Four-Way Failure Arbiter Analysis

• Four-Way Failure Arbiter is a cross-domain concept that encompasses four-branch arbiter compositions in hardware security, mode selection in automotive systems, and resource arbitration in formal verification.
• In arbiter-PUF applications, a 4-XOR configuration is used to enhance unpredictability but remains vulnerable to modeling attacks under chosen-challenge scenarios.
• Formal verification approaches and distributed state machine models in fail-operational systems demonstrate how four-way arbitration ensures proper mode selection while preventing conflicts and deadlocks.

“Four-Way Failure Arbiter” does not appear as a literal, standardized architecture in the cited literature. The nearest established meanings are domain-specific: in arbiter-PUF research, the closest direct structure is a 4-XOR Arbiter PUF built from four underlying Arbiter PUFs driven by the same challenge; in fail-operational automotive systems, the closest analogue is an arbitration logic that selects among four operating modes, namely one nominal mode and three fall-back modes; and in formal hardware verification, the closest canonical case is a 4-input arbiter whose correctness is expressed through ordering, priority, starvation, and deadlock properties. This suggests that the term is best treated as a cross-domain umbrella label for four-way arbitration under failure, uncertainty, or adversarial pressure, rather than as a single named circuit family (Zhuang et al., 2021, Sayadi et al., 2023, Schmid et al., 2021, Darbari et al., 2016).

1. Scope and nearest established interpretations

The literature supports three technically distinct interpretations. First, a four-way arbiter can mean a four-branch composition of arbiter-based primitives, most naturally a 4-XOR Arbiter PUF. Second, a failure arbiter can mean a supervisory logic that arbitrates among degraded operating modes after subsystem faults. Third, a four-way arbiter can mean a conventional four-request resource arbiter whose correctness is established formally under contention and delay. These interpretations share the notion of arbitration, but they differ in what is being arbitrated: race outcomes, system modes, or request streams (Sayadi et al., 2023, Schmid et al., 2021, Darbari et al., 2016).

Interpretation	Closest established structure	Domain
Four-branch arbiter composition	4-XOR Arbiter PUF	Hardware security
Failure-mode arbitration	Nominal mode plus three fall-back modes	Automotive fail-operational systems
Four-request arbitration	R0 to R3 competing for grants	Formal hardware verification

A common misconception is to assume that “four-way” always denotes four symmetric hardware contenders. The fail-operational automotive case is instead four-way at the level of system modes, not four equal channels. Conversely, the 4-XOR Arbiter PUF is four-way at the level of parallel underlying arbiters, but its output remains a single bit. The term is therefore structurally overloaded, and precise interpretation depends on domain.

2. Arbiter-PUF foundations and the four-way composition model

In arbiter-PUF work, the base object is the Arbiter PUF (APUF), an $n$-stage delay-race circuit formed by two racing signals traversing two delay paths through $n$ pairs of 2-to-1 multiplexers. Each challenge bit either preserves the ordering of the paths or swaps them, and the arbiter decides the response from the final arrival order. One paper states that if the top path arrives first the output is $1$, otherwise $0$; another uses the opposite bit polarity through the convention “for $\Delta \ge 0$, $r=0$, otherwise $r=1$.” The invariant structure is the sign-threshold relation, not the particular response labeling (Zhuang et al., 2021, Sayadi et al., 2023).

The additive-delay model appears in both notations. One formulation is

$$r = Sgn\!\left(v(n) + \sum_{i=1}^{n} w(i)\phi(i)\right), \qquad \phi(i) = (2c_i-1)(2c_{i+1}-1)\cdots(2c_n-1),$$

with a separating hyperplane

$w(1)\phi(1)+w(2)\phi(2)+\cdots+w(n)\phi(n)+v(n)=0.$

A closely related formulation writes

$$\Delta = \langle W,\Psi \rangle, \qquad \Psi[n]=1,\quad \Psi[i]=\prod_{j=i}^{n-1}(1-2c[j]),$$

so that the response is determined by the sign of $n$0. Both representations make the plain APUF a linear classifier in transformed-challenge space, which explains its susceptibility to modeling attacks (Zhuang et al., 2021, Sayadi et al., 2023).

The nearest direct “four-way” construction is the XOR Arbiter PUF. A $n$1-XOR Arbiter PUF is defined as $n$2 APUFs evaluated in parallel on the same challenge, with final response

$n$3

Under this definition, a 4-XOR Arbiter PUF is simply four independent underlying APUFs, same input challenge $n$4, and output $n$5. This is the clearest direct realization of a four-way arbiter composition in the cited PUF literature (Zhuang et al., 2021, Sayadi et al., 2023).

The same literature also distinguishes feed-forward APUFs from XOR APUFs. Feed-forward designs are not multi-arbiter-parallel; instead, internal arbiter decisions are injected into later challenge positions, so hidden arbitration events become part of the transformed challenge process. This is relevant because it shows that “failure arbiter” ideas need not be limited to parallel voting; internal arbitration can also function as hidden state or control.

