With the semiconductor manufacturing technology approaching to 14 nm and below, the reliability of IC is challenged, as the speed of CMOS or FinFET is degraded by the aging mechanisms, including negative bias temperature instability (NBTI) and hot carrier injection (HCI). Furthermore, significant process variations differ the aging degradation rate of each individual IC, which causes significant failure time differences even for the ICs belonging to the same lot. Therefore, to select devices for the applications with various reliability requirements, it is necessary to conduct efficient predictive reliability screening during production test at time-zero. In this article, a fast time-zero aging prediction and predictive screening methodology based on a novel on-chip architecture named ZeroScreen is proposed. The pattern-based aging screening time is limited to 8.14 ms per device considering 50-MHz test clock frequency and 6.6-μs automatic test equipment (ATE) voltage settling time. In the experiment, fresh 45-nm FPGA devices and 130-nm ASIC chips are projected into four reliability bins with ZeroScreen-based aging prediction at time-zero. According to the silicon data, the reliability screening errors of ZeroScreen for the 45-nm FPGA chips are less than 6.5% and 4.3% for static and dynamic stress cases, respectively. And the screening errors for the 130 nm ASIC chips are close to 0, for both static and dynamic stress cases.

Physical unclonable function (PUF) is an important security primitive, which generates unique signatures as fingerprints for each chip. This article first presents a novel interconnect-based PUF (iPUF). The proposed iPUF utilizes the manufacturing process variability of interconnect lines to introduce crosstalk variations for generating PUF signatures. By leveraging the variations of passive interconnects, iPUF minimizes the usage of active CMOS components, providing an increased resiliency against environmental variations and aging. Initiated by a linear feedback shift register (LFSR), iPUF sequentially generates 1-bit signature at each clock cycle, making it more efficient compared with ring-oscillator PUF. Second, two schemes for signature uniqueness enhancement of sequential PUFs are proposed. The self-masking scheme windows the sequential signature with an m-bit mask trained by the PUF's own initial sequential signature. Meanwhile, the bit-filtering scheme screens the randomness of each bit within the sequential signature by exploiting several sub-iPUFs and selects the bits with high randomness. To verify the performance of iPUF, Monte Carlo simulations of 500 samples, with variations following industrial data, are conducted in different operating corners. The uniqueness of the given sample set approaches 48.63% with a 10-bit mask. With ±10% supply voltage, 0 °C-100 °C temperature variations, as well as one year of unaccelerated aging, iPUF's reliability values, are as high as 96.09%, 99.06%, and 99.63%, respectively. For verification, 50 dies of iPUF chips are manufactured with a 55-nm technology node. Silicon results demonstrate that iPUF generates 1024-bit signatures with satisfied uniqueness (48.03%) while exhibiting good reliability (90.07%) under 120-mV voltage variations. Finally, iPUF's robustness against various attacks is also proven.

With technology approaching to 14nm and below, the shrinking gate size makes IC reliability become a big concern. As the speed of CMOS and FinFET is degraded by aging mechanisms including negative bias temperature instability (NBTI) and hot carrier injection (HCI). At the same time, significant process variations differ the aging degradation rate of each individual IC, which cause significant failure time differences even for the ICs belonging to the same lot. Therefore, to efficiently bin the devices into the reliability tiers for different safety & security usages, it is necessary to perform predictive reliability screening during production test at time-zero. In this paper, a novel on-chip architecture for fast time-zero predictive aging screening (ZeroScreen) is proposed. The screening time is limited to 8.14ms per device considering 50MHz test clock frequency and 6.6 μs automatic test equipment (ATE) level settling time. In the experiment, 185 fresh FPGA devices under test (DUTs) implemented with ZeroScreen are binned into 4 predictive reliability bins by ZeroScreen. By comparing with the 8-hour accelerated burn-in results, the reliability screening errors of ZeroScreen are less than 6.5% and 4.3% for static and dynamic stress cases, respectively.

Counterfeiting has unfortunately become a worldwide epidemic affecting electronic systems from consumer goods to military equipment, which seriously jeopardizes system security, reliability, and electronic vendors' reputation. The counterfeit parts, e.g., integrated circuits (ICs) and printed circuit boards (PCBs), have shown a significant increase in type and number over the recent years. However, the existing counterfeit detection techniques deal with IC or PCB separately, and hence, they cannot verify the authenticity of an electronic system as a whole. In this paper, we propose concurrent IC and PCB authentication (CIPA), a novel methodology that concurrently verifies the authenticity of both IC and PCB through extracting the signature pairs generated by a ring oscillator (RO) array without/with PCB cavity resonance. With CIPA, remote authentication is allowable by transmitting the signatures between the verifier and the system vendor. The CIPA structure has shown insignificant area overhead (0.945% on average) when implemented on a number of benchmarks. Both CIPA and the benchmarks have been implemented on the authentic and counterfeit FPGA systems, and the results give 100% confidence in detecting counterfeit ones. Furthermore, the authenticity of PCB and IC (i.e., authentic or counterfeit) of the system under test can also be mined from CIPA signatures. According to the experimental results, systems composed of different authenticity states of PCB and IC are differentiated from each other with the confidence of 97.62%. The overall authentication time is 40.2 μs considering 50-MHz system clock.

