# Impact of Radiation-Induced Effects on Embedded GPUs Executing Large Machine Learning Models

Bruno Loureiro Coelho, Fernando Fernandes dos Santos, Matteo Saveriano, Gregory Allen, Andrew Daniel, Steven Guertin, Sergeh Vartania, Edward Wyrwas, Christopher Frost, Paolo Rech

<figure><img src="image_1.png" /></figure>

## ► To cite this version:

Bruno Loureiro Coelho, Fernando Fernandes dos Santos, Matteo Saveriano, Gregory Allen, Andrew Daniel, et al. Impact of Radiation-Induced Effects on Embedded GPUs Executing Large Machine Learning Models. IEEE Transactions on Nuclear Science, 2025, 72 (8), pp.2652-2661. 10.1109/tns.2025.3528764. hal-04887365

HAL Id: hal-04887365

https://hal.science/hal-04887365v1

Submitted on 14 Jan 2025

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>
# Impact of Radiation-Induced Effects on Embedded GPUs Executing Large Machine Learning Models

Bruno Loureiro Coelho, Fernando Fernandes dos Santos, Matteo Saveriano, Gregory Allen, Andrew Daniel, Steven Guertin, Sergeh Vartanian, Edward Wyrwas, Christopher Frost, and Paolo Rech

**Abstract**—Large machine learning (ML) models are able to outperform previous state-of-the-art ML models such as convolutional neural networks (CNNs). In this paper, we study the impact of radiation-induced effects on large ML models executing on the NVIDIA TX2 system-on-chip (SoC). In addition to characterizing the SoC hardware, we compare the radiation response of a popular CNN, ResNet-50, to two recent large ML models: Vision Transformer (ViT), and Data-efficient image Transformers (DeiT). Our evaluation includes experiments with both heavy ions and high energy protons at three different facilities. No SEL was observed in our heavy ion experiments with an LET of $37\,\text{MeV/cm}^2 \times mg$ at up to 80°C. Furthermore, we investigate how high energy protons and heavy ions at low LET affect the correct application output and limit the availability of ML applications. Our analysis reveals not only how radiation-induced errors propagate internally through the ML models all the way to the output, but also the main causes for fatal errors that lead to crashes in the operating system kernel. Particularly, the cross-sections measured for crashes were roughly 4× higher than the ones measured for silent data corruption (SDCs) for every application tested with heavy ions. Additionally, our evaluation of ML applications showed that general matrix multiplications (GeMM) presents a higher SDC cross-section than all the ML models tested (ResNet, ViT, and DeiT), roughly 21% higher with protons and 59% higher with heavy ions.

## I. INTRODUCTION

Computer vision is a key aspect of several space applications, including pre-processing images in satellites to reduce bandwidth, enabling autonomous vehicles for space exploration, or supporting docking and other critical tasks [1]. Recent breakthroughs in machine learning (ML) models, thanks to the adaptation of the transformer architecture for

This work was supported in part by the Italian Ministry for University and Research (MUR) through the “Departments of Excellence 2023-27” program (L.232/2016) awarded to the Department of Industrial Engineering, by the European Union’s 2020 research and innovation programme under grant agreement No 101008126, corresponding to the RADNEXT project, and by the Fondazione per la Valorizzazione della Ricerca Trentina VRT, CUP: E63C24001200007.

Gregory Allen, Andrew Daniel, Steven Guertin, and Sergeh Vartanian are with the Jet Propulsion Laboratory, California Institute of Technology, Pasadena, CA, USA.

Edward Wyrwas is with SSAI, Inc supporting NASA Goddard Space Flight Center, Greenbelt, MD, USA.

Christopher Frost is with ChipIR, Rutherford Appleton Laboratory, Science and Technology Facility Council, Didcot, UK (email: christopher.frost@stfc.ac.uk).

Fernando Fernandes dos Santos is with the University of Rennes, CNRS, Inria, IRISA - UMR 6074, F-35000 Rennes, France (email: fernando.fernandes-dos-santos@inria.fr).

Bruno Loureiro Coelho, Matteo Saveriano, and Paolo Rech are with the Department of Industrial Engineering of the University of Trento, Italy (e-mail: bruno.loureirocoelho@unitn.it, matteo.saveriano@unitn.it, and paolo.rech@unitn.it).

image processing, have surpassed the performance of previous state-of-the-art ML approaches [2], [3]. In order to achieve highly accurate object classification and detection, which is essential to ensure safety, these transformer models contain an extremely large number of parameters, thus being referred to as *large* machine learning models. Fortunately, despite these models being indeed large, modern low-cost hardware accelerators, such as embedded graphics processing units (GPUs), are capable of executing ML models efficiently [4].

While several tasks benefit from it, deploying ML applications in space introduces new reliability challenges [5]–[8]. While some radiation-hardened devices are available in the market, these are extremely expensive, offer poor performance, and have low power-efficiency, which make them unsuitable to run large ML models [1]. In contrast to radiation-hardened devices, the market is pushing the design of efficient, low-power, and low-cost ML accelerators to enable the use of ML at the edge. While these accelerators are highly appealing for space applications, in order to safely deploy commercial-off-the-shelf (COTS) devices in space, it is mandatory to ensure both the reliability and availability of the system [9]. Therefore, it is imperative to measure the response of COTS ML accelerators to radiation-induced single event latchups (SELs) and to the effects of total ionizing dose (TID) [10]. Furthermore, understanding how single event upsets (SEUs) propagate from the hardware to the software allows us to characterize the device availability and application correctness. In particular, we consider application or device *crashes*, and *silent data corruption* (SDCs), which silently cause the application to generate a corrupted output [1], [11].

Specifically, we evaluate the reliability of the NVIDIA Jetson TX2 system-on-chip (SoC) when exposed to heavy ions and protons. We first measure the device response to heavy ions at the Cyclotron Institute, Texas A&M University (TAMU), College Station, in Texas, USA, with an LET of $37\,\text{MeV/cm}^2mg$ while heating the device to 80°C. Then, at the RADiation Effects Facility (RADEF) in Jyväskylä, Finland, we evaluate ML applications on the TX2 using an LET of $1.5\,\text{MeV/cm}^2mg$ at room temperature. Additionally, we also evaluate large ML models at the National Center for Oncological Hadrontherapy (CNAO), in Pavia, Italy, with a 200MeV proton beam.