3. Security failure in four-way arbiter-PUF constructions

Within the PUF literature, “failure” is most precisely a security failure rather than a functional one. A 4-XOR Arbiter PUF still operates as hardware, but the intended strong-PUF unpredictability can fail under adversarial query models. The strongest direct evidence is the chosen-challenge attack on reliable XOR Arbiter PUFs: for simulated perfectly reliable 64-bit 4-XOR APUFs, using a training dataset of $n$6 $n$7 pairs, the reported modeling accuracy on the individual underlying APUFs is $n$8–$n$9. The attack does not directly learn the XOR as a monolithic classifier; it recovers one hidden APUF at a time by exploiting a non-flipping score

$1$0

computed from correlated neighboring challenges at Hamming distance $1$1 in $1$2-space. This result is explicitly for a perfectly reliable 4-XOR Arbiter PUF, so neither perfect reliability nor the absence of repeated measurements is sufficient when chosen correlated challenges are allowed (Sayadi et al., 2023).

A second line of work studies a lightweight challenge-obfuscating interface for arbiter-PUF variants. For an underlying $1$3-bit-challenge PUF, the interface exposes $1$4 external bits, selects exactly $1$5 of those positions as the actual challenge wires for that device, and treats the remaining $1$6 bits as ghost bits. The interface is static and instance-specific, and the paper explicitly claims that it “requires only a small number of additional bits for the input and does not use any transistors.” Its benefit is conditional on the attacker being restricted to eavesdropping rather than chosen-challenge interaction, because active bit-flipping could reveal which positions are ghosts (Zhuang et al., 2021).

The reported neural-network attack results are strong for the tested cases. For 64-stage $1$7-XPUFs with a “16+bits Interface,” the non-interfaced instances are learned at $1$8 accuracy with $1$9K CRPs for 1-XPUF and $0$0K CRPs for 3-XPUF, whereas interfaced 1-XPUF requires $0$1M CRPs and reaches $0$2 with no convergence, and interfaced 3-XPUF requires $0$3M CRPs and reaches $0$4 with no convergence. No explicit 4-XOR experiment is reported there. A plausible implication is that a four-branch XOR construction with the same interface would be at least comparably hard under the same eavesdropping-only threat model, but that remains an inference rather than direct evidence (Zhuang et al., 2021).

Taken together, these results yield a precise design lesson. Four-way XOR composition raises modeling difficulty relative to a single APUF, but it does not eliminate learnability under chosen-challenge access. Conversely, challenge obfuscation can collapse attack accuracy toward random guessing under an eavesdropping-only model, but its security depends strongly on the inability to issue chosen correlated challenges. The two papers therefore expose a sharp threat-model boundary: what looks like a hardened four-way arbiter in one access model is breakable in another (Sayadi et al., 2023, Zhuang et al., 2021).

4. Failure arbitration as mode selection in fail-operational systems

Outside PUFs, the clearest failure-arbiter interpretation is the fail-operational automotive driving system. Here the arbitration logic does not compare racing signals; it selects among legal system configurations after faults. The system consists of two redundant channels, each capable of conducting the driving task, and supports four operating modes: nominal mode plus fall-back modes 1, 2, and 3. Fall-back mode 1 keeps operation on the nominal channel when the fallback channel has failed. Fall-back mode 3 uses the fallback channel after failure in the nominal channel. Fall-back mode 2 is a mixed prioritized mode in which the fallback control channel can command the primary actuators because those actuators “comprise a greater range of functions” (Schmid et al., 2021).

The arbitration logic is distributed rather than monolithic. It is implemented by a set of distributed state machines partitioned across ECUs and connected to communication buses and power supplies. The purpose of the logic is to “ensure the fail-operational behaviour and thus determine the operation mode, i.e. nominal or fall-back.” Inputs include local functional-failure flags, activation and deactivation commands, peer states received over the bus, and architecture-level faults such as communication or power loss. The modeled state space includes at least $0$5, $0$6, $0$7, $0$8, and a passive behavior used after faults to deactivate the failed channel and allow the remaining machines to activate a fallback channel (Schmid et al., 2021).

The safety requirement most closely aligned with a failure arbiter is SG4: “The arbitration logic must activate a functioning fall-back operation in case of a failure,” with ASIL D and FTTI $0$9. Some invariants have FTTI $\Delta \ge 0$0, corresponding to immediate requirements such as avoiding false activation or deactivation. Communication loss is debounced through a counter $\Delta \ge 0$1, with failure only after the count reaches $\Delta \ge 0$2. This matters because the arbiter is verified not only for steady-state fault combinations but also for temporal transitions and recovery behavior (Schmid et al., 2021).

