{"id":"59453224-b856-48fd-be70-ea85f6169911","arxiv_id":"2501.13894","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"A sensor-triggered recovery framework lets a partially damaged RISC-V soft processor on an FPGA keep running by recompiling around failed ALU units or relocating via partial reconfiguration.","lead":"This paper proposes a framework that uses delay sensors on an FPGA to detect laser or radiation attacks before they corrupt a soft RISC-V processor, then recovers from permanent damage by rewriting software to use undamaged ALU functions or by relocating the circuitry through partial reconfiguration. The work targets space systems where chips cannot be replaced and offers a path to continued operation after partial hardware damage.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The detection-to-recovery loop is never demonstrated end-to-end; sensor output, software resynthesis, and hardware reconfiguration are shown separately, so the claim that the sensor 'triggers' recovery is unsupported.","rationale":"The reader correctly identified the TDC sensing premise as a weak point, especially the lack of quantified thresholds and false-alarm data. I agree that this is part of the problem. However, the most load-bearing gap is broader: the paper never connects the sensor output to the recovery mechanisms in a live experiment. The sensing experiment, the instruction-resynthesis experiment, and the reconfiguration experiment are independent demonstrations; the claimed trigger path is only described in the framework (Section IV) and asserted in the results. Even a perfect sensor would not support the central claim without evidence that it actually invokes recovery before or during fault manifestation. The paper does contain credible building blocks and useful overhead measurements, and the missing end-to-end evidence is addressable with a straightforward experiment, so the appropriate verdict remains CONDITIONAL rather than REJECT or UNVERDICTED. My critique is not an ad hominem and does not question the authors' intent; it is a request for the specific missing causal demonstration.","tokens_in":13402,"tokens_out":3475,"duration_ms":34749,"concrete_test":"Run a live end-to-end experiment on the same Genesys-2 setup: start a MAC or Reed-Solomon workload with continuous output verification, apply the 1.0 A laser scan near the ALU, and require the on-chip sensor controller to automatically raise an NMI, execute the sanity check, select the appropriate recovery code variant or trigger partial reconfiguration without external script involvement, and resume correct output. Record (i) the calibrated threshold and its margin against the normal-operation TDC0 variation reported in Section VI-A.1, (ii) the latency from laser onset to NMI and from NMI to resumed correct output, and (iii) the number of trials and any false alarms. If the loop does not complete automatically, or if correct output is not maintained throughout, the central claim is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires a complete chain: TDC output deviation, controller threshold crossing, NMI to the core, sanity check, fault-type identification, selection/translation of a recovery binary or partial reconfiguration, and verified resumption of correct operation. The paper does not demonstrate this chain in any single experiment. Section VI-A shows only a qualitative plot (Fig. 8) of TDC0's Hamming weight changing during laser exposure, with no threshold values, no repeated trials, and no false-positive/false-negative rates; Section VI-A.1 already reports a 'slight alteration' in TDC0 during normal operation. Section VI-B evaluates software recovery on four pre-compiled assembly variants selected by an external script over UART, not by an on-chip sensor-triggered event, and the binary translator is not shown operating in real time. Section VI-C reports that the core 'immediately crashes' after high-power laser exposure and then is reconfigured manually by a computer emulating the housekeeping MCU; no timing, no automatically triggered reconfiguration, and no post-recovery output are shown. Thus, even if each component works in isolation, the paper's claimed causal mechanism — that the sensor detects radiation and triggers the recovery mechanisms before or immediately after fault occurrence, enabling uninterrupted operation — is an architectural assertion rather than an experimentally supported result. If that handoff fails, the recovery mechanisms never activate in time, and the system degrades to a crash-and-reboot scheme rather than the claimed continuous operation.