In our experiments, we collected operational measurements of the TX2 (including current draw and temperature), information from the operating system kernel, and data evaluating several benchmarks: basic arithmetic operations (general matrix multiplication), and three ML models - a popular con-
volutional neural network (CNN), ResNet-50, and two large
machine learning models, Vision Transformer (ViT), and Data-
efficient image Transformers (DeiT). Our analysis reveals that,
although the TX2 does not experience permanent failures nor
operating parameter degradation, the software is vulnerable
to SEUs, particularly to crashes. We investigate the fault
model for the ML applications and show how even a single
fault affecting one element propagates to several elements
of the neural network layer. Our analysis shows that, when
propagating, the original fault spreads to most downstream
layer elements, while the magnitude of the error is gradually
reduced. Furthermore, we also identify that most critical errors
in the kernel originate from SEUs on the CPU. Our detailed
analysis is useful to understand if the TX2 can be safely
employed in space applications and in promptly identifying
radiation-induced corruption in large ML models. In summary,
our contributions are: (i) we perform TID and SEL testing
with the NVIDIA Jetson TX2 using high-penetration ions,
high-LET ions, and high-energy protons; (ii) we analyze the
resilience of the DUT against radiation-induced performance
degradation; (iii) we investigate the effect of single-event
upsets on two state-of-the-art ML model architectures (CNNs
and transformers); (iv) we present data on kernel crashes,
comparing the availability of the DUT with other similar
devices reported in the literature; and (v) we perform an in-
depth analysis on the propagation of radiation-induced errors
throughout ML models.

The remainder of the paper is structured as follows. Sec-
tion II provides background information on relevant topics and
related work. Next, we describe the methodology employed in
our experiments (Section III). Our results are then presented in
Section IV, characterizing the TX2 and analyzing how SEUs
affect ML applications. We then discuss the results presented
in this work in Section V, before concluding the paper in
Section VI.

II. BACKGROUND

This section provides background information on large ML
models and on how radiation affects ML accelerators.

A. *ML for Space applications*

Researchers are showing promising results by applying ML
to several domains, including robotics [12] and autonomous
vehicles [13], which may be used in space applications [11].
This success can be attributed in great part to advances in
ML models, such as CNNs and, more recently, large machine
learning models [2], [14]. CNNs are based on convolution
layers that extract features from complex data, such as images,
allowing object classification and detection. More recently, de-
spite being originally created for natural language processing,
transformers have been shown to provide superior accuracy
compared to CNN in vision tasks like image classification and
detection.

Figure 1 shows a simplified view of the architecture of the Vision Transformer (ViT) [2], the first successful adaptation of transformers to image processing. Unlike CNNs, transformers operate on the entire image in parallel, thus improving the

model's capability to correlate elements in both a local and
global scale. While processing the entire input improves
the performance of the model, transformers are considerably
larger than CNNs, therefore being often referred to as large
machine learning models [2], [3]. This is especially true for
the core layers of the transformer architecture: the multi-layer
perceptron (MLP), and the multi-head self-attention (MHSA)
layers. Because the MLP is a fully-connected (FC) layer, it
requires a large number of multiplications and additions, which
is further increased by processing the entire input at once. This
is also true for the MHSA layers: the self-attention mechanism
is based on a query-key-value (QKV) layer architecture, which
performs matrix multiplications between massive matrices
(Q, K, and V) and the input vector (the entire image after
patch embedding). In other words, the core of the transformer
architecture is based on multiplications between several large
matrices (which are the model weights) and the input vector
(which is the entire embedded image). For instance, the Data-
efficient image Transformers (DeiT) model we test has ≈3.4×
more parameters than the ResNet-50 CNN, thus having higher
computational requirements. Fortunately, hardware accelera-
tors, such as graphics processing units (GPUs), are able to
execute these models efficiently.

B. Radiation-induced faults in GPUs

GPUs have evolved from being dedicated graphic accel-
erators to becoming a cornerstone of modern ML and high-
performance computing. The architectures of GPUs are opti-
mized to perform highly-parallel computations efficiently. This
high efficiency is achieved by a large number of computing

<figure><img src="image_3.png" /><figcaption>Fig. 1: Architecture of a vision transformer, adapted from [2].</figcaption></figure>
cores that are able to perform operations on a large amount of data in parallel. While GPUs can accelerate parallel applications, due to the nature of the architecture, a fault in a shared or critical resource may affect multiple output elements [8], [15]. Additionally, the large number of computational resources in GPUs further increases the likelihood of SEUs. Previous work has evaluated the reliability of GPUs against radiation-induced faults [11], showing how radiation affects the computations performed by these devices. Efforts towards evaluating embedded GPUs include proton testing with the NVIDIA Jetson TX2i (TX2 industrial version) [16], [17], proton testing of the Jetson Xavier [5], and photon testing of the Jetson Nano [18]. This work further advances the knowledge of embedded GPU reliability by being the first to test NVIDIA Jetson TX2 executing large ML models while exposed to heavy ions and protons.

### III. METHODOLOGY

In this section, we detail the hardware and software under evaluation, the characteristics of the heavy ion and proton beams, and the experimental setup.

#### A. Device under test

The device under test (DUT) is the NVIDIA TX2 SoC, which includes two CPUs: a quad-core ARM Cortex-A57 MPCCore, and a dual-core NVIDIA Denver 2 64-bit CPU; the SoC also has a 256-core NVIDIA Pascal GPU and 8GB 128-bit LPDDR4 memory. The TX2 has a power draw that ranges from 7.5W to 15W depending on the settings configured by the user. In our experiments, we used a best-performance configuration, resulting in a power draw of up to 15W during heavy workloads. We first characterize the SoC response to SEL without running any application (GPU is idle). Then, we enable only one ARM core to run applications, leaving every other core of both CPUs disabled. This is done in order to reduce the chances of crashes, as the operating system is executed on the embedded CPUs, which are irradiated.

For the experiments at TAMU, the DUTs were thinned to ≈70µm of residual silicon, whereas stock (not thinned) DUTs were used at RADEF with a high-penetration *O* beam, and at CNAO with high-energy protons.

#### B. Beam characteristics

Our experiment at TAMU used a beam of Kr with an LET in silicon of 37MeV/cm²mg. This experiment was first performed at room temperature and then again at 80°C. The experiment at RADEF was performed at room temperature with an air flow to cool the device and used a beam of *O* with an LET of 1.5MeV/cm²mg. The total fluence was 2×10⁷ions/cm² at TAMU and 4.27×10⁸ions/cm² at RADEF. Our experiment with protons at CNAO used a 200 MeV beam at room temperature, with a total fluence of ≈39.53×10⁹ protons/cm².

