Post-fabrication Testing Research Articles

Design Obfuscation Through 3-D Split Fabrication With Smart Partitioning

We describe a design and fabrication experiment that has been performed to investigate a methodology for assessing the security of application specific integrated circuits (ASICs) fabricated in a split-manufacturing process based on 3-D integrated circuit (3DIC) technologies. The purpose of this process is to protect critical IP from reverse engineering if an adversary obtains either the fabricated wafers or their GDS. A number of 3DIC-based fabrication alternatives were evaluated, and one is selected for this experiment. Several designs, from the trivial to the complex, were used for the study. A self-test module was embedded in each design to facilitate the postfabrication testing. Various obfuscation techniques that include camouflage in the form of function and lookup table hiding and insertion of redundant logic in order to confuse potential attackers were applied. Smart partitioning was implemented for each design in an attempt to conceal vital functions. We introduced metrics that are based on the number of connection possibilities ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$C_{p}$ </tex-math></inline-formula> ) and the depth of partitioning ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$P_{\mathrm{ depth}}$ </tex-math></inline-formula> ) to measure the obfuscation strength. The results show that it should take more than 10 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">60</sup> years to reconstruct the netlist using a brute-force attack. Measurement results are presented showing fabrication success.

A comprehensive framework for cell-aware diagnosis of customer returns

The first step when a customer return occurs in industry is to reproduce the failure mechanism with any original test and test conditions (voltage, temperature, etc.) used during initial post-fabrication test. Depending on the test scenario (test sequence, test scheme, test conditions), different types of defects and failure mechanisms are targeted, thus leading to different diagnosis outcomes. Based on our previous work, this paper presents a comprehensible framework for cell-aware diagnosis of customer returns. The first part of the paper summarizes our previous work in which a generic cell-aware diagnosis flow using a Bayesian classification method was proposed to precisely identify defect candidates in combinational cells of a defective circuit according to a given test scenario. The second part of the paper extends the previous work by dealing with defects in sequential cells of defective circuits. New experiments done on a silicon test chip and a customer return with a given test scenario have proven the efficacy of our flow in terms of diagnosis accuracy and resolution.

Applied Failure Analysis Tools and Techniques Toward Integrated Circuit Trust and Assurance

Abstract Traditional post-fabrication testing can reliably verify whether or not an IC is working correctly, but it cannot tell the difference between an authentic and counterfeit chip or recognize design changes made with malicious intent. This article presents an IC decomposition workflow, based on FA tools and techniques, that provides a quantifiable level of assurance for components in a zero trust environment.

Exploiting the analog properties of digital circuits for malicious hardware

While the move to smaller transistors has been a boon for performance it has dramatically increased the cost to fabricate chips using those smaller transistors. This forces the vast majority of chip design companies to trust a third party---often overseas---to fabricate their design. To guard against shipping chips with errors (intentional or otherwise) chip design companies rely on post-fabrication testing. Unfortunately, this type of testing leaves the door open to malicious modifications since attackers can craft attack triggers requiring a sequence of unlikely events, which will never be encountered by even the most diligent tester. In this paper, we show how a fabrication-time attacker can leverage analog circuits to create a hardware attack that is small (i.e., requires as little as one gate) and stealthy (i.e., requires an unlikely trigger sequence before affecting a chip's functionality). In the open spaces of an already placed and routed design, we construct a circuit that uses capacitors to siphon charge from nearby wires as they transit between digital values. When the capacitors are fully charged, they deploy an attack that forces a victim flip-flop to a desired value. We weaponize this attack into a remotely controllable privilege escalation by attaching the capacitor to a controllable wire and by selecting a victim flip-flop that holds the privilege bit for our processor. We implement this attack in an OR1200 processor and fabricate a chip. Experimental results show that the purposed attack works. It eludes activation by a diverse set of benchmarks and evades known defenses.

