This work introduces a secure split logic synthesis (cloud+local) approach to enable Third Party Intellectual Property (3PIP) vendors that do not have access to expensive state-of-the-art logic synthesis tools to efficiently and securely synthesize their IPs with minimal area and delay overheads. For this, we propose to split the Register Transfer Level (RTL) IP given in Verilog or VHDL such that one part is synthesized on the cloud using a state-of-the-art commercial logic synthesis tool (e.g., Synopsys Design Compiler) while synthesizing locally, on the IP vendor's side, the missing portion of the design using free logic synthesis tools (e.g., Yosys). This approach allows 3PIPs to leverage the power of commercial logic synthesis tools while protecting their IP from anyone having access to the cloud where the logic synthesis tools is hosted without fearing that the IP will be stolen. Experimental results show that our proposed flow is secure, while leading to negligible area and delay overheads. In particular, the proposed flow has an average area overhead of 0.94% to 1.81% for different types of design implementations and in all cases the original timing constraint is met.

Most VLSI design companies are now fabless. This forces them to rely on complex international supply chains that can compromise their Intellectual Property (IP). One popular approach to address this is through logic locking [1], [2]. One of the problems with traditional locking mechanisms is that the locking circuitry is built into the netlist that the (HW) design company delivers to the foundry, which has now access to the entire design, including the locking mechanism [3]. This implies that they could potentially tamper with this circuitry or reverse engineer it to obtain the locking key. An alternative approach is to redact a portion of the hardware design by mapping it to an embedded FPGA (eFPGA). The unprogrammed design is then sent to be fabricated at an untrusted fab, which can now not reverse engineer the design because they do not have the bitstream configuration that makes the entire chip operate correctly. The bitstream acts in this case as the locking key. Hardware redaction is nevertheless not 100% secure, and different attacks have already been proposed [4]. The main problem with most of these attacks is that they require long simulation times, but in reality, when applied to the actual hardware, are executed much faster. Thus, in this work, we propose an open-source FPGA-based hardware redaction framework to speed up new attacks with the ultimate goal of learning how to build more robust hardware redaction systems. The framework is composed of an automated ASIC and FPGA partitioning tool, the mapping of these parts onto a low-cost FPGA board (Terasic DE10-SoC[5]) and a library of software APIs that run on the embedded processor of the FPGA in order to launch attacks onto the redacted systems mapped onto the FPGA fabric. The experimental results show that the emulation platform is orders of magnitude faster than a pure simulation-based approach while also scaling much better. The entire platform is available online at https://github.com/chaitalisathe/FREEDOM.

We introduce machine learning-based solutions for differentiating wafers fabricated using trusted and untrusted mask-sets based on the typical metrology or wafer acceptance tests collected during semiconductor manufacturing and testing. Our methods leverage the systematic nature of process variation and capture the subtle causality between mask modifications and either physical dimensions or electrical characteristics of the produced silicon, which can then be used for the purpose of wafer-level mask-set attestation. Effectiveness of our solutions is demonstrated on a dataset of inline and e-test measurements from 8000 wafers fabricated with multiple variants of a mask-set in the GlobalFoundries 12LP FinFET technology node.

Hardware description language (HDL) netlists extracted from reverse-engineered integrated circuits (ICs) are described at the transistor level, thereby obscuring any internal sequential circuitry. Existing methods to extract sequential behavior from transistor-level netlists rely upon prior knowledge of the design, which may not be available. Toward identifying state-holding elements in an extracted netlist without help from any such information, we propose a new methodology which combines graph searching with satisfiability modulo theories (SMT) solving to detect and locate state-holding nets.

We present a pilot study exploring whether Large Language Models (LLMs) can generate test vectors for stuck-at faults in gate-level combinational circuits. Unlike conventional ATPG, which relies on algorithmic Boolean reasoning, LLMs lack such capability. However, we hypothesize that a "language of test" exists, capable of capturing how input stimuli expose differences between fault-free and faulty netlist functionality -analogous to how natural language expresses meaning through symbol substitution. This stems from observing that netlists, like text, comprise functional paths of logic gates combining signals, akin to sentences combining words. To test this hypothesis, we generated 958K test vectors across 40K randomly generated combinational circuits, using fault-simulation results to fine-tune a 7 billion parameter Llama-2 model via Low-Rank Adaptation (LoRA), Supervised Fine-Tuning (SFT), and Group Relative Policy Optimization (GRPO) to mitigate hallucinations. On unseen netlists, the model generates test vectors for target faults with over 80% success—far exceeding random test generation. While only preliminary, these findings suggest LLMs can learn this "language of test" and aid test generation, warranting further research into training, fine-tuning, and prompt engineering to boost accuracy and utility.

We demonstrate the value of integrating expert-level domain knowledge into Machine Learning (ML) model training, which becomes particularly important when modeling complex processes such as semiconductor manufacturing. Specifically, we discuss a machine learning-based methodology which correlates physical metrology measurements with process control monitoring electrical measurements by employing Multivariate Adaptive Regression Splines (MARS) and Non-Dominating Sorting Genetic Algorithm II (NSGA-II). Baseline effectiveness of this solution in predicting critical measurements for maintaining fabrication process integrity, such as yield shorts, ring oscillator active mode current (IDDA) and frequency differences, is assessed using actual High Volume Manufacturing (HVM) production data from an advanced FinFET technology node. Further improvements, however, can be obtained by leveraging domain-specific expertise. Indeed, as we demonstrate experimentally, model accuracy, training time, and explainability all improve when such expertise is integrated in the training process. Our results highlight the pitfalls of blindly applying machine learning and illustrate the value of including semiconductor experts in the development of machine learning models for process optimization-related tasks.

Securing integrated circuits against counterfeiting through logic locking presents the fundamental challenge of protecting a locking key from physical, Boolean satisfiability (SAT)-based, and structural threats. Prior research has mainly focused on enhancing logic locking to thwart SAT-based and structural attacks but overlooked the necessity of robust physical security. Our work introduces a novel approach: a logic locking scheme utilizing the nonvolatile properties of nanomagnet logic (NML) to provide comprehensive protection. Polymorphic NML minority gates along with conventional locking techniques fortify the locking key against SAT-based and structural threats, while a protective shield, inducing strain in the nanomagnets, offers physical security via a self-destruct mechanism. Although the NML system improves physical security and preserves security against SAT-based and structural attacks, it suffers from drawbacks related to limited reliability and speed, which result in a notable security overhead cost. Consequently, we propose a hybrid CMOS/NML logic locking approach in which NML islands are integrated into a predominantly CMOS-based system. This hybrid solution continues to deliver security against physical, SAT-based, and the known structural attacks while minimizing the associated overhead. We evaluate the security of such hybrid systems against conventional and physically enhanced SAT attacks. The hybrid logic systems are found to retain the security against conventional SAT-based attacks. We further find that these hybrid logic systems are also robust to physically enhanced SAT attacks in which the attacker has access to all internal electrical signals. These hybrid logic systems are thus shown to provide security against all known physical attacks as well as SAT-based attacks, with minimal efficiency tradeoffs resulting from the use of emerging technologies.

We explore the challenges associated with developing a verification solution for a TRAnsistor-level Programmable fabric (TRAP). The TRAP architecture employs bidirectionally operated pass transistors to implement its logic and interconnect network, aiming for high density. However, the existing logic equivalence checking (LEC) methods and tools do not support the primitives necessary to model such transistors in hardware description languages (HDLs). Consequently, verifying the functionality programmed by a given bitstream on TRAP is not inherently feasible. To overcome this limitation, we propose a method that automates the determination of signal flow direction through the bidirectional pass transistors for a given bitstream. Subsequently, we convert the HDL description of the programmed fabric to exclusively utilize unidirectional transistors. This transformation allows us to leverage commercial EDA tools for verifying logic equivalence between the transistor-level HDL representation of the programmed fabric and the post-synthesis gate-level netlist. We have successfully applied the proposed method to verify various benchmark circuits programmed on the TRAP fabric.

The efficiency of validating complex System-on-Chips (SoCs) is contingent on the quality of the security properties provided. Generating security properties with traditional approaches often requires expert intervention and is limited to a few IPs, thereby resulting in a time-consuming and non-robust process. To address this issue, we, for the first time, propose a novel and automated Natural Language Processing (NLP)-based Security Property Generator (NSPG). Specifically, our approach utilizes hardware documentation in order to propose the first hardware security-specific language model, HS-BERT, for extracting security properties dedicated to hardware design. It is capable of phasing a significant amount of hardware specification, and the generated security properties can be easily converted into hardware assertions, thereby reducing the manual effort required for hardware verification. NSPG is trained using sentences from several SoC documentations and achieves up to 88% accuracy for property classification, outperforming ChatGPT. When assessed on five untrained OpenTitan hardware IP documents, NSPG aided in identifying eight security vulnerabilities in the buggy OpenTitan SoC presented in Hack@DAC 2022.

We discuss the problem of generating synthetic Process Control Monitoring (PCM) data and evaluating how accurately it reflects the distribution of actual measurements from manufactured wafers. PCMs are small test structures placed in the scribe lines of the wafer, on which electrical tests (E-tests) are conducted to monitor the impact of process variation on a manufactured wafer. Besides its immediate use in assessing and controlling wafer health, collective PCM data holds invaluable information for process engineers who seek to maximize yield and performance across process corners. Yet availability of such data is limited during the ramp-up phase of a process, when it is needed the most. To address this limitation, we introduce a methodology that leverages correlations across E-test measurements and across wafer locations to generate a large synthetic population from a small data sample. Furthermore, we discuss statistical metrics that can be used to evaluate the accuracy of the synthetically generated vis-à-vis the actual population. Effectiveness of our solution is experimentally validated using E-test data from ~8K wafers fabricated in an advanced GlobalFoundries FinFET node.

We investigate the impact of semiconductor manufacturing process variation on the accuracy of machine learning models implemented as analog Artificial Neural Networks (ANNs). Unlike their digital counterparts, where binary operations and weight representation ensure the robustness of a trained model across software and hardware, the continuous nature of weights and operations in analog ANNs makes the accuracy of a trained model inevitably sensitive to the exact parameters of each fabricated chip. As a result, expensive chip-in-the-loop training is necessitated to ensure high accuracy. Herein, we elucidate the nature and extent of the problem using actual measurements from multiple identically fabricated copies of an analog ANN chip and a variety of trained models. We quantify the accuracy loss when models are ported across chips, as well as the effort required for individually training each chip, and we discuss strategies for containing this effort.

Test vector generation for a TRAnsistor-level Programmable (TRAP) fabric faces a number of feasibility and efficiency challenges. The former are caused by (i) the use of bi-directional pass transistors, which are beyond the capabilities of commercial Automatic Test Pattern Generation (ATPG) tools, and (ii) the design specifics of TRAP, which result in certain stuck-at faults not being logically testable and calling for a quiescent current-based test solution instead. The latter are caused by the fact that ATPG tools are oblivious to (i) the difference between programming bits and regular inputs, which results in lengthy test application times, and (ii) the role that different modules in the architecture of TRAP play in establishing logic circuits, which results in lengthy unguided exploration of a very large functional space to establish appropriate vector justification and response propagation paths. To address these challenges, we explore an array of solutions including (i) employing TRAP instances where bi-directional transistors are replaced by uni-directional ones, (ii) generating custom IDDQ tests, (iii) expressing test application time as the optimization objective of an Integer Linear Program (ILP) formulation, and (iv) leveraging design knowledge, resulting in perfect stuck-at fault coverage of TRAP and an order-of-magnitude savings in test application time.

We discuss the challenges related with developing a post-programming verification solution for a TRAnsistor-level Programmable fabric (TRAP). Toward achieving high density, the TRAP architecture employs bidirectionally-operated pass transis-tors in the implementation of its logic and interconnect network. While it is possible to model such transistors through appropriate primitives of hardware description languages (HDL) to enable simulation-based validation, Logic Equivalence Checking (LEC) methods and tools do not support such primitives. As a result, formally verifying the functionality programmed by a given bit-stream on TRAP is not innately possible. To address this limitation, we introduce a method for automatically determining the signal flow direction through bidirectional pass transistors for a given bit-stream and subsequently converting the HDL describing the programmed fabric to consist only of unidirectional transistors. Thereby, commercial EDA tools can be used to check logic equivalence between the transistor-level HDL describing the programmed fabric and the post-synthesis gate-level netlist.

With most hardware (HW) design companies now relying on third parties to fabricate their integrated circuits (ICs) it is imperative to develop methods to protect their Intellectual Property (IP). One popular approach is logic locking. One of the problems with traditional locking mechanisms is that the locking circuitry is built into the netlist that the (HW) design company delivers to the foundry which has now access to the entire design including the locking mechanism. This implies that they could potentially tamper with this circuitry or reverse engineer it to obtain the locking key. One relatively new approach that has been coined as hardware redaction is to map a portion of the design to an embedded FPGA (eFPGA). The bitstream of the eFPGA now acts as the locking key. In this case the fab receives the design without the bitstream and hence, cannot reverse engineer the functionality of the design. In this work we propose, to the best of our knowledge, the first attack on eFPGA HW redacted ICs by substituting the exact logic mapped onto the eFPGA by a synthesizable predictive model that replicates the behavior of the exact logic. This approach is particularly applicable in the context of approximate computing where hardware accelerators tolerate certain degrees of error at their outputs. One of the main issues addressed in this work is how to generate the training data to generate the synthesizable predictive model. For this we use SAT/SMT solvers as the potential attacker only has access to primary I0 of the IP. Experimental results for various degrees of maximum allowable output errors show that our proposed approach is very effective finding suitable predictive models.

We present a solution for reducing the number of defective analog/RF integrated circuits (ICs) that escape detection during manufacturing testing. Also known as underkill, these ICs may fail when deployed in their target application and eventually become customer returns, casting doubt on the effectiveness of the employed test solution and affecting the bottom line. To ameliorate this problem, we introduce an adaptive outlier detection solution that identifies ICs which are suspect of becoming customer returns and proactively bins them as failing. The outlier detection boundary used by our method is dynamically computed based on the performance distribution of devices on each wafer and the underlying model is updated when new ICs are returned from customers and failure analysis confirms that they are indeed defective devices. The effectiveness of our method in reducing underkill while minimizing the incurred yield loss is evaluated using an industrial dataset from Texas Instruments.

In the latest technology nodes, there is a growing concern about yield loss due to timing failures and delay degradation resulting from manufacturing complexities. Largely, these process imperfections are fixed using empirical methods such as layout guidelines and process fixes which come late during the design cycle. In this work, we propose a framework for improving the design yield by synthesizing netlists with improved ability to withstand delay variations to reduce yield loss. We advocate a defect tolerant approach during early design stages to synthesize netlists by introducing defect-awareness to EDA synthesis, thereby generating robust netlists that can withstand delays induced by process imperfections. Toward this objective, we present a) a methodology to characterize standard library cells for delay defects to model the robustness of the cell delays, and b) a solution to drive design synthesis using the intelligence from the cell characterization to achieve design robustness to timing errors. We also introduce defect tolerance metrics to quantify the robustness of standard cells to timing variations, which we use to generate defect-aware libraries to guide defect-aware synthesis. Effectiveness of the proposed defect-aware methodology is evaluated on a set of benchmarks implemented in GF 12nm technology using static timing analysis (STA), revealing a 70--80% reduction of yield loss due to timing errors arising from manufacturing defects, with minimum impact on the area, power and no impact on performance.

The successful logic locking of integrated circuits requires that the system be secure against both algorithmic and physical attacks. In order to provide resilience against imaging techniques that can detect electrical behavior, we recently proposed an approach for physically and algorithmically secure logic locking with strain-protected nanomagnet logic (NML). While this NML system exhibits physical and algorithmic security, the fabrication imprecision, noise-related errors, and slow speed of NML incur a significant security overhead cost. In this paper, we therefore propose a hybrid CMOS/NML logic locking solution in which NML islands provide security within a system primarily composed of CMOS, thereby providing physical and algorithmic security with minimal overhead. In addition to describing this proposed system, we also develop a framework for device/system co-design techniques that consider trade-offs regarding the efficiency and security.

In this paper, we introduce an innovative super resolution approach to emerging modes of near-field synthetic aperture radar (SAR) imaging. Recent research extends convolutional neural network (CNN) architectures from the optical to the electromagnetic domain to achieve super resolution on images generated from radar signaling. Specifically, near-field synthetic aperture radar (SAR) imaging, a method for generating high-resolution images by scanning a radar across space to create a synthetic aperture, is of interest due to its high-fidelity spatial sensing capability, low cost devices, and large application space. Since SAR imaging requires large aperture sizes to achieve high resolution, super-resolution algorithms are valuable for many applications. Freehand smart-phone SAR, an emerging sensing modality, requires irregular SAR apertures in the near-field and computation on mobile devices. Achieving efficient high-resolution SAR images from irregularly sampled data collected by freehand motion of a smartphone is a challenging task. In this paper, we propose a novel CNN architecture to achieve SAR image super-resolution for mobile applications by employing state-of-the-art SAR processing and deep learning techniques. The proposed algorithm is verified via simulation and an empirical study. Our algorithm demonstrates high-efficiency and high-resolution radar imaging for near-field scenarios with irregular scanning geometries.

