RISC-V-based microcontroller units (MCUs) are increasingly adopted in radiation-heavy environments such as space, where single-event upsets (SEUs) can cause bit-flips in sequential and combinational logic. RISC-V-based designs are ideally suited for these domains, as open architectures allow for fault-tolerance modifications, enhancing readiness for architectures and systems-on-chip (SoCs). While component-level architectural protection methods, such as error correction codes (ECC) and triple modular redundancy (TMR), can individually harden each component, they leave critical gaps: the voters, encoders, and decoders that implement these protections themselves remain unprotected and become single points of failure.
We propose an overlapping protection approach that addresses this fundamental “who checks the checker?” problem. By extending each protection domain to encompass the checking logic of adjacent domains, we achieve end-to-end fault tolerance across an entire RISC-V MCU without requiring radiation-hardened standard cells. We build on croc, an open-source, extensible RISC-V MCU platform based on the CVE2 core, incrementally applying ECC-protected SRAM, triple-core lockstep cores, a reliable OBI interconnect, and TMR peripherals.
Fault injection campaigns in both RTL and synthesized netlist show that the fully protected RISC-V MCU achieves over 99.9% fault coverage at 2.71× area overhead, 22% less than fine-grained triplication. Critically, without overlapping protection, 16.33% of faults in voter signals cause failures; with overlapping, this drops to 0.26%. All designs are implemented using the fully open-source IHP 130nm technology, Yosys, and OpenROAD.