Theofilos Spyrou

Haralampos-G Stratigopoulos

On-Line Testing of Neuromorphic Hardware

Keywords: Neuromorphic computing, spiking neural networks, testing, reliability

We propose an on-line testing methodology for neuromorphic hardware supporting spiking neural networks. Testing aims at detecting in real-time abnormal operation due to hardware-level faults, as well as screening of outlier or corner inputs that are prone to misprediction. Testing is enabled by two on-chip classifiers that prognosticate, based on a low-dimensional set of features extracted with spike counting, whether the network will make a correct prediction. The system of classifiers is capable of evaluating the confidence of the decision, and when the confidence is judged low a replay operation helps to resolve the ambiguity. The testing methodology is demonstrated by fully embedding it in a custom FPGA-based neuromorphic hardware platform. It operates in the background being totally nonintrusive to the network operation, while offering a zero-latency test decision for the vast majority of inferences.

I. INTRODUCTION

Neuromorphic computing having as basis a Spiking Neural Network (SNN) emulates brain-like functionality aiming at solving various problems, such as visual sensing and perception, control-loops for robotics, brain-computer interfacing, audio processing, etc., with comparative advantage to the contemporary von Neumann computing architecture as well as the classical artificial neural networks. Neuromorphic computing is a rapidly evolving field and intense efforts are ongoing on hardware architecture and software design as well as on demonstrating real-world applications [START_REF] Christensen | roadmap on neuromorphic computing and engineering[END_REF]. Nowadays there exist large-scale research hardware platforms [START_REF] Schemmel | A wafer-scale neuromorphic hardware system for large-scale neural modeling[END_REF]- [START_REF] Davies | Loihi: A neuromorphic manycore processor with on-chip learning[END_REF] and several chips have been demonstrated for various benchmarks [START_REF] Chen | A 4096-neuron 1M-synapse 3.8-pJ/SOP spiking neural network with on-chip STDP learning and sparse weights in 10-nm FinFET CMOS[END_REF], [START_REF] Frenkel | A 0.086-mm 2 12.7-pJ/SOP 64k-synapse 256-neuron online-learning digital spiking neuromorphic processor in 28-nm CMOS[END_REF].

This work addresses the on-line testing of SNNs aiming at detection of abnormal behavior due to hardware-level faults, as well as detection of outlier and corner inputs that are prone to misprediction. Therefore, beyond fault detection, the proposed methodology can be used to assess the confidence in the SNN prediction, contributing to the trustworthiness of the application.

The proposed methodology is based on a lightweight and non-intrusive on-die symptom detector that operates in the background in parallel with the SNN and outputs a decision whether the running input will be correctly predicted by the SNN. The detector is based on a committee of two classifiers trained to make the decision based on a low-dimensional set of spike-based features extracted on-die.

The detector is capable of evaluating the confidence of its decision, thus achieving an optimal zero false negatives/zero This work was supported by the ANR RE-TRUSTING project under Grant N o ANR-21-CE24-0015-03. The work of T. Spyrou was supported by the Sorbonne Center for Artificial Intelligence (SCAI) through Fellowship. false positives trade-off. For the vast majority of SNN inferences, a correct decision is made deterministically in one-shot with zero latency and concurrently with the SNN operation without interfering with it. Whenever the decision has lowconfidence, the ambiguity is resolved by performing a single replay operation. The detector is also capable of detecting a percentage of faults that do not affect the SNN prediction for the running input, but are likely to affect the prediction of a future input, thus it serves also as a failure prognosis mechanism that allows taking action to avoid such failures.

The method is demonstrated on hardware using an SNN benchmark for poker card symbol recognition. The SNN is designed in VHDL and is implemented on the FPGA of the Zynq®UltraScale+ TM MPSoC ZCU104 FPGA board by Xilinx, Inc. The classifiers run on the ARM quad-core ARM®Cortex TM -A53 processor of the board.

The rest of the article is structured as follows. In Section II, we provide a concise overview of SNNs. In Section III, we briefly present the state-of-the-art on SNN testing. In Section IV, we discuss the proposed on-line testing approach. In Section V, we present the case study and hardware platform. In Section VI, we present the experimental results. Section VII concludes this article.

II. SNN BACKGROUND INFORMATION

Inspired by biology, SNNs are an effort to leverage the advantages of the human brain in Artificial Intelligence (AI). The neurons comprising a SNN use unit instantaneous signals, called spikes, in order to encode and process the information. Sequences of spikes or spike trains are propagated to the network through layers of neurons linked via weighted connections, called synapses.

One of the least computationally complex, and hence hardware-friendly, neuron model is the Integrate & Fire (I&F) model [START_REF] Indiveri | Neuromorphic silicon neuron circuits[END_REF]. Initially, the neuron is at a resting state, where the membrane potential is set to a low value. The neuron integrates the incoming spikes from the synapses at its input and the membrane potential is increased correspondingly. Once the potential exceeds a specified threshold, the neuron fires a spike, which is propagated to the next layer of neurons via the synapses connected to its output, and the neuron is reset to its resting state again. The refractory period is the time in-between successive spikes regulating the maximum possible spiking frequency of the neuron. An extension to the aforementioned model is the leaky I&F neuron, where the membrane potential is periodically brought closer to the resting state during the idle time of the neuron, so if there are no incoming spikes, then the neuron is gradually reset.

The input to a SNN needs to be in a neuromorphic form too, i.e., in a spike train representation. To achieve this, a neuromorphic camera or a Dynamic Vision Sensor (DVS) is usually employed. A DVS resembles the retina of the human eye and is composed by pixels that behave similarly to a neuron responding to changes in the brightness. If the brightness of a pixel has changed sufficiently, a spike is generated. Each pixel operates independently and reports the brightness changes as they occur.

Neurons operate and fire spikes asynchronously. To handle the inter-neuron communication in a realistic neuromorphic architecture, a protocol like the Address Event Representation (AER) is essential. According to AER, a spike is represented in the form of an event containing the address of either the neuron that generated it, or the neurons that the spike is destined to. This allows the neurons to be triggered only when there is an event associated with them.

For a multi-class recognition task, SNNs typically have one neuron per class at their output layer. The winning class is, for example, the one corresponding to the neuron that produced the largest number of spikes within a given time interval or the neuron that fired first a spike.

III. STATE-OF-THE-ART ON SNN TESTING

SNN hardware implementations inherit to a large degree the remarkable fault tolerance capability of the biological brain. Most faults are benign, that is, they affect a component that does not take part in the computation, they are completely masked thanks to the information propagation through the network, they change the order of the top predicted classes but not the top-1 class, or they lead to inaccurate predictions for only a tiny fraction of the inputs and in this sense they can be tolerated. However, some faults remain critical and can lead to a large drop of correct classification percentage. This fault behavior has been demonstrated in several recent fault injection experiments at software level [START_REF] Hashmi | Automatic abstraction and fault tolerance in cortical microachitectures[END_REF]- [START_REF] El-Sayed | Compact functional testing for neuromorphic computing circuits[END_REF] and in actual neuromorphic hardware [START_REF] Spyrou | Reliability analysis of a spiking neural network hardware accelerator[END_REF].

At software level, faults are injected in synapses and neurons assuming that each component can fail independently. In [START_REF] El-Sayed | Spiking neuron hardware-level fault modeling[END_REF], neuron fault simulation is performed at transistor-level considering defects and process variations, in order to extract failure modes. Main failure modes include a dead neuron, i.e., its output is stuck-at a value independently of the input activity, a saturated neuron, i.e., it produces a non-stop output spike train even in the absence of input activity, and timing variations in the output spike train, such as variations in the time-to-first spike and spiking frequency. Dead and saturated responses can be modelled at software by modifying directly the output spike train, while timing variations can be induced in various ways, for example by modifying the neuron's membrane threshold. Common synapse faults include disabled, stuck-weight or saturated-weight synapses. Given that synapse weights are stored as digital words in a memory while at software are handled as real values, a hardware-aware synapse fault model in software is to digitize the real value, perform bit flips, and then reconvert to a real faulty value.

At hardware-level, traditional fault models such as gate-level stuck-at faults, delay faults, or cell-aware defects can be used. However, studies so far have considered single and multiple bit-flips in the memories storing the various parameters of the network, such as synapse weights, neuron threshold, leakage, and refractory period, routing of events, etc. [START_REF] Spyrou | Reliability analysis of a spiking neural network hardware accelerator[END_REF].