As quality expectations of integrated circuits (ICs) continue to rise, contemporary semiconductor manufacturing and test solutions experience increased pressure to prevent any defective parts from being shipped, even if this comes at the cost of sacrificing yield. Known as “overkill”, this lost yield is essentially the result of overly conservative decisions made to compensate for imperfect silicon, imperfect test, as well as uncertainties related to the application wherein a fabricated IC will be eventually deployed. Such decisions are often driven by auxiliary production characterization or quality control tests and processes, which are not directly related to the specifications of a product but, rather, mainly reflect the test environment. Nevertheless, based on these tests and in an effort to err on the side of caution, industry often scraps a small yet not insignificant percentage of perfectly good devices. To address this problem and judiciously recover a portion of the yield that is left on the table without increasing risk, we introduce a machine-learning based solution which exploits the correlation between specification tests and auxiliary tests in order to independently assess confidence in the validity and significance of the latter, for which limits are empirically defined. Effectiveness of our method is evaluated using an industrial dataset provided by Texas Instruments.

Prevention of integrated circuit counterfeiting through logic locking faces the fundamental challenge of securing an obfuscation key against both physical and algorithmic threats. Previous work has focused on strengthening the logic encryption to protect the key against algorithmic attacks, but failed to provide adequate physical security. In this work, we propose a logic locking scheme that leverages the non-volatility of the nanomagnet logic (NML) family to achieve both physical and algorithmic security. Polymorphic NML minority gates protect the obfuscation key against algorithmic attacks, while a strain-inducing shield surrounding the nanomagnets provides physical security via a self-destruction mechanism.

VLSI design companies are now mainly fabless and spend large amount of resources to develop their Intellectual Property (IP). It is therefore paramount to protect their IPs from being stolen and illegally reversed engineered. The main approach so far to protect the IP has been to add additional locking logic such that the circuit does not meet the given specifications if the user does not apply the correct key. The main problem with this approach is that the fabless company has to submit the entire design, including the locking circuitry, to the fab. Moreover, these companies often subcontract the VLSI design back-end to a third-party. This implies that the third-party company or fab could potentially tamper with the locking mechanism. One alternative approach is to lock through omission. The main idea is to judiciously select a portion of the design and map it onto an embedded FPGA (eFPGA). In this case, the bitstream acts as the logic key. Third party company nor the fab will, in this case, have access to the locking mechanism as the eFPGA is left un-programmed. This is obviously a more secure way to lock the circuit. The main problem with this approach is the area, power, and delay overhead associated with it. To address this, in this work, we present a framework that takes as input an untimed behavioral description for High-Level Synthesis (HLS) and automatically extracts a portion of the circuit to the eFPGA such that the area overhead is minimized while the original timing constraint is not violated. The main advantage of starting at the behavioral level is that partitioning the design at this stage allows the HLS process to fully re-optimize the circuit, thus, reducing the overhead introduced by this obfuscation mechanism. We also developed a framework to test our proposed approach and plan to release it to the community to encourage the community to find new techniques to break the proposed obfuscation method.

Post-fabrication performance calibration, a.k.a. trimming, is an essential part of analog/RF IC manufacturing and testing. Its objective is to counteract the impact of process variations by individually fine-tuning the performance parameters of every fabricated chip so that they meet the design specifications and, thereby, to ensure both high yield and high performance. The prevalent trimming process currently employed in industry involves a search algorithm which consists of repeated digital trim-code selection and measurement in order to optimize the trimmed performance. With hundreds of trims commonly performed on contemporary analog/RF chips, this process becomes overly expensive. In this work, we discuss a machine learning-based approach that ameliorates this problem by leveraging inter-trim correlation. Specifically, our method relies on effectively trained regression models which use the measurements obtained through an intelligently selected and conventionally performed subset of trims, in order to accurately predict the optimal trim codes for the omitted trims. Thereby, as corroborated using data from an actual analog/RF IC currently in production, trim time can be drastically reduced without significantly affecting the accuracy of the selected trim codes.

Deep learning (DL) offers potential improvements throughout the CAD tool-flow, one promising application being lithographic hotspot detection. However, DL techniques have been shown to be especially vulnerable to inference and training time adversarial attacks. Recent work has demonstrated that a small fraction of malicious physical designers can stealthily “backdoor” a DL-based hotspot detector during its training phase such that it accurately classifies regular layout clips but predicts hotspots containing a specially crafted trigger shape as nonhotspots. We propose a novel training data augmentation strategy as a powerful defense against such backdooring attacks. The defense works by eliminating the intentional biases introduced in the training data but does not require knowledge of which training samples are poisoned or the nature of the backdoor trigger. Our results show that the defense can drastically reduce the attack success rate from 84% to ~0%.

Design hotspots are layout patterns which may cause defects due to complex design and process interactions. Several machine learning and pattern matching-based methods have been proposed to identify and correct them early during design stages. However, almost all of them suffer from high false-alarm rates, mainly because they are oblivious to the root causes of hotspots. In this work, we seek to address this limitation by using a novel database enhancement approach through synthetic pattern generation based on a carefully crafted design of experiments. We evaluate the effectiveness of the proposed method using industry-standard tools and designs and demonstrate more than$3\times $reduction in classification error in comparison to the state-of-the-art.

Among various competing designs targeting similar functionality, the key differentiator typically consists of a small amount of custom Intellectual Property (IP). To protect this IP from reverse engineering, designers need effective solutions for hiding the unique aspects of their implementations. In this work, we introduce a general framework for partitioning the computation performed by a design into a part whose implementation is commonly known (and encountered across many designs), and a part which is unique to this design. The former can then be built using conventional techniques (including untrusted manufacturing facilities) while the latter needs to be protected using additional obfuscation techniques. The existence of several other known implementations of the (same or similar) target function serves as a decoy which deflects efforts seeking to reverse-engineer the unique implementation. We demonstrate our framework using a hardware accelerator case study where (a) partitioning is performed through High Level Synthesis (HLS), (b) the commonly known portion of the accelerator is implemented as an Application Specific Integrated Circuit (ASIC), and (c) the unique portion of the accelerator is implemented on an embedded Field-Programmable Gate Array (eFPGA).

Shrinking transistor sizes are jeopardizing the reliability of runtime reconfigurable Field Programmable Gate Arrays (FPGAs), making them increasingly sensitive to aging effects such as Negative Bias Temperature Instability (NBTI). This paper introduces a reliability-aware floorplanner which is tailored to multi-context, coarse-grained, runtime reconfigurable architectures (CGRRAs) and seeks to extend their Mean Time to Failure (MTTF) by balancing the usage of processing elements (PEs). The proposed method is based on a Mixed Integer Linear Programming (MILP) formulation, the solution to which produces appropriately-balanced mappings of workload to PEs on the reconfigurable fabric, thereby mitigating aging-induced lifetime degradation. Results demonstrate that, as compared to the default reliability-unaware floorplanning solutions, the proposed method achieves an average MTTF increase of 2.5× without introducing any performance degradation.

Analog Floating-Gate Transistors (AFGTs) are commonly used to fine-tune the performance of analog integrated circuits (ICs) after fabrication, thereby enabling high yield despite component mismatch and variability in semiconductor manufacturing. In this work, we propose a methodology that leverages such AFGTs to also prevent unauthorized use of analog ICs. Specifically, we introduce a locking mechanism that limits programming of AFGTs to a range which is inadequate for achieving the desired analog performance. Accordingly, our solution entails a two-step unlock-&-calibrate process. In the first step, AFGTs must be programmed through a secret sequence of voltages within that range, called waypoints. Successfully following the waypoints unlocks the ability to program the AFGTs over their entire range. Thereby, in the second step, the typical AFGT-based post-silicon calibration process can be applied to adjust the performance of the IC within its specifications. Protection against brute-force or intelligent attacks attempting to guess the unlocking sequence is ensured through the vast space of possible waypoints in the continuous (analog) domain. Feasibility and effectiveness of the proposed solution is demonstrated and evaluated on an Operational Transconductance Amplifier (OTA). To our knowledge, this is the first solution which leverages the power of analog keys and addresses both unlocking and calibration needs of analog ICs in a unified manner.

A recently proposed TRAnsistor-level Programmable (TRAP) fabric can enable seamless on-die integration of high-density reconfigurable logic with custom ICs. However, state-of-the-art CAD tools are developed for either ASICs or FPGAs and do not support the new architecture. To this end, we present CASPER − a novel CAD framework for implementing designs on the TRAP fabric. CASPER begins with characterizing an ASIC-esque cell library in order to leverage the industry-leading logic synthesis tools for TRAP. We then systematically remodel the TimberWolf and the Versatile Place and Route (VPR) tools to facilitate TRAP-specific design placement and routing, respectively. In addition, we develop a robust programming bitstream generation tool for TRAP. Lastly, we fabricate a 65nm prototype TRAP chip and implement ten ISCAS-85/MCNC benchmark circuits on it. Our evaluation results validate the proposed CAD framework and provide a comparative overhead analysis between TRAP and FPGA.

A recently introduced TRAnsistor-level Programmable fabric (TRAP) has demonstrated great promise towards seamless unification of high-density reconfigurable logic with Application-Specific Integrated Circuits (ASICs). However, practical deployment of TRAP relies on the development of a comprehensive mechanism for detecting manufacturing defects. Unfortunately, the state-of-the-art test schemes are developed either for ASICs or for Field-Programmable Gate Arrays (FPGAs) and do not support this new transistor-level architecture. To address this limitation, we present a novel application-agnostic test methodology specifically tailored to the TRAP fabric. We first introduce a multi-phase, cascadable scheme to efficiently test the programmable transistors in TRAP’s Logic Elements (LEs). Then, we define the required test patterns for verifying the correct functionality of the built-in D flip-flop, full-adder, and multiplexer of each LE. Next, we present a systematic approach for testing the interconnect network. Lastly, we discuss the limitations in testing the memory cells used for storing the TRAP programming bits and we propose design modifications for improving test coverage.

Beneath the potential benefits of the rapidly growing Internet of Things (IoT) technology lurk security risks. In this article, we propose a hardware-based generic framework for IoT workload forensics, an infrastructural technique to securely monitor and ensure delivered IoT services in accordance with specifications and regulatory compliance. In particular, this technique identifies digital workloads being executed in real time through dynamic program behavior modeling based on architecture-level data, fulfilled by dedicated machine learning hardware, without the intervention of high-level software, e.g., the OS and/or the hypervisor. In contrast to the conventional software-based solutions, whose effectiveness may be undermined by software attacks, and which introduce significant runtime overhead, a hardware-based framework enables a secure, prompt and non-intrusive solution. The proposed framework was evaluated on Zedboard, a Zynq-7000 FPGA embedding an ARM Cortex-A9 core. Experimental results using Mibench workload benchmark reveal an average workload identification accuracy of 96.37 percent with insignificant area/power overhead.

We investigate the risk posed by amplitude-modulating analog/RF hardware Trojans in wireless networks and propose a defense mechanism to mitigate the threat. First, we introduce the operating principles of amplitude-modulating analog/RF hardware Trojan circuits and we theoretically analyze their performance characteristics. Subject to channel conditions and hardware Trojan design restrictions, this analysis seeks to determine the impact of these malicious circuits on the legitimate communication and to understand the capabilities of the covert channel that they establish in practical wireless networks, by characterizing its error probability. Next, we present the implementation of two hardware Trojan examples on a Wireless Open-Access Research Platform (WARP)-based experimental setup. These examples reside in the analog and the RF circuitry of an 802.11a/g transmitter, respectively, where they manipulate the transmitted signal characteristics to leak their payload bits. Using these examples, we demonstrate (i) attack robustness, i.e., ability of the rogue receiver to successfully retrieve the leaked data, and (ii) attack inconspicuousness, i.e., ability of the hardware Trojan circuits to evade detection by existing defense methods. Lastly, we propose a defense mechanism that is capable of detecting analog/RF hardware Trojans in WiFi transceivers. The proposed defense, termed Adaptive Channel Estimation (ACE), leverages channel estimation capabilities of Orthogonal Frequency Division Multiplexing (OFDM) systems to robustly expose the Trojan activity in the presence of channel fading and device noise. Effectiveness of the ACE defense has been verified through experiments conducted in actual channel conditions, namely over-the-air and in the presence of interference.

Widespread adoption of the fabless business model and utilization of third-party foundries have increased the exposure of sensitive designs to security threats such as intellectual property (IP) theft and integrated circuit (IC) counterfeiting. As a result, concerted interest in various design obfuscation schemes for deterring reverse engineering and/or unauthorized reproduction and usage of ICs has surfaced. To this end, in this paper we present a novel mechanism for structurally obfuscating sensitive parts of a design through post-fabrication TRAnsistor-level Programming (TRAP). We introduce a transistor-level programmable fabric and we discuss its unique advantages towards design obfuscation, as well as a customized CAD framework for seamlessly integrating this fabric in an ASIC design flow. We theoretically analyze the complexity of attacking TRAP-obfuscated designs through both brute-force and intelligent SAT-based attacks and we present a silicon implementation of a platform for experimenting with TRAP. Effectiveness of the proposed method is evaluated through selective obfuscation of various modules of a modern microprocessor design. Results corroborate that, as compared to an FPGA implementation, TRAP-based obfuscation offers superior resistance against both brute-force and oracle-guided SAT attacks, while incurring an order of magnitude less area, power and delay overhead.

To combat the effects of process variation in modern, high-performance integrated Circuits (ICs), various post-manufacturing calibrations are typically performed. These calibrations aim to bring each device within its specification limits and ensure that it abides by current technology standards. Moreover, with the increasing popularity of mobile devices that usually depend on finite energy sources, power consumption has been introduced as an additional constraint. As a result, post-silicon calibration is often performed to identify the optimal operating voltage (Vmin) of a given Integrated Circuit. This calibration is time-consuming, as it requires the device to be tested in a wide range of voltage inputs across a large number of tests. In this work, we propose a machine learning-based methodology for reducing the cost of performing the Vmincalibration search, by identifying the optimal wafer-level search parameters. The effectiveness of the proposed methodology is demonstrated on an industrial dataset.

The protection of Intellectual Property (IP) has emerged as one of the most serious areas of concern in the semiconductor industry. To address this issue, we present a method and architecture to map selective portions of a design, given as a behavioral description for High-Level Synthesis (HLS) to a high-security embedded Field-Programmable Gate Array (eFPGA). In this manner, only the end-user has access to the full functionality of the chip. Using six benchmark circuits, we show that our approach is effective. In all cases, the Time-To-Break (TTB) is so long (at least 8 million hours) that for all practical purposes the designs are secure while incurring area overheads of around 5%. Further, latencies were only slightly increased, while the computation times are under one minute.

Extensive technology scaling has not only increased the complexity of Integrated Circuit (IC) fabrication but also multiplied the challenges in the Design For Manufacturability (DFM) space. Among these challenges, detection of design weak-points, popularly known as `Lithographic Hotspots', has attracted substantial attention. Hotspots are certain patterns which exhibit a higher probability of causing defects due to complex design-process interactions. Identifying such patterns and fixing them in the design stage itself is imperative towards ensuring high yield. In the early days of hotspot detection, Pattern Matching (PM) based methods were proposed. While effective in identifying previously known patterns, these methods failed to identify Never-Seen-Before (NSB) hotspots. To address this drawback, Machine Learning (ML) based solutions were introduced. Over the last decade, we have witnessed a plethora of ML-based hotspot detection methods being developed, each slightly outperforming its predecessors in accuracy and false-alarm rates. In this paper, we critically analyze the ML-based hotspot detection literature and we highlight common misconceptions which are found therein. We also pinpoint the underlying reasons that have led to these misconceptions by dissecting the ICCAD-2012 benchmark dataset, which has largely guided the evolution of this area, and revealing its limitations. Furthermore, we propose an enhanced version of this benchmark dataset, which we deem more appropriate for accurately assessing hotspot detection methods. Finally, we offer our suggestions to improve the effectiveness of ML-based Hotspot Detection methods and demonstrate about 5X reduction in false-alarms in comparison to the state-of-the-art.

Among the various strategies for hiding malicious capabilities in integrated circuits (ICs), analog circuit design techniques have recently drawn increased attention due their lower area, power and delay footprints, which make their detection significantly more challenging. Specifically, switched capacitors have been used for creating stealthy trigger circuits based on toggling activity on a victim wire. Various methodologies for detecting such culprits have been investigated; however, recent literature in this area contains several misconceptions or inaccuracies regarding the topologies of these trigger circuits and the effectiveness of previously proposed detection methods. Therefore, in this paper, we first revisit the design of switched capacitor-based trigger circuits and we present several design configurations which are not encompassed by previously demonstrated models, but which can also serve the same malevolent purpose. We, then, discuss the effectiveness and the shortcomings of existing defense methodologies, and we point towards additional research that is needed in this area.

Unlike the extensive research effort that has been expended over the last 15 years in understanding the threats of hardware Trojans, piracy and counterfeiting of digital Integrated Circuits (ICs), and in developing appropriate prevention and detection solutions, the topic of security and trust remains in a rather nascent state for their analog/radio-frequency (RF) counterparts. Indeed, as shown in a recent survey, which summarized and presented the available body of knowledge in trusted and secure design of analog/RF ICs, our understanding of the pertinent threats and our ability to thwart them through existing solutions are both rather limited. However, given the widespread use of analog functionality (i.e., physical interfaces, sensors, actuators, wireless communications, etc.) in most contemporary systems, comprehending their vulnerabilities and devising pertinent remedies is urgently required. In this paper, we discuss the limitations of the current state-of-the-art in this field, we highlight recent developments, and we suggest research directions and steps to be taken toward designing, fabricating and deploying trusted and secure analog/RF ICs.

