💬 NLP

ProWAFT: A ROMA-LPD Instance for Workload-Aware and Dynamic Fault Tolerance in FPGA-Based CNN Accelerators

ProWAFT is a proactive, workload-aware framework for FPGA-based CNN accelerators that dynamically optimizes the trade-off between latency, energy, and reliability by selectively applying Triple Modular Redundancy (TMR) to critical reconfigurable partitions via partial reconfiguration, achieving superior performance and fault tolerance compared to static or reactive approaches.

Original authors: Xinxin Chen, Haoran Qiao, Yiming Guo, Kecheng Luo, Siyuan Feng, Jingwen Ma

Published 2026-07-03

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Xinxin Chen, Haoran Qiao, Yiming Guo, Kecheng Luo, Siyuan Feng, Jingwen Ma

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are running a busy, high-speed factory (the FPGA accelerator) that builds complex structures called CNNs (the brain behind things like self-driving cars or facial recognition). This factory is built on a special kind of material (SRAM-based FPGA) that is incredibly fast and efficient, but it has a flaw: it's like a house of cards in a windy room. Sometimes, invisible gusts of wind (transient faults or "glitches") blow through, knocking over a few cards and causing the factory to build a slightly crooked product without anyone noticing immediately. This is called a "silent error."

The paper introduces a new manager for this factory called ProWAFT. Here is how it works, using simple analogies:

The Problem: The "All-or-Nothing" Dilemma

Previously, factory managers had two bad choices to stop the wind from knocking things over:

The "Fortress" Approach (Static TMR): They built three identical copies of every machine and made them vote on the result. If one breaks, the other two fix it.
- The Downside: This is incredibly heavy. It uses too much electricity and slows the factory down because you are running three machines for every one job.
The "Fix-It-When-Broken" Approach (Reactive Recovery): They let the machines run normally and only fixed them after a glitch was detected.
- The Downside: By the time they noticed the glitch, the factory had already stopped to fix it, causing a massive delay (latency) that ruined the schedule.

The Solution: ProWAFT (The Smart, Adaptive Manager)

ProWAFT is a "smart manager" that doesn't treat every job the same. It knows that some factory jobs are critical (like building the engine of a car) and some are less critical (like painting a bumper). It also knows that the "wind" (fault risk) changes strength throughout the day.

Here is how ProWAFT makes decisions:

1. It Reads the "Job Criticality" (Workload Criticality Score)
Imagine a conveyor belt bringing in different tasks.

If a critical task arrives (e.g., a complex calculation that, if wrong, ruins the whole product), ProWAFT says, "Okay, this is high stakes. Let's put up the shields (Triple Modular Redundancy/TMR) for this specific machine."
If a low-stakes task arrives (e.g., a simple math check), ProWAFT says, "No need for heavy shields here; let's keep the machine fast and light."

2. It Predicts the "Wind" (Fault Risk)
ProWAFT has a weather forecast for the factory floor. It knows that at certain times, the "wind" (faults) is stronger. If the forecast says a storm is coming, it proactively puts up shields before the wind hits, rather than waiting for the damage to happen.

3. It Uses "Magic Doors" (Partial Reconfiguration)
The factory has special doors that can instantly swap out a machine's internal parts without shutting down the whole building.

Instead of rebuilding the whole factory, ProWAFT opens a door, swaps a standard machine for a "shielded" one, does the critical work, and swaps it back. This is called Partial Reconfiguration.
The manager is careful not to swap doors too often, because the act of swapping takes time and energy. It only swaps when the risk of a glitch is higher than the cost of swapping.

The Result: A Balanced Factory

When the researchers tested ProWAFT on a real factory (a Xilinx Zynq chip) with 500 different jobs:

It was faster than the "Fortress" approach because it didn't waste energy shielding every single machine all the time.
It was more reliable than the "Fix-It-When-Broken" approach because it stopped problems before they caused delays.
It saved energy by only using the heavy shields when absolutely necessary.

The Bottom Line

Think of ProWAFT as a smart security guard who doesn't lock every door in the building all day (too expensive) and doesn't wait for a thief to break in before calling the police (too slow). Instead, the guard looks at what is being carried (is it a diamond or a brick?), checks the weather (is it stormy outside?), and only locks the specific doors that need protection at that exact moment.

The paper claims this approach creates a perfect balance: the factory runs fast, uses less power, and rarely makes mistakes, all while the manager makes these decisions in the blink of an eye (less than half a millisecond).

Technical Summary: ProWAFT

1. Problem Statement

SRAM-based FPGAs offer an attractive platform for energy- and latency-constrained Convolutional Neural Network (CNN) inference at the network edge. However, they are vulnerable to transient faults (e.g., Single-Event Upsets or SEUs) that can corrupt configuration bits or on-chip computation, leading to silent errors in CNN inference.

Existing mitigation strategies face a fundamental trade-off:

Static Redundancy (e.g., Full TMR): Improves correctness but incurs substantial performance and energy overhead, which is often prohibitive for edge devices.
Reactive Recovery: Triggers reconfiguration only after a fault is detected. While this reduces steady-state overhead, it introduces unacceptable latency spikes on the critical path when faults occur.
The Core Challenge: Fault impact is highly non-uniform. Both the fault risk (varying with time and operating conditions) and the workload sensitivity (varying by layer type, precision, and error-propagation behavior) change dynamically. Static protection levels assume a stationary environment and homogeneous workload, which does not hold in practice.