Post-manufacturing functional testing methods are proposed in [START_REF] Tseng | Machine learningbased test pattern generation for neuromorphic chips[END_REF], [START_REF] El-Sayed | Compact functional testing for neuromorphic computing circuits[END_REF], [START_REF] El-Sayed | Self-testing analog spiking neuron circuit[END_REF]. The idea in [START_REF] Tseng | Machine learningbased test pattern generation for neuromorphic chips[END_REF], [START_REF] El-Sayed | Compact functional testing for neuromorphic computing circuits[END_REF] is to identify available input samples or craft new input samples, for example adversarial samples [START_REF] Tseng | Machine learningbased test pattern generation for neuromorphic chips[END_REF], that can sensitise faults and output a prediction that differs from this of the nominal fault-free network. A compact set of input samples can be generated achieving this objective. In [START_REF] El-Sayed | Self-testing analog spiking neuron circuit[END_REF], a built-in self-test for biological spiking neurons is proposed where the neuron is exercised from its bias voltages to span the entire range of operation and output all possible firing patterns. If a pattern is missing, then the neuron is labelled faulty.

Fault tolerance techniques can be proactive or reactive, and typically each can address a subset of fault types and locations. Proactive techniques aim at making the SNN tolerate by design a number or certain types of faults. One approach is to perform fault-aware training where faults are injected during training epochs, for example as synapse weight perturbations, aiming at maximizing simultaneously accuracy and fault tolerance [START_REF] Schuman | Resilience and robustness of spiking neural networks for neuromorphic systems[END_REF], [START_REF] Putra | ReSpawn: Energyefficient fault-tolerance for spiking neural networks considering unreliable memories[END_REF], [START_REF] Putra | SparkXD: A framework for resilient and energy-efficient spiking neural network inference using approximate DRAM[END_REF]. A second approach is to derive the memory fault map via testing, then prioritize placing of Most Significant Bits (MSBs) of network parameters on non-faulty memory cells [START_REF] Putra | ReSpawn: Energyefficient fault-tolerance for spiking neural networks considering unreliable memories[END_REF]. A third approach is to adopt training algorithms that naturally offer fault tolerance [START_REF] Schuman | Resilience and robustness of spiking neural networks for neuromorphic systems[END_REF], [START_REF] Spyrou | Neuron fault tolerance in spiking neural networks[END_REF]. For example, in [START_REF] Spyrou | Neuron fault tolerance in spiking neural networks[END_REF], it is shown that training with dropout can nullify the effect of dead neuron faults and timing variations in all layers except the very last ones. At hardware-level, a proactive technique is to perform Triple Modular Redundancy (TMR) for the most critical layers, with priority given on the last layer [START_REF] Spyrou | Neuron fault tolerance in spiking neural networks[END_REF].

Reactive fault tolerance techniques are implemented at hardware-level and, in general, are composed of two mechanisms, namely a self-test mechanism for fault detection and a fault-mitigation strategy. One approach is to focus on the most lethal faults, namely neuron saturation and large synapse weight increases. For neuron saturation, it is proposed to implement a symptom detector attached to each neuron and silence the neuron if it exhibits saturation behavior [START_REF] Spyrou | Neuron fault tolerance in spiking neural networks[END_REF], [START_REF] Putra | SoftSNN: Low-cost fault tolerance for spiking neural network accelerators under soft errors[END_REF]. For large synapse weight increases, it is proposed to replace the weight with a pre-defined value, i.e., a zero value [START_REF] Putra | SoftSNN: Low-cost fault tolerance for spiking neural network accelerators under soft errors[END_REF]. These fault-mitigation approaches essentially translate a critical fault into a benign fault. Finally, another approach is to perform on-line re-learning by disabling components for which re-learning cannot make up for the damage [START_REF] Hashmi | Automatic abstraction and fault tolerance in cortical microachitectures[END_REF].

The reader is referred to [START_REF] Su | Testability and dependability of AI hardware: Survey, trends, challenges, and perspectives[END_REF] for a survey on testability and dependability approaches for AI hardware including SNNs.

IV. PROPOSED TESTING APPROACH

Summarizing the state-of-the-art, we make the following observations: 1) Proactive fault tolerance methods [START_REF] Schuman | Resilience and robustness of spiking neural networks for neuromorphic systems[END_REF], [START_REF] Putra | ReSpawn: Energyefficient fault-tolerance for spiking neural networks considering unreliable memories[END_REF], [START_REF] Spyrou | Neuron fault tolerance in spiking neural networks[END_REF], [START_REF] Putra | SparkXD: A framework for resilient and energy-efficient spiking neural network inference using approximate DRAM[END_REF] cannot compensate the effect of all faults, thus a number of faults remain critical and a dedicated test procedure is desired. 2) On-line concurrent error detection is implemented at the component-level, i.e., checking the status of synapses and neurons individually [START_REF] Spyrou | Neuron fault tolerance in spiking neural networks[END_REF], [START_REF] Putra | SoftSNN: Low-cost fault tolerance for spiking neural network accelerators under soft errors[END_REF], [START_REF] El-Sayed | Self-testing analog spiking neuron circuit[END_REF]. This approach may result in large overhead. 3) Functional testing based on selected fault-sensitizing inputs [START_REF] Tseng | Machine learningbased test pattern generation for neuromorphic chips[END_REF], [START_REF] El-Sayed | Compact functional testing for neuromorphic computing circuits[END_REF] is primarily a post-manufacturing testing approach but can also be executed on-line periodically in idle times by storing the functional tests in an on chip memory. Besides the memory overhead, the assumption is that the memory remains fault-free. Moreover, this approach does not guarantee high safety standards as it misses transient errors and detects permanent errors with latency. 4) Testing approaches are demonstrated for hardware-level fault detection only, while their utilisation for outlier and corner input detection is not studied so far.

The primary objective of the proposed testing approach is to detect in real-time any abnormality in the SNN operation, either it is due to a fault occurring or due to an outlier or corner input.

Testing, in general, can be viewed as checking a set of symptoms that point to abnormal operation. We postulate that defining symptoms at the output of neurons is a good strategy since information flows in the form of spike trains and for the SNN prediction to be affected the output spike train of at least one neuron in the network should be appreciably altered.

However, checking the output of every single neuron results in test resources with large overhead. To this end, we propose defining symptoms at a higher-level of hierarchy in the network, specifically at the output of each feature map. By construction, according to the AER protocol, a feature map outputs a flow of spiking events e(t, d), where t is the time of the event and d is the sender or the recipient neuron coordinates. Illustrated in Fig. 1a, we propose to project the spike events of neurons of the feature map in time, consider a pre-defined time window that is dependent on the duration of the input, and define a test parameter at the feature maplevel equal to the count of accumulated spike events during the time window. The premise is that an abnormal operation will be manifested in the cumulative spiking activity at the output of at least one feature map both in terms of the number of produced spikes and the spike frequency, causing some test parameters to drift away from their expected values. This drift is a symptom of abnormal operation. In this way, we drastically reduce the test parameter dimensionality from the neuron size to the feature map size. In fact, it may not be necessary to consider all feature maps since an abnormal spiking activity at the output of a feature map will propagate and spread through the network, thus it may be detectable at the output of feature maps in the next network hierarchy levels.

Next step is making a test decision based on the test parameters. We postulate that checking their combination across the network can be a better test criterion as opposed to checking them individually. This can be done by training a single oneclass classifier to map the test parameters to an one-bit test decision addressing the complete network. In machine learning terminology, the test parameters serve as the input features of the classifier, not to be confused with the feature extraction performed by each feature map in the SNN. The classifier is trained on the fault-free network using the available training input samples. Each input is presented to the network and test parameters are collected at the outputs of the feature maps. This is an one-off effort that is already spent during training. The classifier will learn the area in the test parameter space that corresponds to normal operation, enclosing it with a classification boundary, as shown for example with the yellow classifier in Fig. 1b. In abnormal operation, the combination of test parameters will drift outside the classification boundary and the classifier will flag an error detection.

The performance of a classifier is assessed based on two metrics, namely false negatives or test escapes, i.e., abnormal operation goes undetected, and false positives or overkill, i.e., flagging an error when there is actually none. However, a single classifier is likely incapable of perfectly distinguishing normal from abnormal operation and is bounded to making errors. Using a single classifier, the classifier establishing the optimal trade-off between test escapes and overkill would have been decided based on test economics.

To this end, we adopt a two-tier test approach originally proposed for analog circuits [START_REF] Stratigopoulos | Error moderation in low-cost machine-learning-based analog/RF testing[END_REF]. We propose to avoid using a single classifier making a deterministic decision and instead use a system of two classifiers, as shown in Fig. 1b. The yellow classifier is designed to be strict, i.e., in its inner area it encloses only feature patterns corresponding to normal operation. The blue classifier is designed to be lenient, i.e., feature patterns falling in its outer area for sure correspond to abnormal operation. If the decision of the two classifiers agrees, i.e., the footprint of the feature pattern lies into the inner area of the yellow classifier or into the outer area of the blue classifier, in other words it lies outside the grey zone between the two boundaries, then this decision is deterministic and can be trusted. In contrast, if the footprint lies into the grey zone, then the test decision has low confidence. Essentially, the grey zone serves as a guard-band.