Ensuring high reliability in modern integrated circuits (ICs) requires the employment of several die screening methodologies. One such technique, commonly referred to as die inking, aims to discard devices that are likely to fail, based on their proximity to known failed devices on the wafer. Die inking is traditionally performed manually by visually inspecting each manufactured wafer and thus it is very time-consuming. Recently, machine learning has been used to automate and speed-up the inking process. In this work, we employ on-line machine learning to address the practicability limitations of the current state-of the-art automated inking approach. Effectiveness is demonstrated on an industrial dataset of manually inked wafers.

Automated defect inspection in manufacturing of microscopic probes is an important task and often requires machine learning driven solutions. A supervised only approach can be challenging, because production manufacturing process typically have few defects, thus large amounts of labeled training data are generally not available. In this work, we instead employed multiple models in a multi-step process to achieve the end goal of identifying defect and non-defect probe tips.

Contemporary technology nodes exhibit high defectivity due to complex interactions between the process and certain layout topologies/patterns. Foundries identify such patterns during diagnosis, Scanning Electron Microscope (SEM) inspections, Failure Analysis (FA), etc., and create a database to restrict their presence in future designs. However, such a database can be generated only after fabricating a few products, hence making this process reactive. Ideally, foundries would prefer to have a proactive approach, where such sensitive patterns are available up-front during technology development. Thereby, they can build accurate Hotspot Detection models and offer a robust Product Design Kit (PDK) to even the earliest of customers, either by ensuring that the process is immune to such patterns or by including them in the Design For Manufacturability Guidelines (DFMGs). To enable this, Early Design Space Exploration (EDSE) can be performed, wherein an Electronic Design Automation (EDA) tool generates synthetic layout patterns. In this work, we introduce VIPER, a novel, controlled random walk-based pattern generation method, which not only generates realistic and Design Rule-clean layout patterns, but which also offers versatility so that the generated patterns can be intuitively customized to specific needs. To ensure that the generated patterns are representative of real designs, we data mine designs in previous technology nodes and we learn some of their typical characteristics. Effectiveness of the proposed method is contrasted against the state-of-the-art, commercially available EDA tool.

We propose a machine learning-based solution for noise classification and decomposition in RF transceivers. Wireless transmitters are affected by various noise sources, each of which has a distinct impact on the signal constellation points. The proposed approach takes advantage of the characteristic dispersion of points in the constellation by extracting key statistical and geometric features that are used to train a machine learning model. The trained model is, then, capable of identifying the noise source fingerprint, comprised by single or multiple noise sources, for each affected device. Effectiveness of the model has been verified using constellation measurements from a combined set of simulated and actual silicon devices.

We introduce a method for protecting analog Integrated Circuits (ICs) against unauthorized use by obfuscating their operating point using an analog neural network. With the model of the trained analog neural network acting as a lock and its inputs as the key, only the correct key combination will unlock the analog IC, by providing it with the required bias conditions to operate within its specification limits. By defining the key combinations in the continuous analog space and by using floating gate transistors to realize the neural network, the proposed method defends itself against efforts to guess the correct key through model approximation attacks. Moreover, by inhibiting retraining of the analog neural network, the proposed solution enables customization of the lock and key combination to each IC. The proposed solution has been implemented in silicon through a proof-of-concept experimental setup comprising a Low-Noise Amplifier (LNA) and a programmable analog neural network. Experimental results demonstrate the effectiveness of the method in preventing unauthorized use of an analog IC.

We propose a hardware-based solution for performing real-time workload forensics that enables identification of a process while it is being executed. More specifically, we divide execution flow of a process into consecutive frames and we extract descriptive features related to the Translation Lookaside Buffer (TLB) utilization profile for each such frame. These features are then processed through trained machine learning models to analyze program behavior and identify workload at the granularity of a process. Unlike previous research on workload forensics that performs ex post facto analysis based on the complete process execution profile, this method continuously analyzes the segmented workload execution flow; thus, it does not require knowledge of process creation, switch, and termination timestamps. Furthermore, as compared with software-based workload forensics solutions, whose data logging mechanism may be compromised by software attacks, the proposed hardware-based logging mechanism does not rely on services from the operating system (OS) or high-level applications and is, therefore, inherently immune to software tampering. The proposed workload forensics method was evaluated using a Linux OS loaded on Spike, an open-source RISC-V simulator. Experimental results using the Mibench benchmark suite indicate an overall identification accuracy of 98.9% with practicable logging overhead.

We discuss the threat that malicious circuitry (a.k.a. hardware Trojan) poses in wireless communications and propose a remedy for mitigating the risk. First, we present and theoretically analyze a stealthy hardware Trojan embedded in the forward error correction (FEC) block of an 802.11a/g transceiver. FEC seeks to shield the transmitted signal against noise and other imperfections. This capability, however, may be exploited by a hardware Trojan to establish a covert communication channel with a knowledgeable rogue receiver. At the same time, the unsuspecting legitimate receiver continues to correctly recover the original message, despite experiencing a slight reduction in signal-to-noise ratio (SNR) and, therefore, remains oblivious to the attack. Next, we implement this hardware Trojan on an experimental setup based on the Wireless Open Access Research Platform (WARP) and we demonstrate (i) attack robustness, i.e., the ability of the rogue receiver to correctly receive the leaked information and (ii) attack inconspicuousness, i.e., imperceptible impact on the legitimate transmission. Lastly, we theoretically analyze and experimentally evaluate a Trojan-agnostic detection mechanism, namely, channel noise profiling, which monitors the noise distribution to identify inconsistencies caused by hardware Trojans, regardless of their implementation details. The effectiveness of channel noise profiling is experimentally assessed using the proposed hardware Trojan under various channel conditions and a different covert Wi-Fi attack previously proposed in the literature.

Locking the functionality of an integrated circuit (IC) thwarts attacks such as intellectual property (IP) piracy, hardware Trojans, overbuilding, and counterfeiting. Although functional locking has been extensively investigated, locking the performance of an IC has been little explored. In this paper, we develop provably-secure performance locking, where only on applying the correct key the IC shows superior performance; for an incorrect key, the performance of the IC degrades significantly. This leads to a new business model, where the companies can design a single IC capable of different performances for different users. We develop mathematical definitions of security and theoretically, and experimentally prove the security against the state-of-the-art-attacks. We implemented performance locking on a FabScalar microprocessor, achieving a degradation in instructions per clock cycle (IPC) of up to 77% on applying an incorrect key, with an overhead of 0.6%, 0.2%, and 0% for area, power, and delay, respectively.

Kernel rootkits generally attempt to maliciously tamper kernel objects and surreptitiously distort program execution flow. Herein, we introduce a hardware-assisted hierarchical on-line system which detects such kernel rootkits by identifying deviation of dynamic intra-process execution profiles based on architecture-level semantics captured directly in hardware. The underlying key insight is that, in order to take effect, malicious manipulation of kernel objects must distort the execution flow of benign processes, thereby leaving abnormal traces in architecture-level semantics. While traditional detection methods rely on software modules to collect such traces, their implementations are susceptible to being compromised through software attacks. In contrast, our detection system maintains immunity to software attacks by resorting to hardware for trace collection. The proposed method is demonstrated on a Linux-based operating system running on a 32-bit x86 architecture, implemented in Simics. Experimental results, using real-world kernel rootkits, corroborate the effectiveness of this method, while a predictive 45nm PDK is used to evaluate hardware overhead.

Over the past few years, several self-calibration methodologies have proven their efficiency to calibrate analog and radio-frequency circuits against process variations. Specifically, statistical techniques based on machine-learning have been proposed to recover yield loss and even enhance circuit performances. In addition, these techniques enable to calibrate circuits after a single performance test, i.e. in one-shot. However, towards fully-integrated calibration techniques, the inference part of the machine learning algorithm needs to be performed as energy-efficiently as possible to reduce calibration cost to a minimum. Following the path of resource-efficient machine learning, this work explores an alternative to state-of-the-art Neural Network based statistical techniques. Specifically, we investigate the opportunities of using Bayesian Networks for resource-efficient on-chip statistical calibration of analog/RF circuits. Results will show that several improvements can be achieved using Bayesian Networks: (a) provide a comprehensive calibration framework with explicit relationships between parameters (b) demonstrate similar prediction accuracies that neural networks (c) optimize across several performance parameters with a single network and in a single query and (d) enable a more energy-efficient hardware implementation. The proposed self-calibration algorithm is applied to a low-noise amplifier fabricated with IBM's 130nm CMOS process, leading to a significant reduction in the number of operations required to obtain the best tuning knob setting.

We introduce a hardware dithering methodology for neutralizing Trojans in integrated circuits (ICs). The proposed approach seeks to make the operating point of an IC an unpredictable moving target during run time. Thereby, the ability of a Trojan to exploit the process variation margins, wherein hardware Trojans typically find breathing room to operate while remaining concealed, is significantly restricted. To demonstrate this hardware dithering concept, we leverage tuning knobs operating on the power and frequency characteristics of the transmission of a wireless cryptographic IC. These knobs are driven by a random number generator, thus forcing the circuit into a random walk in the space of its parametric performances while in normal operating mode. In essence, while the circuit remains within its operating specifications during this random walk, its exact operating point varies, thus muddying the waters for the adversary. Experimental results on the wireless cryptographic IC, which was designed and fabricated in a 0.35μm CMOS technology, corroborate that hardware dithering imposes a significant and unpredictably dispersed bit error rate to the adversary, thereby impeding hardware Trojan operation.

This special session will discuss how machine learning can transform test. The first talk will review the key challenges and will argue whether contemporary tools, such as deep learning, could offer any advantages over traditional methods. The second talk will focus on extracting useful information from big test data. The third talk will view adaptive test as running machine learning algorithms in real time on big data.

Continuous technology scaling and the introduction of advanced technology nodes in Integrated Circuit (IC) fabrication is constantly exposing new manufacturability issues. Design hotspots are one of such problems, which are a result of complex design and process interactions. These hotspots are known to vary from design to design and foundries expect such hotspots to be predicted early and corrected in the design stage itself, as opposed to a process fix for every hotspot, which would be intractable. Various efforts have been made in the past to address this issue by using a known database of hotspots as a source of information. Most of those works use either Machine Learning (ML) or Pattern Matching (PM) techniques to identify and predict hotspots in new incoming designs. Almost all of those methods suffer from high false-alarm rates, mainly because (i) they are oblivious to the root causes of hotspots, and (ii) a large hotspot database to learn from is generally not available. In this work, we try to address these limitations by using novel hotspot Design of Experiments (DOEs) and synthetic pattern generation approaches. We analyze the effectiveness of the proposed method against the state-of-the-art on a 45nm process, using industry standard tools and designs.

Information flow tracking (IFT) is a widely used methodology for ensuring data confidentiality in electronic systems and numerous such methods have been developed at various software or hardware description levels. Among them, proof-carrying hardware intellectual property (PCHIP) introduced an IFT methodology for digital hardware designs described in hardware description languages (HDLs). The risk of accidental information leakage, however, is not restricted to the digital domain. Indeed, analog signals originating from sources of sensitive information, such as biometric sensors, as well as analog outputs of a circuit, could carry or leak secrets. Moreover, similar to digital designs, analog circuits can also be contaminated with malicious information leakage channels capable of evading traditional manufacturing test. Compounding the problem, in analog/mixed-signal circuits such information leakage channels can cross the analog/digital or digital/analog interface, making their detection even harder. To this end, in this paper we introduce a PCHIP-based methodology which enables systematic formal evaluation of information flow policies in analog/mixed-signal designs. As we demonstrate, by integrating IFT across the digital and analog domain, our method is able to detect sensitive data leakage from the digital domain to the analog domain and vice versa, without requiring any modification of the current analog/mixed-signal circuit design flow.

We introduce a CMOS computational fabric consisting of carefully arranged regular rows and columns of transistors which can be individually configured and appropriately interconnected in order to implement a target digital circuit. Termed Field Programmable Transistor Array (FPTA), this novel reconfigurable architecture enables several highly-desirable features including (i) simultaneous storage of three configurations along with the ability to dynamically switch between them in a fraction of a single cycle, while retaining the fabric's computational state, (ii) rapid or full modification of a stored configuration in a time proportional to the number of modified configuration bits through the use of hierarchically arranged, high throughput, asynchronously pipelined memory buffers, and (iii) support for libraries containing cells of the same height and variable width, just as in a typical standard cell circuit, thereby simplifying transition from a prototype to a custom IC design. Besides presenting the design details of this fabric in a 130nm technology and demonstrating the aforementioned capabilities, we also briefly discuss the development of a complete CAD flow for programing this fabric and we use numerous benchmark circuits to contrast its area efficiency against a typical FPGA implemented in the same technology node.

We introduce a hardware-based methodology for performing on-line intrusion detection in microprocessors. The proposed method extracts fingerprints from the basic blocks of the routine executed in response to a system call and examines their validity using a Bloom filter. Implementation in hardware renders spoofing attacks, to which operating system or hypervisor-level intrusion detection methods are vulnerable, ineffective. The proposed method is evaluated using kernel rootkits which covertly modify the system call service routines of a Linux operating system running on a 32-bit x86 architecture, implemented in the Simics simulation environment, while hardware overhead is evaluated using a predictive 45nm PDK.

We summarize and present the available body of knowledge in trusted and secure design of analog/mixed-signal/ radio frequency (RF) integrated circuits (ICs) and intellectual properties (IPs), covering both known vulnerabilities and available remedies. Furthermore, we discuss the limitations of the current state-of-the-art in this topic, highlight the concomitant risks, and suggest research directions and steps to be taken towards designing, fabricating and deploying trusted and secure analog/mixed-signal/RF circuits. More specifically, a comprehensive survey of the relevant literature is provided, organized around three themes: (i) hardware Trojans and Trojan states in analog/mixed-signal/RF ICs along with existing detection/prevention methods, (ii) analog/mixed-signal/RF IC/IP reverse engineering and counterfeiting, as well as techniques for proving authenticity and ownership, and (iii) limitations of existing methods in the analog/mixed-signal (AMS) and RF domain, focusing on the gaps that exist in our current understanding of this problem and potential directions towards filling them and mitigating the threats in AMS/RF ICs/IPs.

Logic locking is an intellectual property (IP) protection technique that prevents IP piracy, reverse engineering and overbuilding attacks by the untrusted foundry or end-users. Existing logic locking techniques are all based on locking the functionality; the design/chip is nonfunctional unless the secret key has been loaded. Existing techniques are vulnerable to various attacks, such as sensitization, key-pruning, and signal skew analysis enabled removal attacks. In this paper, we propose a tenacious and traceless logic locking technique, TTlock, that locks functionality and provably withstands all known attacks, such as SAT-based, sensitization, removal, etc. TTLock protects a secret input pattern; the output of a logic cone is flipped for that pattern, where this flip is restored only when the correct key is applied. Experimental results confirm our theoretical expectations that the computational complexity of attacks launched on TTLock grows exponentially with increasing key-size, while the area, power, and delay overhead increases only linearly. In this paper, we also coin ``parametric locking," where the design/chip behaves as per its specifications (performance, power, reliability, etc.) only with the secret key in place, and an incorrect key downgrades its parametric characteristics. We discuss objectives and challenges in parametric locking.

We propose a defense method capable of detecting hardware Trojans (HTs) in the analog/RF circuitry of wireless local area network (WLAN) transceivers. The proposed method, which is implemented on the receiver (RX) side and cannot be tampered with by the attacker, leverages the channel estimation capabilities present in Orthogonal Frequency Division Multiplexing (OFDM) systems. Specifically, it employs an adaptive approach to robustly isolate possible HT activity from channel and device noise, thereby exposing the Trojan's presence. The adaptive channel estimation (ACE) defense mechanism is put to the test using a HT which is implemented on a printed circuit board (PCB) and mounted on the Wireless Open-Access Research Platform (WARP). This HT, which is introduced through minute modifications in the power amplifier (PA), manipulates the transmission power characteristics of an 802.11a/g transmitter (TX) in order to leak sensitive data, such as the encryption key. Effectiveness of the proposed defense has been verified through experiments conducted in actual channel conditions, namely over-the-air and in the presence of interference.

Post silicon trimming is extensively used to counter the effects of manufacturing process variation on certain critical electrical parameters of an integrated circuit (IC). Usually, trimming is performed iteratively by adjusting the resistance value of a trim circuit to specific discrete values. Test programs represent those values by codes and apply common search algorithms in order to find a code which makes a device (optimally) compliant to its design specifications. Consequently, manufacturing yield is increased significantly, yet at the expense of added test time and complexity. In this work, we introduce a novel methodology wherein a trained multivariate model is used to predict, adaptively for each wafer, the optimal starting point of the algorithm that searches for the trim code. Thereby, we seek to minimize the number of code changes that the search algorithm has to perform and, by extension, the overall trim time. In order to provide this prediction prior to wafer sort, so that simplicity of test-floor logistics does not get compromised, the predictive model is built using electrical test (e-test) measurements, which are available before wafer sort, and is trained through measurements from a set of early wafers. Effectiveness of the proposed method in reducing trim time is demonstrated on 370 wafers of an high performance device manufactured by Texas Instruments.

Manual wafer-level die inking is a common procedure for excluding die locations that are likely to be defective. Although this is a more cost-effective process, as compared to the expensive burn-in tests, it remains a labor-intensive step during IC testing. For each manufactured wafer, test engineers have to visually inspect every failure map in order to identify any regions where additional die need to be marked and discarded. Towards reducing this cost, we introduce a novel pattern recognition methodology to learn and automatically generate the inking patterns from the failure maps, thus eliminating the need for human intervention. Effectiveness is demonstrated on an industrial set of manually inked wafers.