<figure><img src="image_4.png" /><figcaption>Fig. 2: TX2 test setup installed at RADEF, Jyväskylä.</figcaption></figure>

#### C. Experimental setup

During the SEL test, the DUT was idle, i.e., only the Ubuntu operating system was running on the SoC. The SEU tests were performed at RADEF and CNAO, with Figure 2 showing the experimental setup at RADEF. The DUT is mounted in front of the heavy ion beam shutter, with the DUT heat sink removed from the board to allow the beam to target the die area. Additionally, a continuous air flow was blown to the die surface to ease heat dissipation.

Figure 3 shows a simplified view of the methodology employed during the heavy ion experiments, where a supporting device (not irradiated) automatically controlled the beam shutter. In order to minimize TID in the SEU test, we used a Raspberry Pi 4 to send the electrical signal to the panel responsible for the beam shutter to be opened only when the DUT was performing the main computations of each application (described in Section III-F), while the shutter was closed during setup, warm up, memory download, result checking, reboot, and power cycle. This was achieved by the DUT communicating with the server application (on the Raspberry Pi 4) via simple User Datagram Protocol (UDP) messages with commands to open or close the shutter. As also shown in Figure 3, in each iteration, the DUT checks the computed output against the fault-free golden output. Due to the nature of the device, both the CPU and GPU are irradiated, therefore we perform this comparison in the GPU to reduce comparison time. If an error is detected, the beam is turned off (as previously described), and the entire output is downloaded to the server for posterior analysis. With this methodology, there is minimal CPU intervention required, thus each fault-free iteration consists mostly of GPU kernel time. The server was also responsible for automatically (re)starting the application whenever a software crash or hang happened. Application-level crashes are identified by the DUT and communicated to the server, whereas software (kernel or application) hangs are automatically detected by the server via a watchdog. As shown in Figure 4, when the DUT was unresponsive, the server automatically power-cycled the DUT via a smart power outlet.

In the proton experiment at CNAO, it was not possible to
<figure><img src="image_5.png" /><figcaption>Fig. 3: Software setup for the experiments with heavy ions.</figcaption></figure>

automatically control the beam due to the way the irradiation is performed: each run (called *treatment*) is configured to deliver a number of spots - 200 spots in our experiments. Each spot then irradiates the target with a configured number of protons; we used spots with $4 \times 10^7$ protons, except for two runs (treatments) with spots of $6 \times 10^7$ protons each, thus resulting in $8 \times 10^9$ protons per treatment (and $12 \times 10^9$ for the two runs with more protons per spot). Each treatment ends once every spot is delivered, and a new treatment must be manually triggered.

The beam spot had a diameter of 3cm at RADEF, and roughly 1.22cm at CNAO, thus all facilities had beam spots sufficiently large to uniformly irradiate the whole TX2 SoC.

The experiments at TAMU with high-LET ions used a flux of $2 \times 10^4$ ions/cm$^2$/s, while the experiments at RADEF with high-penetration ions used a flux of $3 \times 10^4$ ions/cm$^2$/s. As previously explained, because CNAO is a radiation facility focused on medical treatments, the proton beam is delivered in a number of spots, which comprises a *treatment*. During our experiments, the accelerator produced a proton beam with a flux of $4 \times 10^8$ protons/cm$^2$/s. However, each spot only delivered $4 \times 10^7$ protons, i.e., the shutter was only open for long enough to deliver that many protons.

### D. Operating system kernel logs collection

As shown in Figure 4, we collected and stored logs from the operating system kernel by using the UART1 serial port of the DUT. This setup prevents overloading the network with kernel logs, and avoids additional computational overheads to the DUT introduced by other approaches. During each (re)boot attempt, the DUT first runs the boot loader, which then selects and loads a kernel. In our analysis (in Section IV-E), we consider the kernel errors that happened during *loading*, i.e., either while the boot loader was running or while the kernel

was initially loading, and during normal operating system execution, i.e., everything after the user login prompt, including when the ML applications were running. Additionally, we identify and classify errors happening in the CPU or GPU, comparing how each of these components contribute to the overall availability of the DUT. In our analysis, every CPU hang required restarting the kernel (operating system), while GPU hangs only required restarting the application (not the entire operating system). All of the CPU hangs observed were detected by the kernel, which then triggered an auto-reboot event.

### E. Voltage, power, current, and temperature measurements

We recorded measurements for the voltage, power, and current of 12 components of the NVIDIA TX2, which include GPU, CPUs, main memory, and other cores (I/O, networking, etc.). These measurements were frequently read from the device i2c directories by the DUT and sent to the server, which then stored these logs. We also recorded the temperature measurements for the DUT, which the board automatically measures for the CPU cluster, GPU, and the die area near the GPU. The DUT reads each measurement every 5ms to detect critical readings, but logs only once every 1 second to avoid overloading the server network.

### F. Software applications

During the SEU test, we evaluated 4 applications (tested one at a time): (i) general matrix multiply (GeMM); (ii) ResNet-50 convolutional neural network (CNN); (iii) Vision Transformer (ViT), and (iv) Data-efficient image Transformers (DeIT). All applications tested were written in Python 3 v3.6.9, with PyTorch v1.10.0 and CUDA 10.2.

GeMM is a cornerstone operation for CNNs and transformer models, as the core operations performed by these models can be efficiently mapped to matrix multiplications. Therefore, evaluating the reliability of GeMM is an effective way of characterizing the underlying hardware while also providing valuable insight into the basic blocks of ML models. We tested GeMM with sizes 2048×2048 and 4096×4096 single-precision floating-point values (FP32). The matrix sizes were chosen to saturate the GPU resources so not to underestimate the device cross-section.

ResNet-50 is one of the most widely used CNNs for image classification, achieving satisfactory accuracy while being relatively lightweight. In our tests, we used the pre-trained ResNet-50 model available in PyTorch's vision module (torchvision).

Then, we evaluated ViT [2], the vision transformer used as base by more recent models, and DeiT, a transformer model recently proposed by Facebook [3]. For our experiment, we used the pre-trained ViT and DeiT models available from the Timm/HuggingFace model database [19]. Between CNN and transformer architectures, the latter are generally larger: DeiT requires nearly 3.4× more GPU memory than the ResNet-50 (97.7MB for ResNet, 330.2MB for DeiT).