To deal with low confidence decisions, we need an extra fast test to make a final decision with incontestable accuracy. For this purpose, we investigate the different scenarios to understand how the system of the two classifiers responds in each case. The input of the SNN can be typical or can be an outlier or corner input that is foreign to the bulk of the training set and, thereby, is prone misprediction. On the other hand, the SNN can be fault-free or contain a fault. The case of fault occurrence or an outlier or corner input will be flagged by the yellow classifier by construction. The problem lies in the fact that the yellow classifier can also inadvertently flag an error for a typical input and a fault-free SNN.

We observed experimentally that this latter scenario happens due to the stochasticity of the SNN. More specifically, a neuromorphic design is by nature asynchronous, meaning that a neuron might receive a spike event at its input or fire one at its output anytime. On the other hand, the controlling processor operates synchronously based on a clock. The synchronization between the two could potentially create some micro-delays in their communication, which propagate during the inference of the SNN. Given that the decision-making in a SNN is based on the temporal characteristics of the spike trains, these delays result in a variance of the triggering time of neurons and, thereby, in a stochasticity at their output spike trains.

To understand the effect of stochasticity, using our case study described in Section V, we repeated the SNN inference multiple times for each sample of the training set. We observed that the scenario where the yellow classifier flags an error for a typical input and fault-free SNN occurs for a handful of repetitions for a few samples. The footprint of the feature pattern of these samples lies closer to the boundary of the yellow classifier, thus they can be marginally misclassified.

Based on this observation, to make a final decision when the system has low confidence, the strategy that we propose is to perform one replay operation presenting the same input sample to the SNN a second time. If now the yellow classifier predicts normal operation, then the SNN prediction can be trusted to be correct. Otherwise, the system flags an error.

V. CASE STUDY A. Convolutional SNN

As case study we use a convolutional SNN designed for recognizing the symbol on poker cards [START_REF] Pérez-Carrasco | Mapping from frame-driven to frame-free event-driven vision systems by low-rate rate coding and coincidence processing-application to feedforward ConvNets[END_REF]. The dataset is generated by presenting successively a deck of 40 cards in front of a DVS during 0.96 seconds, and considering their symbol centered to a 32 × 32 pixel window. The SNN architecture shown in Fig. 2 consists of 4 convolutional layers SC1, SC2, SC3, and SC4 and 2 pooling layers SP1 and SP2 used to downsample the feature maps of layers SC1 and SC2, respectively. Fig. 2 also indicates the number of feature maps per layer, the feature map sizes, and the receptive fields on each feature map.

B. Hardware platform

Fig. 3 presents the architecture of the hardware platform that embeds the testable SNN. The platform is implemented on the Zynq®UltraScale+ TM MPSoC ZCU104 FPGA board by Xilinx, Inc., and consists of four main parts:

• SNN hardware accelerator: The SNN is designed in VHDL using as building block to implement a feature map a generic event-driven configurable convolutional node [START_REF] Camuñas-Mesa | A configurable event-driven convolutional node with rate saturation mechanism for modular convnet systems implementation[END_REF].

The main parts of the node are the convolutional unit, the router to handle the transmission of the spike events from their origin to their destination, a configuration block for programming the synapse weights, neuron parameters (i.e., threshold, leakage, and refractory period), and feature map parameters (i.e., size and center), and memory to store all these parameters. The SNN is configured in a 2-D mesh of nodes and is implemented on the FPGA of the board. • Software: A MATLAB framework is designed with routines to generate the SNN configuration file, perform the fault injection to generate the configuration files of faulty SNN instances, train the classifiers, and analyse the results to compute the confusion matrix of the classification. • Memory: The memory stores the input samples dataset, the SNN configuration files, and the output file to be processed off-line.

• Controlling processor: The processor of the board uses one core for handling the configuration of the SNN instances in batch mode, feeding the input samples to the SNN for each experiment, and storing the SNN output (i.e., spike trains produced by all feature maps). An extra core is used to process the spike trains to extract the features used in the classification, and to host and run the two classifiers.

C. Classifiers

Each classifier is implemented with a Support Vector Machine (SVM) using a Radial Basis Function (RBF) kernel. The two hyper-parameters are ν, which controls the trade-off between overfitting and generalization of the SVM in oneclass learning, and γ, which is the coefficient of the RBF kernel [START_REF] Schölkopf | Estimating the support of a high-dimensional distribution[END_REF]. We use the cross-language LIBSVM library [START_REF] Chang | LIBSVM: A library for support vector machines[END_REF]. The two SVM models are trained in MATLAB and then they are loaded by the C application running on the processor.

D. Dataset categorization

To account for the SNN stochasticity, for a given input sample, the SNN inference is repeated multiple times and the samples are categorized as follows:

• Group 1: Samples whose class is consistently correctly predicted. • Group 2: Samples whose class is consistently erroneously predicted. • Group 3: Samples that are ambiguously predicted during the multiple repetitions due to the SNN stochasticity.

The two SVMs are trained using samples in Group 1. As we care about the impact of faults when the SNN correctly predicts an input sample, the fault detection capability of the SVMs is assessed on Group 1 only. Group 2 comprises the outlier input samples that the SNN did not learn to predict correctly after training. Group 3 comprises corner input samples for which the SNN prediction has high variance and can end up being incorrect.

E. Fault model

The fault model consists of permanent bit-flips in the memories that store the various SNN parameters (i.e., synapse weights, neuron parameters, feature map parameters) and its routing configuration. We consider two scenarios, namely single bit-flips across different bit positions and multiple bit-flips uniformly distributed with a Bit Error Rate (BER) probability from 10 -6 to 10 -1 . In total, we consider 7402 SNN instances with single faults and 6278 SNN instances with multiple faults.

To assess the criticality of a fault, we consider its impact on the SNN classification result. Faults are categorized into:

• Critical faults: For a given input sample, a fault is critical if the predicted class of the faulty SNN is different than this of the fault-free SNN. • Benign faults: For a given input sample, a fault is benign if the predicted class of the faulty SNN matches this of the fault-free SNN. The 0.31% of fault-free inferences that were previously flagged as low-confidence are now flagged as "no-fault" since their footprint jumps inside the yellow boundary. Whereas, the inferences with the 13.3% of critical faults and 17.65% of benign faults that were previously flagged as low-confidence, are now flagged as "fault" since their footprint remains inside the grey zone.

Regarding the outlier and corner samples from Groups 2 and 3, the yellow SVM flags an error in all cases, thus the system successfully warns when SNN outputs incorrect predictions. Considering the system of two SVMs, all samples in Group 3 and 59.98% of samples in Group 2 lie in the low-confidence grey zone, while for the rest 40.02% of samples in Group 2 an error is flagged directly. The uncertainty is lifted with the replay operation as all these samples remain in the grey zone.

As a final note, deterministic one-shot decisions are completed without delaying the next SNN inference, while whenever there is a low-confidence decision there is a delay equal to the time of one inference due to the replay operation. The SVMs run in software on a second processor core, in parallel with the SNN operation. Thus, they are totally transparent to the SNN without interrupting or interfering with it. The only overhead in our hardware implementation is the utilization of the extra processor core dedicated to the SVMs that increases power consumption.

VII. CONCLUSIONS

We presented a generic on-line testing methodology virtually applicable to any SNN hardware accelerator design and cognitive task. Two classifiers monitor the cumulative spike count at the output of feature maps of the SNN and are trained to detect in real-time outlier or corner inputs that are prone to misprediction, as well as hardware-level faults. This is achieved without generating any overkill thanks to the simultaneous assessment of the confidence in the decision. Whenever the confidence is low, a single replay operation suffices to resolve the ambiguity and make an accurate final decision. The methodology is fully demonstrated on a custom FPGA-based neuromorphic hardware platform. It is shown that it enables trustworthy operation with zero-latency transparent decisions for over 99.6% of the SNN inferences, while for the rest the decision is made with a delay of one inference. The only overhead is the power consumption from the utilization of a second processor core dedicated to the integration of the two classifiers.

  (a) Feature extractor at feature map-level. (b) Network-level test.

Fig. 1 :

 1 Fig. 1: Principle of operation.

Fig. 2 :

 2 Fig. 2: Convolutional SNN for poker card symbol recognition.

Fig. 3 :

 3 Fig. 3: Embedded neuromorphic hardware accelerator platform.

Fig. 4 :

 4 Fig. 4: Pareto front curve test escape vs. overkill for SVMs trained with different pairs of hyper-parameter values ν and γ.