As CMOS technology continues to scale down, the effect of process variations on yield and performance of analog/RF ICs is becoming more prominent. To counteract this effect, learning-based post-production tuning has been proposed, wherein regression functions are trained and used to adjust tunable knobs based on low-cost alternate tests, thereby improving the performances of a circuit and, by extension, increasing yield. Of course, tunable knobs are also subject to process variations; yet this is not an issue when the knobs are part of the procedure that generates the data with which the regression models are trained, as this data reflects the impact of process variations on both the tunable circuit and the knobs. In various cases, however, such as in heterogeneous integrated systems, 3D ICs, or multi-chip modules, the knob circuitry may not be integrated on the same die, thereby limiting our ability to obtain a comprehensive set of training data. Accordingly, in this work we investigate the impact of knob non-idealities which are not captured in the training data, on the ability of the learned regression functions to accurately predict the optimum knob position that maximizes the performance of a circuit. Using a tunable cascode low-noise amplifier (LNA) fabricated in 130nm CMOS process, alongside external knobs designed as linear low drop out regulators (LDOs) and voltage dividers operating on the bias voltages of the LNA, we first quantify this impact. Then, we demonstrate that by explicitly introducing “noise” in the knob output values used during training set generation, we can effectively alleviate external knob non-idealities and improve quality of tuning.

Welcome to 2017, the thirty-fifth in a series of annual symposia that focuses on innovation in the field of testing of integrated circuits and systems.

Yield estimation is an indispensable piece of information at the onset of high-volume production of a device, as it can inform timely process and design refinements in order to achieve high yield, rapid ramp-up, and fast time-to-market. To date, yield estimation is generally performed through simulation-based methods. However, such methods are not only very time-consuming for certain circuit classes, but also limited by the accuracy of the statistical models provided in the process design kits (PDKs). In contrast, herein we introduce yield estimation solutions which rely exclusively on silicon measurements and we apply them toward predicting yield during: 1) production migration from one fabrication facility to another and 2) transition from one design generation to the next. These solutions are applicable to any circuit, regardless of PDK accuracy and transistor-level simulation complexity, and range from rather straightforward to more sophisticated ones, capable of leveraging additional sources of silicon data. Effectiveness of the proposed yield forecasting methods is evaluated using actual high-volume production data from two 65-nm RF transceiver devices.

Part II of this paper series focuses on automation of the extended proof-carrying hardware intellectual property (PCHIP) framework for data secrecy protection in third-party IPs, which was presented in part I. Specifically, we introduce: 1) VeriCoq-IFT, an automated PCHIP framework for information flow policies and 2) VeriCoq-H, a hierarchy-preserving Verilog-to-Coq converter. VeriCoq-IFT aims to: 1) automate the process of converting designs from an HDL to the Coq formal language; 2) generate security property theorems ensuring compliance with information flow policies; 3) construct proofs for such theorems; and 4) check their validity in a design, with minimal user intervention. VeriCoq-H, on the other hand, seeks to convert the entire functionality of a Verilog design to its Coq representation while preserving design hierarchy. It facilitates the development of hierarchical proofs and enables the construction of hybrid module libraries containing the HDL code and the corresponding reusable lemmas for each module. Applicability of our automated VeriCoq-IFT framework is demonstrated by evaluating trustworthiness of two DES encryption circuits and several genuine and Trojan-infested advanced encryption standard (AES) designs, along with the utility of VeriCoq-H in preventing malicious modification of sensitive data, such as the secret key of an encryption circuit.

Proof-carrying hardware intellectual property (PCHIP) is a previously proposed framework for ensuring trustworthiness of third-party hardware IP through the development of formal proofs for security properties designed to prevent introduction of malicious behavior. Based on this framework, we introduce new approaches for assuring that the secrecy of internal information in a hardware design is not compromised by design flaws or malicious hardware Trojans. Specifically, we devise two PCHIP-based information flow tracking approaches, which enhance the formal PCHIP framework with secrecy tags and/or sensitivity levels in order to provide mechanisms for proving that sensitive information does not reach undesired sites. To assist in the development of data secrecy properties, we also introduce the concept of theorem generation functions, which enable generation of security theorems independent of the target circuit, thereby paving the way for proof automation. In addition, we enhance the PCHIP framework with a hierarchy-preserving methodology and we show its utility in preventing malicious data modification, which may indirectly result in sensitive information leakage, such as by modifying the secret key in a cryptographic core. This enhanced PCHIP framework also enables development of hybrid module libraries, which contain hardware description language code along with proofs of lemmas for these modules. These module libraries can then be used for hierarchically proving security properties in higher level designs, thereby reducing the proof development burden in the general PCHIP framework. Efforts toward automation of the proposed methodologies, as well as evaluation of their effectiveness in identifying design flaws or hardware Trojans in various cryptographic hardware designs are presented in part II of this paper series.

Using silicon measurements from 40 chips fabricated in Taiwan Semiconductor Manufacturing Company's (TSMC's) 0.35-μm technology, we demonstrate the operation of two hardware Trojans, which leak the secret key of a wireless cryptographic integrated circuit (IC) consisting of an Advanced Encryption Standard (AES) core and an ultrawideband (UWB) transmitter (TX). With their impact carefully hidden in the transmission specification margins allowed for process variations, these hardware Trojans cannot be detected by production testing methods of either the digital or the analog part of the IC and do not violate the transmission protocol or any system-level specifications. Nevertheless, the informed adversary, who knows what to look for in the transmission power waveform, is capable of retrieving the 128-bit AES key, which is leaked with every 128-bit ciphertext block sent by the UWB TX. Moreover, through physical measurements and MATLAB simulations, we show that the attack facilitated by these hardware Trojans is robust to test equipment and communication channel noise. Finally, we experimentally evaluate the effectiveness of a popular hardware Trojan detection method, namely, statistical side-channel fingerprinting via trained one-class classifiers, in detecting the hardware Trojans introduced in our fabricated IC population.

We introduce a machine learning approach for distinguishing between integrated circuits fabricated in a ratified facility and circuits originating from an unknown or undesired source based on parametric measurements. Unlike earlier approaches, which seek to achieve the same objective in a general, design-independent manner, the proposed method leverages the interaction between the idiosyncrasies of the fabrication facility and a specific design, in order to create a customized fab-of-origin membership test for the circuit in question. Effectiveness of the proposed method is demonstrated using two large industrial datasets from a 65nm Texas Instruments RF transceiver manufactured in two different fabrication facilities.

We present our experiences in implementing hardware-based attacks to subvert the results of an election system. The election system was outlined by the Cyber Security Awareness Week (CSAW) Embedded Security Challenge (ESC) competition in 2015, held at the New York University (NYU). The system had multiple layers of security and primarily used homomorphic encryption. The competition presented a challenge to hack the election system such that a preferred candidate wins the election. We cryptanalyzed the given election system to evaluate the effectiveness of various theoretical and practical attacks, and used a custom designed embedded system to demonstrate our attacks. The embedded system was implemented on a Nexys 4 DDR Artix-7 FPGA board. Our work, which earned the first place in the competition, demonstrates that low-cost hardware-based attacks can indeed lead to catastrophic consequences.

Yield estimation is an indispensable piece of information at the onset of high-volume manufacturing (HVM) of a device. The increasing demand for faster time-to-market and for designs with growing quality requirements and complexity, requires a quick and successful yield estimation prior to HVM. Prior to commencing HVM, a few early silicon wafers are typically produced and subjected to thorough characterization. One of the objectives of such characterization is yield estimation with better accuracy than what pre-silicon Monte Carlo simulation may offer. In this work, we propose predicting yield of a device using information from a similar previous-generation device, which is manufactured in the same technology node and in the same fabrication facility. For this purpose, we rely on the Bayesian Model Fusion (BMF) technique. The effectiveness of the proposed methodology is evaluated using sizable industrial data from two RF devices in a 65nm technology.

We propose a methodology for dynamically selecting an optimal probe-test flow which reduces test cost without jeopardizing test quality. The granularity of this decision is at the wafer-level and is made before the wafer reaches the probe station, based on an e-test signature which reflects how process variations have affected this particular wafer. The proposed method offers flexibility by optimizing test flow per process signature and its implementation is simple and compatible with most commonly used Automatic Test Equipment. Furthermore, unlike static test elimination approaches, whose agility is limited by the relative importance of the permanently dropped tests, the proposed method is capable of exploring test cost reduction solutions which achieve very low test escape rates. Decisions are made by an intelligent system which maps every point in the e-test signature space to the most appropriate probe-test flow. Training of the system seeks to optimize the test flow of each process signature in order to maximize test cost reduction for a given target of test escapes, thereby enabling exploration of the trade-off between test cost reduction and test quality. The proposed method is demonstrated on an industrial dataset of a million devices from a 65nm Texas Instruments RF transceiver.

We introduce a methodology for dynamically selecting whether to subject a wafer to a complete or a reduced probe-test flow, while ensuring that the concomitant test cost savings do not compromise test quality. The granularity of this decision is at the wafer-level and is made before the wafer reaches the probe station, based on an e-test signature which reflects how process variations have affected this particular wafer. While the proposed method may offer less flexibility than approaches that dynamically adapt the test flow on a per-die basis, its implementation is simpler and more compatible with most commonly used Automatic Test Equipment. Furthermore, unlike static test elimination approaches, whose agility is limited by the relative importance of the dropped tests, the proposed method is capable of exploring test cost reduction solutions which maintain very low test escape rates. Decisions are made by an intelligent system which maps every point in the e-test signature space to either the complete or the reduced test flow. Training of the system seeks to maximize the number of wafers subjected to the reduced flow for a given target of test escapes, thereby enabling exploration of the trade-off between test cost reduction and test quality. The proposed method is demonstrated on an industrial dataset of a few million devices from a Texas Instruments RF transceiver.

We discuss a methodology and the corresponding hardware architecture for performing self-calibration of analog/RF ICs through the use of on-die learning. More specifically, we introduce the design of an on-chip analog neural network which can be trained to implement a non-linear regression function. This regression function is, then, used to approximate a Figure-of-Merit (FoM) reflecting the performances of an analog/RF IC. As an input to this regression function, we use the readings of low-cost on-chip sensors in response to simple on-chip generated stimuli. The FoM is predicted for all possible settings of the knobs provided for calibrating the chip performances and the best option is retained. The proposed methodology is demonstrated on a tunable Low-Noise Amplifier (LNA) which was designed and fabricated in IBM's 130nm RF CMOS process. Experimental results show that the proposed self-calibration method achieves not only significant yield enhancement but also a compelling optimization of the LNA's overall performance across the entire chip population.

Yield estimation is an indispensable piece of information at the onset of high-volume production of a device. It can be used to refine the process/design in time so as to guarantee high production yield. In the case of migration of production of a specific device from a source fab to a target fab, yield estimation in the target fab can be accelerated by employing information from the source fab, assuming that the process parameter distributions in the two fabs are similar, but not necessarily the same. In this paper, we employ the Bayesian Model Fusion (BMF) technique for efficient yield prediction of a device in the target fab. BMF adopts prior knowledge from the source fab and combines it intelligently with information from a limited number of early silicon wafers from the target fab. Thus, BMF allows us to obtain quick and accurate yield estimates at the onset of production in the target fab. The proposed methodology is demonstrated on an industrial RF transceiver.

As a result of technology scaling, power density of multi-core chips increases and leads to temperature hot-spots which accelerate device aging and chip failure. Moreover, intense efforts to reduce power consumption by employing low-power techniques decrease the reliability of new design generations. Traditionally, reactive thermal/power management techniques have been used to take appropriate action when the temperature reaches a threshold. However, these approaches do not always balance temperature and, as a result, may degrade system reliability. Therefore, to distribute temperature evenly across all cores, a proactive mechanism is needed to forecast future workload characteristics and the corresponding temperature, in order to make decisions before hot spots occur. Such proactive methods rely on an engine to precisely predict future workload characteristics. In this work, we first discuss the state-of-the-art methods for predicting workload dynamics and we compare their performance. We, then, introduce a prediction method based on Support Vector Regression (SVR), which accurately predicts the workload behavior several steps ahead. To evaluate the effectiveness of our approach, we use several programs from the PARSEC benchmark suite on an UltraSPARC T1 processor running the Sun Solaris operating system and we extract architectural traces. Then, the extracted traces are used to generate power and thermal profiles for each core using the McPAT and Hot-Spot simulators. Our results show that the proposed method forecasts workload dynamics and power very accurately and outperforms previous prediction techniques.

Proof carrying hardware intellectual property (PCHIP) introduces a new framework in which a hardware (semiconductor) Intellectual Property (IP) is accompanied by formal proofs of certain security-related properties, ensuring that the acquired IP is trustworthy and free from hardware Trojans. In the PCHIP framework, conversion of the design from a hardware description language (HDL) to a formal representation is an essential step. Towards automating this process, herein we introduce VeriCoq, a converter of designs described in Register Transfer Level (RTL) Verilog to their corresponding representation in the Coq theorem proving language, based on the rules defined in the PCHIP framework. VeriCoq supports most of the synthesizable Verilog constructs and is the first step towards automating the entire framework, in order to simplify adoption of PCHIP by hardware IP developers and consumers and, thereby, increase IP trustworthiness.

We introduce a Concurrent Hardware Trojan Detection (CHTD) methodology for wireless cryptographic integrated circuits (ICs), based on continuous extraction of a side-channel fingerprint and evaluation by a trained on-chip neural classifier. While similar statistical side-channel fingerprinting methods have been extensively studied in the past, they operate either before an IC is deployed or, periodically, during idle times, after an IC is deployed. Therefore, they can be easily evaded by a hardware Trojan which remains dormant at all times except during normal operation. In contrast, the proposed methodology operates concurrently with the normal functionality of the IC and is, therefore, much harder to evade. The proposed methodology is demonstrated using a hybrid experimentation platform consisting of (i) a custom-designed wireless cryptographic IC, infested with hardware Trojans that are controllable to be either active or dormant, (ii) a Spice-level simulation model of the fingerprint extraction circuit, and (iii) a custom-designed programmable analog neural network IC. Experimental results corroborate that the proposed CHTD methodology effectively identifies hardware Trojans when they are active, while not incurring any false positives when they are absent or dormant.

Growing demand for more powerful yet smaller devices has resulted in continuous scaling of fabrication technologies. While this approach supports aggressive design specifications, it has resulted in tighter constraints for circuit designers who face yield losses in analog/RF ICs due to process variation. Over the last few years, several statistical techniques have, therefore, been proposed to counter these losses and to recover yield through individual post-manufacturing calibration of each fabricated chip using tuning knobs. These techniques can be broadly classified as iterative or one-shot calibration methods, with the latter having the benefit of being faster and, therefore, more likely to be cost-effective in a high volume manufacturing (HVM) environment. In this paper, we first put three previously proposed one-shot statistical calibration methods to the test using a custom-designed tunable LNA, which was fabricated in IBM's 130nm RF CMOS process. We, then, introduce an improvement to the tuning knob selection criterion, which applies to all three methods, increasing their effectiveness. Finally, we demonstrate the efficacy of a previously proposed approach which uses simulation data and Bayesian model fusion in order to reduce the number of chips required for training the statistical models employed by the three one-shot calibration methods.

We investigate the utility of correlations between e-test and probe test measurements in predicting yield. Specifically, we first examine whether statistical methods can accurately predict parametric probe test yield as a function of e-test measurements within the same fab. Then, we investigate whether the e-test profile of a destination fab, in conjunction with the e-test and probe test profiles of a source fab, suffice for accurate yield prognosis during fab-to-fab product migration. Results using an industrial dataset of ~3.5M devices from a 65nm Texas Instruments RF transceiver design fabricated in two different fabs reveal that (i) within-fab yield prediction error is in the range of a few tenths of a percentile point, and (ii) fab-to-fab yield prediction error is in the range of half a percentile point.

The notion of Architectural Vulnerability Factor (AVF) has been extensively used to evaluate various aspects of design robustness. While AVF has been a very popular way of assessing element resiliency, its calculation requires rigorous and extremely time-consuming experiments. Furthermore, recent radiation studies in 90 nm and 65 nm technology nodes demonstrate that up to 55 percent of Single Event Upsets (SEUs) result in Multiple Bit Upsets (MBUs), and thus the Single Bit Flip (SBF) model employed in computing AVF needs to be reassessed. In this paper, we present a method for calculating the vulnerability of modern microprocessors -using Statistical Fault Injection (SFI)- several orders of magnitude faster than traditional SFI techniques, while also using more realistic fault models which reflect the existence of MBUs. Our method partitions the design into various hierarchical levels and systematically performs incremental fault injections to generate vulnerability estimates. The presented method has been applied on an Intel microprocessor and an Alpha 21264 design, accelerating fault injection by 15×, on average, and reducing computational cost for investigating the effect of MBUs. Extensive experiments, focusing on the effect of MBUs in modern microprocessors, corroborate that the SBF model employed by current vulnerability estimation tools is not sufficient to accurately capture the increasing effect of MBUs in contemporary processes.

We introduce two statistical methods for identifying recycled integrated circuits (ICs) through the use of one-class classifiers and degradation curve sensitivity analysis. Both methods rely on statistically learning the parametric behavior of known new devices and using it as a reference point to determine whether a device under authentication has previously been used. The proposed methods are evaluated using actual measurements and simulation data from digital and analog devices, with experimental results confirming their effectiveness in distinguishing between new and aged ICs and their superiority over previously proposed methods.