When testing GeMM we log the corrupted output to identify potential patterns of multiple element corruptions while when
<figure><img src="image_6.png" /><figcaption>Fig. 4: Server setup for the experiments with heavy ions.</figcaption></figure>

testing the neural networks we also check the output of each layer to identify when the fault occurred in the network and how it propagates till the output.

## IV. RESULTS

This section presents the results obtained from our experiments with heavy ions and protons. First, we characterize the Jetson TX2 DUT based on the SEL and TID testing (§IV-A), and the operational measurements collected during the low-LET heavy ion and high-energy proton tests (§IV-B). Then, we focus on analyzing how SEUs propagate from the hardware to the software, first measuring cross-sections for SDCs and crashes (§IV-C), before further analyzing how SDCs affect the application output (§IV-D), and the reasons for kernel crashes (§IV-E).

### A. SEL and TID

The experiment at TAMU with high-LET heavy ions (as described in Section III-C) focused on testing the DUT for SEL and TID effects. This experiment included a total of three runs with a flux of $2 \times 10^4 \text{ions/cm}^2/\text{sec}$, except for the first run, which started with a flux of $1 \times 10^3 \text{ions/cm}^2/\text{sec}$ before increasing it to match the flux used for the rest of the experiment. The first run subjected the DUT to $1 \times 10^7 \text{ions/cm}^2$ at room temperature, before the second run repeated the experiment at 80°C, irradiating the DUT with another $1 \times 10^7 \text{ions/cm}^2$. Finally, we performed a last run with another board (also a Jetson TX2) at 80°C for a total of $1 \times 10^7 \text{ions/cm}^2$. After irradiation both boards that were tested remained functional, with no observable SEL or TID effects measured - a promising result for the reliability of the TX2 in space applications.

### B. Impact of radiation on voltage, current, and temperature

We analyzed the measurements logged in order to determine whether heavy ion and proton radiation affect the power,

<figure><img src="image_7.png" /><figcaption>Fig. 5: Measurements for DeiT during normal program execution and last measurement before an application crash (DUE).</figcaption></figure>

current, and voltage draw of the DUT. Since the voltage did not change significantly throughout the experiment, we only show results for the current (the power draw follows the current draw due to stable voltage).

Figure 5 shows a comparison of (in blue) stable current measurements (i.e., in normal computations, after the application already warmed up) and (in orange) the last current measurement before a crash occurred for the DeiT application during the heavy ion tests at RADEF. A similar analysis was performed for each application considering both crashes and SDCs (separately), with every analysis presenting a similar behavior to the one shown in Figure 5. As shown in the figure, because there is no sign of spikes right before crashes, we cannot find a direct correlation between current/voltage measurements and radiation events.

We also performed a fine-grained analysis over each log from the experiment, with Figure 6 showing the measured current draw from a sample log of each application, at a rate of 1 log per second. After the setup phase (including warm up), the measurements for GEMM and DeiT are very stable, while ResNet periodically alternates between two different patterns. This behavior for ResNet is not caused by radiation (it is present even without radiation) and is likely due to the low occupancy of the GPU by ResNet. As each iteration is short, synchronization with the host CPU induces GPU throttling, thus leading to the observed behavior. Although some peaks can be observed in the measurements (e.g., an increase of ≈ 8.9% current draw for GeMM 2048x2048 around measurement #200), these are not related to SDCs or crashes but are intrinsic variations caused by the GPU utilization, not induced by radiation. The same trend is observed for all applications and events observed.

The analysis of the temperatures for each thermal zone (described in Section III-E) also did not reveal any correlation between radiation-induced events and temperature changes. The temperatures of the CPU stabilized around 60±3°C for all applications (except idling) during heavy ion experiments, and around 80±5°C during proton experiments. This difference in the temperature of the CPU should not surprise since we did not cool down the DUT with air during the proton experiments like it was done in the low-LET heavy ion experiments. Figure 7 shows the temperature of the GPU measured during sample runs of the GeMM and ViT applications in both heavy
<figure><img src="image_8.png" /><figcaption>Fig. 6: Sample GPU current measurements throughout a run of each application. Innocuous not radiation-related spikes occur.</figcaption></figure>

<figure><img src="image_9.png" /><figcaption>Fig. 7: Temperatures observed for GeMM and ViT during experiments. The DUT was not cooled with air during the proton experiments.</figcaption></figure>

ion and proton experiments. In general, the measurements for both the CPU and the GPU stabilized after around a minute (roughly 60 measurements), with the GPU reaching higher temperatures than the CPU due to higher utilization by the applications. When comparing applications with heavy ions, GeMM (2048x2048, in the figure) saturates the GPU resources, thus causing the GPU to heat up more (roughly 78±5°C) than during the tests with the ViT model (≈75±5°C). On the other hand, because we could not cool the DUT with air during the proton experiments, both applications present similarly high temperatures for the GPU (around 95°C). The remaining applications were also quite stable, with the temperature of the GPU stabilizing around 72±2°C for GeMM 4096x4096 and 65±2°C for ResNet and DeiT.

These results attest that, for the LET tested, no radiation-induced SEL or operational parameter variations were observed with heavy ions up to a fluence of $4.27×10^8$ ions/cm², and with high-energy protons up to a fluence of ≈39.53×10⁹ protons/cm².

### C. SEUs on AI Applications

During our experiments, we observed a total of 23 SDCs and 102 crashes for the NNs, as well as 35 SDCs and 129 crashes for GeMM. In order to analyze how radiation affects the operation of the TX2, Table I and Figure 8 show

<table><caption>TABLE I: Cross-sections measured with heavy ions. Error values reported with 95% confidence intervals.</caption><thead><tr><th>Application</th><th>σ<sub>CRA SH</sub><br>(cm<sup>2</sup>)</th><th>σ<sub>SDC</sub><br>(cm<sup>2</sup>)</th><th>LET<br>(MeV/cm<sup>2</sup>mg)</th></tr></thead><tbody><tr><td>Idle (Ubuntu)</td><td>2.3 x10<sup>-6</sup></td><td>N/A</td><td>37</td></tr><tr><td>GeMM 2048x2048</td><td>4.38±2.01 x10<sup>-7</sup></td><td>0.91±1.22 x10<sup>-7</sup></td><td>1.5</td></tr><tr><td>GeMM 4096x4096</td><td>7.33±1.64 x10<sup>-7</sup></td><td>1.93±1.04 x10<sup>-7</sup></td><td>1.5</td></tr><tr><td>ResNet-50 (CNN)</td><td>4.61±2.14 x10<sup>-7</sup></td><td>0.44±1.14 x10<sup>-7</sup></td><td>1.5</td></tr><tr><td>DeiT (transformer)</td><td>4.27±1.06 x10<sup>-7</sup></td><td>0.76±0.60 x10<sup>-7</sup></td><td>1.5</td></tr></tbody></table>