Design-for-test approach of an asynchronous network-on-chip architecture and its associated test pattern generation and application

Asynchronous design offers an attractive solution to address the problems faced by networks-on-chip (NoC) designers such as timing constraints. Nevertheless, post-fabrication testing is a big challenge to bring the asynchronous NoCs to the market because of a lack of testing methodology and support. This study first presents the design and implementation of a design-for-test (DfT) architecture, which improves the testability of an asynchronous NoC architecture. Then, a simple method for generating test patterns for network routers is described. Test patterns are automatically generated by a custom program, given the network topology and the network size. Finally, we introduce a testing strategy for the whole asynchronous NoC. With the generated test patterns, the testing methodology presents high fault coverage (99.86%) for single stuck-at fault models.

Test pattern generation and partial-scan methodology for an asynchronous SoC interconnect

Asynchronous design offers a solution to the interconnect problems faced by system-on-chip (SoC) designers, but their adoption has been held back by a lack of methodology and support for post-fabrication testing. This paper first addresses the problem of testing C-elements, an important building block of asynchronous circuits. A simple method for generating test patterns is described which is shown to be applicable for a wide range of implementations. Based on the C-element testability, a partial scan technique was developed that achieves a test coverage of over 99.5% when applied to an asynchronous, network-on-chip, interconnect fabric. Test patterns are automatically generated by a custom program, given the interconnect topology. Area savings of at least 60% are noted, in comparison to standard, asynchronous, full-scan level-sensitive scan devices (LSSD) methods.

Indirect Test Architecture for SoC Testing

A generic model for test architectures in the core-based system-on-chip (SoC) designs consists of source/sink, wrapper, and test access mechanism (TAM). Current test architectures for digital cores assume a direct connection between the core and the tester. In these architectures, the tester establishes a physical link between itself and the core, such that it can directly control the core's design-for-testability (DFT), such as the scan chains or primary inputs. This direct connection undermines the modularity in the generic test architecture by tightly coupling its elements. In this paper, we propose a network-oriented indirect and modular architecture (NIMA) for postfabrication test in an SoC design methodology. In NIMA, test stimuli and expected results for digital cores are first compiled into new formats and subsequently encapsulated into packets. These packets are augmented with control and address bits such that they can autonomously be transmitted to their destination through a switching fabric. Owing to the indirect nature of the connection, embedded autonomous blocks at each core are used to apply the test to the core and compare the test results with expected values. This indirect access to the core decouples test data processing at the core from its communication providing the basis for flexible and modular test design and programming. Moreover, NIMA facilitates remote-access of single or multiple testers to an SoC, and enables the sending of test data to an SoC in-field in order to test the chip in its target system. Finally, NIMA serves in contributing toward the development of new test architectures that benefit from network-centric SoCs. We present a first implementation of NIMA when applied to a number of SoC benchmarks.

Testability in analogue cellular neural networks

AbstractThis paper addresses the problem of testing an ACNN by postulating the need for including some extra hardware to render feasible a postfabrication test. the work presented here deals with a test methodology based on adding some extra circuitry to every cell of a regular ACNN. This methodology is just an initial proposal for taking advantage of the network regularity to perform a global test which can be externally interpreted and hence has potential application for reconfiguring the network.

Implementation of 32-bit RISC processor incorporating hardware concurrent error detection and correction

The need for reliable integrated circuits is becoming of paramount importance as they are increasingly used in a range of safety critical applications or domestic products. In the past reliability has been achieved at the IC level by comprehensive testing of the device after manufacture. The use of scan design and BILBO techniques have assisted designers in achieving the necessary high test coverages with little effort. However these methods only address the problem of testing for permanent faults after fabrication or periodically during the lifetime of a system. These ‘classical’ techniques do not tackle the more serious problem of intermittent faults, which will come to dominate VLSI circuits as device geometries decrease. To deal with intermittent faults and maintain reliable operation concurrent test methods need to be used. The paper will present one possible method of detecting and correcting single intermittent faults that occur during normal operation and also assist the designer in post fabrication testing. The chosen technique uses information redundancy in the form of a SEC/DED Hamming code and will be illustrated by the design of a 32-bit CMOS RISC processor. The processor is capable of detecting and correcting errors arising from faults as they occur without the need to halt normal operations or recourse to any specialised software. A detailed appraisal of the costs involved in using this technique will be given in terms of the extra silicon area needed and the reduction in throughput of the processor.