Creating backdoors in integrated circuits (ICs), stealing hardware intellectual property, counterfeiting electronic components, reverse engineering ICs, and injecting malware in ICs are no longer nation state acts requiring specialized, expensive, and unlimited resources. Democratization of IC design has created numerous opportunities for rogues throughout the IC supply chain to inflict these attacks with aplomb and for a variety of reasons: personal gain, economic harm, economic gain, bringing disrepute, and sheer fun among others.

We discuss the design of an experimentation platform intended for prototyping low-cost analog neural networks for on-chip integration with analog/RF circuits. The objective of such integration is to support various tasks, such as self-test, self-tuning, and trust/aging monitoring, which require classification of analog measurements obtained from on-chip sensors. Particular emphasis is given to cost-efficient implementation reflected in: 1) low energy and area budgets of circuits dedicated to neural networks; 2) robust learning in presence of analog inaccuracies; and 3) long-term retention of learned functionality. Our chip consists of a reconfigurable array of synapses and neurons operating below threshold and featuring sub-μW power consumption. The synapse circuits employ dual-mode weight storage: 1) a dynamic mode, for fast bidirectional weight updates during training and 2) a nonvolatile mode, for permanent storage of learned functionality. We discuss a robust learning strategy, and we evaluate the system performance on several benchmark problems, such as the XOR2-6 and two-spirals classification tasks.

We propose a technology-independent vulnerability-driven parity selection method for protecting modern microprocessor in-core memory arrays against multiple-bit upsets (MBUs). As MBUs constitute over 50% of the upsets in recent technologies, error correcting codes or physical interleaving are typically employed to effectively protect out-of-core memory structures, such as caches. Such methods, however, are not applicable to high performance in-core arrays, due to computational complexity, high delay, and area overhead. Therefore, we investigate vulnerability-based parity forest formation as an effective mechanism for detecting errors. Checkpointing and pipeline flushing can subsequently be used for correction. As the optimal parity tree construction for MBU detection is a computationally complex problem, an integer linear program formulation is introduced. In addition, vulnerability-based interleaving (VBI) is explored as a mechanism for further enhancing in-core array resiliency in constrained, single parity tree cases. VBI first physically disperses bitlines based on their vulnerability factor and then applies selective parity to these lines. Experimental results on Alpha 21264 and Intel P6 in-core memory arrays demonstrate that the proposed parity tree selection and VBI methods can achieve vulnerability reduction up to 86%, even when a small number of bits are added to the parity trees.

Statistical side channel fingerprinting is a popular hardware Trojan detection method, wherein a parametric signature of a chip is collected and compared to a trusted region in a multi-dimensional space. This trusted region is statistically established so that, despite the uncertainty incurred by process variations, the fingerprint of Trojan-free chips is expected to fall within this region while the fingerprint of Trojan-infested chips is expected to fall outside. Learning this trusted region, however, assumes availability of a small set of trusted (i.e. "golden") chips. Herein, we rescind this assumption and we demonstrate that an almost equally effective trusted region can be learned through a combination of a trusted simulation model, measurements from process control monitors (PCMs) which are typically present either on die or on wafer kerf, and advanced statistical tail modeling techniques. Effectiveness of this method is evaluated using silicon measurements from two hardware Trojan-infested versions of a wireless cryptographic integrated circuit.

We introduce an analog non-volatile neural network chip which serves as an experimentation platform for prototyping custom classifiers for on-chip integration towards fully standalone built-in self-test (BIST) solutions for RF circuits. Our chip consists of a reconfigurable array of synapses and neurons operating below threshold and featuring sub-μW power consumption. The synapse circuits employ dynamic weight storage for fast bidirectional weight updates during training. The learned weights are then copied onto analog floating gate (FG) memory for permanent storage. The chip architecture supports two learning models: a multilayer perceptron and an ontogenic neural network. A benchmark XOR task is first employed to evaluate the overall learning capability of our chip. The BIST-related effectiveness is then evaluated on two case studies: the detection of parametric and catastrophic faults in an LNA and an RF front-end circuits, respectively.

Wafer-level spatial correlation modeling of probetest measurements has been explored in the past as an avenue to test cost and test time reduction. In this work, we first improve the accuracy of a popular Gaussian process-based wafer-level spatial correlation method through two key enhancements: (i) confidence estimation-based progressive sampling, and, (ii) inclusion of spatio-temporal features for inter-wafer trend learning. We then explore a new application of the enhanced correlation modeling method in estimating High Volume Manufacturing (HVM) yield from a small set of early wafers and we demonstrate its effectiveness on a large set of actual industrial test data.

Laser trimming is used extensively to ensure accurate values of on-chip precision resistors in the presence of process variations. Such laser resistor trimming is slow and expensive, typically performed in a closed-loop, where the laser is iteratively fired and some circuit parameter (i.e. current) is monitored until a target condition is satisfied. Toward reducing this cost, we introduce a novel methodology for predicting the laser trim length, thereby eliminating the closed-loop control and speeding up the process. Predictions are obtained from waferlevel spatial correlation models, learned from a sparse sample of die on which traditional trimming is performed. Effectiveness is demonstrated on an actual wafer of laser-trimmed ICs.

As the electronic component supply chain grows more complex due to globalization, with parts coming from a diverse set of suppliers, counterfeit electronics have become a major challenge that calls for immediate solutions. Currently, there are a few standards and programs available that address the testing for such counterfeit parts. However, not enough research has yet addressed the detection and avoidance of all counterfeit parts-recycled, remarked, overproduced, cloned, out-of-spec/defective, and forged documentation-currently infiltrating the electronic component supply chain. Even if they work initially, all these parts may have reduced lifetime and pose reliability risks. In this tutorial, we will provide a review of some of the existing counterfeit detection and avoidance methods. We will also discuss the challenges ahead for implementing these methods, as well as the development of new detection and avoidance mechanisms.

In an effort to reduce the cost of specification testing in analog/RF circuits, spatial correlation modeling of wafer-level measurements has recently attracted increased attention. Existing approaches for capturing and leveraging such correlation, however, rely on the assumption that spatial variation is smooth and continuous. This, in turn, limits the effectiveness of these methods on actual production data, which often exhibits localized spatial discontinuous effects. In this work, we propose a novel approach which enables spatial correlation modeling of wafer-level analog/RF tests to handle such effects and, thereby, to drastically reduce prediction error for measurements exhibiting discontinuous spatial patterns. The core of the proposed approach is a k-means algorithm which partitions a wafer into k clusters, as caused by discontinuous effects. Individual correlation models are then constructed within each cluster, revoking the assumption that spatial patterns should be smooth and continuous across the entire wafer. Effectiveness of the proposed approach is evaluated on industrial probe test data from more than 3,400 wafers, revealing significant error reduction over existing approaches.

We propose an AVF-driven parity selection method for protecting modern microprocessor in-core memory arrays against MBUs. As MBUs constitute more than 50% of the upsets in latest technologies, error correcting codes or physical interleaving are typically employed to effectively protect out-of-core memory structures, such as caches. However, such methods are not applicable to high-performance in-core arrays, due to computational complexity, high delay and area overhead. To this end, we revisit parity as an effective mechanism to detect errors and we resort to pipeline flushing and checkpointing for correction. We demonstrate that optimal parity tree construction for MBU detection is a computationally complex problem, which we then formulate as an integer-linear-program (ILP). Experimental results on Alpha 21264 and Intel P6 in-core memory arrays demonstrate that optimal parity tree selection can achieve great vulnerability reduction, even when a small number of bits are added to the parity trees, compared to simple heuristics. Furthermore, the ILP formulation allows us to find better solutions by effectively exploring the solution space in the presence of multiple parity trees; results show that the presence of 2 parity trees offers a vulnerability reduction of more than 50% over a single parity tree.

Statistical intra-die correlation has been extensively studied as a means for reducing test cost in analog/RF ICs. Generally known as alternate test, this approach seeks to predict the performances of an analog/RF chip based on low-cost measurements on the same chip and statistical models learned from a training set of chips. Recently, an orthogonal direction for leveraging statistical correlation towards reducing test cost of analog/RF ICs has also gained traction. Specifically, inter-die spatial correlation models learned from specification tests on a sparse subset of die on a wafer are used to predict performances on the unobserved die. In this work, we investigate the potential of combining these two statistical approaches, anticipating that the performance prediction accuracy of the joint correlation model will surpass the accuracy of its constituents. Experimental results on industrial semiconductor manufacturing data validate this conjecture and corroborate the utility of the combined performance prediction models.

Many of the design companies cannot afford owning and acquiring expensive foundries and hence, go fabless and outsource their design fabrication to foundries that are potentially untrustwrothy. This globalization of Integrated Circuit (IC) design flow has introduced security vulnerabilities. If a design is fabricated in a foundry that is outside the direct control of the (fabless) design house, reverse engineering, malicious circuit modification, and Intellectual Property (IP) piracy are possible. In this tutorial, we elaborate on these and similar hardware security threats by making connections to VLSI testing. We cover design-for-trust techniques, such as logic encryption, aging acceleration attacks, and statistical methods that help identify Trojan'ed and counterfeit ICs.

We introduce a proof-carrying based framework for assessing the trustworthiness of third-party hardware Intellectual Property (IP), particularly geared toward microprocessor cores. This framework enables definition of and formal reasoning on security properties, which, in turn, are used to certify the genuineness and trustworthiness of the instruction set and, by extension, are used to prevent insertion of malicious functionality in the Hardware Description Language (HDL) code of an acquired microprocessor core. Security properties and trustworthiness proofs are derived based on a new formal hardware description language (formal-HDL), which is developed as part of the framework along with conversion rules to/from other HDLs to enable general applicability to IP cores independent of coding language. The proposed framework, along with the ability of a sample set of pertinent security properties to detect malicious IP modifications, is demonstrated on an 8051 microprocessor core.

We present a silicon implementation of a hardware Trojan, which is capable of leaking the secret key of a wireless cryptographic integrated circuit (IC) consisting of an Advanced Encryption Standard (AES) core and an Ultra-Wide-Band (UWB) transmitter. With its impact carefully hidden in the transmission specification margins allowed for process variations, this hardware Trojan cannot be detected by production testing methods of either the digital or the analog part of the IC and does not violate the transmission protocol or any system-level specifications. Nevertheless, the informed adversary, who knows what to look for in the transmission power waveform, is capable of retrieving the 128-bit AES key, which is leaked with every 128-bit ciphertext block sent by the UWB transmitter. Using silicon measurements from 40 chips fabricated in TSMC's 0.35μm technology, we also assess the effectiveness of a side channel-based statistical analysis method in detecting this hardware Trojan.

The use of side-channel parametric measurements along with statistical analysis methods for detecting hardware Trojans in fabricated integrated circuits has been studied extensively in recent years, initially for digital designs but recently also for their analog/RF counterparts. Such post-fabrication trust evaluation methods, however, are unable to detect dormant hardware Trojans which are activated after a circuit is deployed in its field of operation. For the latter, an on-chip trust evaluation method is required. To this end, we present a general architecture for post-deployment trust evaluation based on on-chip classifiers. Specifically, we discuss the design of an on-chip analog neural network which can be trained to distinguish trusted from untrusted circuit functionality based on simple measurements obtained via on-chip measurement acquisition sensors. The proposed method is demonstrated using a Trojan-free and two Trojan-infested variants of a wireless cryptographic IC design, as well as a fabricated programmable neural network experimentation chip. As corroborated by the obtained experimental results, two current measurements suffice for the on-chip classifier to effectively assess trustworthiness and, thereby, detect hardware Trojans that are activated after chip deployment.

We investigate the complexity and utility of performing Multiple Bit Upset (MBU) vulnerability analysis in modern microprocessors. While the Single Bit Flip (SBF) model constitutes the prevailing mechanism for capturing the effect of Single Event Upsets (SEUs) due to alpha particle or neutron strikes in semiconductors, recent radiation studies in 90nm and 65nm technology nodes demonstrate that up to 55% of such strikes result in Multiple Bit Upsets (MBUs). Consequently, the accuracy of popular vulnerability analysis methods, such as the Architecural Vulnerability Factor (AVF) and Failures In Time (FIT) rate estimates based on the SBF assumption comes into question, especially in modern microprocessors which contain a significant amount of memory elements. Towards alleviating this concern, we present an extensive infrastructure which enables MBU vulnerability analysis in modern microprocessors. Using this infrastructure and a modern microprocessor model, we perform a large scale MBU vulnerability analysis study and we report two key findings: (i) the SBF fault model overestimates vulnerability by up to 71%, as compared to a more realistic modeling and distribution of faults in the 90nm and 65nm processes, and (ii) the rank-ordered lists of critical bits, as computed through the SBF and MBU models, respectively, are very similar, as indicated by the average rank difference of a bit which is less than 1.45%.

As the supply chain of electronic circuits grows more complex, with parts coming from different suppliers scattered across the globe, counterfeit integrated circuits (ICs) are becoming a serious challenge which calls for immediate solutions. Counterfeiting includes re-labeling legitimate chips or illegitimately replicating chips and deceptively selling them as made by the legitimate manufacturer, or simply selling fake chips. Counterfeiting also includes providing defective parts or simply previously used parts recycled from scrapped assemblies. Obviously, there is a multitude of legal and financial implications involved in such activities and even if these devices initially work, they may have reduced lifetime and may pose reliability risks. In this tutorial, we provide a comprehensive review of existing techniques which seek to prevent and/or detect counterfeit integrated circuits. Various approaches are discussed and an advanced machine learning-based method employing parametric measurements is described in detail.

Monitoring the semiconductor manufacturing process and understanding the various sources of variation and their repercussions is a crucial capability. Indeed, identifying the root-cause of device failures, enhancing yield of future production through improvement of the manufacturing environment, and providing feedback to the designer toward development of design techniques that minimize failure rate rely on such a capability. To this end, we introduce a spatial decomposition method for breaking down the variation of a wafer to its spatial constituents, based on a small number of measurements sampled across the wafer. We demonstrate that by leveraging domain-specific knowledge and by using as constituents dynamically learned, interpretable basis functions, the ability of the proposed method to accurately identify the sources of variation is drastically improved, as compared to existing approaches. We then illustrate the utility of the proposed spatial variation decomposition method in (i) identifying the main contributor to yield variation, (ii) predicting the actual yield of a wafer, and (iii) clustering wafers for production planning and abnormal wafer identification purposes. Results are reported on industrial data from high-volume manufacturing, confirming the ability of the proposed method to provide great insight regarding the sources of variation in the semiconductor manufacturing process.

Critical Path Monitors (CPM) are a way of modeling the frequency response of a microprocessor to voltage, environment, workload, and other operating point changes. When coupled with a frequency controller, the CPM gives the microprocessor the ability to adjust its frequency to match the current operating environment. This allows for more efficient designs since voltage and frequency margins required to compensate for voltage droops, di/dt events, temperature changes, and other noise events are no longer needed. Calibration is key to functional Critical Path Monitors. Calibration compensates for process variation and pulls the CPM in-line with the hardware it is controlling. In this talk the CPM, frequency control loop, and calibration methodology of the Power7+ microprocessor is described. The CPM models frequency response well enough, after calibration, to allow for a 22% margin reduction. Our measurements demonstrate the value of the CPM for modeling frequency response that can be applied to DVFS microprocessors with the potential to reduce development and test times and to make systems more resilient.

We present a nonintrusive concurrent error detection (CED) method for protecting the control logic of a contemporary floating-point unit (FPU). The proposed method is based on the observation that control logic errors lead to extensive data path corruption and affect, with high probability, the exponent part of the IEEE-754 floating-point representation. Thus, exponent monitoring can be utilized to detect errors in the control logic of the FPU. Predicting the exponent involves relatively simple operations; therefore, our method incurs significantly lower overhead than the classical approach of duplicating the control logic of the FPU. Indeed, experimental results on the openSPARC T1 processor using SPEC2006FP benchmarks show that as compared to control logic duplication, which incurs an area overhead of 17.9 percent of the FPU size, our method incurs an area overhead of only 5.8 percent yet still achieves detection of over 93 percent of transient errors in the FPU control logic. Moreover, the proposed method offers the ancillary benefit of also detecting 98.1 percent of the data path errors that affect the exponent, which cannot be detected via duplication of control logic. Finally, when combined with a classical residue code-based method for the fraction, our method leads to a complete CED solution for the entire FPU which provides a coverage of 94.1 percent of all errors at an area cost of 16.32 percent of the FPU size.

The use of side-channel parametric measurements along with statistical analysis methods for detecting hardware Trojans in fabricated integrated circuits has been studied extensively in recent years, initially for digital designs but recently also for their analog/RF counterparts. Such post-fabrication trust evaluation methods, however, are unable to detect dormant hardware Trojans which are activated after a circuit is deployed in its field of operation. For the latter, an on-chip trust evaluation method is required. To this end, we present a general architecture for post-deployment trust evaluation based on on-chip classifiers. Specifically, we discuss the design of an on-chip analog neural network which can be trained to distinguish trusted from untrusted circuit functionality based on simple measurements obtained via on-chip measurement acquisition sensors. The proposed method is demonstrated using a Trojan-free and two Trojan infested variants of a wireless cryptographic IC design, as well as a fabricated programmable neural network experimentation chip. As corroborated by the obtained experimental results, two current measurements suffice for the on-chip classifier to effectively assess trustworthiness and, thereby, detect hardware Trojans that are activated after chip deployment.