2. Methodology: ProWAFT

ProWAFT (Proactive Workload-Aware Fault Tolerance) is a runtime framework designed for FPGA-based CNN accelerators. It utilizes Partial Reconfiguration (PR) to selectively apply Triple Modular Redundancy (TMR) across reconfigurable partitions based on real-time conditions.

The framework operates through four sequential stages:

2.1 System Model

The accelerator is modeled as a set of $K$ reconfigurable partitions ( $P$ ). Each partition can be configured with hardware functions from a library ( $F$ ) containing both baseline and protected (TMR) variants. The system processes a stream of workloads ( $W$ ), where each workload corresponds to a CNN layer described by a feature vector (operator type, input shape, precision, etc.).

2.2 Workload Criticality Scoring (WCS)

ProWAFT quantifies the sensitivity of a specific workload to hardware faults using a Workload Criticality Score (WCS):
$WCS(W_i) = \alpha \cdot S_{data}(W_i) + \beta \cdot S_{control}(W_i) + \gamma \cdot P_{error}(W_i)$

$S_{data}$ : Derived from the entropy of the output activation distribution.
$S_{control}$ : Flags workloads on conditional paths (0 or 1).
$P_{error}$ : The likelihood of error propagation, estimated via lightweight pre-characterization (e.g., single-bit fault injection).

2.3 Fault-Aware Performance and Risk Modeling

For a candidate configuration, ProWAFT predicts performance and reliability:

Baseline Metrics: Calculates fault-free latency ( $T_{base}$ ) and energy ( $E_{base}$ ) based on operations, clock frequency, and power profiles.
Risk Modeling: Computes a Reliability Risk Score (RRS) by combining the estimated partition-level fault probability ( $p_{fault}$ ) with a Fault Propagation Factor (FPF). The FPF accounts for workload criticality, partition utilization, and the number of downstream partitions consuming the output.
Fault-Aware Prediction: Adjusts baseline metrics by the RRS to estimate expected latency and energy under fault conditions.
PR Overhead: Explicitly models the time and energy cost of switching configurations ( $\Delta_{PR}$ ).

2.4 Policy and Online Decision Rule

ProWAFT formulates the configuration selection as a sequential decision problem. For each incoming workload, it evaluates a set of feasible configurations to minimize a Composite Cost ( $C_{total}$ ):
$C_{total} = \eta_T \cdot \tilde{T} + \eta_E \cdot \tilde{E} + \eta_R \cdot RRS + \Delta_{PR}$
Where $\eta$ represents application-specific weights for latency, energy, and reliability. The controller uses a low-overhead receding-horizon approach to select the action that minimizes the immediate objective plus reconfiguration overhead, subject to a reconfiguration budget.

3. Key Contributions

Runtime Configuration Formulation: The paper formulates proactive, workload-aware fault tolerance as a runtime configuration problem, enabling selective TMR via partial reconfiguration to explicitly trade off latency, energy, and reliability.
Lightweight Modeling Stack: Introduces a decision-making stack comprising the Workload Criticality Score (WCS) and a fault-propagation-based risk formulation (FPF/RRS), integrated into a composite cost function.
Implementation and Evaluation: Implements ProWAFT on a Xilinx Zynq UltraScale+ ZCU104 platform with six reconfigurable regions. It evaluates the system under a time-varying SEU injection model using a diverse 500-task CNN workload trace (ResNet-18, MobileNetV2, EfficientNet-Lite).

4. Experimental Results

The evaluation compares ProWAFT against three baselines: Static-Base (no redundancy), Static-TMR (always redundant), and Reactive-Reconfig (reconfigure only after fault detection).

Overall Effectiveness: ProWAFT achieves the best trade-off. Compared to Static-TMR, it improves normalized throughput by 45.9% (0.61 to 0.89) and reduces energy by 30.3% (302.5 J to 210.7 J) while maintaining a high success rate (98.8%). Compared to Reactive-Reconfig, it reduces the composite cost by 30.8% (0.78 to 0.54).
Adaptivity: The system dynamically adjusts TMR usage from 12.3% (Low Risk) to 95.2% (Critical Workloads) based on real-time fault risk and workload criticality.
Overhead:
- Decision Overhead: The online decision process takes 0.50 ms (0.13 mJ).
- Proactive vs. Reactive: The total proactive overhead (decision + PR) for single-partition updates is 4.70 ms, which is 3.3× lower than the reactive recovery overhead (15.30 ms).
Component Contribution: Ablation studies confirm that removing WCS, the propagation model, or the policy logic leads to a 13–22% increase in composite cost, validating the necessity of each component.

5. Significance and Claims

The paper claims that ProWAFT addresses the mismatch between static protection strategies and the dynamic nature of edge inference workloads and fault environments. By treating reliability as a runtime decision rather than a one-time design choice, ProWAFT minimizes a composite objective spanning performance, energy, and reliability risk.

The authors assert that ProWAFT achieves a superior performance-energy-reliability trade-off compared to static and reactive baselines, with low online decision overhead and quantified reconfiguration costs. They note that while the current implementation uses software-based fault injection for controlled evaluation, future work aims to validate the approach under physical fault campaigns (e.g., radiation and thermal stress) and extend the framework to larger accelerator libraries.