A fault campaign is a reproducible experiment specification, not a few random bit flips followed by a percentage. It records design version, targets, timing, effects, budget, oracle, and what the model cannot simulate.
Define what one attempt means
If each fire drill changes exits, smoke location, and assembly time, pass rates are not comparable. A hardware campaign must fix design version, seed, events per attempt, and whether failures/retries count as new attempts. The analogy does not show that an injection tool reaches a silicon node.
For an RTL model, enumerate targets and time windows, define effects (flip, stuck-at, skip, delay), and set a per-attempt budget. Separate fault-free controls, authorized operation, unauthorized operation, and denial of service. Preserve each counterexample’s full input sequence, first bad commit, random seed, and model hash. SYNFI demonstrates pre-silicon fault analysis on synthesized netlists; a netlist result is still not a physical injection. SYNFI.
RTL and netlist targets differ: synthesis may merge redundant logic, recode an FSM, or duplicate/remove registers. A two-stage campaign must preserve RTL-signal-to-cell mappings and unmapped targets. Classify outcomes at least as safety violation, availability failure, detected-and-blocked-in-time, detected-too-late, not activated, or tool-unobservable. “Detected” alone is not a security pass.
After fixing the design hash and fault budget, run fault-free controls, single faults, and explicitly bounded combinations. The property sketch below has not been compiled; assertions check the oracle at every acceptance, not just the alert. Coverage lists untouched target/time bins rather than hiding them behind total fault count.
The companion lab uses four target classes (ROM check_done, debug permission, first fetch, and key release) across three synthetic time bins, for twelve target/time pairs. Edge location describes where an injection is placed; it does not identify the target class. This fixed denominator is a teaching fixture, not hardware coverage.
Preserve replay evidence
Each result needs attempt ID, DUT/netlist hash, tool version, configuration, seed, target, effect, edge/window, budget, input trace, output, assertions, classification, and replay command. If a tool prunes cases whose outputs do not change, document its pruning rule and equivalence assumption.
Offline interactive lab
RTL / SVA review direction
These are property sketches: define the harness transaction, reset and oracle, then confirm sampling boundaries before binding to the design. They have not been compiled or proven. reference_authorized must come from an independent reference model outside the fault-injection targets and their influence cone. A permission bit inside the DUT cannot serve as its own oracle when that bit may also be faulted.
assert property (@(posedge clk) disable iff (!rst_n)
accepted_commit |-> reference_authorized);If accepted_commit never occurs, the property can pass vacuously. Add a separate cover for a fault-free authorized acceptance. Classify reset-disabled cycles, non-activated attempts, and late alerts separately. This snippet does not prove CDC, timing, side-channel, or physical injection behavior; each requires its own tool evidence or measurement.
Check your reasoning
- Recognition — What separates a fault attempt from a fault outcome? Reasoning: An attempt records stimulus and target. The outcome records the observed effect, accepted state, detector response, and whether acceptance preceded the alert.
- Contrast — Why is total attempts not a coverage denominator? Reasoning: Repeated attempts can hit the same target/time bin. State the full bin set, unique bins reached, and untouched bins.
- Scenario — An alert arrives after an unauthorized commit. How should the campaign classify it? Reasoning: Record both the unauthorized commit and the late alert. Do not count the alert as a timely block; outcome categories may overlap.
- Failure diagnosis — A simulator prunes cases whose outputs do not change. What must be documented? Reasoning: Record the pruning rule and its equivalence assumption, then retain a way to replay representative pruned and retained cases.
- Design risk / transfer — Another engineer must reproduce one counterexample next month. Which fields matter? Reasoning: Preserve source/netlist and tool hashes, configuration, seed, target/window, budget, input trace, output, assertion, classification, and replay command.
References
SYNFI pre-silicon fault analysis
MY ACADEMY · LESSON FILM
Lesson video
The film explains this lesson’s data path. After a section, return to the interactive exercise and change the input or fault conditions. The animation presents a teaching model; it does not replace RTL simulation.
Swipe the film horizontally, or use the arrow keys to inspect the diagrams.
Diagram scope
Teaching model · Not RTL simulation or silicon testing
Highlights show reading order, not an executed fault campaign or a hit rate
Narration uses a synthetic voice. Both the interaction and animation have model boundaries; interpret results using this lesson’s sources and validation scope.
Wrap-up: take this lesson into a design review
- Threat model and assumptions
Fix RTL/netlist hash and fault target/effect/time/budget; the asset is preventing unauthorized acceptance.
- Why the design fails
Ambiguous attempts, target mapping, or treating detection as a pass make campaigns incomparable or hide violations.
- Defenses
Use fault-free controls and classified replayable attempts; separate safety, availability, timely blocking, and tool gaps.
- Validation and checks to perform
Preserve seed, tool config, hashes, traces, first bad commit; report RTL/netlist denominators and unmapped targets separately.
- Limits and unverified claims
Digital RTL/netlist models do not establish physical reachability, frequency, location precision, or fault correlation.
Try a changed assumption
Choose one unmapped RTL target. Propose how to confirm its netlist cell and how to report an unresolved mapping.
This wrap-up summarizes the lesson’s teaching cases, references and experiment scope. Checks not reported as completed remain future work.