Test cost reduction for RF devices has been an ongoing topic of interest to the semiconductor manufacturing industry. Automated test equipment designed to collect parametric measurements, particularly at high frequencies, can be very costly. Together with lengthy set up and test times for certain measurements, these cause amortized test cost to comprise a high percentage of the total cost of manufacturing semiconductor devices. In this work, we investigate a spatial correlation modeling approach using Gaussian process models to enable extrapolation of performances via sparse sampling of probe test data. The proposed method performs an order of magnitude better than existing spatial sampling methods, while requiring an order of magnitude less time to construct the prediction models. The proposed methodology is validated on manufacturing data using 57 probe test measurements across more than 3,000 wafers. By explicitly applying probe tests to only 1% of the die on each wafer, we are able to predict probe test outcomes for the remaining die within 2% of their true values.

This work seeks to expose the vulnerability of un-trusted computing platforms used in critical systems to hardware Trojans and combined hardware/software attacks. As part of our entry in the Cyber Security Awareness Week (CSAW) Embedded System Challenge hosted by NYU-Poly in 2011, we developed and presented 10 such processor-level hardware Trojans. These are split in five categories with various impacts, such as altering instruction memory, modifying the communication channel, stealing user information, changing interrupt handler location and RC-5 encryption algorithm checking of a medium complexity micro-processor (8051). Our work serves as a good starting point for researchers to develop Trojan detection and prevention methodologies on modern processor and to ensure trustworthiness of computing platforms.

On-chip trainable neural networks show great promise in enabling various desired features of modern integrated circuits (IC), such as Built-In Self-Test (BIST), security and trust monitoring, self-healing, etc. Cost-efficient implementation of these features imposes strict area and power constraints on the circuits dedicated to neural networks, which, however, should not compromise their ability to learn fast and retain functionality throughout their lifecycle. To this end, we have designed and fabricated a reconfigurable analog neural network (ANN) chip which serves as an expertise acquisition platform for various applications requiring on-chip ANN integration. With this platform, we intend to address the key cost-efficiency issues: a fully analog implementation with strict area and power budgets, a learning ability of the proposed architecture, fast dynamic programming of the weight memory during training, and high precision non-volatile storage of weight coefficients during operation or standby. We explore two learning structures: a multilayer perceptron (MLP) and an ontogenic neural network with their corresponding training algorithms. The core circuits are biased in weak inversion and make use of the translinear principle for multiplication and non-linear conversion operations. The chip is mounted on a custom PCB and connected to a computer for chip-in-the-loop training. We present measured results of the core circuits and the dual-mode weight memory. The learning ability is evaluated on a 3-input XOR classification task.

In the course of semiconductor manufacturing, various e-test measurements (also known as inline or kerf measurements) are collected to monitor the health-of-line and to make wafer scrap decisions preceding final test. These measurements are typically sampled spatially across the surface of the wafer from between-die scribe line sites, and include a variety of measurements that characterize the wafer's position in the process distribution. However, these measurements are often only used for wafer-level characterization by process and test teams, as the sampling can be quite sparse across the surface of the wafer. In this work, we introduce a novel methodology for extrapolating sparsely sampled e-test measurements to every die location on a wafer using Gaussian process models. Moreover, we introduce radial variation modeling to address variation along the wafer center-to-edge radius. The proposed methodology permits process and test engineers to examine e-test measurement outcomes at the die level, and makes no assumptions about wafer-to-wafer similarity or stationarity of process statistics over time. Using high volume manufacturing (HVM) data from industry, we demonstrate highly accurate cross-wafer spatial predictions of e-test measurements on more than 8,000 wafers.

As semiconductor process nodes continue to shrink, the cost and complexity of manufacturing has dramatically risen. This manufacturing process also generates an immense amount of data, from raw silicon to final packaged product. The centralized collection of this data in industry information warehouses presents a promising and heretofore untapped opportunity for integrated analysis. With a machine learning-based methodology, latent correlations in the joint process-test space could be identified, enabling dramatic cost reductions throughout the manufacturing process. To realize such a solution, this work addresses three distinct problems within semiconductor manufacturing: (1) Reduce test cost for analog and RF devices, as testing can account for up to 50% of the overall production cost of an IC; (2) Develop algorithms for post-production performance calibration, enabling higher yields and optimal power-performance; and, (3) Develop algorithms for spatial modeling of sparsely sampled wafer test parameters. Herein these problems are addressed via the introduction of a model-view-controller (MVC) architecture, designed to support the application of machine learning methods to problems in semiconductor manufacturing. Results are demonstrated on a variety of semiconductor manufacturing data from TI and IBM.

We present a novel methodology for protecting incore microprocessor memory arrays from Multiple Bit Upsets (MBUs). Recent radiation studies in modern SRAMs demonstrate that up to 55% of Single Event Upsets (SEUs) due to alpha particle or neutron strikes result in MBUs. Towards suppressing these MBUs, methods such as physical interleaving or periodic scrubbing have been successfully applied to caches. However, these methods are not applicable to in-core, high-performance Content-Addressable Memories (CAM) arrays, due to computational complexity, high delay and area overhead, and lack of information redundancy. To this end, we propose a cost-effective method for enhancing in-core memory array resiliency, called Vulnerability-based Interleaving (VBI). VBI physically disperses bit-lines based on their vulnerability factor and applies selective parity to these lines. Thereby, VBI aims to ensure that an MBU will affect at most one critical bit-field, so that the selective parity will detect the error and a subsequent pipeline flush will remove its effects. Experimental results employing simulation of realistic MBU fault models on the instruction queue of the Alpha 21264 microprocessor in a 65nm process, demonstrate that a 30% selective parity protection of VBI-arranged bit-lines reduces vulnerability by 94%.

We discuss a new approach for protecting the secrecy of internal information in an Integrated Circuit (IC) from malicious hardware Trojan threats and, thereby, enhancing hardware trust. The proposed approach is based on Register Transfer Level (RTL) code certification within a formal logic environment. The key novelty lies in the introduction of a new semantic model for the Verilog Hardware Description Language (HDL) in the Coq theorem-proving platform, which facilitates tracking and proving secrecy labels of internal sensitive data and, by extension, security properties of the design. Additional framework enhancements include the ability to encapsulate sub-module properties in the top module proof environment, thereby strengthening the ability of Coq representation to reason on hierarchically organized RTL code. We demonstrate the proposed framework on a DES encryption core, wherein we employ it to prevent secret information (e.g. round keys) leaking by hardware Trojans inserted at the RTL description of the circuit.

A recently proposed Built-In Self-Test (BIST) method for analog/RF circuits requires stimuli generator, measurement acquisition, and decision making circuits to be integrated on-chip along with the Device Under Test (DUT). Practical implementation of this approach hinges on the ability to meet strict area and power constraints of the circuits dedicated to test. In this work, we investigate a cost-efficient implementation of a neural classifier, which is the central component of this BIST method. We present the design of a reconfigurable analog neural network (ANN) experimentation platform and address the key questions concerning its cost-efficiency: a fully analog implementation with strict area and power budgets, a learning ability of the proposed architecture, fast dynamic programming of the weight memory during training, and high precision non-volatile storage of weight coefficients during operation or standby. Using this platform, we implement an ontogenic neural network (ONN) along with the corresponding training algorithms. Finally, we demonstrate the learning ability of the proposed architecture with a real-world case study wherein we train the ANN to predict the results of production specification testing for a large number of RF transceiver chips fabricated by Texas Instruments.

Global Signal Vulnerability (GSV) analysis is a novel method for assessing the susceptibility of modern microprocessor state elements to failures in the field of operation. In order to effectively allocate design for reliability resources, GSV analysis takes into account the high degree of architectural masking exhibited in modern microprocessors and ranks state elements accordingly. The novelty of this method lies in the way this ranking is computed. GSV analysis operates either at the Register Transfer (RT-) or at the Gate-Level, offering increased accuracy in contrast to methods which compute the architectural vulnerability of registers through high-level simulations on performance models. Moreover, it does not rely on extensive Statistical Fault Injection (SFI) campaigns and lengthy executions of workloads to completion in RT- or Gate-Level designs, which would make such analysis prohibitive. Instead, it monitors the behavior of key global microprocessor signals in response to a progressive stuck-at fault injection method during partial workload execution. Experimentation with the Scheduler and Reorder Buffer modules of an Alpha-like microprocessor and a modern Intel microprocessor corroborates that GSV analysis generates a near-optimal ranking, yet is several orders of magnitude faster than existing RT- or Gate-Level approaches.

We present a novel framework for facilitating the acquisition of provably trustworthy hardware intellectual property (IP). The proposed framework draws upon research in the field of proof-carrying code (PCC) to allow for formal yet computationally straightforward validation of security-related properties by the IP consumer. These security-related properties, agreed upon a priori by the IP vendor and consumer and codified in a temporal logic, outline the boundaries of trusted operation, without necessarily specifying the exact IP functionality. A formal proof of these properties is then crafted by the vendor and presented to the consumer alongside the hardware IP. The consumer, in turn, can easily and automatically check the correctness of the proof and, thereby, validate compliance of the hardware IP with the agreed-upon properties. We implement the proposed framework using a synthesizable subset of Verilog and a series of pertinent definitions in the Coq theorem-proving language. Finally, we demonstrate the application of this framework on a simple IP acquisition scenario, including specification of security-related properties, Verilog code for two alter- native circuit implementations, as well as proofs of their security compliance.

In semiconductor manufacturing, a wealth of wafer-level measurements, generally termed inline data, are collected from various on-die and between-die (kerf) test structures and are used to provide characterization engineers with information on the health of the process. While it is generally believed that these measurements also contain valuable information regarding die performances, the vast amount of inline data collected often thwarts efficient and informative correlation with final test outcomes. In this work, we develop a data mining approach to automatically identify and explore correlations between inline measurements and final test outcomes in analog/RF devices. Significantly, we do not depend on statistical methods in isolation, but incorporate domain expert feedback into our algorithm to identify and remove spurious autocorrelations which are frequently present in semiconductor manufacturing data. We demonstrate our method using data from an analog/RF product manufactured in IBM's 90nm low-power process, on which we successfully identify a set of key inline parameters correlating to module final test (MFT) outcomes.

The notion of Architectural Vulnerability Factor (AVF) has been extensively used by designers to evaluate various aspects of design robustness. While AVF is a very accurate way of assessing element resiliency, its calculation requires rigorous and extremely time-consuming experiments. In response, designers have introduced various methodologies that allow AVF calculation within reasonable time, at the cost of some loss of accuracy. In this paper, we present a method for calculating the AVF of design elements-using Statistical Fault Injection (SFI)-with equal accuracy but several orders of magnitude faster than traditional SFI techniques. Our method partitions the design into various hierarchical levels and systematically performs incremental fault injections to generate the AVF numbers. The presented method has been applied on an Intel microprocessor, where experimental results corroborate its ability to achieve great speed-up while maintaining perfect accuracy in calculating AVF.

The deployment of alternative, low-cost RF test methods in industry has been, to date, rather limited. This is due to the potentially impaired ability to identify device pass/fail labels when departing from traditional specification test. By relying on alternative tests, pass/fail labels must be derived indirectly through new test limits defined for the alternative tests, which may incur error in the form of test escapes or yield loss. Clearly, estimating these test metrics as early as possible in the test development process is key to the success of an alternative test approach. In this work, we employ a test metrics estimation technique based on non-parametric kernel density estimation to obtain such early estimates, and, for the first time, demonstrate a real-world case study of test metric estimation efficiency at parts-per-million levels. To achieve this, we employ a set of more than 1 million RF devices fabricated by Texas Instruments, which have been tested with both traditional specification tests as well as alternative, low-cost On-chip RF Built-in Tests, or “ORBiTs”.

We discuss a new type of a structural hardware Trojan, which does not attack the target circuit itself but tries to mute the internal hardening scheme instead. By implementing this type of hardware Trojan, we argue that most of the currently proposed hardware Trojan prevention methods are far from adequate, assuming that attackers are patient, smart and have basic knowledge of the hardening structure. As demonstrated through our work for the CSAW Embedded System Challenge hosted by NYU-Poly in 2010, attackers can easily construct test patterns to “reverse-engineer” the hardening scheme from the Register Transfer Level (RTL) description. A simple look-up table can then invalidate the hardening scheme, even if it is as sophisticated as the Ring Oscillator (RO)-based Trojan prevention method used in this competition. Hence, our conjecture is that any single-scheme Trojan prevention method is insufficient to keep hardware Trojans out of the door and only a combination of several methods is a plausible solution.

We present a non-intrusive concurrent error detection (CED) method for protecting the control logic of a contemporary floating point unit (FPU). The proposed method is based on the observation that control logic errors lead to extensive datapath corruption and affect, with high probability, the exponent part of the IEEE 754 floating point representation. Thus, exponent monitoring can be utilized to detect errors in the control logic of the FPU. Predicting the exponent involves relatively simple operations, therefore our method incurs significantly lower overhead than the classical approach of duplicating the control logic of the FPU. Indeed, experimental results on the openSPARC T1 processor show that, as compared to control logic duplication, which incurs an area overhead of 17.9% of the FPU size, our method incurs an area overhead of only 5.8% yet still achieves detection of over 95% of transient errors in the FPU control logic. Moreover, the proposed method offers the ancillary benefit of also detecting 98.1% of datapath errors that affect the exponent, which cannot be detected via duplication of control logic. Finally, when combined with a classical residue code-based method for the fraction, our method leads to a complete CED solution for the entire FPU which provides a coverage of 94.4% of all errors at an area cost of 16.32% of the FPU size.

IT is with great pleasure that we introduce this special section on Chips and Architectures for Emerging Technologies and Applications to the audience of the IEEE Transactions on Computers. We are currently witnessing a technology advancement which is making the gap between the present and future much narrower than it has ever been. The purpose of this special section is to showcase highly innovative, creative, and futuristic chip architectures and functionalities that can range from new paradigms in reconfigurable systems architectures, to adaptive, organic, ubiquitous, and biologically inspired computing, to new classes of chip implants, or any other highly innovative human-to-computer interface. This special section includes two papers, which we hope will offer an interesting perspective on the challenges involved in designing integrated circuits and architectures that leverage the capabilities of emerging technologies in novel applications. The first paper, ‘‘Exploring the Potential of Threshold Logic for Cryptography-Related Operations,’’ by Alessandro Cilardo, investigates the application of a non-Boolean computational paradigm to cryptographic applications. More specifically, the author demonstrates the power of linear Threshold Logic functions, which are enabled by new technologies such as Resonant Tunneling Diodes (RTDs), Single-Electron Tunneling (SET), Quantum Cellular Automata (QCA), and Tunneling Phase Logic (TPL), towards performing fundamental cryptographic operations. An architecture for implementing such operations, namely a Montgomery modular reduction and multiplication, is also introduced and its intrinsic superiority to traditional Boolean computational models in demonstrated. The second paper, ‘‘3D Integration of CMOL Structures for FPGA Applications,’’ by Z. Abid, Ming Liu, and Wei Wang, introduces a combination of hybrid CMOS/ nanoelectronic (CMOL) circuits and 3D integration, in order to develop a 3D CMOL technology with particular emphasis on designing Field-Programmable Gate-Array (FPGA) chips. The authors discuss the architecture, 3D integration, defect tolerance and performance aspects of this technology, as well as its breakthrough potential for developing the next generation of FPGAs. We would like to thank the previous editor-in-chief of the IEEE Transactions on Computers, Dr. Fabrizio Lombardi, for suggesting that we organize this special section, the current editor-in-chief Dr. Albert Y. Zomaya, for hosting this section, and all of the editorial staff for the support in the making of the issue. Additionally, we would like to thank the authors of the submitted papers and the numerous reviewers whose contributions made this special section possible.

We present a Concurrent Error Detection (CED) scheme for the Scheduler of a modern microprocessor. The proposed CED scheme is based on monitoring a set of invariances imposed through added hardware, violation of which signifies the occurrence of an error. The novelty of our solution stems from the workload-cognizant way in which these invariances are selected so that they leverage the application-level error masking inherent in program execution. Specifically, in order to ensure cost-effectiveness of the hardware employed to construct these invariances, we make use of information regarding the type and frequency of errors affecting the typical workload of the microprocessor. Thereby, we identify the most susceptible aspects of instruction execution and we accordingly distribute CED resources to protect them. Our approach is demonstrated on the Scheduler of an Alpha-like superscalar microprocessor with dynamic scheduling, hybrid branch prediction and out-of-order execution capabilities. Using an extensive fault-simulation infrastructure that we developed around this microprocessor, we profile the impact of Scheduler faults across a variety of different SPEC2000 benchmarks. Based on the results, we construct a CED scheme which monitors the time and location of instruction execution, the executed operation, the utilized resources, as well as the executed and retired sequence of instructions. At a hardware cost of only 32 percent of the Scheduler, the corresponding CED scheme detects over 85 percent of its faults that affect the architectural state of the microprocessor. Furthermore, over 99.5 percent of these faults are detected before they corrupt the architectural state, while the average detection latency for the remaining faults is in the order of a few clock cycles, implying that efficient recovery methods can be developed.

We investigate the correlation between low-level faults in the control logic of a modern microprocessor and their instruction-level impact on the execution of typical workload. Such information can prove immensely useful in accurately assessing and prioritizing faults with regards to their criticality, as well as commensurately allocating resources to enhance online testability and error/fault resilience through concurrent error detection/correction methods. To this end, we developed an extensive fault simulation infrastructure which allows injection of stuck-at faults and transient errors of arbitrary starting time and duration, as well as cost-effective simulation and classification of their repercussions into various instruction-level error types. As a test vehicle for our study, we employ a superscalar, dynamically-scheduled, out-of-order, Alpha-like microprocessor, on which we execute SPEC2000 integer benchmarks. Extensive fault injection campaigns in control modules of this microprocessor facilitate valuable observations regarding the distribution of low-level faults into the instruction-level error types that they cause. Experimentation with both Register Transfer (RT-) and Gate-Level faults, as well as with both stuck-at faults and transient errors, confirms the validity and corroborates the utility of these observations.