The counterfeit parts, e.g. integrated circuits (ICs) and printed circuit boards (PCBs), have shown significant increase over the recent years. However, existing counterfeit detection techniques deal with IC or PCB separately. Hence cannot verify the authenticity of the electronic system as a whole. In this paper, we propose a novel methodology, named CIPA, which concurrently verifies the authenticity of both IC and PCB through extracting the signature pairs generated by ring oscillator (RO) array without/with PCB cavity resonance. Remote authentication is allowable by transmitting CIPA signatures between the verifier and system vendor. CIPA structure has shown insignificant area overhead (0.945% on average), when implemented on a number of benchmarks. Both CIPA and the benchmarks have been implemented on authentic and counterfeit FPGA systems, results giving 100% confidence in detecting counterfeit ones.

Scan-based test is commonly used to increase testability and fault coverage, however, it is also known to be a liability for chip security. Research has shown that intellectual property (IP) or secret keys can be leaked through scan-based attacks, which can be performed by entities within the supply chain. In this paper, we propose a design and test methodology against scan-based attacks throughout the supply chain, which includes a dynamically obfuscated scan (DOS) for protecting IP/integrated circuits (ICs). By perturbing test patterns/responses and protecting the Obfuscation Key, the proposed architecture is proven to be robust against existing noninvasive scan-based attacks, and can protect all scan data from attackers in foundry, assembly, and system development without compromising the testability. Further, a novel test methodology cooperating with the DOS design is also proposed, which shows full pattern application flexibility. Finally, detailed security and experimental analyses have been performed on ITC and industrial benchmarks. Demonstrated by the simulation results, the proposed architecture can be easily plugged into EDA generated scan chains without generating a noticeable impact on conventional IC design, manufacturing, and test flow. The results demonstrate that the proposed methodology can protect chips from existing brute force, differential, and other scan-based attacks that target the Obfuscation Key. Furthermore, the proposed design is of low overhead on area, power consumption, and pattern generation time, and there is no impact on test time.

Scan-based test is commonly used to increase testability and fault coverage, however, it is also known to be a liability for chip security. Research has shown that intellectual property (IP) or secret keys can be leaked through scan-based attacks. In this paper, we propose a dynamically-obfuscated scan design for protecting IPs against scan-based attacks. By perturbing all test patterns/responses and protecting the obfuscation key, the proposed architecture is proven to be robust against existing non-invasive scan attacks, and can protect all scan data from attackers in foundry, assembly, and system developers (i.e., OEMs) without compromising the testability. Furthermore, the proposed architecture can be easily plugged into EDA generated scan chains without having a noticeable impact on conventional integrated circuit (IC) design, manufacturing, and test flow. Finally, detailed security and experimental analyses have been performed on several benchmarks. The results demonstrate that the proposed method can protect chips from existing brute force, differential, and other scan-based attacks that target the obfuscation key. The proposed design is of low overhead on area, power consumption, and pattern generation time, and there is no impact on test time.

With silicon technology further scaling, the switching activity is getting more intense in modern designs. The large switching activities together with GHz operation frequency can greatly affect the power integrity by generating IR-drop noises. Excessive IR-drop can cause functional failures such as timing failure, abnormal reset and SRAM flipping. Hence, IR-drop needs to be monitored in-field. However, directly measuring transient IR-drop waveform usually involves high design or equipment cost. This paper presents a low-cost on-chip GHz ring oscillator-based transient IR-drop monitor (TRO). TRO is composed of all-digital elements, and can be easily integrated into existing IC design flow with negligible overhead. Different from traditional transient IR-drop monitors, TRO measures IR-drop waveform width and average in-field, while recovers IR-drop peak, and reconstructs the transient noise waveform during data analysis or customer return, which eliminates the need for custom circuits or high frequency sampling clock. Simulation results show that TRO is sensitive to IR-drop with peak and width larger than 100 mV and 1.0 ns, which is suitable for GHz IC monitoring. The IR-drop noise width detection resolution can reach 0.125 ns and higher under the help of the proposed edge detector, with noise peak and width measurement error rate less than 6.8% and 9.0%, for 97% of the Monte Carlo samples considering process variations. According to the results and analyses, TRO is also able to trigger quick adaptation within one clock cycle.

