## 3 Advanced Techniques in Fault Injection and Error Rate Estimation
### Fault Injection Method  
#### 3.1.1 Soft Error Mitigation IP  
SEM (soft error mitigation) IP is Xilinx's library IP designed to protect digital circuits from soft errors [30]. SEM IP provides the ability to access configuration memory using the ICAP function. Additionally, the ECC (error correction code) and CRC (cyclic redundancy code) functions added to the configuration memory area of the FPGA are used to detect soft errors that occur in the configuration memory and mitigate their effects.  
As shown in Figure 3, SEM IP operates in five states (initialization, observation, IDLE, injection, and correction) according to external commands. This action can be observed in the waveform using the Integrated Logic Analyzer (ILA) tool, as shown in Figure 4. SEM IP consists of several states, and the description of each state is as follows:  
Figure 3: Soft error mitigation IP state diagram.  
Step 1: Initialization State  
* This is the initial state for activating SEM IP. This step checks whether the configuration memory is accessible and whether SEM IP is operating normally.
* If it can operate normally, it automatically enters the observation state.
* When the ICAP_GRANT signal is applied, it enters the initialization state.
* Upon entering the relevant state, the \"status_initialization\" signal among the output signals of SEM IP is set to high (the remaining signals are low) to indicate the current state.  
Step 2: Observation State  
* This state monitors the configuration memory for faults.
* It automatically enters the initialization state and can transition to the IDLE state using a specific command (the \"I\" command).
* Upon entering the relevant state, the \"status_observation\" signal among the output signals of SEM IP is set to high (the remaining signals are low) to indicate the current state.  
Step 3: IDLE State  
* The user waits for a command to be input to request a specific task from SEM IP.
* The users can perform the following tasks using specific external commands (R, N, O, etc.):  
* R command: Switch to SEM IP initialization state.
* N command: Access the desired configuration memory bit with a combination of 'N' and 10 hexadecimal numbers and inject a bit flip-flop fault (refer to Section 3.1.2).
* O command: Switch to SEM IP observation state.
* Upon entering the corresponding state, all output signals of SEM IP go to low to indicate the current state.  
Step 4: Injection State  
* This is a state in which the fault injection location (configuration memory address) commanded by the user is identified, and a flip-flop is triggered for the bit at the identified location.
* Once the fault injection is completed, it automatically transitions to the IDLE state and waits to receive the next command.
* Upon entering the relevant state, the \"status_injection\" signal among the output signals of SEM IP goes high (the remaining signals are low) to indicate the current state.  
Step 5: Correction State  
* This is a state in which the bit errors in the configuration memory are periodically monitored, and when a single bit error occurs, error correction and error classification are performed for the error.
* It automatically transitions to the correction state from the observation state.  
Figure 4: Soft error mitigation IP waveform.  
* Upon entering the relevant state, the output signal of SEM IP is set according to fault identification and classification, as follows: (1) Fault observation: The \"status_observation\" signal is set to high (the remaining signals are low). (2) Fault detection: The \"status_correction\" signal is set to high (the remaining signals are low). (3) Fault classification: The \"status_classification\" signal is set to high (the remaining signals are low).