<table><caption>TABLE II: Cross-sections measured with protons. Error values reported with 95% confidence intervals.</caption><thead><tr><th>Application</th><th>σ<sub>CRA SH</sub><br>(cm<sup>2</sup>)</th><th>σ<sub>SDC</sub><br>(cm<sup>2</sup>)</th><th>Energy<br>(MeV)</th></tr></thead><tbody><tr><td>GeMM 2048x2048</td><td>3.31±1.12 x10<sup>-9</sup></td><td>2.41±2.02 x10<sup>-9</sup></td><td>199.4</td></tr><tr><td>ViT (transformer)</td><td>2.73±1.12 x10<sup>-9</sup></td><td>0.83±1.96 x10<sup>-9</sup></td><td>199.4</td></tr></tbody></table>

the cross-section for crashes (availability) and SDCs (output correctness) for each application tested with heavy ions. The error values shown in Table I (and Figure 8) consider a 95% confidence interval [20]: whenever the upper and lower bounds are asymmetrical, the table reports the highest. When idle, the TX2 was simply running the operating system (the GPU was not used). The higher crash cross-section compared to the experiments with applications running on the GPU is a combination of two factors: (a) higher LET (37 vs 1.5 MeV/cm²mg) and (b) to reduce crashes and increase the probability of seeing SDCs, when testing applications, we turn on only one of the six available CPU cores, thus reducing the area sensible to crash-inducing SEUs.

Even if only one CPU is turned on, when testing applications, the cross-section for crashes is still higher than the one for SDCs. This can be explained by the architecture of the NVIDIA TX2, which makes it impossible to irradiate the GPU without affecting the embedded CPUs. Considering the GPU is responsible for data-intensive computations, SEUs on the GPU are more likely to induce SDCs, whereas SEUs on the CPU are more likely to result in crashes than SDCs [21], [22]. Interestingly, even when testing very large models such as DeiT, the crash cross-section is ≈4× higher than the one for SDCs. Our evaluation with protons reveals a similar trend, as shown in Table II (and Figure 8) (error values consider a

<figure><img src="image_10.png" /><figcaption>Fig. 8: Cross-sections measured with heavy ions and protons. Error bars consider a 95% confidence interval.</figcaption></figure>
95% confidence interval [20]): the cross-sections for crashes is higher than the one for SDCs for both GeMM and ViT. Once again, the SDC cross-section for GeMM is higher than the one for the ML application tested due to the difference in GPU occupancy: GeMM 2048x2048 is able to saturate GPU resource utilization. These results highlight the importance of detecting crashes or hangs when deploying the TX2 in space, in order to be able to quickly reboot the application or the device.

## D. Corrupted output analysis

To understand how radiation impacts the correctness of ML applications, we compare the corrupted outputs collected during experiments and the golden (fault-free) copy.

**General Matrix Multiplication (GeMM):** We multiply two square matrices (NxN), and, if any of the output elements is corrupted, the output is marked as faulty. On a GPU, it is likely that one single particle corrupts multiple parallel processes, leading to multiple corrupted elements in the output matrix. Table III shows the geometrical analysis of the GeMM output for the detected SDCs and the probability of each pattern to be observed. We categorize errors as: (1) **single** error: only one corrupted element in the output matrix; (2) **line** error: multiple corrupted elements on the same row/column; (3) **square** error: four or more elements distributed in a rectangle; and (4) **cube** error: eight or more elements in a 3D matrix distributed in a rectangular cuboid. As shown in Table III, radiation frequently leads to multiple incorrect elements: only 20% for 2048x2048 and 10% for 4096x4096 GeMM output errors affect one single element of the output matrix. Multiple errors are more likely to propagate in the neural network, thus leading to misclassifications.

**AI models:** ResNet, ViT, and DeiT each perform a sequence of operations (layers), with the output of a layer being used as the input for the subsequent layer. For each SDC we observed (i.e., a mismatch in the neural network output), we also stored the corrupted output of each layer from the first layer where the fault originates till the output. This evaluation is useful to (a) understand which layer is more likely to be corrupted and (b) track how the fault propagates through the neural network.

Table IV shows the kind of layer where the fault originates and the kind of corruption induced by radiation at the output of the layer (a 1D, 2D, or 3D vector) with SDCs grouped by the type of operation done by the layer where the fault first occurred. Interestingly, SDCs in the ResNet-50 CNN were first detected as square errors in 3D tensors (in convolution layers), which means the error propagated in 2 out of the 3 dimensions. This result is mainly due to convolutions constituting the

<table><caption>TABLE IV: Initial error shapes observed on ML models.</caption><thead><tr><th>Model</th><th>Shape</th><th>Layer type</th><th>Frequency</th></tr></thead><tbody><tr><td rowspan="8">ResNet-50</td><td>Square (3D)</td><td>convolution</td><td>100%</td></tr><tr><td>Single (2D)</td><td>fully-connected</td><td>18.2%</td></tr><tr><td>Single (2D)</td><td>query-key-value</td><td>9.1%</td></tr><tr><td>Line (2D)</td><td>fully-connected</td><td>9.1%</td></tr><tr><td>Line (2D)</td><td>query-key-value</td><td>9.1%</td></tr><tr><td>Line (2D)</td><td>projection</td><td>9.1%</td></tr><tr><td>Line (2D)</td><td>activation</td><td>9.1%</td></tr><tr><td>Square (2D)</td><td>fully-connected</td><td>27.2%</td></tr><tr><td rowspan="2">DeiT</td><td>Cube (3D)</td><td>projection</td><td>9.1%</td></tr><tr><td>Square (2D)</td><td>fully-connected</td><td>27.2%</td></tr></tbody></table>

bulk of the computations in CNNs, thus being more likely to experience SEUs. The DeiT model, however, had a distribution of SDCs affecting single elements, a line of elements, and elements in multiple dimensions (square-shaped in 2D tensors and cube-shaped in 3D tensors). It is worth noting that both the fully-connected (FC) and the query-key-value (QKV) layers are based on matrix multiplication, explaining why SEUs often affect multiple output elements.