Fig. 5 :

 5 Fig. 5: Performance of system with two SVMs. VI. EXPERIMENTAL RESULTS First we consider a single SVM and we assess the performance based on the resultant test escape and overkill. The trade-off is explored in Fig. 4 showing the Pareto front by training different SVMs while varying the combination of ν and γ values. The two end points marked in the Pareto front correspond to test escape for zero overkill and overkill for zero test escape, respectively. These two SVMs are the selected blue and yellow classifiers, respectively, shown in Fig. 1. Fig. 5 shows the performance of the system of two SVMs for samples in Group 1. Rows correspond to the SNN status (i.e., critical fault, benign fault, fault-free) and the columns correspond to the on-line test decision. Out of all faults, (8.8 + 0 + 1.35) = 10.15% are critical and (17.02 + 56.97 + 15.86) = 89.85% are benign. As it can be seen, (8.8/10.15) * 100 = 86.7% of critical faults are detected in real-time, while test escape and overkill are both zero for the one-shot decisions. However, the system has low confidence for (1.35/10.15) * 100 = 13.3% of critical faults and 0.31% of fault-free inferences. Regarding benign faults, (17.02/89.85) * 100 = 18.94% are proactively detected, (56.97/89.85) * 100 = 63.41% are classified as no fault, and for (15.86/89.85) * 100 = 17.65% the system has low confidence. With a replay operation all uncertainties are lifted. The 0.31% of fault-free inferences that were previously flagged as low-confidence are now flagged as "no-fault" since


Isabelle Drouet

Daniel Andler

Anouk Barberousse

Julie Jebeile

Expert reports by large multidisciplinary groups: the case of the International Panel on Climate Change

Recent years have seen a notable increase in the production of scientific expertise by large multidisciplinary groups. The issue we address is how reports may be written by such groups in spite of their size and of formidable obstacles: complexity of subject matter, uncertainty, and scientific disagreement. Our focus is on the International Panel on Climate Change (henceforth IPCC), unquestionably the best-known case of such collective scientific expertise. What we show is that the organization of work within the IPCC aims to make it possible to produce documents that are indeed expert reports. To do so, we first put forward the epistemic norms that apply to expert reports in general, that is, the properties that reports should have in order to be useful and to help decision-making. Section 2 claims that these properties are: intelligibility, relevance and accuracy. Based on this analysis, section 3 points to the difficulties of having IPCC reports indeed satisfying these norms. We then show how the organization of work within the IPCC aims at and to a large extent secures intelligibility, relevance and accuracy, with the result that IPCC reports can be relied on for decision-making. Section 4 focuses on the fundamentals of IPCC's work organization--that is, division of labour within the IPCC--while section 5 investigates three frameworks that were introduced over the course of the functioning of the IPCC: the reviewing procedure of IPCC reports, the language that IPCC authors use to express uncertainty and the Coupled Model Intercomparison Project (CMIP). Concluding remarks are offered in section 6.

Introduction

Recent years have seen a notable increase in the production of scientific expertise by large multidisciplinary groups. Topics range from radioactive waste management to biodiversity, to genetically modified crops and, of course, climate change. The typical output consists in a written report that addresses multiple dimensions of the topic, displays a serious effort to assess and communicate the associated uncertainties and, most importantly, is supposed to help decisionmaking. The issue we address is how such reports may be written in spite of formidable obstacles: complexity of subject matter, uncertainty, and scientific disagreement.

Our focus will be on the International Panel on Climate Change (henceforth IPCC), unquestionably the best-known case of such collective scientific expertise. Whatever one thinks of IPCC reports, it must be acknowledged that the IPCC is used as a model for more recent instances of scientific expertise by large multidisciplinary groups, such as the Intergovernmental Science-Policy Platform on Biodiversity and Ecosystem Services (IPBES), and that its reports serve as a reference in many discussions about climate change. IPCC reports have also been much discussed themselves. One stance, which we may characterise as political, is that the content of IPCC reports is fixed somehow independently from their writing process and that the composition of the reports essentially demands that authors align their public beliefs with a set of predefined claims. By contrast, we consider that IPCC reports should be seen as genuine epistemic objects, resulting from a true effort at producing useful and informative documents. Under such a conception of IPCC reports, their very existence calls for an explanation. If not by belief alignment, how is it possible that a group as large as the community of IPCC authors deals with the difficulties inherent in the challenge of writing expert reports on as complicated a topic as climate change?

We provide an answer to this question that is half normative and half empirical, showing that the organisation of work within the IPCC aims to achieve the standards of scientific expertise along lines that are compatible with IPCC's productions carrying epistemic weight.

What we show, more precisely, is that the organisation of work within the IPCC aims to make it possible to produce documents that are indeed expert reports. To do so, we first put forward the epistemic norms that apply to expert reports in general, that is, the properties that reports should have in order to be useful and to help decision-making. Section 2 claims that these properties are: intelligibility, relevance and accuracy. Based on this analysis, Section 3 points to the difficulties of having IPCC reports indeed satisfying these norms. We then show how the organisation of work within the IPCC aims at and to a large extent secures intelligibility, relevance and accuracy, with the result that IPCC reports can be relied on for decision-making. Section 4 focuses on the fundamentals of IPCC's work organisation-that is, division of labour within the IPCC-while Section 5 investigates three frameworks that were introduced over the course of the functioning of the IPCC: the reviewing procedure of IPCC reports, the language that IPCC authors use to express uncertainty and the Coupled Model Intercomparison Project (CMIP). Concluding remarks are offered in Section 6.

Epistemic norms for expert reports

Decision-makers ask for expert reports when they want information on which they may ground their decisions. For this to be possible, expert reports have to display certain features or, in other words, to fulfill some epistemic requirements. To the best of our knowledge, no ready-made list of such requirements is available. Indeed, from the seminal papers of [START_REF] Hardwig | Epistemic dependence[END_REF] and [START_REF] Goldman | Experts: Which ones should you trust?[END_REF] to the most recent contributions (e.g. Goldman 2018), the epistemology of expertise has been focused on the relationship between laypersons and experts, with a marked emphasis on the problem faced by the former of how to identify and choose the latter (see e.g. Selinger and Crease 2006). What we are after is more basic, somehow presupposed by the epistemological literature on expertise. Moreover it is focused on the products of expertise [START_REF] Quast | Expertise: A practical explication[END_REF]) and therefore of relevance primarily to emitters of purported expertise. We are looking for properties that a document should satisfy to serve as a useful expert report and that experts should therefore aim for. The literature in epistemology contains several lists of traits of expertise or of clues that may be used to track it (e.g. [START_REF] Goldman | Experts: Which ones should you trust?[END_REF][START_REF] Scholz | Symptoms of expertise: Knowledge, understanding and other cognitive goods[END_REF][START_REF] Martini | Experts in science: A view from the trenches[END_REF]and 2019) out of which some such properties can be inferred. Based on this and with no claim to a proper analysis of the concept of expertise (something many authors identify as a misguided project), we offer that, to be of use to decision-makers, an expert report must meet, at a minimum, the three following requirements:

intelligibility: laypeople can understand the report. Of course this implies local intelligibility: the meaning of all the words used in the report (including technical terms) and of the sentences that make it up is clear. But intelligibility also requires logical coherence, as the overall meaning of a document involving contradictions cannot be grasped. What is more, an intelligible report is 1 consistent, by which we mean that it is uniform as regards formal matters and the use of terms. Finally, the main conclusions of the report taken as a whole are easily identifiable and unequivocal-a property we may call "global intelligibility"; relevance: the material provided by the report helps solve the decision problem at stake and no important dimension of this problem is overlooked. This implies that the questions that prompted the commission of the report are answered, but it often requires that some further questions are answered, too. Relevance is a delicate matter in general because of the dual nature of expert reports: on the one hand they should help answer a specific question or set of questions, but on the other hand they are meant to serve as reference documents, which can be consulted in case of uncertainty on any issue related to their subject matter. The first goal Notice that freedom from logical contradictions is compatible with the presentation of incompatible theories (but not with 1 their assertion) and (to anticipate a bit) that, as a matter of fact, presenting incompatible theories is an essential part of what IPCC reports do.

prescribes informational concision or non-cluttering, which runs counter the informational richness required by the second goal; accuracy: the report is true to the best of our evidence and theories regarding the issues it broaches. This requires that the author of the report takes into account and fairly assesses the relevant theories or sources of evidence on the topics addressed by the report.

