Today’s logic chips and System-on-Chips (SoCs) are ever-growing in size, complexity, and integration density. This drives a continuous need to develop novel and advanced ways to efficiently test such devices after manufacturing. High-bandwidth IJTAG over SSN (HB-IJTAG) is one such innovation that leverages the high-speed and parallel Streaming Scan Network (SSN) bus to concurrently access many local IEEE 1687 (IJTAG) networks.However, every time the high-bandwidth IJTAG access mode is activated, it must first be configured through the global IJTAG network. The initial configuration and subsequent reconfigurations constitute a substantial test time overhead due to the lower shift speed and serial nature of global IJTAG.This paper introduces wide-ranging enhancements to the high-bandwidth IJTAG access to allow for persistent utilization of the high-speed SSN bus. By eliminating the reasons for the expensive reconfigurations, high-bandwidth IJTAG can remain active throughout the entire test session. This results in a significant reduction of test setup time and more efficient test delivery. Our experiments clearly demonstrate these benefits in different pattern delivery scenarios. Persistently using the high-bandwidth data delivery reduced the relevant IJTAG pattern execution time by up to 243x, yielding an up to 18x lower overall test time for SSN ATPG patterns.

The increasing complexity of Integrated Circuits (ICs) is driven by heterogeneous functionality and stringent performance demands. This necessitates scalable and efficient design for testability (DFT) solutions to ensure cost-effective test access and functional correctness. Streaming Scan Network (SSN) and High-Bandwidth IJTAG over SSN (HB-IJTAG) enhance the test efficiency significantly by accelerating the data transfer and optimizing the test execution. However, these technologies introduce validation challenges due to more intricate control mechanisms and their large-scale deployment.This paper presents a novel, holistic approach for generating and sequencing functional validation patterns. These patterns systematically leverage SSN and HB-IJTAG capabilities to optimize overall efficiency. The proposed methodology enables the concurrent and robust validation of hundreds of SSN and HB-IJTAG DFT components, significantly improving the overall test execution time.

As Systems-on-Chip (SOC) designs grow in complexity, so do the challenges associated with testing them. Some of the obstacles SOC designers face include limited I/O and scan channels, routing and timing closure issues, increasing manufacturing test and defect diagnosis time, and growing test data volume. Various design-for-test (DFT) techniques exist to handle complex SOC designs that have multiple cores. One new DFT implementation technique is the streaming scan network (SSN) high-bandwidth parallel data bus. SSN addresses many of the SOC challenges by providing an optimized packet-based scan data delivery system. It also dynamically optimizes test time by adjusting the data applied to each core. However, SSN is limited to delivering scan data; it cannot be used to deliver data to individual instruments in a physical block using the IEEE 1687 (IJTAG) network. This paper introduces a new high-bandwidth IJTAG DFT technology that leverages the existing high-speed parallel SSN bus to drive the serial IJTAG network. It describes the DFT implementation methodology, the impact to the backend in terms of timing and SDC, and how verification was done by Intel as they deployed it on multiple dielets in their next generation client CPU. Moreover, data on area overhead and the overall test cost savings achieved is presented.

Reconfigurable Scan Networks (RSNs) allow flexible access to embedded instruments for post-silicon test, validation and debug or diagnosis. The increased observability and controllability of registers inside the circuit can be exploited by an attacker to leak or corrupt critical information.Precluding such security threats is of high importance but difficult due to complex data flow dependencies inside the reconfigurable scan network as well as across the underlying circuit logic.This work proposes a method that fine-granularly computes dependencies over circuit logic and the RSN. These dependencies are utilized to detect security violations for a given insecure RSN, which is then transformed into a secure RSN.Experimental results demonstrate the applicability of the method to large academical and industrial designs. Additionally, we report on the required effort to mitigate found security violations which also motivates the necessity to consider the circuit logic in addition to pure scan paths.

With ever more complex and larger VLSI devices and higher and higher reliability requirements, high quality test with a large fault and defect coverage is becoming even more relevant. At the same time, when unspecified or unknown input values (X values) have to be considered in a pattern, commercial ATPG tools are sometimes not capable of determining whether a fault can be tested - but there is at least a chance to detect the fault, as 0/X or 1/X could be propagated to at least one output. Consequently, these faults are considered to be possibly detected and often counted towards the overall fault coverage with a weighting factor. However, as the actual probability to detect these faults with the considered test pattern is not taken into account, this could lead to an over-or underestimation of their real fault coverage, falsifying the test results. We introduce a #SAT-based characterization algorithm for this class of faults. This new algorithm is, for the first time, able to accurately compute the detection probability for faults marked as possibly detected by state-of-the-art commercial tools. Our experimental results for the largest ITC'99 benchmarks as well as larger industrial-circuits show that our algorithm can accurately determine the detection probability for most of the possibly detected faults and also identify faults that are completely untestable or found with a probability of 100 % irrespective of the assignment of the inputs with an X value. Furthermore, they show that the detection probability is circuit-dependent and consequently should not just be estimated by a simple weighting factor but requires a more in-depth evaluation. Otherwise, there is a high risk that the achieved results could clearly be to optimistic or pessimistic with regard to the real fault coverage.