With the rapid development and globalization of semiconductor design and fabrication, integrated circuit (IC) is becoming more vulnerable to malicious modification called hardware Trojan. As Advanced Encryption Standard (AES) core has been widely used in security critical applications, it can easily become a target of Hardware Trojan. In this paper, 9 potential AES hardware Trojans, which cover Trojan types leaking key or plain text are demonstrated. Then three protections of varying strengths against the proposed Trojans, including combination, reorder, and reconfiguration logic insertion, are presented. The proposed protections are shown to effectively disfunction the 9 types of potential Trojans. Therefore, the information security of AES is significantly improved.

For 40nm and below technologies, billions of transistors can be integrated into a single chip. Meanwhile, the operation frequency has reached over Giga Hertz. In this case, highly synchronized switching activities can induce significant current, which leads to IR-drop. Excessive IR-drop can cause timing failure, abnormal reset, or disruption of data processing. As a result, dynamic voltage and frequency scaling (DVFS) system implemented effective adaptation strategies are widely used by SoCs to mitigate IR-Drop noise and stabilize performance. As the basis of DVFS action, economic and accurate IR-drop monitors are in great need. This paper presents a novel and efficient IR-Drop Alarmer, which can cooperate with the DVFS system for fast IR-drop adaptation. The IR-drop alarming threshold of the proposed sensor is configurable between 45mV to 120mV. Considering a 1.1ns width IR-drop noise, the IR noise sampling window can be as small as 0.125ns, with alarming duration error rate less than 6.8% for 97% of the Monte Carlo samples considering process variations. Furthermore, the proposed alarmer is composed by all-digital standard gates without an y high frequency sampling clock, which is of low area overhead and power consumption.

For 45-nm technologies and below, the maximum operation frequency of integrated circuits (ICs) has reached multiple gigahertz. At the same time, the size of modern ICs has increased significantly with several billions of transistors integrated on each die. When a large number of transistors switch at the same time, high current consumption is generated. The high current consumption combining with the parasitic resistance and inductance of the power supply network generates a significant power supply noise peak, which causes abnormal reset and generates excessive radiation emission, and hence needs to be accurately monitored, adapted, and mitigated. This paper presents a novel power supply noise measurement and adaptation system that can monitor the peak power supply noise and make dynamic adaptation within one clock cycle. The proposed system has been implemented in Nangate 45-nm technology. It has been proved that the proposed measurement and the adaptation system can successfully avoid the performance degradation or functional failure due to excessive power supply noise. The peak power supply noise monitoring accuracy is 5 mV. The adaptation reaction time is 75%-100% of single system clock cycle. The proposed system is robust against temperature and process variation, and of negligible area overhead and power consumption.

Speed binning of integrated circuits using Fmax test of a SoC requires application of complex functional and structural test patterns. Today's test-pattern-based speed binning techniques incur high test cost in terms of long test time and requires significant effort to generate effective patterns. In this paper we propose a novel speed binning flow that uses path timing slacks, extracted with robust digital embedded sensor IPs, of selected critical/near-critical paths. We apply machine learning techniques to model a predictor considering the extracted slacks and the Fmax values from a set of randomly tested die during wafer sort. The proposed flow has been demonstrated in a SoC circuit at 28/32nm technology. The worst-case miss-binning of the predictor is within 6% of the nominal Fmax.

As process technology further scales, aging, noise and variations in integrated circuits (ICs) and systems become a major challenge to both the semiconductor and electronic design automation (EDA) industries, which may cause significantly increased mismatch between modeled and actual silicon behavior, and even IC failure in field. Therefore, the addition of accurate and low-cost on-chip sensors is of great value to reduce the mismatch and perform in-field measurements. This paper presents a novel standard-cell-based sensor for reliability analysis of digital ICs (called Radic), in order to better understand the characteristics of gate, functional path aging and process variations' impact on timing performance, and perform in-field aging measurements. The Radic sensor has been fabricated on two floating gate Freescale SoCs in very advanced technology. The measurement results demonstrate that the resolution can be better than 0.1 ps, and the accuracy is kept throughout aging/process variation. Additionally, a built-in aging adaption system based on Radic sensor is proposed to perform in-field aging adaption. Simulation results verify that, comparing with designs with fixed aging guardband, the proposed aging adaption system releases 80% of aging timing margin, saves silicon area by 1.02%-3.16% at most targeting frequencies, and prevents aging induced failure.