An important difference between these three properties is the extent to which laypeople can reckon whether or to what degree they are met. Laypeople can tell whether they understand or think they understand what a given report says, thereby assessing its intelligibility. They can also state whether all the questions they deem relevant with regard to a given demand are addressed. However, they usually cannot fully assess accuracy directly from the report, as they do not know what are the best among the available evidence and theories. Accuracy is therefore mostly inferred from what one knows about the author of the report, for instance from her track record, that is, her past successes and failures at cognitive tasks akin to the one under consideration. Conversely, the choice of an expert primarily aims to secure accuracy-with the consequence that the elements identified by [START_REF] Goldman | Experts: Which ones should you trust?[END_REF] as useful to choose an expert can also serve to assess the accuracy of her report.

Intelligibility, relevance and accuracy are not the only requirements that one may think of as bearing on expert reports. Other candidate requirements include confidence-arousing, trustworthiness, indisputability, objectivity or unbiasedness. However, we claim that intelligibility, relevance and accuracy are fundamental as properties of the reports themselves (as opposed to their authors). Accuracy is crucial in this respect. Indeed, as we understand it, accuracy is not compatible with bias with regard to the selection or assessment of theories or evidence. It also requires that the report is objective in the sense of taking into account the most salient perspectives on the problems at stake. Moreover, an accurate report is worthy of trust and, therefore, whatever hints at accuracy arouses confidence by the same token. It should finally be noted that intelligibility, relevance and accuracy are ideal properties of expert reports. A given report may fail to fully satisfy all three of them, however it should satisfy each of them to a substantial degree. 2But even this is in no way easy to achieve, not the least because our three requirements may clash with one another or with other desiderata. For example, technical terms which are hard to understand for non-experts often occur in the formulation of theories and therefore accuracy is noticeably more difficult to achieve under the constraint of intelligibility than otherwise. Moreover, intelligibility, relevance and accuracy may not suffice to elicit confidence, or ensure that the report be indisputable to such a degree as to deflect criticism inspired by intentional misunderstanding proffered in bad faith. For instance, intelligibility often calls for simplification, which in turn may provide an opening for criticism-be it made in good or bad faith-, or for the charge of bias. Last but not least, there is the overall constraint of timeliness: an otherwise excellent report that comes too late is of limited use; but timeliness puts additional pressure on the satisfaction of the other demands.

The difficulties in reaching intelligibility, relevance and accuracy are particularly acute in the case of scientific reports by large multidisciplinary groups. Moreover, the sheer number of contributors precludes that the norms of expertise be successfully pursued without an appropriate organisation of work. We now turn to IPCC reports and explain why it is difficult to have them fulfill the three requirements we have identified. IPCC's work organisation is investigated in the sequel of the paper.

IPCC Assessment Reports

This formulation suggests that intelligibility, relevance and accuracy come in degrees. We think that this is indeed the IPCC Assessment Reports (henceforth ARs) aim to assess the state of climate knowledge, evaluating the risks associated with climate change and human action on the environment, and developing different scenarios according to the type of action taken to decrease CO2 and other greenhouse gas emissions. This assessment is based on the review of the relevant corpuses of scientific literature. As Jones (2015) also stresses, it is epistemically significant that the IPCC is not meant to lead original research-nor, for that matter, to produce new data.

IPCC ARs are primarily characterised by the breadth of their topic (climate change) and the range of the associated decisions (bearing on mitigation and adaptation). Writing them down requires a colossal amount of work, bearing on a staggering variety of issues. IPCC's enterprise eludes not only, of course, a single author, but also, especially given the time constraint, any small group of scientists. Nothing short of a wide, multidisciplinary community can be up to the task. For a given AR, this community comprises several hundred members, working in a plurality of scientific disciplines and belonging to different geographical areas. The community is divided into three working groups (WGs), each of which produces a separate document: WG1 focuses on the physics of climate and climate change, WG2 on mitigation of climate change, WG3 on adaptation to climate change. We will be concerned solely with WG1 and its contribution to the report. The fifth AR, AR5 issued in 2015, on which we focus, is 5,500 pages long, of which 1,500 are contributed by WG1. This contribution covers many different transdisciplinary subject matters, from clouds and aerosols to sea-level change, or again the methodological question of how to evaluate climate models.

It seems straightforward that the mere length of ARs makes it a challenge to reach global intelligibility. How to identify the main conclusions of such lengthy documents and to make clear that they indeed follow from their content is far from obvious. The length of ARs furthermore implies that even the requirement of consistency is difficult to achieve. In particular, it is not trivial to ensure that terms are used in a uniform way throughout extremely lengthy documents with a huge number of authors. The difficulty is here compounded by the multidisciplinarity of the community of authors, which makes it likely that some terms of art are initially not granted the same meaning by all members of the community, inducing violations of the condition that [START_REF] Miller | When is consensus knowledge-based? Distinguishing shared knowledge from mere agreement[END_REF] calls "social calibration". This is a genuine worry when authors have different scientific cultures [START_REF] Knorr Cetina | Epistemic cultures: How the sciences make knowledge (1st ed)[END_REF][START_REF] Andersen | Epistemic dependence in interdisciplinary groups[END_REF]). The worry is practical but also normative: multidisciplinary enterprises typically involve more opaque epistemic dependence, where one "does not possess the expertise necessary to carry out independently, and to assess profoundly, the piece of scientific labor her colleague is contributing" (Wagenknecht 2016, p. 118), and less translucent epistemic dependence, where one does possess this expertise, than monodisciplinary ones [START_REF] Wagenknecht | Opaque and translucent epistemic dependence in collaborative scientific practice[END_REF](Wagenknecht , 2016 chapter 7) chapter 7).

Local intelligibility is not very much less of a problem, as scientific theories are usually expressed with the help of mathematics and specialised vocabulary. This reduces ambiguity and enhances clarity for those who are able to understand but, on the other hand, it usually makes it impossible for an uninitiated reader to make sense of the different pieces of information. A further impediment has to do with the diversity of statuses that scientific hypotheses may have relative to confirmation. Within the relevant scientific community, it is usually clear whether a given hypothesis is well-confirmed or uncertain, whether it can be safely relied upon or is a topic for active research. But this subtle and usually tacit assessment of the plausibility of the hypotheses at hand is very difficult to communicate outside the relevant community. In the case of climate science, the problem is made worse by the fact that most projections are affected by uncertainty. Indeed, uncertainty is difficult to convey to the general public and scientists usually express it in ways that may be considered as too technical or ambiguous for laypersons.

Uncertain projections are not distinctive of climate science: they also characterise most scientific fields that call for expertise by large multidisciplinary groups. In the case of climate science, however, uncertainties stem from different sources. The first one is the incompleteness of empirical data themselves, which results in persisting uncertainty regarding some empirical phenomena (in the sense of [START_REF] Bogen | Saving the phenomena[END_REF]. The second source of uncertainties of the classical sort is the use of computer models and simulations. The complex computer models that climate science massively resorts to involve their share of idealisations, ad hoc hypotheses, parametrisation choices… all of which are necessary for computational purposes but generate uncertainties in the results of simulations. The third source of uncertainty consists in the disconnectedness of the pieces of climate science. Climate is a highly complex system regarding which exist several pieces of firmly established knowledge, but these pieces are dis-unified, concerning phenomena at very different temporal or spatial scales, and there is currently no prospect of discovering systematic connections between all of them. The problem is not only that the physical and chemical laws driving the relevant interactions are not entirely known, but that scientists are clueless as to how to fill many of the gaps in their knowledge . The resulting 3 uncertainties are not, or not only, of the kind that is most classically associated with knowledge incompleteness, but are much deeper. It is particularly hard to give a fair idea of the size and nature of these various uncertainties, which are therefore an impediment to both consistency and local intelligibility.

That climate science is loaded with uncertainties is problematic also in connection with accuracy. To see this, let us come back to the idea that choosing the author of an expert report can be seen as a means for users of the report to aim to secure that it is (or rather will be) accurate. Following this idea, reports whose authors are not chosen by their purported users must hint at their own accuracy. This is what happens in the case of the IPCC, which stems from a joint action by the World Meteorological Organisation and the United Nations and treats questions that are self-assigned by the corresponding scientific community. But the uncertainties of climate science make the task especially tricky. How can one convince the layman that a document reporting many uncertainties, some of which are severe, is accurate and indeed presents the best of our theories and evidence? This is not obvious, particularly as ARs are collectively authored. As underlined by [START_REF] John | Expertise in climate science[END_REF], "standard ways of assessing a human speaker's trustworthiness may not apply well to assessing corporate speech" (p. 132)-and, as a matter of fact, Goldman's proposal with regard to the choice of an expert cannot be straightforwardly relied on in the context of assessing the accuracy of a collective of authors.