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a detection- and response-based countermeasure for recovering partially damaged processors in space, using time-to-digital converter (TDC) sensors to detect radiation or glitching, software instruction resynthesis to substitute faulty ALU operations, and FPGA partial reconfiguration to relocate a more extensively damaged core. The authors implement a RISC-V Rocket core on a 28 nm Kintex-7 FPGA and use a near-infrared laser to emulate both radiation below the fault threshold and permanent hard errors. The abstract claims that the sensor can confidently detect radiation and trigger processor testing and fault recovery, enabling continuous operation without interruption.","tokens_in":13615,"tokens_out":3720,"duration_ms":36419,"significance":"If the full detection-to-recovery loop were demonstrated, this work would be a useful step toward low-overhead recovery from permanent hardware faults in space processors. The paper has several concrete strengths: the arithmetic/logic substitution transformations in Section VI-B are elementary and correct, the overhead measurements for the pre-compiled code variants in Fig. 9 are explicit, the TDC sensing approach is motivated by prior side-channel work, and the partial-reconfiguration concept is relevant to FPGA-based space systems. However, the significance of the central claim depends on an end-to-end integration that the current experiments do not provide. The paper's value at present is in the component demonstrations and the architectural blueprint, not in a validated closed-loop system.","major_comments":[{"comment":"The detection claim in the Abstract is not quantitatively supported. Fig. 8 shows only a qualitative Hamming-weight trace of TDC0 during laser exposure, with no detection threshold, no false-positive/false-negative rates, no repeated trials, and no statistical separation between normal and exposed operation. The problem is compounded by Section VI-A.1, which reports a 'slight alteration' in TDC0 during normal operation. Without a criterion distinguishing the attack-induced deviation from normal workload and environmental noise, the claim that the sensor 'confidently detect[s] the radiation' is not established.","section":"Section VI-A, Fig. 8"},{"comment":"Software recovery is not shown as an automatic response to a detected fault. The experiments use four pre-compiled assembly variants generated offline by a translator script, and an external host script selects among them via UART. The paper does not demonstrate the binary translator executing at runtime, nor does it measure the latency from a sensor-triggered event to a code switch. Consequently, Fig. 9 measures the overhead of the transformed programs, not the overhead of the proposed real-time translation mechanism, and the claim that the sensor 'triggers' the software recovery is an architectural assumption rather than a demonstrated result.","section":"Section VI-B"},{"comment":"The hardware reconfiguration demonstration does not establish an automatically triggered recovery. The text states that under a 2.5 A laser exposure the core 'immediately crashes,' and that a computer emulating the housekeeping MCU performs the reconfiguration. No timing data, no post-recovery output, and no explicit decision rule from the TDC data to the partial-reconfiguration command are provided. The phrase 'based on the TDC sensory data captured right before the laser exposure' is vague, and the claimed recovery via partial reconfiguration is therefore not demonstrated as part of a sensor-driven reaction loop.","section":"Section VI-C"},{"comment":"The claim that the sensor detects radiation 'even before a fault occurs' is not supported by the presented experiments. Section VI-A.2 uses a laser current of 1 A, which the authors state is below the 1.5 A threshold for inducing temporary faults, so the experiment only shows detection of sub-fault radiation. In contrast, the hard-error experiment in Section VI-C uses a current that crashes the core immediately. There is no experiment showing that the TDC-triggered NMI arrives early enough to interrupt the processor and preserve correct state before a fault corrupts the computation. This timing relationship is load-bearing for the promise of 'continuous operation without any interruption.'","section":"Abstract and Section VI-A.2"}],"minor_comments":[{"comment":"The phrase 'For the sake of illustrious' should be reworded; likely 'illustration' was intended.","section":"Section VI-A"},{"comment":"The figures would be far more informative if a threshold line, axis units, and the sampling rate were shown, and if multiple runs were overlaid to demonstrate repeatability.","section":"Figs. 7 and 8"},{"comment":"The description of the external script that reads TDC outputs and sends commands via UART should clearly state that this