Masking Circuit Faults and Trojan Circuit Injections Using Sat Solvers

Abstract

Combinational circuit C composed of gates and its sub-circuit with set V of output nodes and set U of input nodes are considered. The set V consists of output nodes of fault gates of the circuit C (only logical faults are examined) and fault free gates, the inputs of which are at the same time lines in that Trojan circuit payloads are injected. A procedure of forming the set U, as a rule, depends on circuit C fabrication technology and is out of our consideration. We suggest recovering the circuit C behavior by using as much as possible simple masking circuits (patch circuits). Masking circuit inputs are connected with nodes from the set U, and outputs are united either with nodes that are fed by nodes from the set V or directly with nodes from the set V. The conventional way of recovering the circuit C behavior (in the frame of Engineering Change Order (ECO) technologies) is based on using results of circuit C simulation. This way guarantees correct circuit C behavior only on a set of Boolean vectors applied during simulation. We suggest using incompletely specified Boolean functions of nodes from V in the frame of ECO technologies, which allows guaranteeing correct behavior of the circuit C among all its input Boolean vectors. Deriving the incompletely specified Boolean functions is connected with applying SAT solvers. Having got these functions, we then obtain the masking circuit (patch circuit) using ESPRESSO and ABC systems.