Finally, the fact that climate science is affected by considerable uncertainty implies that rational disagreement, which is a normal feature of science in progress [START_REF] Solomon | Contingency and Dissent in Science Project Discussion Paper Series[END_REF][START_REF] Andler | Dissensus in science as a fact and a norm[END_REF], is more likely to occur in climate science than in other areas of science. In addition to being a potential threat to intelligibility, disagreement within climate science deepens the necessity and difficulty of showing that ARs are accurate. Indeed, as explained by [START_REF] Beatty | Masking disagreement among experts[END_REF], disagreement between experts or within the scientific field from which they stem may be interpreted as showing that experts' authority is usurped and their reports lack accuracy. In the case of climate change, the situation is compounded by the fact that disagreements percolate through to society at large and that, particularly in this arena, it sometimes stems from disingenuous criticism or from an irrational assessment of climate data or climate science literature. Specifically, IPCC ARs take part in the debate with so-called "deniers", that is, individuals who deny that climate change is real and/or that it has a human origin. An important episode in this debate is the "Climategate''. In 2009, a few weeks before the Copenhagen Summit on climate change, emails and files exchanged among climate scientists were leaked after the hacking of a server at the Climatic Research Unit at the University of East Anglia, and some of these documents were presented by climate change deniers or skeptics as evidencing significant manipulation of data by climate scientists, in an attempt to In fact, as Nancy Cartwright has been arguing, with increasing persuasiveness, for decades, there may be no scientific overestimate global warming. Significantly, IPCC WGI responded to this and quickly issued a statement supporting the accused authors. 4Relevance may seem the least problematic norm as regards IPCC ARs. Indeed, the breadth and generality of their topic seem to imply that just about any contribution to climate science addresses a question that is relevant with regard to IPCC's charge. But by the same token, the very breadth of ARs' topic, together with the fact that climate and climate change call for multidisciplinary study, makes it more of a challenge to ensure that no important question has been forgotten. More crucially, the fact the IPCC is not mandated by decision-makers aiming to solve some specific decision problems implies that ARs do not fully meet the requirement of relevance unless their content can be easily connected with every likely political query related to climate change. What this amounts to and how it can be achieved is in no way obvious.

The immensity and nature of the topic of IPCC ARs, as well as the resulting length of the reports themselves, not only contribute to make it difficult that these reports satisfy the norms that bear on expert reports. As we have seen, they also impose that ARs are authored by a very large and diverse community. Thereby, they preclude that the norms of intelligibility, relevance and accuracy be satisfied by more or less tacit and uncoordinated efforts. A well-adjusted organisation of work must be explicitly defined. We contend that in the case of the IPCC, the elaboration of such an organisation and the compliance with it were made possible by a solid common background. Climate science has solid and uncontested foundations, the climate science community has a long tradition of sharing data, methods and results at the international level, and climate scientists involved in IPCC's action share the conviction that climate change is occurring and that it is urgent to take action against it. In our view, this background has been instrumental in equipping the IPCC with procedures that organise collective work in a suitable way-that is, in a way that aims to have ARs satisfy the norms of intelligibility, relevance and accuracy and makes it likely that they do so. The remainder of the paper shows that IPCC's procedures can indeed be understood as aiming at these norms. Section 4 deals with the division of labour within the IPCC while section 5 focuses on three frameworks that were not in place at the beginning of IPCC's operations and were set up in response to perceived defects of its early production.

Division of labour

Since the first AR, issued in 1990, collective work within IPCC is organised by a supervising entity, the Bureau. In accordance with its "Terms of reference" (IPCC 2021c),"the purpose of the Bureau is to provide guidance to the Panel [of scientific experts] on the scientific and technical aspects of its work, to advise on related management and strategic issues, and to take decisions on specific issues within its mandate" ( §1). As regards ARs, its functions primarily include advice on the work programme and on the coordination of work between the WGs, and selection of IPCC authors and reviewers.

The Bureau is currently composed of 34 members. It includes the chair and vice-chairs of the IPCC, as well as the members (co-chairs and vice-chairs) of the different WG Bureaus. The 5 Bureau of a WG is in charge of the "preparation of working group […] assessment reports", mainly through the organisation of "scoping meetings". These meetings aim to define the scope of the reports and develop draft outlines and work plans. The WG Bureau thereby supervises the definition of the table of contents of the AR's various parts, including chapter and section titles.

The text of this statement has been removed from IPCC's website but it can still be found here: http://

The definition by the Bureau of the main questions to be addressed by IPCC authors serves different goals. In particular, it implies that authors are not individually responsible for ARs' scope and will not have to personally bear the burden of a debate with people claiming that a subject matter has been unduly neglected or highlighted. As regards the content of ARs, the role of WG Bureaus implies that they take charge of relevance. They also contribute to their global intelligibility and to the absence of contradictions, as dividing up from above the scientific content of an AR efficiently limits overlaps between the different chapters or sections. Whatever overlaps remain are also taken care of by the Bureau, which provides "guidance on crosscutting scientific issues related to the drafting of the reports" (ibid., §5, c). Finally, the existence and terms of reference of the Bureau also indicate a concern for accuracy, through the selection of IPCC authors (see IPCC 2021b, Section 4.3.2). The hierarchical dimension is present not only at the level of the full ARs but also at the lower level of their chapters. Each chapter is under the responsibility of two or three "coordinating lead authors", who integrate the contribution of "lead authors", who themselves use the material provided by "contributing authors".

Work within the IPCC has features that pertain to several of the types of interdisciplinary collaboration distinguished by [START_REF] Rossini | Frameworks for integrating interdisciplinary research[END_REF] and discussed by [START_REF] Andersen | Epistemic dependence in interdisciplinary groups[END_REF]. Actual writing is ensured by very small units of people who can interact along the lines of "common group learning", that is, in such a way that the resulting epistemic production can be seen as common knowledge in the group. Coordinating lead authors integrate the contributions provided by lead authors, much along the lines of the "integration by leader" framework. Work is distributed among coordinating lead authors according to their area of expertise, as in the "negotiation among experts" model. However, IPCC as a whole does not conform to any of these models, and neither can it be analysed as a combination of collaborations that may be thought of along these lines. Crucially, although it is true that WG Bureaus can be seen as leaders with regard to contributing lead authors, their participation in the production of ARs relies on dividing labor rather than on integrating contributions. We contend that this original, idiosyncratic organisation is instrumental in ARs satisfying the norms of expertise.

To start with, actual writing work is divided into small bits that are taken care of by small units of people. Within such groups, it is much easier than at the level of the entire Panel to spot disagreements and it is likely that the disagreements that are reducible by rational discussion are indeed eliminated. This contributes to having reports that are intelligible and hint at their own accuracy (or at least do not contain one type of material that may be used to put this accuracy into question). What is more, the "task and responsibilities" of contributing lead authors include that they take care of potential disagreements between the contributions of different lead authorseven though IPCC's documentation does not specify how they are supposed to do so. Contributing lead authors also complement the work of the Bureau with respect to "crosscutting [...] issues" and ensure that they are indeed "addressed in a complete and coherent manner" (IPCC 2021b, Annex 1: Tasks and responsibilities for lead authors, coordinating lead authors, contributing authors, expert reviewers and review editors of IPCC reports and government focal points, Section 2 about coordinating lead authors). It is also incumbent upon them to deal with the threat to intelligibility that arises from the fact that one and the same topic may have to be addressed in different places in the AR. Social calibration can be pursued along the same ascending pathways that are taken by contradiction tracking, from actual written contributions, to the sections, and then to the chapters and finally the ARs. The convergence of these pathways or, in other words, the pyramidal organisation of the IPCC, is very helpful. It entails that the larger the interactional expertise needed to competently occupy a position of a given type, that is, the more expertise is necessary to communicate and "interact interestingly" with the relevant participants (Collins and Evans 2002, p. 254), the fewer positions of this type in IPCC's organisational structure. Many authors work as contributing authors, alone or within groups where social calibration is not a problem or can be secured by explicit discussion. This requires little, if any, interactional expertise. A smaller but still important number of authors serve as lead authors, a position that requires at the minimum to master the different subject matters broached in one section and be able to communicate with other lead authors of the same chapter. This is more demanding but still a quite common feature among scientists. Finally, coordinating lead authorship calls for interactional expertise over large domains, but is taken up by only a small number of authors. The pyramidal organisation of the IPCC thus divides up the work load of ensuring social calibration but does so in a way that does not require that all participants have interactional expertise covering the scope of the whole AR or even of an entire chapter. It thereby helps to overcome the threat to consistency that comes from multidisciplinarity. This pyramidal division of labor also limits the epistemic impact of interactions that involve opaque epistemic dependence: typically, contributing authors with substantial expertise in distant areas will not interact directly.