script is part of the experimental harness, not the proposed on-chip sensor controller, to avoid overstating the level of automation demonstrated.","section":"Section V-D"},{"comment":"The text interchangeably refers to a 'housekeeping microcontroller' and a host computer emulating that MCU; please consistently distinguish the emulated component from the real implementation.","section":"Section VI-B and VI-C"},{"comment":"The reserved LUTs/FFs required for partial reconfiguration are mentioned but not quantified; please report the resource overhead of the reserved regions.","section":"Section VI-C and Table I"}],"recommendation":"major_revision","confidential_remarks":"The paper has a promising architectural idea and useful component-level results, but the central claim is an end-to-end assertion that the current experiments do not validate. I recommend major revision rather than rejection because the missing integration is plausibly within the scope of a revision: the authors could add a single closed-loop experiment in which a TDC threshold crossing triggers an NMI, a sanity check identifies the faulty unit, and either the pre-compiled recovery variant or a partial reconfiguration is selected and executed with timing and post-recovery correctness verification. Repeated trials and a false-alarm analysis would strengthen the detection claim substantially."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is an honest engineering integration paper, not a breakthrough. What it does well is assemble three known ideas—TDC-based disturbance sensing, ALU instruction substitution, and FPGA partial reconfiguration—into one framework for surviving partial hard errors in a RISC-V core, and it reports concrete overhead numbers for the resynthesis step. The MAC and Reed-Solomon overhead tables (memory and cycles) are useful and likely reproducible.\n\nThe soft spot is exactly where the abstract is strongest. You claim the sensor 'confidently detects' the laser and triggers the recovery mechanisms. What you actually show is a qualitative TDC trace under laser exposure (Fig. 8), a set of pre-compiled assembly variants selected by an external script over UART, and a manual reconfiguration of the FPGA after the core crashes. At no point does a single experiment run sensor → threshold crossing → NMI → sanity check → fault-type identification → automatic selection of a recovery binary or bitstream → verified resumption of correct output. The chain is an architectural assertion, not a demonstrated result. That's a real gap, but it's an addressable one. The fix is straightforward: run the whole loop on one or more fault scenarios, report threshold values and false-alarm rates, and verify the recovered program's output.\n\nTwo smaller concerns. The TDC output during normal operation already shows 'a slight alteration' for TDC0, so you need to show that your threshold separates workload-induced drift from actual disturbances. And the hardware recovery section says the core 'immediately crashes'—so the current system is closer to detect-and-reboot than to the uninterrupted operation the abstract advertises.\n\nOn citation and math: nothing egregious. The instruction substitution transformations are elementary De Morgan and shift-add equivalents, correctly described. The reliance on your prior TDC work is fine because that work is published and the implementation is standard.\n\nBottom line: worth a serious referee if the venue is a workshop, and with the end-to-end experiment it could be a solid journal paper. As written, I'd want that one experiment before trusting the headline claim.","headline":"Useful integration of known fault-tolerance pieces, but the sensor-to-recovery loop is shown as separate experiments, not one end-to-end system.","tokens_in":14214,"tokens_out":2518,"would_cite":true,"duration_ms":22850,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A processor chip hit by permanent hardware faults can be kept running by sensing radiation before it strikes and then resynthesizing or reconfiguring around the damage.","keywords":["time-to-digital converter","radiation detection","hardware fault recovery","partial reconfiguration","instruction resynthesis","RISC-V","FPGA","space security"],"falsifier":"Run the same benchmark under normal operation for as long as the laser trial while recording the sensor near the ALU; if any normal-operation sample crosses the threshold that flagged the laser exposure, no threshold can separate benign workload noise from radiation.","tokens_in":13170,"feed_emoji":"🛰️","tokens_out":8289,"duration_ms":69604,"temperature":0.7,"pith_summary":"Satellites currently protect onboard computers from radiation with error-correcting codes and redundancy, but