**Propagation of SDCs.** We track how SDCs propagate through subsequent layers till reaching the CNN or transformer output. Figure 9 shows how faults propagate through the DeiT model. We plot the average difference between the erroneous and correct value at the layer output (in red) and the percentage of layer output elements that are corrupted (in blue). The figure shows, on the X axis, the relative layer number: layer 0 is *not* the first layer of the network but is the layer where the fault originates.

Figure 9 shows how errors start (lower X values) in few elements (blue bar, Y2 axis on the right), but the value of the average error is considerable (red bar, Y1 axis on the left). For instance, the initial error (X=0) is roughly 80% of the expected value (red bar), while only 3.3% of the elements of a layer are incorrect even after propagating through 3 layers (blue bar). As the radiation-induced error propagates (i.e., as X increases), the number of incorrect elements (blue) quickly increases, while the value of the average error (red) decreases. After 9 layers, the error has already spread to over 53% of the elements (blue bar), while the average error has decreased by 20× (red bar). In other words, errors start with few elements being considerably far from the expected value, then the error magnitude is diluted after few layers (≈10 layers), spreading the error to most of the elements in the layer. These results show that the evaluated ML models have some natural resilience to radiation-induced errors: given that neural networks output probabilities of objects being certain classes, small computational errors do not affect the final decision of the application. However, given that ML models require a few layers to dilute the error, this could mean that errors originating on the final layers of a model may potentially change the application outcome.

<table><caption>TABLE III: Observed error shapes for different GeMM sizes.</caption><thead><tr><th>Shape (2D)</th><th>GeMM 2048x2048</th><th>GeMM 4096x4096</th></tr></thead><tbody><tr><td>Single</td><td>20%</td><td>10%</td></tr><tr><td>Line</td><td>40%</td><td>55%</td></tr><tr><td>Square</td><td>40%</td><td>25%</td></tr><tr><td>Other</td><td>0%</td><td>10%</td></tr></tbody></table>
<table><caption>TABLE V: Kernel errors observed during experiments. GPU errors only lead to application crashes, not kernel crashes.</caption><thead><tr><th>Kernel</th><th>Error</th><th>Description</th><th>Frequency</th></tr></thead><tbody><tr><td rowspan="6">Operating System</td><td>CPU memory error</td><td>ECC-related error, such as double bit flip detection. Most common error type. Information includes values of CPU registers and kernel call trace.</td><td>42.0%</td></tr><tr><td>Critical temperature</td><td>The board automatically shuts down once a critical temperature is reached (100°C).</td><td>0.75%</td></tr><tr><td>BPMP try-wait timeout</td><td>This error cascades into several other errors, including registers being accessed without a clock.</td><td>1.0%</td></tr><tr><td>Soft lockup</td><td>Automatically identified by the operating system kernel, this watchdog timeout lists the issue as "hung tasks".</td><td>0.25%</td></tr><tr><td>Kernel paging error</td><td>This is a recursive kernel bug that requires rebooting the device.</td><td>0.5%</td></tr><tr><td>Undefined instruction</td><td>The stack trace indicates that the error first happened during the Python script.</td><td>0.25%</td></tr><tr><td rowspan="4">Bootloader or Kernel loading</td><td>CPU memory error</td><td>Similar error to the CPU memory errors in the OS kernel. This is also the most common type of error while booting.</td><td>11.0%</td></tr><tr><td>HALT: spinning forever</td><td>This error occurs at early stages during boot, before a kernel is even loaded.</td><td>4.75%</td></tr><tr><td>Hard lockup</td><td>Hard lockups are preceded by generic CPU SErrors during kernel startup.</td><td>3.5%</td></tr><tr><td>ARI request timed out</td><td>These errors usually happen either right as the kernel starts loading, or right after a generic CPU SError message.</td><td>5.25%</td></tr><tr><td rowspan="2">GPU</td><td>Single bit flip</td><td>These GPU errors are relatively common but do not cause kernel crashes.</td><td>29.25%</td></tr><tr><td>Fake MMU fault</td><td>These lead to several errors in the GPU driver but do not cause kernel crashes.</td><td>1.5%</td></tr></tbody></table>

<figure><img src="image_11.png" /><figcaption>Fig. 9: Propagation of SDCs throughout the layers of the DeiT.</figcaption></figure>

## E. Characterization of kernel crashes

In order to characterize kernel crashes that require rebooting the device, we collected data from the serial port of the TX2, thus allowing us to observe and analyze kernel and debug messages. Table V presents the types of errors observed and their proportion relative to the boot attempts during the experiments. The data shown in Table V was collected during the proton experiments, where it was not possible to automatically stop the beam during boot (as previously explained in Section III-C). Therefore, we present data on errors observed both during operating system execution, and bootloader or kernel loading. As the data collected during the heavy ion experiments only covers operating system execution, and because the errors observed had similar distribution, we only show the data for proton experiments in the table. First, this data confirms that kernel crashes requiring a reboot originate from SEUs affecting the CPU, with the fault propagating from the hardware to the software stack, inducing unrecoverable errors in the control logic of the boot loader or operating system kernel. During program execution (i.e., when the operating system kernel has completed loading), CPU memory errors

are the most common error type that lead to a kernel crash, accounting for 53% of total kernel errors, or over 60% of fatal errors (i.e., that lead to kernel crash). The CPU is also the most critical component during boot and kernel loading: although there is a variety of fatal errors, they are all tied to the CPU, whether it is a simple memory error or hard lockups (which originate from memory errors). Finally, while the GPU can also be affected by SEUs, these errors do not cause kernel crashes. Indeed, in our experiments we observed roughly twice as many CPU-related errors (which cause kernel crashes) than GPU errors (which are non-fatal).

# V. DISCUSSION

Based on the results presented in Section IV, the NVIDIA Jetson TX2 shows resilience to destructive SEL and TID effects when exposed to heavy ions with LETs of up to 37MeV/cm²mg at high temperatures, and high-energy protons at room temperature. Furthermore, the TX2 did not present significant operational measurement changes in voltage, current, power, or temperature when exposed to radiation.

Related work has evaluated other ML accelerators, such as the Versal™ VC1902 AI Engine (built on 7nm finFET) [23], the Google Coral Edge TPU (built on 12nm or 16nm finFET) [24], and the Intel Neural Compute Stick 2 (built on 16nm finFET [24]). Similarly to our evaluation of the TX2, beam experiments did not produce observable SEL effects on the VC1902, Coral Edge TPU, or the Neural Compute Stick 2 [23], [24]; additionally, the devices did not present noticeable TID effects, except for stuck bits when exposing the Coral Edge TPU to heavy ions with the highest LET tested (57.3MeV/cm²mg) [24]. These results show that COTS devices have some resilience to destructive effects, which is a positive result for the potential use of AI accelerators in space-related applications.
While the hardware may be resilient to destructive effects, SEUs often propagate from the hardware to the software stack, thus limiting device and application availability, or affecting the output of machine learning applications. Our analysis (Table V) shows that CPU memory errors often cause kernel crashes, both during normal OS operation and while booting/loading the kernel. Therefore, reducing the effect of SEUs on the device (and application) availability can be achieved by either protecting the CPU or utilizing kernels that are more robust to radiation-induced errors.