The organisational structure of the IPCC further implies that the content of an AR cannot be consensual in the sense of every author affirming every statement in the AR. As already underlined by [START_REF] Beatty | Consensus: Sometimes it doesn't add up[END_REF], "there is no meaningful consensus of any kind involving the sorts of numbers that so commonly accompany the release and promotion of IPCC assessments" (p. 193). As we have seen, the division of labor within the IPCC importantly relies on a division of the content of ARs and the result is that not every author has her say on every idea, or even has considered every sentence in the AR-far from it! However, IPCC authors may and arguably do jointly accept, in the sense of [START_REF] Gilbert | Modelling collective belief[END_REF], the content of ARs, through authors not in charge of a given part deferring to the ones who are. Moreover, consensus may hold in a more substantial sense among the people who share the responsibility of a given part of the report and it is indeed aimed at: "In taking decisions, and approving, adopting and accepting reports, the Panel, its Workings Groups and any Task Forces use all best endeavours to reach consensus" (IPCC 2021a, §10, p. 2).

Although it is not devoid of vagueness, this sentence suggests that decisions about actual writing should be taken as the outcomes of informal deliberations aiming for a position or formulation that is consensual in the sense of being acceptable by all or at least unobjected to any of the authors involved-a type of consensus that Beatty (2017) characterises as "less aggregative and more collective" (p. 179) than consensus associated "with some form of counting: vote tallying, opinion polling, adding-up the number of authors that endorse a particular position in their published papers" (p. 179). Consensus seeking cannot be justified by the epistemic properties of consensual positions. Indeed, consensus cannot be taken as indicative of knowledge [START_REF] Miller | When is consensus knowledge-based? Distinguishing shared knowledge from mere agreement[END_REF][START_REF] Miller | The social epistemology of consensus and dissent[END_REF]) and deference to it may fail to be justified [START_REF] Miller | Scientific consensus and expert testimony in courts: Lessons from the Bendectin litigation[END_REF]. However, in the context of the IPCC, consensus can be considered as a means toward univocity and thereby global intelligibility. More precisely, consensus, be it in the weak, collective form, is relevant for univocity to the extent that dissent remains a possibility and would be reported in case it occurred. Now, this is exactly what IPCC procedures suppose, as lead authors are "required to record in the Report views which cannot be reconciled with a consensus view but which are nonetheless scientifically and technically valid" (IPCC 2021b, Annex 1, Section 1 about lead authors). Contrary to what [START_REF] Curry | Climate change: No consensus on consensus[END_REF] tend to suggest, intelligibility is not meant to be achieved at the expense of an accurate presentation of the best of our current theories and evidence.

How accuracy is supposed to be actually reached remains unclear at this stage, though. For one thing the division of labour within the IPCC primarily targets the obvious requirements of logical coherence, consistency, global intelligibility and relevance but hardly takes care of local intelligibility, or accuracy. For another, the principles organising IPCC's work remain formal. They are stated in written instructions, and in view of the breadth and dimension of the reports they cannot provide explicit answers to all the substantive questions that may arise in the process of writing reports that satisfy the norms of expertise. As is also suggested by the exceptional lightness of the IPCC's hierarchical structure relative to its size, further procedures are needed, that help to reach local intelligibility and accuracy and also to actually avoid gaps, overlaps or inconsistencies.

Key add-ons

The background shared by IPCC members not only underpinned division of labour in a way that facilitates the production of reports satisfying the epistemic norms bearing on expertise. It also enabled the IPCC to set up and introduce new organisational frameworks in order to respond to perceived defects of its early production. We identify and discuss three such add-ons: a common vocabulary to express uncertainties, an open reviewing process, and an international framework for comparing models. We present them in turn and explain how they contribute to ARs satisfying the requirements of intelligibility, relevance and accuracy.

A common language for expressing uncertainty

As explained in Section 3, climate science is loaded with uncertainties whose nature and variety constitute an impediment to achieving intelligibility of ARs. The need was felt early on of a precisely defined vocabulary which IPCC authors would be required to employ systematically [START_REF] Moss | Characterizing and communicating scientific uncertainty: Building on the IPCC second assessment[END_REF]. Although the intent was clear from the beginning, the goal has turned out to be surprisingly difficult to meet. The sought-after lexicon has been defined in a series of evolving guidance notes that make up "a continuing tradition of iterative improvement of the treatment of uncertainties" (Mastrandrea and Mach 2011, p. 659). An initial version, for AR3, is provided in [START_REF] Moss | Uncertainties in the IPCC TAR: Recommendations to lead authors for more consistent assessment and reporting[END_REF] and a second one, for AR4, in Manning et al. (2004). The framework for AR5 is defined in [START_REF] Mastrandrea | Guidance note for lead authors of the IPCC fifth assessment report on consistent treatment of uncertainties[END_REF]'s "Guidance note for lead authors of the IPCC fifth assessment report on consistent treatment of uncertainties" and more thoroughly discussed in Mastrandrea et al. (2011). 6 By defining a framework for the assessment and expression of uncertainties that is meant to be used throughout the whole ARs, [START_REF] Mastrandrea | Guidance note for lead authors of the IPCC fifth assessment report on consistent treatment of uncertainties[END_REF] primarily aims at consistency (as indicated by its title). However, the definition of this framework is available both for authors and for readers or users of ARs and can be referred to in order to clarify the meaning of expressions of uncertainty in ARs. As a consequence it leads to a significant improvement in local intelligibility too, providing IPCC authors with the means to make more of their assumptions and reckonings explicit and thereby helping to avoid a whole set of misunderstandings. 7 The uniform treatment and expression of uncertainties is also instrumental in promoting global intelligibility. It requires authors to combine disparate evidential and theoretical claims affected by uncertainties of various types in order to produce one all-encompassing (although often dual, as we shall see) uncertainty assessment for each important statement in the AR, and this undoubtedly helps to have clear-cut conclusions. The "Guidance note" also promotes global intelligibility in another manner, by bringing into focus the nature of ARs. The note requires that authors assess confidence in the validity of their key findings, where confidence is defined as a combination of two ingredients: "the type, amount, quality, and consistency of evidence" supporting it and the "degree of agreement" of which it is the subject within the community of climate scientists. This characterisation of confidence essentially depends on ARs being reviews of scientific literature, as opposed to original research pieces. Confidence claims within ARs therefore remind readers of the status of ARs and thereby enhance their intelligibility.

The CMIP

A second add-on to IPCC's organisation is its reliance, in the last decade or so, on the Coupled Model Intercomparison Project (CMIP). CMIP is a worldwide scientific project created in 1995 by

As far as we know, this document has not been revised in preparation for AR6.

6

Psychological studies show nevertheless that the calibrated language is ambiguous. IPCC uncertainty statements are 7 understood differently depending on cultural differences (e.g. between British English and Chinese translations) or ideological differences [START_REF] Budescu | Improving communication of uncertainty in the reports of the Intergovernmental Panel on Climate Change[END_REF][START_REF] Budescu | Effective communication of uncertainty in the IPCC reports[END_REF][START_REF] Harris | Lost in translation? Interpretations of the probability phrases used by the Intergovernmental Panel on Climate Change in China and the UK[END_REF]. Moreover, they are usually not understood correctly, as the table of equivalence between probabilities and verbal expressions is not intuitive. Finally, how uncertainty statements are understood depends on the context, and specifically on the severity of the events under consideration and of their consequences [START_REF] Harris | Communicating environmental risks: Clarifying the severity effect in interpretations of verbal probability expressions[END_REF].

the Program for Climate Model Diagnosis and Intercomparison (PCMDI) [START_REF] Meehl | The Coupled Model Intercomparison Project (CMIP)[END_REF], a US funded agency within the Lawrence Livermore National Laboratory. It provides a framework for studying and straightforwardly comparing the outputs of simulations of the past, present and future climate contributed by leading modelling centres around the world. The initial motivation was that although models are increasingly complex, model errors and disagreements among them remain significant and poorly understood -for instance, current general circulation models (GCMs) predict an increase of global mean surface air temperature due to a doubling of atmospheric carbon dioxide within a rather large range (1.5 -4.5°C). The CMIP defines standards for models to have their outputs archived in its database: they must be GCMs and be run under the same given boundary conditions and idealised scenarios of global warming.