permanent hardware damage escapes both. This paper proposes instead to detect the radiation itself, before it turns into a fault, using small delay-based sensors embedded on the processor chip, and then to recover by rewriting affected instructions in software or, if damage is broad, by reconfiguring the damaged region of an FPGA. The authors demonstrate the chain on a RISC-V core in a 28 nm FPGA, firing a near-infrared laser to emulate radiation and permanent damage. If the detection and recovery chain works, a satellite computer could survive partial hardware destruction without a second processor standing by.","feed_headline":"Delay sensors catch radiation before faults; chip self-heals","feed_subtitle":"A laser-struck RISC-V processor on an FPGA keeps running after instruction resynthesis or partial reconfiguration.","key_machinery":"The central mechanism is the time-to-digital converter (TDC), a tapped delay line whose registers sample a delayed clock signal and output a thermometer-like pattern; it is calibrated so the Hamming weight of the output sits near half the sensor width, and any injected energy that shifts propagation delays changes that weight. A hardware sensor controller samples the TDCs, compares each against a threshold, and raises a non-maskable interrupt on deviation; the interrupt launches the soft sanity check, the translation of failed instructions, and, when needed, FPGA partial reconfiguration through the configuration port. The argument turns on this sensing-and-response chain catching the disturbance early enough that recovery can begin before the fault corrupts state.","core_discovery":"On the paper's own terms, the discovery is that a partially damaged processor can be kept running instead of being discarded, and that the damage can be caught before it corrupts execution. Any glitch or radiation pulse perturbs the chip's power delivery network and measurably changes signal propagation delays; a calibrated time-to-digital converter (TDC) placed near the arithmetic logic unit registers that change and raises a non-maskable interrupt. Software then runs a sanity check to identify which ALU component failed. If the multiplier, adder, or AND gate is lost, a binary translator resynthesizes the program using still-working instructions: multiply becomes add-and-shift, addition becomes a ripple-carry built from XOR and AND, and AND becomes NOT and OR via De Morgan's law. If damage is widespread, the system partially reconfigures the FPGA to relocate the entire core to an undamaged area. The authors report that both recovery paths restore correct operation of a RISC-V core after laser exposure.","pith_inferences":["The threshold separating benign workload-induced delay shift from attack-induced shift is the crux of any real deployment: the paper shows a qualitative jump under laser exposure but also notes a slight sensor alteration during normal operation, so a practical system needs calibrated false-positive and false-negative rates before this is safe for a satellite.","The same detect-then-resynthesize pattern could generalize beyond space to ground data centers where processors already fail randomly due to hard errors; a reconfigurable logic layer could heal such failures without human replacement.","A systematic compiler-level fallback generator could automate the resynthesis for any failing functional unit, not just the multiplier, adder, and AND gate, by precomputing equivalent instruction sequences offline and selecting them at runtime.","The clock-cycle overhead of the fallback code, such as multiplication via loops, may be too large for real-time satellite tasks; a practical system would likely keep the fast path until damage is detected and only then switch to the slow fallback, which needs testing under realistic workloads."],"forward_implications":["A satellite computer can trade triple-modular redundancy for a single commercial processor plus a small radiation-hardened housekeeping controller, if the TDC sensors reliably trigger before faults occur.","Isolated ALU failures, such as a lost multiplier, adder, or AND gate, can be survived purely in software at the cost of extra clock cycles and a modest memory footprint.","Widespread damage that would normally brick the processor can be recovered by relocating the core to reserved FPGA fabric through partial reconfiguration, with the paper demonstrating correctness after relocation on a short-circuited device.","The reserved resources and TDC duplication are small relative to the core, so the approach is compatible with size, weight, and power constraints if the FPGA has spare logic.","The recovery mechanisms assume the chip's communication links and its ability to be reprogrammed survive; if the whole