## 3 Physical and Mixed Safety
### Trustworthy and Explainable SNNs  
We decided to temporarily divide AI system robustness into three categories--from the low level to the highest: hardware robustness, software stability, and inference reliability. Often, AI robustness is investigated only for the last category--inference reliability. The general-purpose hardware robustness and software stability are tested and assured earlier in the software stack, by much broader use cases, with low-level tests performed not only for the AI domain. Hence, traditional AI, which uses general-purpose hardware and primarily general-purpose software, can be investigated mainly for inference robustness. However, SNNs are targeted to utilize custom, specialized hardware--neuromorphic devices. Therefore, hardware robustness and software stability can be considered in the context of TAI as a whole, together with inference reliability. As adversarial attacks on classic ANNs/CNNs are the often addressed issue, we discuss them separately in Section 3.4. [PERSON] et al. [84] designed the Fault Simulation Framework for testing faulty behaviors of spiking Integrate-and-Fire (I&F) neuron analog model implementation. They considered standard transistor defect models, including stuck-on and stuck-off behaviors. For the passive elements (resistors and capacitors), the defect model includes variations of the parameters up to 50%. In summary, their defect model for a single analogue neuron took 46 different defects into account. They identified many defective behaviors, ranging from catastrophic states (non-functional neurons) to parametric defects (variations in spike timing compared to the nominal response). They defined a taxonomy for different neuron defects. Finally, the authors stated that these hardware-level errors can be readily reproduced on the network's behavioral level by direct changes to the model parameters. [PERSON] et al. [85] investigated neuron defects identified in [PERSON] et al. 's [84] experiments. They designed two SNNs for the classification task. The first was designed to classify digits from the N-MNIST [86] dataset, and the second was for gesture classification from IBM's DVS128 gesture dataset [87]. The first network performed with 98.08% classification accuracy and the second with 82.2% classification accuracy (with shortened samples). After the experiments, consisting of fault injection and implementing a fault repair mechanism, they proposed a neuron fault-tolerant strategy for SNNs and a fault-tolerant SNN architecture. The proposed techniques improved the overall classification accuracies. Their strategy consisted of a few mechanisms, including passive fault tolerance using dropout, active fault tolerance in hidden layers (offline self-test, an online self-test, a recovery mechanism), and active fault tolerance in the output layer. In the next research, [PERSON] et al. [88], instead of simulating an SNN, implemented it utilizing an FPGA as a neuromorphic device. Their SNN performs poker card symbol recognition tasks. The baseline for the recognition task (without fault injection) was \(85\pm 2.5\%\). The fault injection engine flips the bits of different memory segments (splitter parameters, router parameters, neuron parameters, kernel parameters, kernel weights). After that, the accuracy results were compared to the baseline performance. Based on the comparison results, the authors pointed out the list of memory segments that should be especially protected against memory faults. These are splitter parameters, router parameters, and kernel parameters. Other parameters indicate some degree of fault tolerance for bit flips in Least-Significant Bits (LSBs). However, we suppose that these parameters' LSBs' resilience indicates that some variables could be represented with fewer bits. [PERSON] and [PERSON] [89] in 2014 focused on a robust human detection system in all weather conditions. They proposed their neuromorphic vision solution, an alternative to already existing algorithms.