Although it is difficult to directly compare the cross-sections from our evaluation to the measurements from other experiments (due to differences in DUTs, ML models, and experimental setups), it is possible to make relative comparisons. For instance, our analysis in Section IV-C showed that, for each of the configurations tested, the cross-sections for crashes in the TX2 is ≈4× higher than the ones for SDCs. Related work has shown that discrete GPUs (i.e., *not* embedded in the SoC) also present a higher crash cross-section than SDC cross-section [25]. While both discrete and embedded GPUs often suffer from crashes, beam tests with embedded devices generally observe more crash events due to the CPU also being irradiated [8]. Experiments done with similar SoCs also show that crashes are more frequent than SDCs in embedded GPUs [5], [8], [18].

In addition to characterizing the DUT, our experimental results shown in Section IV-C revealed that the ViT architecture is more susceptible to radiation-induced errors than CNNs. Results from related work confirm this, and also show that the *criticality* of the two ML model architectures are similar [26], [27]. This behavior can be partially attributed to the size of transformer models: larger models are more likely to be affected by radiation-induced errors, but the massive number of parameters also provides similar error-masking capabilities to CNNs. Since vision transformers are recent models, there is an active thread of research into this architecture, aiming to both understand and improve their reliability.

Our analysis on how SDCs affect ML models, presented in Section IV-D, also showed that errors in transformers are often distributed in line or square shapes, especially in computation-intensive layers, such as fully-connected (FC) and query-key-values (QKV) layers. A similar behavior was observed in related work [28], where the authors analyze the shapes of error distributions in CNNs, showing that line and square (rectangular) errors in convolution layers propagate through the max-pool layers. This result agrees with our analysis of both ResNet-50 (a CNN), and the ViT and DeiT transformers - while the architectures of CNNs and transformers differ, convolutions are the computation-intensive operations in CNNs, whereas the QKV (and FC) layers are the computation-intensive layers in transformers. Interestingly, despite the radiation-induced fault model in SRAM-based FPGA configuration memory being different from AI accelerators (persistent vs transient), radiation experiments on CNNs implemented on FPGAs report consistent results compared with our data [29], [30], where the convolution layers are the most critical layers of the models tested.

Finally, our in-depth analysis of the propagation of errors

through machine learning models shows that SEUs have a significant immediate effect on computation, considering that errors start with a high magnitude. However, as the ML model propagates the error through subsequent layers, the magnitude is diluted over most elements of the layer. Furthermore, fully-connected (FC) and query-key-value (QKV) layers are the most likely to be affected by SEUs, often leading to multiple incorrect elements. Therefore, protecting the last few FC and QKV layers in a model may improve the overall robustness to SEUs by reducing the impact on the final output of the model.

## VI. CONCLUSION

This work evaluated the reliability of the Jetson TX2 when exposed to heavy ions and protons. We performed heavy ion experiments with a Kr beam with an LET of 37MeV/cm²mg, and with an O beam with an LET of 1.5MeV/cm²mg, and proton experiments with a high-energy 200MeV beam. As a highly promising result for the use of AI in space, no SELs were observed, and our analysis of the operational measurements did not reveal a direct correlation between current/voltage measurements and radiation-induced events. We also analyzed the corrupted output of ML applications, showing that errors generally start in a few elements, but with significant difference from the correct value. The ML models then propagate the errors through subsequent layers, increasing the number of incorrect elements in the layer while reducing the error magnitude.

## REFERENCES

[1] P. Rech, "Artificial neural networks for space and safety-critical applications: Reliability issues and potential solutions," *IEEE Transactions on Nuclear Science*, vol. 71, no. 4, pp. 377-404, Apr. 2024.

[2] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, "An image is worth 16x16 words: Transformers for image recognition at scale," in *International Conference on Learning Representations*, Vienna, Austria, May 2021.

[3] H. Touvron, M. Cord, M. Douze, F. Massa, A. Sablayrolles, and H. Jegou, "Training data-efficient image transformers & distillation through attention," in *Proceedings of the 38th International Conference on Machine Learning*, vol. 139, Virtual event, Jul. 2021, pp. 10347-10357.

[4] F. F. d. Santos, A. Kritikakou, J. E. R. Condia, J.-D. Guerrero-Balaguera, M. S. Reorda, O. Sentieys, and P. Rech, "Characterizing a neutron-induced fault model for deep neural networks," *IEEE Transactions on Nuclear Science*, vol. 70, no. 4, pp. 370-380, Apr. 2023.

[5] D. M. Hiemstra, C. Jin, Z. Li, R. Chen, S. Shi, and L. Chen, "Single event effect evaluation of the jetson agx xavier module using proton irradiation," in *IEEE Radiation Effects Data Workshop*, Santa Fe, NM, USA, Nov. 2020, pp. 31-34.

[6] I. Rodriguez-Ferrandez, M. Tali, L. Kosmidis, M. Rovituso, and D. Steenari, "Sources of single event effects in the nvidia xavier soc family under proton irradiation," in *IEEE 28th International Symposium on On-Line Testing and Robust System Design*, Torino, Italy, Sep. 2022, pp. 112-118.

[7] S. M. Guertin, W. P. Parker, A. C. Daniel, and P. Adell, "Recent see results for snapdragon processors," in *2019 IEEE Radiation Effects Data Workshop*, San Antonio, TX, USA, Jul. 2019, pp. 157-161.

[8] J. M. Badia, G. Leon, J. A. Belloch, A. Lindoso, M. Garcia-Valderas, Y. Morilla, and L. Entrena, "Reliability evaluation of lu decomposition on gpu-accelerated system-on-chip under proton irradiation," *IEEE Transactions on Nuclear Science*, vol. 69, no. 7, pp. 1467-1474, Jul. 2022.