The characterization of analog-mixed signal (AMS) silicon requires a suitable pattern set able to exercise the parametric operational space to - among other tasks - validate the correct (specified) working behaviour of the device under test. As experience shows, most of the unexpected problems occur for very specific value combinations of a few test condition variables that were not expected to have an influence. Additionally, restrictions on the operational conditions have to be taken into account. We present a method to efficiently create a set of test conditions to cover such a constrained search space with a user-defined density. First, an initial test condition set is generated using quasirandom Sobol sequences. Secondly, we analyse the test conditions to identify and fill uncovered areas in the parameter space using the in-house interval constraint solver iSAT3. The applicability of the method is demonstrated by experimental results on a 19-dimensional search space using a realistic set of constraints.

Opens are known to be one of the predominant defects in nanoscale technologies. With an increasing number of complex cells in today's very large-scale integration designs intracell opens are becoming a larger and larger problem. Typically, these defects are modeled by transistor stuck-off faults (TSOFs) and assumed to be detected by transition delay fault (TDF) timing tests. However, tests for TDF fail to detect a high percentage of TSOFs and even tools that target them directly are not sufficient to screen all open defects. Furthermore, generated tests might be invalidated in case hazards and charge-sharing are not properly considered. In this paper, we present a waveform-accurate SAT-based automatic test pattern generation (ATPG) framework to tackle these problems. The proposed method not only allows for the generation of tests that are robust against hazards and charge-sharing, it can also be used to generate tests for faults only detectable by hazard-based activation-and hence even increase the fault coverage beyond state-of-the-art cell-aware tests. Our experimental results for the largest ITC'99, IWLS 2005 as well as larger industrial circuits mapped to the state-of-the-art NanGate 45-nm as well as NanGate 15-nm cell library using complex cells show the high efficiency and scalability of the proposed method. For example, the results show that without properly considering hazards and charge-sharing up to 17.9% of the generated tests could be invalidated. In addition, hazard-activated ATPG allows to detect an additional 10.1% of conventionally undetectable faults that could result in a very significant defective parts per million improvement.

Opens are known to be one of the predominant defects in nanoscale technologies. Especially with an increasing number of complex cells in today's VLSI designs intra-gate opens are becoming a major problem. The generation of tests for these faults is hard, as the timing of the circuit needs to be considered accurately to prevent the invalidation of the generated tests through hazards. Current test generation methods, including new cell aware tests that explicitly target open defects, ignore the possibility of hazard caused test invalidation. Such tests can fail to detect a significant fraction of the targeted opens. In this work we present a waveform-accurate hazard-aware test generation approach to target intra-gate opens. Our methodology is based on a SAT-based encoding and allows the generation of tests guaranteed to be robust against hazards. Experimental results for large benchmarks mapped to the state-of-the-art NanGate 45nm cell library including complex cells show the test generation efficiency of the proposed method. Large circuits were efficiently handled - even without the use of fault simulation. Our experiments show that on average, about 10.92 % of conventional hazard-unaware tests will fail to detect the targeted opens because of test invalidation - these are reliably detected by our new test generation methodology. Importantly, our approach can also be applied to improve the effectiveness of commercial cell aware tests.

A prototype of the framework AutoFault, which automatically constructs fault-injection attacks for hardware realizations of ciphers, is presented. AutoFault can be used to quickly evaluate the resistance of security-critical hardware blocks to fault attacks and the adequacy of implemented countermeasures. The framework takes as inputs solely the circuit description of the cipher and the fault(s) and produces an algebraic formula that can be handed over to an external solver. In contrast to previous work, attacks constructed by AutoFault do not incorporate any cipher-specific cryptoanalytic derivations, making the framework accessible to users without cryptographic background. We report successful application of AutoFault in combination with a state-of-the-art SAT solver to LED-64 and to small-scale AES. To the best of our knowledge, this is the first time that a state-of-the-art cipher (LED-64) was broken by a fault attack with no prior manual cryptanalysis whatsoever.

With an increasing number of complex cells in today's VLSI designs, intra-gate opens are becoming a larger and larger problem. Typically, these defects are modeled by transistor stuck-off faults (TSOF) and assumed to be detected by transition delay fault (TDF) timing tests. However, tests for TDF fail to detect a high percentage of TSOFs and even tools that target them directly are not sufficient to screen all open defects. This is because CMOS circuits experience a large number of hazards during circuit inputs switching which are not modeled by classical tools. Hazards may activate some TSO faults considered untestable by classical ATPGs. The generation of tests that target such hazard activated opens can result in a very significant DPPM improvement - if used. In this paper, we present the first deterministic methodology for targeting hazard activated opens. It is based on a waveform-accurate SAT-based modeling and allows to accurately determine if a TSOF is detectable by hazard activation - or not. In addition, we provide a thorough investigation of the additionally achievable fault coverage using the state-of-the-art NanGate 45nm as well as NanGate 15nm cell libraries.

The #SAT problem, that is counting the number of solutions of a propositional formula, extends the well-known SAT problem into the realm of probabilistic reasoning. However, the higher computational complexity and lack of fast solvers still limits its applicability for real world problems. In this work we present our distributed parallel #SAT solver dCountAntom which utilizes both local, shared-memory parallelism as well as distributed (cluster computing) parallelism. Although highly parallel solvers are known in SAT solving, such techniques have never been applied to the #SAT problem. Furthermore we introduce a solve progress indicator which helps the user to assess whether the presented problem is likely solvable within a reasonable time. Our analysis shows a high accuracy of the estimated progress. Our experiments with up to 256 CPU cores working in parallel yield large speedups across different benchmarks derived from real world problems: With the maximum number of available cores dCountAntom solved problems on average 141 times faster than a single core implementation.