chip is fried, the countermeasure no longer applies."],"supporting_citations":[{"why":"Supplies the tapped-delay TDC design that the paper adopts and repurposes for fault sensing.","marker":"[17]"},{"why":"Shows TDC sensors can detect voltage attacks and trigger fault recovery, the direct precedent for the sensing-response chain.","marker":"[7]"},{"why":"Establishes that remote fault attacks on FPGAs disturb the power delivery network, the physical effect the TDCs measure.","marker":"[12]"},{"why":"Demonstrates laser-based disturbance detection and mitigation on FPGAs with delay sensors and partial reconfiguration, the closest prior countermeasure.","marker":"[9]"},{"why":"Documents FPGA partial reconfiguration as the mechanism for relocating a damaged core.","marker":"[24]"},{"why":"Argues for dynamic fault tolerance through resource pooling on FPGAs in space, the conceptual basis for using reconfiguration as recovery.","marker":"[25]"},{"why":"Provides the open-source soft RISC-V processor core used as the target system.","marker":"[40]"},{"why":"Supplies the textbook add-and-shift method used to substitute a failed multiplier.","marker":"[41]"}],"fun_headline_variants":["Chip detects laser strikes before damage, then heals itself","Delay sensors spot radiation; processor recompiles to survive","RISC-V core recovers from permanent faults via software resynthesis","Hardware faults caught early; damaged ALU replaced by recompilation","Laser-proofing: fault-tolerant processor reconfigures on the fly"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the sensors and their calibrated thresholds can tell radiation-induced delay changes apart from normal workload and environmental noise, and catch the disturbance soon enough to run the self-test before a fault corrupts state.","fun_headline_variants_meta":{"raw":{"variants":["Chip detects laser strikes before damage, then heals itself","Delay sensors spot radiation; processor recompiles to survive","RISC-V core recovers from permanent faults via software resynthesis","Hardware faults caught early; damaged ALU replaced by recompilation","Laser-proofing: fault-tolerant processor reconfigures on the fly"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000775,"raw_usage":{"total_tokens":3484,"prompt_tokens":1056,"completion_tokens":2428,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":672,"completion_tokens_details":{"reasoning_tokens":2348}},"tokens_in":672,"tokens_out":2428,"duration_ms":15555,"temperature":1.0,"reasoning_tokens":2348,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T15:29:35.114330+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same benchmark under normal operation for as long as the laser trial while recording the sensor near the ALU; if any normal-operation sample crosses the threshold that flagged the laser exposure, no threshold can separate benign workload noise from radiation.","supporting_citations":[{"cited_title":"Practical implementations of remote power side-channel and fault- injection attacks on multitenant fpgas,","cited_arxiv_id":null,"evidence_quote":"Supplies the tapped-delay TDC design that the paper adopts and repurposes for fault sensing."},{"cited_title":"Fault recovery from multi-tenant fpga voltage attacks,","cited_arxiv_id":null,"evidence_quote":"Shows TDC sensors can detect voltage attacks and trigger fault recovery, the direct precedent for the sensing-response chain."},{"cited_title":"Ram- jam: Remote temperature and voltage fault attack on fpgas using memory collisions,","cited_arxiv_id":null,"evidence_quote":"Establishes that remote fault attacks on FPGAs disturb the power delivery network, the physical effect the TDCs measure."},{"cited_title":"LaserEscape: Detecting and Mitigating Optical Probing Attacks,","cited_arxiv_id":null,"evidence_quote":"Demonstrates laser-based disturbance detection and mitigation on FPGAs with delay sensors and partial reconfiguration, the closest prior countermeasure."},{"cited_title":"Koch, Partial reconfiguration on FPGAs: architectures, tools and applications","cited_arxiv_id":null,"evidence_quote":"Documents FPGA partial reconfiguration as the mechanism for relocating a damaged core."},{"cited_title":"Dynamic fault tolerance through resource pooling,","cited_arxiv_id":null,"evidence_quote":"Argues for dynamic fault tolerance through resource pooling on FPGAs in space, the conceptual basis for using reconfiguration as recovery."},{"cited_title":"The rocket chip generator,","cited_arxiv_id":null,"evidence_quote":"Provides the open-source soft RISC-V processor core used as the target system."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the textbook add-and-shift method used to substitute a failed multiplier."}],"review_version":1}