[9] A. C. Daniel and G. R. Allen, "Heavy-ion test results of several commercial components for use in a class d interplanetary mission payload," in *2018 IEEE Nuclear & Space Radiation Effects Conference*, Waikoloa, HI, USA, Jul. 2018, pp. 58-62.
[10] A. D. Topper, M. V. O'Bryan, M. C. Casey, J.-M. Lauenstein, S. D. Stansberry, M. J. Campola, E. P. Wilcox, R. L. Ladbury, M. D. Berg, E. J. Wyrwas, K. Ryder, K. A. LaBel, J. A. Pellish, P. J. Majewicz, and D. J. Cochran, "Nasa goddard space flight center's compendium of total ionizing dose, displacement damage dose, and single-event effects test results," in *2019 IEEE Radiation Effects Data Workshop*, San Antonio, TX, USA, Jul. 2019, pp. 117-126.

[11] P. Rech, L. Pilla, P. Navaux, and L. Carro, "Impact of gpus parallelism management on safety-critical and hpc applications reliability," in *2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks*, Atlanta, GA, USA, Jun. 2014, pp. 455-466.

[12] Z. Durante, B. Sarkar, R. Gong, R. Taori, Y. Noda, P. Tang, E. Adeli, S. K. Lakshmikanth, K. Schulman, A. Milstein, D. Terzopoulos, A. Famoti, N. Kuno, A. Llorens, H. Vo, K. Ikeuchi, L. Fei-Fei, J. Gao, N. Wake, and Q. Huang, "An interactive agent foundation model," *arXiv preprint* 2402.05929, Feb. 2024.

[13] J. Mao, Y. Qian, J. Ye, H. Zhao, and Y. Wang, "Gpt-driver: Learning to drive with gpt," *arXiv preprint* 2310.01415, Oct. 2023.

[14] K. He, X. Zhang, S. Ren, and J. Sun, "Deep residual learning for image recognition," in *2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)*, Las Vegas, NV, USA, Jun. 2016, pp. 770-778.

[15] F. F. d. Santos, J. E. R. Condia, L. Carro, M. S. Reorda, and P. Rech, "Revealing gpus vulnerabilities by combining register-transfer and software-level fault injection," in *2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)*, Taipei, Taiwan, Jun. 2021, pp. 292-304.

[16] E. Miller, C. Heistand, and D. Mishra, "Space-operating linux: An operating system for computer vision on commercial-grade equipment in leo," in *2023 IEEE Aerospace Conference (AERO 2023)*, Big Sky, MT, USA, Mar. 2023, pp. 4066-4077.

[17] E. J. Wyrwas and T. Wilcox, "Radiation effects and analysis lessons: a scientist's field instruction to explain radiation testing." Jun. 2022. [Online]. Available: https://nepp.nasa.gov/workshops/etw2022/talks/16-JUN-THU/1600-Wyrwas-20220002512.pdf

[18] W. S. Slater, N. P. Tiwari, T. M. Lovelly, and J. K. Mee, "Total ionizing dose radiation testing of nvidia jetson nano gpus," in *2020 IEEE High Performance Extreme Computing Conference (HPEC 2020)*, Waltham, MA, USA, Sep. 2020, pp. 639-641.

[19] R. Wightman, "Pytorch image models," Feb. 2023. [Online]. Available: https://github.com/rwightman/pytorch-image-models

[20] H. Quinn, "Challenges in testing complex systems," *IEEE Transactions on Nuclear Science*, vol. 61, no. 2, pp. 766-786, Apr. 2014.

[21] V. Fratin, D. Oliveira, C. Lunardi, F. Santos, G. Rodrigues, and P. Rech, "Code-dependent and architecture-dependent reliability behaviors," in *2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)*, Luxembourg City, Luxembourg, Jun. 2018, pp. 13-26.

[22] P. R. Bodmann, G. Papadimitriou, R. L. R. Junior, D. Gizopoulos, and P. Rech, "Soft error effects on arm microprocessors: Early estimations versus chip measurements," *IEEE Transactions on Computers*, vol. 71, no. 10, pp. 2358-2369, Oct. 2022.

[23] P. Maillard, Y. P. Chen, J. Barton, and M. L. Voogel, "Single event latchup (sel) and single event upset (seu) evaluation of xilinx 7nm versal™ acap programmable logic (pl)," in *2021 IEEE Radiation Effects Data Workshop (REDW)*, Virtual conference, Jul. 2021, pp. 41-46.

[24] M. C. Casey, J. S. Goodwill, E. J. Wyrwas, R. A. Austin, C. M. Wilson, S. D. Stansberry, N. Gorius, and S. Aslam, "Single-event effects on commercial-off-the-shelf edge-processing artificial intelligence asics," *IEEE Transactions on Nuclear Science*, vol. 70, no. 8, pp. 1716-1723, Aug. 2023.

[25] F. F. Dos Santos, L. Carro, and P. Rech, "Understanding and improving gpus' reliability combining beam experiments with fault simulation," in *2023 IEEE European Test Symposium (ETS 2023)*, Venezia, Italy, May 2023, pp. 4-13.

[26] F. F. Dos Santos, P. Rech, A. Kritikakou, and O. Sentieys, "Neutron-induced error rate of vision transformer models on gpus," in *2023 23rd European Conference on Radiation and Its Effects on Components and Systems (RADECS)*, Toulouse, France, Sep. 2023, p. in press.

[27] X. Xue, C. Liu, Y. Wang, B. Yang, T. Luo, L. Zhang, H. Li, and X. Li, "Soft error reliability analysis of vision transformers," *IEEE Transactions on Very Large Scale Integration (VLSI) Systems*, vol. 31, no. 12, pp. 2126-2136, Dec. 2023.

[28] F. F. d. Santos, P. F. Pimenta, C. Lunardi, L. Draghetti, L. Carro, D. Kaeli, and P. Rech, "Analyzing and increasing the reliability of convolutional neural networks on gpus," *IEEE Transactions on Reliability*, vol. 68, no. 2, pp. 663-677, Jun. 2019.

[29] F. Libano, B. Wilson, J. Anderson, M. J. Wirthlin, C. Cazzaniga, C. Frost, and P. Rech, "Selective hardening for neural networks in fpgas," *IEEE Transactions on Nuclear Science*, vol. 66, no. 1, pp. 216-222, Jan. 2019.

[30] H. Tian, Y. Ibrahim, R. Chen, C. Jin, S. Shi, J. Xing, J. Li, and L. Chen, "Evaluation of seu impact on convolutional neural networks based on bram and cram in fpgas," *Microelectronics Reliability*, vol. 144, no. 1, p. 114974, May 2023.