A proof-of-concept hardware neural network for the purpose of analog built-in self-test is presented. The network is reconfigurable into any one-hidden-layer topology within the constraints of the number of inputs and neurons. Analog operation domain of synapses and neurons in conjunction with the digital weight storage allow fast computational time, low power consumption and fast training cycle. The network is trained in the chip-in-the-loop fashion with the simulated annealing-based parallel weight perturbation training algorithm. Its effectiveness in learning how to separate nominal from faulty circuits is investigated on two case studies: a Butterworth filter and an operational amplifier. The results are compared to those of the software neural networks of equivalent topologies and limitations concerning the practical applicability are discussed.

In semiconductor device fabrication, continual demand for high performance, high yield devices has caused designers to look to post-production tunable circuits as the next logical step in analog/RF design and test development. These approaches have not yet achieved the maturity necessary for industrial adoption, primarily due to complexity and cost. In this work, we develop a general model which systematically outlines several key observations constraining the complexity of performance calibration in analog/RF devices. Moreover, we develop a detailed cost model permitting direct comparison of performance calibration methods to industry standard specification testing. Our analysis is demonstrated on a tunable RF LNA device simulated in 0.18μm RFCMOS.

A stand-alone built-in self-test architecture mainly consists of three components: a stimulus generator, measurement acquisition sensors, and a measurement processing mechanism to draw out a straightforward Go/No-Go test decision. In this paper, we discuss the design of a neural network circuit to perform the measurement processing step. In essence, the neural network implements a non-linear classifier which can be trained to map directly sensor-based measurements to the Go/No-Go test decision. The neural network is fabricated as a single chip and is put to the test to recognize faulty from functional RF LNA instances. Its decision is based on the readings of two amplitude detectors that are connected to the input and output ports of the RF LNA. We discuss the learning strategy and the generation of information-rich training sets. It is shown that the hardware neural network has comparable learning capabilities with its software counterpart.

We present a method for selective hardening of control state elements against soft errors in modern microprocessors. In order to effectively allocate resources, our method seeks to rank the control state elements based on their susceptibility, taking into account the high degree of architectural masking inherent in modern microprocessors. The novelty of our method lies in the way this ranking is computed. Unlike methods that compute the architectural vulnerability of registers based on high-level simulations on performance models, our method operates at the Register Transfer (RT-) Level and is, therefore, more accurate. In contrast to previous RT-Level methods, however, it does not rely on extensive transient fault injection campaigns and lengthy executions of workloads to completion, which may make such analysis prohibitive. Instead, it monitors the behavior of key global microprocessor signals in response to a progressive stuck-at fault injection method during partial workload execution. Experimentation with the Scheduler module of an Alpha-like microprocessor corroborates that our method generates a near-optimal ranking, yet is several orders of magnitude faster.

We present a machine learning approach to the problem of RF specification test compaction. The proposed compaction flow relies on a multi-objective genetic algorithm, which searches in the power-set of specification tests to select appropriate subsets, and a classifier, which makes pass/fail decisions based solely on these subsets. The method is demonstrated on production test data from an RF device fabricated by IBM. The results indicate that machine learning can identify intricate correlations between specification tests, which allows us to infer the outcome of all tests from a subset of tests. Thereby, the number of tests that need to be explicitly carried out and the corresponding cost are reduced significantly without adversely impacting test accuracy.

This paper discusses the generation of information-rich, arbitrarily-large synthetic data sets which can be used to (a) efficiently learn tests that correlate a set of low-cost measurements to a set of device performances and (b) grade such tests with parts per million (PPM) accuracy. This is achieved by sampling a non-parametric estimate of the joint probability density function of measurements and performances. Our case study is an ultra-high frequency receiver front-end and the focus of the paper is to learn the mapping between a low-cost test measurement pattern and a single pass/fail test decision which reflects compliance to all performances. The small fraction of devices for which such a test decision is prone to error are identified and retested through standard specification-based test. The mapping can be set to explore thoroughly the tradeoff between test escapes, yield loss, and percentage of retested devices.

Towards improving performance, modern microprocessors incorporate a variety of architectural features, such as branch prediction and speculative execution, which are not critical to the correctness of their operation. While faults in the corresponding hardware may not necessarily affect functional correctness, they may, nevertheless, adversely impact performance. In this paper, we investigate quantitatively the performance impact of such faults using a superscalar, dynamically-scheduled, out-of-order, Alpha-like microprocessor, on which we execute SPEC2000 integer benchmarks. We provide extensive fault simulation-based experimental results and we discuss how this information may guide the inclusion of additional hardware for performance loss recovery and yield enhancement.

Summary form only given, as follows. This session is the final round of the TTTC 2009 Best Doctoral Thesis Contest. This contest is organized by the TTTC Student Activities Committee for the fifth consecutive year and aims to promote and strengthen the interaction between graduate students and the industrial community, as well as to serve as a process by which student work is exposed to and tested under real-life industrial needs. This is achieved by offering students the chance to present their work in a conference environment to academic and industrial test experts, who will evaluate and comment in terms of novelty and advancement of industrial practice. In the preliminary round of this contest, doctoral students who are expected to graduate in 2009 were invited to submit a one page abstract of their thesis, where they defined the problem and its relevance to industry, described existing industrial practices for solving the problem and explained the proposed methodology and how it advances the theory and/or practice in the particular field. The abstracts were reviewed by a panel of industrial and academic experts and a set of finalists were selected for the final round of the contest. In this final round, during a dedicated session at the IEEE VLSI Test Symposium (VTS’09), each contestant is given a ten minute slot in front of a panel of experts, split equally between oral presentation and Q&A period. The panel of experts will judge the presented doctoral theses with regards to theoretical advancement, industrial relevance and presentation, and the winner of the contest will receive the 2009 TTTC Doctoral Thesis Award during the social event of the Symposium, to which all finalists are invited. The award consists of a certificate, an honorarium and an invitation to submit a paper on the presented work to the IEEE Design & Test magazine.

We discuss the results of an extensive fault simulation study involving the control logic of a modern alpha-like microprocessor. In this comparative study, faults are injected in both the RT- and the Gate-Level description of the design and are simulated under actual workload of the microprocessor, which is executing SPEC2000 benchmarks. The objective of this study is to analyze and contrast the impact of RT- and gate-level faults on the instruction execution flow of the microprocessor. The key observation is a pronounced consistency in the type and frequency of instruction level errors (ILEs) arising due to RT- vs. gate-level faults. The motivation for this work stems from the need to understand the relative importance of low-level faults based on their instruction-level impact, in order to appropriately allocate error detection and/or correction resources. Hence, the consistency revealed through this study implies that such decisions can be made equally effective based on RT-level fault simulation results, as with their far more computationally-expensive gate-level equivalents.

A fast and accurate simulator with elaborate hazard detection capabilities is vital for asynchronous circuits, not only for the purpose of design validation through logic simulation, but even more importantly for the purpose of test validation through fault simulation. Towards this end, we developed SPIN-SIM, a logic and fault simulator built around Eichelbergerpsilas classical hazard detection method, yet extended in various ways in order to overcome its limitations. More specifically, in order to improve simulation accuracy and hazard detection, SPIN-SIM i) employs a 13-valued algebra for which it adapts Eichelbergerpsilas method, ii) maintains partial orders of causal signal transitions through relative time-stamps, and iii) unfolds time-frames judiciously to distinguish between hazards and actual transitions. Experimental results demonstrate that, at the cost of a negligible increase in computational time over Eichelbergerpsilas method, if any at all, SPIN-SIM achieves significantly more accurate logic simulation and, by extension, drastically more efficient fault simulation. Furthermore, while the proposed method was developed and is presented for the class of speed-independent circuits, it is easily extendible to various other classes of asynchronous circuits.

We discuss the problem of soft errors in asynchronous burst-mode machines (ABMMs), and we propose two solutions. The first solution is an error tolerance approach, which leverages the inherent functionality of Muller C-elements, along with a variant of duplication, to suppress all transient errors. The proposed method is more robust and less expensive than the typical triple modular redundancy error tolerance method and often even less expensive than previously proposed concurrent error detection methods, which only provide detection but no correction. The second solution is an error mitigation approach, which leverages a newly devised soft-error susceptibility assessment method for ABMMs, along with partial duplication, to suppress a carefully chosen subset of transient errors. Three progressively more powerful options for partial duplication select among individual gates, complete state/output logic cones, or partial state/output logic cones and enable efficient exploration of the tradeoff between the achieved soft-error susceptibility reduction and the incurred area overhead. Furthermore, a gate-decomposition method is developed to leverage the additional soft-error susceptibility reduction opportunities arising during conversion of a two-level ABMM implementation into a multilevel one. Extensive experimental results on benchmark ABMMs assess the effectiveness of the proposed methods in reducing soft-error susceptibility, and their impact on area, performance, and offline testability.

Several existing methodologies have leveraged the correlation between the non-RF and the RF performances of a circuit in order to predict the latter from the former and, thus, reduce test cost. While this form of specification test compaction eliminates the need for expensive RF measurements, it also comes at the cost of reduced test accuracy, since the retained non-RF measurements and pertinent correlation models do not always suffice for adequately predicting the omitted RF measurements. To alleviate this problem, we develop a methodology that estimates the confidence in the obtained test outcome. Subsequently, devices for which this confidence is insufficient are retested through the complete specification test suite. As we demonstrate on production test data from a zero-IF down-converter fabricated at IBM, the proposed method outperforms previous defect filtering and guard banding methods and enables a more efficient exploration of the tradeoff between test accuracy and number of retested devices.

Sets of Pairs of Functions to be Distinguished (SPFD) is a functional flexibility representation method that was recently introduced in the logic synthesis domain, and promises superiority in exploring the flexibility offered by a design over all previous representation methods. In this work, we illustrate how the SPFD of a particular wire reveals information regarding the number of potential transient errors that may occur on that wire and may affect the output of the circuit. Using an SPFD-based rewiring method, we then demonstrate how to evolve a logic circuit in order to minimize the total number of potential transient errors in the circuit and, consequently, reduce its Soft Error Rate (SER) while controlling the effect on the rest of the design parameters, such as area, power, delay, and testability. Experimental results on ISCAS'89 and ITC'99 benchmark circuits indicate that the SER can be reduced at no additional overhead to any of the design parameters.

We investigate the correlation between register transfer-level faults in the control logic of a modern microprocessor and their instruction-level impact on the execution flow of typical programs. Such information can prove immensely useful in accurately assessing and prioritizing faults with regards to their criticality, as well as commensurately allocating resources to enhance testability, diagnosability, manufacturability and reliability. To this end, we developed an extensive infrastructure which allows injection of stuck-at faults and transient errors of arbitrary starting point and duration, as well as cost-effective simulation and classification of their repercussions into various instruction-level error types. As a test vehicle for our study, we employ a superscalar, dynamically-scheduled, out-of-order, Alpha-like microprocessor, on which we execute SPEC2000 integer benchmarks. Extensive experimentation with faults injected in control logic modules of this microprocessor reveals interesting trends and results, corroborating the utility of this simulation infrastructure and motivating its further development and application to various tasks related to robust design.

Unlike the top-down photolithographic CMOS VLSI process, cost-effective bulk fabrication of nanodevices calls for a bottom-up approach, generally called self-assembly. Self- assembly, however, inherently lends itself to innate disparities in the structure of nominally identical nanodevices and, consequently, wide inter-device variance in their functionality. As a result, nanodevice characterization and testing calls for a slow and tedious procedure involving a large number of measurements. In this work, we discuss a statistical approach which learns measurement correlations from a small set of fully characterized nanodevices and utilizes the extracted knowledge to simplify the process for the rest of the nanodevices. More specifically, we employ various machine-learning methods which rely on a small subset of measurements to (i) predict the performances of a fabricated nanodevice, (ii) decide whether a nanodevice passes or fails a given set of specifications, and (iii) bin a nanodevice with regards to several sets of increasingly strict specifications. The proposed methods are demonstrated and their effectiveness is assessed, within the context of nanowire-based chemical sensing, using a set of fabricated and fully characterized nanowires.

Machine-learning-based test methods for analog/RF devices have been the subject of intense investigation over the last decade. However, despite the significant cost benefits that these methods promise, they have seen a limited success in replacing the traditional specification testing, mainly due to the incurred test error which, albeit small, cannot meet industrial standards. To address this problem, we introduce a neural system that is trained not only to predict the pass/fail labels of devices based on a set of low-cost measurements, as aimed by the previous machine-learning-based test methods, but also to assess the confidence in this prediction. Devices for which this confidence is insufficient are then retested through the more expensive specification testing in order to reach an accurate test decision. Thus, this two-tier test approach sustains the high accuracy of specification testing while leveraging the low cost of machine-learning-based testing. In addition, by varying the desired level of confidence, it enables the exploration of the tradeoff between test cost and test accuracy and facilitates the development of cost-effective test plans. We discuss the structure and the training algorithm of an ontogenic neural network which is embodied in the neural system in the first tier, as well as the extraction of appropriate measurements such that only a small fraction of devices are funneled to the second tier. The proposed test-error-moderation method is demonstrated on a switched-capacitor filter and an ultrahigh-frequency receiver front end.

We introduce a logic-level soft error mitigation methodology for combinational circuits. The proposed method exploits the existence of logic implications in a design, and is based on selective addition of pertinent functionally redundant wires to the circuit. We demonstrate that the addition of functionally redundant wires reduces the probability that a single-event transient (SET) error will reach a primary output, and, by extension, the soft error rate (SER) of the circuit. We discuss three methods for identifying candidate functionally redundant wires, and we outline the necessary conditions for adding them to the circuit. We then present an algorithm that assesses the SET sensitization probability reduction achieved by candidate functionally redundant wires, and selects an appropriate subset that, when added to the design, minimizes its SER. Experimental results on ISCAS'89 benchmark circuits demonstrate that the proposed soft error mitigation methodology yields a significant SER reduction at the expense of commensurate hardware, power, and delay overhead.

The authors present a case study that employs production test data from an RF device to assess the effectiveness of four different methods in predicting the pass/fail labels of fabricated devices based on a subset of performances and, thereby, in decreasing test cost. The device employed is a zero-IF down-converter for cell-phone applications and the four methods range from a sample maximum-cover algorithm to an advanced ontogenic neural network. The results indicate that a subset of non-RF performances suffice to predict correctly the pass/fail label for the vast majority of the devices and that the addition of a few select RF performances holds great potential for reducing misprediction to industrially acceptable levels. Based on these results, the authors then discuss enhancements and experiments that will further corroborate the utility of these methods within the cost realities of analog/RF production testing.

Asynchronous controllers exhibit various characteristics that limit the effectiveness and applicability of the concurrent error detection (CED) methods developed for their synchronous counterparts. Asynchronous burst-mode machines (ABMMs), for example, do not have a global clock to synchronize the ABMM with the additional circuitry that is typically used by synchronous CED methods (for example, duplication). Therefore, performing effective CED in ABMMs requires a synchronization method that will appropriately enable the checker (for example, comparator) in order to avoid false alarms. Also, ABMMs contain redundant logic, which guarantees the hazard-free operation required for correct interaction between the circuit and its environment. Redundant logic, however,' allows some single event transients to manifest themselves only as hazards but not as logic discrepancies. Therefore, performing effective CED in ABMMs requires the ability to detect hazards with which synchronous CED methods are not concerned. In this work, we first devise hardware solutions for performing checking synchronization and hazard detection. We then demonstrate how these solutions enable the development of three complete CED methods for ABMMs. The first method (duplication-based CED) is an adaptation of the well-known duplication method within the context of ABMMs. The second method (transition-triggered CED) is a variation of duplication wherein the implementation cost is reduced by allowing hazards in the duplicate circuit. ln contrast to these two methods, which are nonintrusive, the third method (Berger code-based CED) is intrusive since it requires reencoding of the ABMM with check symbols based on the Berger code. Although this intrusiveness may slightly impact performance, Berger code-based CED incurs the lowest area overhead among the three methods, as indicated through experimental results

We discuss the use of the Berger code for concurrent error detection (CED) in asynchronous burst-mode machines (ABMMs). We present a state encoding method which guarantees the existence of the two key components for Berger-encoding an ABMM, namely an inverter-free ABMM implementation of the circuit and an ABMM implementation of the corresponding Berger code generator. We also propose improved solutions to two inherent problems of CED in ABMMs, namely checking synchronization and detection of error-induced hazards. Experimental results demonstrate that Berger code-based CED reduces significantly the cost of previous CED methods for ABMMs

As a class of asynchronous circuits, handshake circuits are designed to tolerate variation of gate delays. However, certain timing constraints, such as the bundled data assumption, are exploited in the single-rail implementation of these circuits in order to simplify them. Therefore, any delay fault in the circuit may cause one of two problems, namely performance degradation or logic errors. To address the challenges incurred by the autonomous behavior of handshake circuits during at-speed test, we propose test methods for both types of delay faults based on a DFT strategy which greatly simplifies the complexity of test generation. The efficiency of the proposed methodology is demonstrated through experimental results on several handshake circuits.

