Safe-NEureka: a Hybrid Modular Redundant DNN Accelerator for On-board Satellite AI Processing

Low Earth Orbit (LEO) constellations are revolutionizing the space sector, with on-board Artificial Intelligence (AI) becoming pivotal for next-generation satellites. AI acceleration is essential for safety-critical functions such as autonomous Guidance, Navigation, and Control (GNC), where errors cannot be tolerated, and performance-critical processing of high-bandwidth sensor data, where occasional errors are tolerable. Consequently, AI accelerators for satellites must combine robust protection against radiation-induced faults with high throughput. This paper presents Safe-NEureka, a Hybrid Modular Redundant Deep Neural Network (DNN) accelerator for heterogeneous RISC-V systems. It operates in two modes: a redundancy mode utilizing Dual Modular Redundancy (DMR) with hardware-based recovery, and a performance mode repurposing redundant datapaths to maximize parallel throughput. Furthermore, its memory interface is protected by Error Correction Codes (ECCs), and the controller by Triple Modular Redundancy (TMR). Implementation in GlobalFoundries 12nm technology shows a 96 reduction in faulty executions in redundancy mode, with a manageable 15 area overhead. In performance mode, the architecture achieves near-baseline speeds on 3x3 dense convolutions with a 5 throughput and 11 efficiency reduction, compared to 48 and 53 in redundancy mode. This flexibility ensures high overheads are limited to critical tasks, establishing Safe-NEureka as a versatile solution for space applications.

💡 Research Summary

The paper addresses the dual challenge faced by low‑Earth‑orbit (LEO) satellites: the need for highly reliable AI processing for safety‑critical functions such as guidance, navigation, and control, and the demand for high‑throughput inference for bandwidth‑intensive payloads like hyperspectral imaging. To reconcile these opposing requirements, the authors propose Safe‑NEureka, a hybrid modular redundant (HMR) deep‑neural‑network accelerator built on top of the open‑source NEureka engine and integrated into a heterogeneous RISC‑V system‑on‑chip. The core idea is to partition the original 4 × 4 systolic array into two 4 × 2 sub‑units that can be dynamically re‑configured. In redundancy mode, the two sub‑units execute the same computation in a dual‑modular‑redundancy (DMR) fashion, with temporal diversity and a lightweight hardware recovery mechanism that detects mismatches and re‑executes the faulty portion. In performance mode, the sub‑units operate in parallel, effectively doubling the compute bandwidth for non‑critical workloads. Critical controller logic is protected by triple‑modular‑redundancy (TMR), while all memory interfaces and interconnects employ error‑correction codes (ECC). The design is synthesized in GlobalFoundries 12 nm, incurring a modest 15 % area overhead relative to a non‑redundant baseline. Gate‑level fault‑injection experiments show a 96 % reduction in faulty executions when redundancy mode is active. Throughput in redundancy mode drops by 48 % and energy efficiency by 53 %, whereas performance mode incurs only a 5 % throughput penalty and an 11 % efficiency loss on a representative 3 × 3 dense convolution layer. The authors release the full RTL as open source, enabling further research and adaptation for space‑borne AI accelerators. Safe‑NEureka thus demonstrates a practical, reconfigurable approach to achieving both fault tolerance and high performance in the constrained environment of satellite on‑board processing.