As process technology further scales, aging, noise and variations in integrated circuits (ICs) and systems become a major challenge to both the semiconductor and EDA industries, since a significantly increased mismatch is emerging between modeled and actual silicon behavior. Therefore, the addition of accurate and low-cost on-chip sensors is of great value to reduce the mismatch. This paper presents a standard-cell-based, novel, and accurate sensor for reliability analysis of digital ICs (Radic), in order to better understand the characteristics of gate/path aging and process variations' impact on timing performance. The Radic sensor performs aging, flip-flop (FF) metastability window and variation measurements on-chip. This sensor has been fabricated in a floating gate Freescale SOC in very advanced technology. The measurement results demonstrate that the resolution is better than 0.1ps, and the accuracy is kept throughout aging/process variation. Furthermore, reliability and FF metastability measurements are performed using the proposed sensor. The measurement results agree with the existing models.

With technology scaling, the deviation between predicted path delay using simulation and actual path delay on silicon increases due to process variation and aging. Hence, on-chip measurement architectures are now widely used due to their higher accuracy and lower cost compared to using external expensive measurement devices. In this paper, a novel path-delay measurement architecture called path-based ring oscillator (Path-RO) which takes into account variations is proposed. Path-RO can perform accurate on-chip path-delay measurement with nearly no impact on functional data path. At the same time, process variations will not affect the measurement accuracy. The accuracy degradation due to aging is also negligible, which enables Path-RO to monitor path delay throughout aging process. This delay sensor is perfectly suitable for fast and accurate speed binning as well. By targeting speed paths, the speed of chip can be binned efficiently even in presence of clock skew. Various simulation results collected by Path-RO inserted into b19 circuit demonstrate its high accuracy and efficiency.

Physical Unclonable Functions (PUFs) are employed to generate unique signature to be used for integrated circuit (IC) identification and authentication. Existing PUFs exploit only process variations for generating unique signature. Due to the spatial correlation between process parameters, such PUFs will be vulnerable to be modeled or leak information under side-channel attacks. The PUF we present in this paper, called PE-PUF, takes into account both process and environmental variations which magnifies chip-to-chip signature randomness and uniqueness. PE-PUF takes into account process variations, temperature, power supply noise and crosstalk; all these effects are major sources of variations and noise in integrated circuits. Designers would be able to select PE-PUF response by applying different input patterns.? Furthermore, PE-PUF imposes no routing constraints to the design. The gates in PE-PUF are distributed across the entire chip and cannot be easily identified/modeled or leak side-channel information. Simulation results demonstrate that each IC can be uniquely characterized by PE-PUF with higher secrecy rate when compared to other PUFs that use only process variations.

As technology scales to 45nm and below, the deviation between predicted path delay using simulation and actual path delay on a manufactured chip increases. Hence, on-chip measurement architectures are now widely used due to their higher accuracy and lower cost compared to using external expensive testers. In this paper, we propose a novel path delay measurement architecture called Enhanced path-based ring oscillator (Path-RO) that takes into account variations. The proposed Enhanced Path-RO can accurately and quickly measure path delay on-chip under variations with nearly no impact on functional data path. Enhanced Path-RO is perfectly suitable for fast and accurate speed binning as well by targeting speed paths on-chip even in presence of clock skew. Simulation results under variations collected by the Enhanced Path-RO inserted into ITC'99 b19 circuit demonstrate its high accuracy and efficiency.

Chip design and fabrication is becoming increasingly vulnerable to malicious activities and alternations with globalization. An adversary can introduce a Trojan designed to disable and/or destroy a system at some future time (Time Bomb) or the Trojan may serve to leak confidential information covertly to the adversary. This paper proposes a taxonomy for Trojan classification and then describes a statistical approach for detecting hardware Trojans that is based on the analysis of an ICs power supply transient signals. A key component to improving the resolution of power analysis techniques to Trojans is calibrating for process and test environment (PE) variations. The main focus of this research is on the evaluation of four signal calibration techniques, each designed to reduce the adverse impact of PE variations on our statistical Trojan detection method.

As technology scales to 45 nm and below, process variations will present significant impact on path delay. This trend makes the deviation between simulated path delay and actual path delay in a manufactured chip more significant. In this paper, we propose a new on-chip path delay measurement structure called path-based ring oscillator (Path-RO). The proposed method creates an oscillator from a targeted path for which it is used to measure path delay on-chip under the impact of process variations. To alleviate accuracy degradation caused by the architecture itself, a high-accuracy calibration process is presented. Through experimental results on Path-ROs inserted in ITCpsila99 b19 benchmark, we obtain path delay distribution under different process variations. The accuracy and efficiency of path delay measurement using Path-RO are also verified by comparing the results obtained from post-layout Hspice simulations.