Rewiring has been used extensively for optimizing the area, the power consumption, the delay, and the testability of a circuit. In this work, we demonstrate how rewiring can also be used for reducing the soft error rate (SER). We employ an ATPG-based rewiring method to generate functionally-equivalent yet structurally-different implementations of a logic circuit based on simple transformation rules. This rewiring capability, along with an off-the-shelf method for assessing the SER of a circuit, enable the integration of the SER in a unified search algorithm that iteratively evolves the design in order to satisfy a given set of objectives. Experimental results on ISCAS'89 and ITC'99 benchmark circuits verify that rewiring can indeed be successfully used to reduce the SER of a circuit and, thus, it facilitates a design-space exploration framework for trading off area, power consumption, delay, testability, and SER

Numerous machine-learning-based test methodologies have been proposed in recent years as a fast alternative to the standard functional testing of mixed-signal/RF integrated circuits. While the test error probability of these methods is rather low, it is still considered prohibitive for accurate production testing. In this paper, we demonstrate how to minimize this test error probability and, thus, how to bridge the accuracy of functional and machine-learning-based test methods. The underlying idea is to measure the confidence of the machine-learning-based test decision and retest the small fraction of circuits for which this confidence is low via standard functional test. Through this approach, the majority of circuits are tested using fast machine-learning-based tests, which, nevertheless, are equivalent to the standard functional ones with regards to test error probability. By varying the acceptable confidence level, the proposed method enables exploration of the trade-off between test time and test accuracy

The aim of the TTTC Doctoral Thesis Award is to promote and strengthen the interaction between doctoral students who are about to graduate and the industrial community. It also serves as a process that allows their work to be exposed to and tested under real life industrial needs by experts in the field. This is achieved with student presentations in a dedicated VTS session in front of an industrial panel that evaluates, comments and contributes to their work in terms of novelty and advance of industrial practice and this of theoretical methodology.

This paper presents discuss the problem of parity-tree selection for performing concurrent error detection (CED) with low overhead in finite state machines (FSMs). We first develop a nonintrusive CED method based on compaction of the state/output bits of an FSM via parity trees and comparison to the correct responses, which are generated through additional on-chip parity prediction hardware. Similar to off-line test-response-compaction practices, this method minimizes the number of parity trees required for performing lossless compaction. However, while a few parity trees are typically sufficient, the area and the power consumption of the corresponding parity predictor is not always in proportion with the number of implemented functions. Therefore, parity-tree-selection methods that minimize the overhead of the parity predictor, rather than the number of parity trees, are required. Towards this end, we then extend our method into a systematic search that exploits the correlation between the area and the power consumption of a function and its entropy, in order to select parity trees that minimize the incurred overhead. Experimental results on benchmark circuits demonstrate that this solution achieves significant reduction in area and power consumption over the basic method that simply minimizes the number of parity trees.

This paper presents a novel methodology for concurrent error detection in linear analog circuits. The error-detection circuit monitors the input and some observable internal nodes of the examined circuit and generates an estimate of its output. The estimate coincides with the output in error-free operation, while in the presence of errors, it diverges. Thus, concurrent error detection is performed by comparing the two signals through an analog comparator. In essence, the error-detection circuit operates as a duplicate of the examined circuit, yet it is smaller, in general, and never exceeds the size of an actual duplicate. The proposed methodology is demonstrated on three analog filters.

SPIN-PAC is a static test compaction method for Speed-Independent circuits. We demonstrate how the test sets can be compacted by combining multiple consecutive test vectors within a test sequence into a vector pair of higher Hamming distance, and by eliminating or pruning independent test sequences. We discuss the exponential nature of optimally solving this problem, we propose an efficient algorithm to approximate it, and we evaluate its performance through experiments.

We discuss the problem of concurrent error detection (CED) in a popular class of asynchronous controllers, namely burst-mode machines. We first outline the particularities of these clock-less circuits, including the use of redundancy to ensure hazard-free operation, and we explain how they limit the applicability and effectiveness of traditional CED methods, such as duplication. We then demonstrate how duplication can be enhanced to resolve these limitations through additional hardware for comparison synchronization and detection of error-induced hazards, which jeopardize the interaction of the circuit with its environment. Finally, we propose a transition-triggered CED method which employs a transition prediction junction to eliminate the need for hazard detection circuitry and hazard-free implementation of the duplicate. As indicated by experimental results, the proposed method reduces significantly the cost of CED, with an average of 22% in hardware savings.

We develop a neural network that learns to separate the nominal from the faulty instances of a circuit in a measurement space. We demonstrate that the required separation boundaries are, in general, non-linear. Unlike previous solutions which draw hyperplanes, our network is capable of drawing the necessary non-linear hypersurfaces. The hypersurfaces translate to test criteria that are strongly correlated to functional tests. A feature selection algorithm interacts with the network to identify a discriminative low-dimensional measurement space.

We propose a methodology for testing ultra-high-speed asynchronous pipelines, the latest and most promising asynchronous circuit design style. Unlike traditional delay-insensitive asynchronous micro-pipelines, which use slow capture-pass latches, these circuits employ aggressive handshaking protocols and transparent latches between fine-grain pipeline stages, in order to achieve high performance. Their functional robustness, however, relies on certain timing constraints that need to be satisfied. As a result, these circuits are no longer delay-insensitive, which means that stuck-at faults are not always leading to pipeline stalling. In addition, delay faults may result in violation of these timing constraints, thus affecting not only performance, as in delay-insensitive micro-pipelines, but also functional correctness. To address these new challenges, we develop a test method for both stuck-at and timing constraint violation faults in fine-grain ultra-high-speed asynchronous pipelines. The efficiency of the proposed method is demonstrated on MOUSETRAP, a recently developed pipeline for high-speed applications

We discuss the design of a neural system that learns to separate nominal from faulty instances of an analog circuit in a low dimensional measurement space. The key novelty of the proposed system is that it successively establishes a separation hypersurface of order that adapts to the intrinsic complexity of the problem. Thus, it performs excellent classification even in the presence of complex distributions. The test criterion for classifying a circuit is simply the location of its measurement pattern with respect to the separation hypersurface. Despite its simplicity, this criterion is, by construction, strongly correlated to the performance parameters of the circuit and does not rely on fault models.

A neural classifier that learns to separate the nominal from the faulty instances of a circuit in a measurement space is developed. Experimental evidence, which demonstrates that the required separation boundaries are, in general, nonlinear, is presented. Unlike previous solutions that build hyperplanes, the proposed classifier is capable of drawing nonlinear hypersurfaces. A new circuit instance is classified through a simple test, which examines the location of its measurement pattern with respect to these hypersurfaces. The classifier is trained through an algorithm that probably converges to the optimal separation boundary. Additionally, a feature selection algorithm interacts with the classifier to identify a discriminative low-dimensional measurement vector. Despite employing only a few measurements, the test criteria established by the neural classifier are strongly correlated to the performance parameters of the circuit and do not rely on a presumed fault model.

We discuss the problem of concurrent error detection (CED) with bounded latency in finite state machines (FSMs). The objective of this approach is to reduce the overhead of CED, albeit at the cost of introducing a small latency in the detection of errors. In order to ensure no loss of error detection capabilities as compared to CED without latency, an upper bound is imposed on the introduced latency. We examine the necessary conditions for performing CED with bounded latency, based on which we extend a parity-based method to permit bounded latency. We formulate the problem of minimizing the number of required parity bits as an integer program and we propose an algorithm based on linear program relaxation and randomized rounding to solve it. Experimental results indicate that allowing a small bounded latency reduces the hardware cost of the CED circuitry.

We develop a fault simulator for input stuck-at faults in Speed-Independent circuits by extending Eichelberger's method. In order to achieve higher accuracy, a 13-valued algebra is adopted, the relative order of causal signal transitions is maintained, and time frames are unfolded in a careful manner. Based on this simulator, we propose a random test generation algorithm which reduces the probability that the circuit finds itself in non-deterministic states and helps it recover when this happens. Experimental results show that the combination of the two techniques achieves an average improvement of 18% in fault coverage.

SPIN-TEST is a simulation-based gate-level ATPG system for speed-independent circuits. Its core engine is an A* search algorithm which employs an accurate fault simulator and an efficient cost function to guide a deterministic test pattern generation phase. A random test pattern generation phase is also available in order to improve run time. The key ATPG challenge in speed-independent circuits is the generation of patterns that are valid independently of the relative timing and the order of arrival of signals. SPIN-TEST addresses this challenge by guaranteeing fault sensitization with hazard/race-free patterns and response observation that is not affected by oscillations or non-deterministic circuit states. Experimental results on benchmark circuits demonstrate the efficiency of SPIN-TEST in terms of both high fault coverage and low test generation time.

We selectively generate and optimize the frames constructed by the rePLay architecture statically. Since static analysis provides a global view of the interaction between the basic blocks and a bigger aggressive optimization space, we propose a method to construct the frames using profiling and static analysis. Frame selection and optimization are analyzed in the criteria to produce well-optimized, frequently executed frames with minimum recovery penalty. In addition, hardware support is reduced to only perform mis-speculation recovery. Empirical results show the frame-optimized code outperforming baseline code on the SPEC integer benchmarks.

We present SPIN-SIM, a logic and fault simulator for speed-independent circuits, that extends the classical Eichelberger's method and overcomes its limitations. In order to improve simulation accuracy. SPIN-SIM adopts a 13-valued algebra, maintains the relative order of causal signal transitions, and unfolds time frames judiciously. In addition, complex gates are handled through replacement by pseudo-gate equivalents with regards to functionality, timing and faulty behavior. Experimental results show that SPIN-SIM incurs a negligible increase in computational time over Eichelberger's method, yet is much more accurate and achieves a significant improvement in fault coverage.

We discuss the problem of parity tree selection for lossless compaction of the output responses of a circuit. Earlier methods assume off-chip storage of the correct compacted responses and therefore minimize the number of necessary parity trees. In contrast, our method targets on-chip generation of the correct compacted responses and therefore minimizes the actual implementation cost of the corresponding parity prediction functions. We present a systematic search approach that exploits the correlation between the hardware cost of a function and its entropy, in order to select parity trees that minimize the incurred cost, while achieving lossless compaction. Experimental results demonstrate that our method achieves significant hardware reduction over methods that minimize the number of parity trees.

We present a low-cost concurrent test methodology for enhancing the reliability of RTL controller-datapath circuits, based on the notion of path invariance. The fundamental observation supporting the proposed methodology is that the inherent transparency behavior of RTL components, typically utilized for hierarchical off-line test, renders rich sources of invariance within a circuit. Furthermore, additional sources of invariance are obtained by examining the algorithmic interaction between the controller, and the datapath of the circuit. A judicious selection & combination of modular transparency functions, based on the algorithm implemented by the controller-datapath pair, yields a powerful set of invariant paths in a design. Compliance to the invariant behavior is checked whenever the latter is activated. Thus, such paths enable a simple, yet very efficient concurrent test capability, achieving fault security in excess of 90% while keeping the hardware overhead below 40% on complicated, difficult-to-test, sequential benchmark circuits. By exploiting fine-grained design invariance, the proposed methodology enhances circuit reliability, and contributes a low-cost concurrent test direction, applicable to general RTL circuits.

We analyze the effect of errors in branch predictors, a representative example of speculative processor subsystems, to motivate the necessity for fault tolerance in such subsystems. We also describe the design of fault tolerant branch predictors using general fault tolerance techniques. We then propose a fault-tolerant implementation that utilizes the finite state machine (FSM) structure of the pattern history table (PHT) and the set of potential faulty states to predict the branch direction, yet without strictly identifying the correct state. The proposed solution provides virtually the same prediction accuracy as general fault tolerant techniques, while significantly reducing the incurred hardware overhead.

We discuss the compaction of independent test sequences for sequential circuits. Our first contribution is the formulation of this problem as an integer program, which we then solve through a well-known method employing linear programming relaxation and randomized rounding. The key contribution of this approach is that it yields the first polynomial time approximation algorithm for this problem. More specifically, it provides a provably good approximation guarantee while running in time polynomial with respect to the number of vectors in the original test sequences and the number of faults. Another virtue of our approach is that it provides a lower bound for the compacted set of test sequences and, therefore, a quality measure for the test compaction algorithm. Experimental results on benchmark circuits demonstrate that the proposed solution efficiently identifies nearly optimal sets of compacted test sequences.

We discuss the design of a novel analog checker that monitors two duplicate signals and provides a digital error indication when their absolute difference is unacceptably large. The key feature of the proposed checker is that it establishes a test criterion that is dynamically adapted to the magnitude of its input signals. We demonstrate that, when this checker is utilized in concurrent error detection, the probability of both false negatives and false positives is diminished. In contrast, checkers implementing a static test criterion may only be tuned to achieve efficiently one of the aforementioned objectives. Likewise, when the proposed checker is employed for off-line test purposes, it results simultaneously in both high yield and high fault coverage.

We present a novel analog checker that adjusts dynamically the error threshold to the magnitude of its input signals. We demonstrate that this property is crucial for accurate concurrent error detection in analog circuits. Dynamic error threshold adjustment is achieved by regulating the bias point of the output stage inverters of the checker, which provide a digital indication of potential errors in the circuit under test. We discuss the theoretical foundation and we present simulations that validate the underlying principle of the design. As compared to previous solutions, the proposed checker reduces the incurred overhead, while significantly enhancing the quality of concurrent error detection.

We propose a methodology for non-intrusive design of concurrently self-testable FSMs. The proposed method is similar to duplication, wherein a replica of the original FSM acts as a predictor that immediately detects potential faults by comparison to the original FSM. However, instead of duplicating the complete FSM, the proposed method replicates only a minimal portion adequate to detect all possible faults, yet at the cost of introducing potential fault detection latency. Furthermore, in contrast to concurrent error detection approaches, which presume the ability to resynthesize the FSM and exploit parity-based state encoding, the proposed method is non-intrusive and does not interfere with the encoding and implementation of the original FSM. Experimental results on FSMs of various sizes and densities indicate that the proposed method detects 100 % of the faults with very low average fault detection latency. Furthermore, a hardware overhead reduction of up to 33 % is achieved, as compared to duplication-based concurrent error detection. 1.

We propose a methodology that examines design modules and identifies appropriate vector justification and response propagation requirements for reducing the cost of hierarchical test path construction. Test requirements are defined as a set of fine-grained input and output bit clusters and pertinent symbolic values. They are independent of actual test sets and are adjusted to the inherent module connectivity and regularity. As a result, they combine the generality required for fast hierarchical test path construction with the precision necessary for minimizing the incurred cost, thus fostering cost-effective hierarchical test.

We introduce a methodology for identifying transparency behavior appropriate for hierarchical test, based on the theoretical principles of transparency composition. Unlike high level approaches that identify limited, coarse transparency behavior, the proposed methodology is capable of extracting a wide class of fine grained transparency functions for arbitrary sub-word bit clusters. The functions in this class can furthermore be rapidly extracted on the fly and efficiently utilized for hierarchical test translation, thus alleviating the exponential extraction time and storage space requirements of exhaustive approaches. The twin benefits of rapid, automated extraction coupled with the expansion of utilizable transparency scope deliver reduced DFT while enabling cost-effective hierarchical test of high quality.

We discuss a hierarchical test generation method for DFT-free controller-datapath pairs. A transparency based scheme is devised for the datapath, wherein locally generated vectors are translated into global design test. The controller is examined through influence tables, used to generate valid control state sequences for testing each module through hierarchical test paths. Fault coverage levels and vector counts thus attained match closely, those of traditional test generation methodologies, while sharply reducing the corresponding computational cost.

We discuss a novel hierarchical test generation methodology for RTL designs, based on the concept of modular transparency. We introduce the channel notion, a powerful mechanism that captures modular transparency in terms of bijection functions defined on variable bitwidth signal entities. Through a recursive search algorithm, transparency channels are further combined into reachability paths suitable for translating local test vectors for each module into global design test. A divide and conquer hierarchical test generation methodology is described, resulting in significant test generation time speed-up and comparable fault coverage and vector count to complete circuit gate-level ATPG.

We present a low-cost on-line test methodology for RTL controller-datapath pairs, based on the notion of path invariance. The fundamental observation supporting the proposed methodology is that the transparency behavior inherent in RTL components renders rich sources of invariance in a design. Furthermore, the algorithmic controller-datapath interaction provides additional sources of invariance. A judicious selection and combination of modular transparency, based on the algorithm implemented by the controller-datapath pair, yields a powerful set of invariant paths. Such paths enable a simple, yet very efficient on-line test capability, achieving fault security in excess of 90% while keeping the hardware overhead below 40% on complicated, difficult to test, benchmarks.

We introduce a novel behavioral test synthesis methodology that attempts to increase module reachability, driven by powerful global design path analysis. Based on the notion of transparency channels, test justification and propagation bottlenecks are revealed for each module in the design. Subsequently the proposed behavioral test synthesis scheme eliminates during scheduling, allocation and binding, as many reachability bottlenecks, as possible. Furthermore, it identifies the control states and provides the templates required for translating each module's test into global design rest. We demonstrate our scheme on a representative example, unveiling the potential of path analysis based techniques to accurately identify and eliminate module reachability bottlenecks, thus guiding behavioral rest synthesis.

We introduce a formal mechanism for capturing test justification and propagation related behavior of blocks. Based on the identified test translation behavior, an RTL testability analysis methodology for hierarchical designs is derived. An algorithm for pinpointing the local-to-global test translation controllability and observability bottlenecks is presented. The analysis results are validated through an ATPG-based experimental flow and the applicability of the scheme for addressing test challenges in large designs by guiding DFT decisions is discussed.