By thus enforcing standardization, the CMIP enables the scientific community to evaluate GCMs in a fair way, to compare their results, to identify those that are robust as well as whatever problematic features they may have in common, and to possibly uncover the sources of the disagreements among them. Such a process eventually helps to improve the models. Moreover, ensembles of models have proved to be more informative than singular models with respect to exploration of uncertainties about future climate change [START_REF] Parker | Whose probabilities? Predicting climate change with ensembles of models[END_REF][START_REF] Katzav | The future of climate modelling[END_REF]Katzav, Dijkstra and de Laast, 2012;[START_REF] Katzav | The epistemology of climate models and some of its implications for climate science and the philosophy of science[END_REF][START_REF] Parker | Climate Science[END_REF], their most prominent aim now being to estimate uncertainties quantitatively.

Though a strictly scientific project, the CMIP has recently turned out to play a major role with regard to ARs. By homogenising the inputs of ARs, it has greatly increased IPCC authors' ability to reach consistency and global intelligibility. Moreover, the CMIP has a bearing on the relevance of ARs. More precisely, it encapsulates part of the answer to the question of what should be presented and discussed in ARs. As emphasised by [START_REF] Parker | Ensemble modeling, uncertainty and robust predictions[END_REF], successive versions of the program "have been designed to support research relevant for IPCC scientific assessments of climate change" (p. 214), to the extent that successive versions of the program have been numbered after the corresponding ARs. Specifically, the choice of the scenarios that serve as inputs for models within the CMIP is exogenous to the scientific enterprise and has been driven by the concern of producing information that is relevant for decision-making in the context of climate change. Finally, the CMIP has the more general effect of bringing climate science and IPCC closer to each other. It comes about that IPCC has progressively become the main structuring force of international climate science research and that IPCC timing now governs the scheduling of many activities in this domain, among which the running of GCM computer simulations. ARs have become the major review papers in the various fields they cover and researchers are strongly motivated to have their own papers quoted and used in ARs. Together with the provision of a large database, the CMIP thereby promotes ARs' accuracy. Note that it also has the side-effect of consolidating and expanding the common scientific background on which IPCC's functioning relies, as research in climate science is scheduled and partially standardized by IPCC's agenda and requirements.

Reviewing procedure

Accuracy is the main target of the last organisational framework that we shall discuss: the reviewing procedure to which ARs are submitted from AR4 onwards. As detailed in Section 4.3.4 of the "Procedures for the preparation, review, acceptance, adoption, approval and publication of IPCC reports" (IPCC 2021b), ARs undergo two formal rounds of reviews. The first round is ensured by scientific experts selected by the Bureau because of their significant expertise or following the suggestion of governments or of NGOs. Comments are taken into account and a revised draft is submitted for review by the same (or similar) experts but also by governments. IPCC authors are required to consider and address all comments at both stages of the review process. The whole process is supervised by two to four "review editors" per chapter, "normally" including one member of the WG Bureau and one "independent expert based on the lists provided by governments and observer organisations". As defined in Section 5 of the above-mentioned Annex, the role of review editors is primarily to ensure that all pertinent elements and comments are taken into account and that controversies be either resolved or presented in an adequate and fair way.

It seems clear that this weighty multi-stage reviewing procedure smooths the path towards intelligibility. Indeed, be it in or out of the context of the IPCC, one remit of reviewers is to ensure that the documents under review can be locally understood, that they are free from logical contradiction and consistent, and that their main conclusions are easy to locate and unambiguous. Similarly, reviewers are in general expected to check that the scope of the reviewed document is in keeping with its stated goals, thereby contributing to its relevance. However, the reviewing process of ARs essentially aims at their accuracy. The "function" of reviewers is indeed defined as "to comment on the accuracy and completeness of the scientific/technical/socio-economic content and the overall scientific/technical/socio-economic balance of the drafts" (IPCC 2021b, Annex 1, Section 4 on expert reviewers). Fairness with regard to evidence and available theories is also taken care of in an exogenous way, through the choice of reviewers: "in selecting Review Editors, the Bureaus should […] aim for a balanced representation of scientific, technical and socioeconomic views" (IPCC 2021b, Section 4.3.4).

IPCC's reviewing process is mentioned in relation with accuracy concerns in the statement that was issued by WGI in the context of the Climategate. The primary aim of this statement was to argue in favour of the trustworthiness of the conclusions of AR4, a consequence of the AR being accurate, and to this effect it stressed the openness of IPCC assessments. Openness is promoted by the reviewing procedure to the extent that some governments (including the US government) made the second draft of the report freely available online, with the possibility for any reader to submit comments. It contributes to accuracy by bringing to a completion the movement of widening the circle of people who can have a say on the content of the ARs, which in turn raises the probability that no important piece of evidence or theory is neglected and that not all participants in the writing process are biased in the same way. Notice however that openness does not only serve the primary purpose of enhancing accuracy. It also helps in the secondary task of arousing confidence and pointing to AR's accuracy, by indicating that ARs are not meant to be produced by a closed lot of people sharing a hidden and arguably largely political agenda. What is essential here is not so much openness itself as its publicity. This is the sense of the concomitant IPCC efforts towards transparency, specifically with regard to the review process, meant to be "objective, open and transparent" (IPCC 2021b, Section 4.3.4). In fact, in the wake of the Climategate (and also of the publication in 2010 of an independent review of the processes and procedures of the IPCC ), the reviewing procedure was not so much strengthened as it was formalised, while the role 8 of review editors was more clearly delineated.

Concluding remarks

Producing reports that assess the state of climate knowledge while satisfying the norms of intelligibility, relevance and accuracy is a formidable challenge. We contended that in view of the size and diversity of the group of IPCC authors, and also of the length of IPCC ARs, this challenge cannot be taken up without procedures that suitably organise collective work. This part of our analysis, developed in Sections 2 and 3, can be used as a framework to study other cases of collective scientific expertise. The organisation of work within the IPCC is composed of a hierarchical division of labour supplemented by three more recent add-ons: language calibration as regards uncertainty, coupling with the CMIP and a thorough reviewing process. By describing these different elements and showing how they aim to and make it possible that ARs have the epistemic properties of expert reports, we provide support to the view that IPCC's undertaking is primarily epistemic rather than political.

This review was published by the InterAcademy Council under a contract signed with the UNO in 2010. It can be found While there is little doubt that these elements strongly help IPCC authors in their effort to produce ARs that meet the epistemic requirements bearing on expertise, IPCC ARs are arguably not perfectly intelligible, relevant and accurate. Global intelligibility largely remains an open problem, due mainly to the length of ARs. For this reason, ARs are supplemented by "Summaries for policy-makers". We did not study them because they are not part of the ARs per se and, more importantly, because they raise a whole new set of philosophical questions: they are openly political objects, whose content is negotiated and approved line by line following a process that is open to all governments.

Whether ARs are relevant is also a vivid issue. Relevance as we defined it is a matter of fit between the questions broached in an expertise report and the decision problems on which this report is meant to bring light. Now, in the case of the IPCC no specific decision problem is targeted: ARs aim to provide a generic expertise basis to be relied on for climate related decisions. Relevance therefore comes down to a matter of covering the entire scope of climate science and of laying emphasis on the theories or hypotheses that seem more useful for policy-making. Delineation from above of the scope and outline of ARs, thorough review and coupling with the CMIP help to achieve it, as we saw. It may be argued, though, that the very task of the IPCC is too broad and insufficiently specific to be of any use for actual decision problems in real political life. This probably explains why local analogs of the IPCC are developing, at the national or subnational levels. These groups should not be seen as alternatives to the IPCC; they rather supplement and expand upon IPCC's work. To this effect, they can rely not only on the same common scientific background that enabled the IPCC to organise work in an efficient way, but also on the consolidation and expansion of this background by IPCC's activities themselves. As for work organisation itself, IPCC's structure and added frameworks can serve as references which have proved to be helpful as regards the satisfaction of the epistemic norms of expertise.

case. However, we will usually refer to them as to all-or-nothing properties, in order to avoid unnecessarily complex formulations.

framework in which disparate pieces of science will in due time be stitched together[START_REF] Cartwright | The dappled world: A study of the boundaries of science[END_REF][START_REF] Cartwright | The dethronement of laws in science[END_REF].

www.climatesciencewatch.org/2009/12/04/ipcc-statement-on-stolen-emails-from-the-climatic-research-unit-at-theuniversity-of-east-anglia/.The Task Force on National Greenhouse Gas Inventories also has a Bureau, which has the same status as WG

5Bureaus and which we therefore include in the reference of "WG Bureaus".

here: http://www.interacademies.org/33365.aspx.

Acknowledgements

This work was initially supported by Sorbonne Universités, through the DéciGIEC Convergence program (SU-2014-R-DPD-05-01). Julie Jebeile acknowledges support from the Swiss National Science Foundation (project PP00P1_170460). All authors would like to thank Marion Vorms for her comments on a previous version of this paper and three reviewers for their insightful comments, which led to substantive revisions and improvements in the paper.