The formalization uses NuSMV and temporal logic. The study reports seven coupled state machines with thirty individual states, more than six thousand potential combinations, four operation modes, five communication buses and 25 individual signal connections, and a failure matrix of size $\Delta \ge 0$3, including power supply. Within the ISO 26262-scoped analysis, all 48 single failures and 2256 double faults are verified. The most informative result is that formal analysis uncovered a real arbitration defect: a specific timing during communication-bus recovery led to the activation of two operation modes. That finding is central to the encyclopedia concept of a four-way failure arbiter, because it shows that the hard problem is not only choosing the correct degraded mode, but also proving that overlapping or unintended modes are unreachable (Schmid et al., 2021).

5. Formal verification patterns for four-way arbiters

The hardware-verification literature supplies a direct four-request arbiter model. In the “simple arbiter” case study, inputs R0 to R3 compete for outputs G0 to G3. Up to 4 input handshakes may occur per cycle, while at most 1 output handshake is allowed in a cycle. If all four inputs request the same output in the same cycle, lower index has higher priority, so $\Delta \ge 0$4. If requests to the same output arrive in different cycles, then first-come-first-serve overrides same-cycle priority. These rules define a genuine four-way arbitration problem at the request level (Darbari et al., 2016).

The verification method is abstraction-based rather than reference-model-based. It tracks a single symbolic watched requestor instead of all queued transactions, uses a non-deterministic observation window arbit_window, and maintains a counter representing how many requests are ahead of the watched one. The arbiter-specific counting logic is $r=0$5 with the tracking counter updated by abstract increment and decrement events. The principal assertion is $r=0$6 which states that when the watched request has been accepted and the abstract rank reaches the head at an output handshake, it must be the one observed at output (Darbari et al., 2016).

This methodology is presented as an adaptation of the FIFO “smart tracker” abstraction. Its stated coverage includes ordering correctness, arbitration, deadlock, starvation, and data integrity. The paper further reports that the methodology was applied to priority-based, FCFS, and round-robin arbiters, with exhaustive proofs for 4–8 requestors in seconds of wall-clock time and scaling to 128 requestors in minutes. For a four-way failure arbiter, the main transferable point is that arbitration correctness can be reduced to symbolic rank tracking plus a small set of structural assertions, rather than a full explicit model of all competing requests (Darbari et al., 2016).

A plausible extension, rather than a direct claim of the paper, is that failure-aware retirement modes such as cancellation, timeout, or drop can be incorporated by analogy with the packet-design adaptation discussed in the same verification framework. Under that reading, a four-way failure arbiter would require not only grant ordering but also mutual exclusiveness of terminal outcomes and explicit “no ghost grant after failure” properties.

6. Metastability, near-tie behavior, and challenge-selection effects

If “failure” is interpreted as unstable or ambiguous arbiter behavior, the FPGA arbiter-PUF literature identifies the relevant physical regime directly. A 64-stage FPGA arbiter PUF implemented by remote random reconfiguration reports that “the noise is caused exclusively by a metastability of the arbiter that develops when the transit times are nearly exactly balanced so that both input pulses occur simultaneously.” The work defines a metastable bit as one that flips at least once when the same challenge is applied 100000 times. For random challenges, the metastability rate was $\Delta \ge 0$5. For its selected “m-challenges,” which intentionally target near-zero delay difference on a reference chip, metastability is much more prominent; about $\Delta \ge 0$6 of m-challenges metastable on one chip were also metastable on other tested chips (Spenke et al., 2016).

This line of work is important because it sharpens the distinction between security failure and physical failure. In the XOR-Arbiter-PUF attack literature, “failure” usually means loss of unpredictability. In the FPGA implementation literature, failure is closer to metastability or near-tie ambiguity at the arbiter itself. The two notions are not identical, but they meet at the decision boundary: the same near-zero differential-delay region that produces instability is also the region richest in information about the underlying model (Spenke et al., 2016).

That connection is made explicit in active-learning work on APUFs. There the response is modeled as

$\Delta \ge 0$7

and the physically meaningful quantity is $\Delta \ge 0$8, i.e. distance to the hyperplane. Challenges near the estimated hyperplane, corresponding to $\Delta \ge 0$9 in the paper’s normalized-distance construction, are most informative and accelerate learning. In contrast, challenge sets chosen with larger $r=0$0, especially around $r=0$1, can slow learning dramatically: in the reported “slow” setting, training on 1000, 3000, 5000, or 10000 selected CRPs yields only about $r=0$2–$r=0$3 external accuracy depending on the model, even though internal recognition on the selected set can be essentially $r=0$4 (Dumoulin et al., 2023).

For the encyclopedia concept of a Four-Way Failure Arbiter, the implication is clear. Whenever arbitration depends on near-tie regions—whether those are race-path boundaries in APUFs or failure boundaries in richer decision logic—the same boundary conditions tend to be both operationally delicate and information-rich. This suggests that any future literal four-way failure arbiter would need to analyze metastability, environmental robustness, and query-dependent information leakage together, rather than treating them as separate concerns.