Recent trends in integrated circuits industry include decentralization of the production flow by involving different integration teams, third-party IP vendors and other untrusted entities. As a result, this is opening up a door to new types of attacks that may lead to devastating consequences, such as denial of service or data leakage. Therefore, the problem of ensuring hardware security has gained much attention in the last years, especially early in the design cycle, when an attacker may insert malicious circuitry at register transfer (RT) or gate level. Due to the increased complexity of modern devices, the research community is spending a lot of effort in developing more sophisticated detection methodologies and smarter attacks. However, the main problem is that they are validated on the existing benchmarks that do not reflect the real complexity. Trying to fill this gap, this paper proposes a set of RT-Level Hardware Trojan benchmarks injected in a RISC-based pipelined microprocessor core. To prove the viability, the impacts on area, power and frequency are presented and discussed. For any proposed Hardware Trojan, the functional description, the implementation details and the effects once activated are provided.

With the complexity of nanoelectronic devices rapidly increasing, an efficient way to handle large number of embedded instruments became a necessity. The IEEE 1687 standard was introduced to provide flexibility in accessing and controlling such instrumentation through a reconfigurable scan chain. Nowadays, together with testing the system for defects that may affect the scan chains themselves, the diagnosis of such faults is also important. This article proposes a method for generating stimuli to precisely identify permanent high-level faults in a IEEE 1687 reconfigurable scan chain: the system is modeled as a finite state automaton where faults correspond to multiple incorrect transitions; then, a dynamic greedy algorithm is used to select a sequence of inputs able to distinguish between all possible faults. Experimental results on the widely-adopted ITC'02 and ITC'16 benchmark suites, as well as on synthetically generated circuits, clearly demonstrate the applicability and effectiveness of the proposed approach: generated sequences are two orders of magnitude shorter compared to previous methodologies, while the computational resources required remain acceptable even for larger benchmarks.

The increasing number of embedded instruments used to perform test, monitoring, calibration and debug within a semiconductor device has called for a brand new standard-the IEEE 1687. Such a standard resorts to a reconfigurable scan network to provide efficient and flexible access to instruments and to handle complex structures. As it has to deliver reliable service, many approaches, both formal and simulation-based, have been proposed in the literature to perform test, diagnosis and verification of such networks. This paper focuses on the problem of post-silicon validation of a network, a problem that has not been adequately addressed, yet. We analyze the mismatches between the specification and its silicon implementation, and we propose a methodology to detect a subset of them by applying functional patterns and observing the length of the active scan path. Experimental results on ITC2016 benchmarks demonstrate that the proposed approach is broadly applicable, and able to generate very effective sequences. We also classify mismatches that cannot be targeted relying exclusively on the active scan path length information.

A fundamental part of the new IEEE Std 1687 is the Instrument Connectivity Language (ICL), which allows for abstract description of the scan network. The big novelty if compared to legacy solutions like BSDL is the possibility of describing new topology-enabling elements such as the Scan-Muxes in a behavioural way which can be easily and efficiently exploited by Test Generation Tools to retarget instrument-level operations to top-level patterns. This means that for a given design, the Developer will have to write both the RTL and the ICL descriptions: to the author's best knowledge there is no automated tool to make the translation RTL to ICL. This methodology is error-prone due to the human factor, the difference in intent in the two descriptions and the syntactic and semantic complexity of the languages. Incoherence between ICL and RTL will result in retargeting errors, so it is fundamental to validate the equivalence between the two descriptions. This paper presents an automated methodology that starting from the ICL description is able to generate a set of RTL testbenches that can be simulated against the original RTL model to detect discrepancies and incoherence, and provides quantitative metrics in terms of code and functional coverage. Experimental results are reported on the set of ITC2016 set of benchmark networks.

The Negative Bias Temperature Instability (NBTI) phenomenon is one of the main reliability issues in today's nanoelectronic systems. It causes increase in threshold voltage of pMOS transistors, thus degrading signal propagation delay in logic paths between flip-flops. Recently, IEEE published a new standard IEEE 1687 for Reconfigurable Scan Networks (RSN) to facilitate access to embedded instrumentation within an integrated circuit. In the field, the RSN infrastructure is often exploited for fault-management in failure-sensitive critical parts of the system. Therefore, the severity level of a fault in the RSN itself is very high, thus, amplifying the impact of the reliability issues caused by the aforementioned effect. To the best of the authors' knowledge no approach has been proposed to investigate or address this issue so far. In this paper, we analyze the effect of NBTI-induced aging in RSNs from architectural and operational (functional) perspectives and present a novel technique to mitigate the degradation. The methodology is demonstrated on a a case-study example and the effectiveness of our approach is evaluated on a sub-set of ITC2016 benchmark RSN designs.

In last years, the Internet of Things (IoT) has gained attention in relevant fields of application as Industry 4.0. IoT is usually structured around three layers according to computing capacity and energy cost: cloud, fog, and edge. This paper focuses on the edge layer which is close to the end-user. Specifically, the authors fully address a binary image classification problem in the edge without going toward upper layers, i.e., the intelligence and the computation is brought to the edge layer, instead of being simple sensing devices. To this end, the authors propose a cascade Support Vector Machine (SVM) embedded implementation specially designed to be executed within a low-cost FPGA, which could be embedded in an IoT edge device. The experimental results performed show the feasibility and correct functionality of the proposal when comparing to a regular computer.

The broad need to efficiently access all the instrumentation embedded within a semiconductor device called for a standardization, and the reconfigurable scan networks proposed in IEEE 1687 have been demonstrated effective in handling complex infrastructures. At the same time, different techniques have been proposed to test the new circuitry required; however, most of the automatic approaches are either too computationally demanding to be applied in complex cases, or too approximate to yield high-quality tests. This paper models the state of a reconfigurable scan network with a finite state automaton, using the length of the active path as the output alphabet and the configurations as input symbols. Permanent faults are represented as incorrect transitions, and a greedy algorithm is used to generate a functional test sequence able to detect all these multiple state-transition faults. The automaton's state set and the input alphabet are small subsets of the possible ones, and are carefully chosen. Experimental results on ITC'16 benchmarks demonstrate that the proposed approach is broadly applicable; the test sequences are more efficient than the ones previously generated by search heuristics.

Nowadays, industries require reliable methods for accessing the instrumentations embedded within semiconductor devices. The situation led to the definition of standards, such as the IEEE 1687, for designing the required infrastructures, and the proposal of techniques to test them. So far, most of the test-generation approaches are either too computationally demanding to be applied in complex cases, or too approximate to yield high-quality tests. This paper exploits a recent idea: the state of a generic reconfigurable scan chain is modeled as a finite state automaton and a low-level fault, as an incorrect transition; it then proposes a new algorithm for generating a functional test sequence able to detect all incorrect transitions far more efficiently than previous ones. Such an algorithm is based on a greedy search, and it is able to postpone costly operations and eventually minimize their number. Experimental results on ITC`16 benchmarks demonstrate that the proposed approach is broadly applicable; has limited computational requirements; and the test sequences are order of magnitudes shorter than the ones previously generated by approximate methodologies.