the accumulator respectively. As the row position of a faulty MAC unit varies from one through four, it approaches nearer to final accumulator output. In this scenario, the generated error from the fault becomes difficult to mask due to reduced effect of ensuing MAC units, thereby gradually increasing the output error probability. However, after a certain bit position in both the graphs, the variation does not follow the pattern. This can be primarily subjected to overflow issues, which arise as a result of leaking effect from the stuckat1 fault in higher order bits. For example, let us consider Case 2 where , , , and the condition is satisfied. In this case, will be equal to , which will overflow and become 0 as the accumulator can only accommodate ten bits. This effect can be seen in Figure 1(f), for a specific set of random weights, where the error probability reduces to 0.125 for Row 1 when . However, bit truncation operation in the quantization phase also plays a trivial role in this phenomenon. In Figure 1(f), although overflow does not occur for , the fault gets masked as a result of quantization and the error probability plummets close to zero. On the other hand, for , even though there is an overflow effect, the error probability increases, because the cumulative effect of the fault throughout the register cannot entirely be masked by bit truncation.
IvC Validation Results
The observations from the proposed hypothesis are validated by simulating a neural network using Keras in Python. The model is trained on MNIST handwritten digit database of 60,000 images. A low classification accuracy of a model is illustrative of a high output error probability and viceversa. Both stuckat0 and 1 faults are induced in the weights and the mean accuracy is plotted, as shown in Figure 1(b) and Figure 1(e) respectively.
From the plots, it is observed that as the faulty bit position varies from LSB ‘1’ to MSB ‘7’, the impact on prediction accuracy increases, thereby corroborating our observation on the impact of faulty bit position. The increase in number of faulty layers in the network also reduces the accuracy significantly, as observed from the hypothesised fault model. The observation on faulty MAC position cannot be directly verified by the validation model as it cannot access the accumulated output of each MAC unit in the systolic array individually. However, a fault in the multiplier can be translated to a fault in the weight matrix, the impact of which have been validated as shown in Figure 1(b) and Figure 1(e). The classification model has an initial accuracy of without any stuckat faults. With the induction of fault in the seventh bit position, the accuracy reduces to an average of and for stuckat0 and stuckat1 respectively. Hence, the obtained results are coherent with the analytics derived from the formal model, thereby justifying the correctness of the model.
V Conclusion
The proposed formal model and an extensive analysis of permanent faults in a TPU provide an insight into its expected behavior. The obtained results show that the number of layers in a neural network, the type of faults and their location have a direct impact on the probability of misclassification. The proposed highlevel model can be used by the hardware designers in adopting proper fault mitigation techniques for improving the yield. Note, in addition to the number of layers, the size of the model (the number of states) also depends on the size of activation and weight registers. Since PRISM includes multiple model checking engines enabling the probabilistic verification of models of up to states, it suffers from state space explosion problem. However, different state abstraction techniques exist to overcome this issue. In the future, we plan to model the effect of temporal faults in TPUs (such as softerrors [10]).
References
 [1] Jouppi et al., “Indatacenter performance analysis of a tensor processing unit,” in 2017 ACM/IEEE 44th Annual International Symposium on Computer Architecture (ISCA), pp. 1–12.

[2]
Chen et al.
, “Eyeriss: An energyefficient reconfigurable accelerator for deep convolutional neural networks,”
IEEE Journal of SolidState Circuits, vol. 52, no. 1, pp. 127–138, 2016.  [3] H.T. Kung, “Why systolic architectures?” IEEE computer, vol. 15, no. 1, pp. 37–46, 1982.
 [4] Kung et al., “Faulttolerance and twolevel pipelining in vlsi systolic arrays,” CarnegieMellon Univ Pittsburgh PA Dept of Computer Science, Tech. Rep., 1983.
 [5] Kim et al., “On the design of faulttolerant twodimensional systolic arrays for yield enhancement,” IEEE Transactions on Computers, vol. 38, no. 4, pp. 515–525, 1989.
 [6] Zhang et al., “Analyzing and mitigating the impact of permanent faults on a systolic array based neural network accelerator,” in 2018 IEEE 36th VLSI Test Symposium (VTS), pp. 1–6.
 [7] Kwiatkowska et al., “PRISM: Probabilistic symbolic model checker,” in International Conference on Modelling Techniques and Tools for Computer Performance Evaluation. Springer, 2002, pp. 200–204.
 [8] ——, “Stochastic model checking,” in International School on Formal Methods for the Design of Computer, Communication and Software Systems. Springer, 2007, pp. 220–270.
 [9] Hansson et al., “A logic for reasoning about time and reliability,” Formal aspects of computing, vol. 6, no. 5, pp. 512–535, 1994.
 [10] Hoque et al., “Early analysis of soft error effects for aerospace applications using probabilistic model checking,” in International Workshop on Formal Techniques for SafetyCritical Systems. Springer, 2013, pp. 54–70.
Comments
There are no comments yet.