Satellite microwave remote sensing is acknowledged as the primary method for obtaining global-scale surface soil moisture (SSM) data. Typically, spaceborne microwave sensors aboard polar-orbiting satellites yield SSM estimates with a native spatial resolution of several tens of kilometers and a temporal resolution of about once or twice daily. This indicates considerable potential for enhancing both of their spatial and temporal resolutions. Although spatial downscaling of spaceborne microwave SSM has garnered significant attention recently, the enhancement of their temporal resolution has received less focus. This study pioneers a methodology for generating hourly-scale satellite SSM estimates. The developed approach integrates a novel blending module that combines geostationary satellite observations with a spatially downscaled SSM dataset derived from traditional fusion among microwave and optical observations on polar-orbiting platforms. This blending module leverages land surface temperature (LST) data from geostationary satellites, which effectively quantify SSM variations on an hourly interval upon the thermal inertia theory. Consequently, a comprehensive spatio-temporal integrated framework for SSM downscaling is established to produce hourly-scale SSM at a resolution of 6 km, enhancing upon the daily and 36-km resolutions of existing microwave SSM datasets. Validation of the downscaled hourly SSM estimates was conducted through an established ground soil moisture observatory network in North China, revealing an unbiased root mean square error (ubRMSE) of no higher than 0.04 cm³/cm³. This result confirms preservation of the fundamental accuracy of original microwave SSM retrievals and demonstrates the effectiveness of the developed framework in improving both spatial and temporal representativeness of SSM data.

In this paper we discuss parametric measurements of devices implemented in a commercial 14nm CMOS FinFET process taken at cryogenic temperatures. The data may be used to create cryo-CMOS device models for developing CMOS control and readout circuits of qubits in quantum computer. Access to a large number of devices was enabled using an integrated digitally addressable analog multiplexer; the combination of this multiplexer and the set of devices accessible through the multiplexer forms an addressable parametric array. We will discuss the test structure, the measurement technique, the test challenges, and the device parameter shifts that we have observed, over a temperature range from 300K down to 7.9K. The addressable nature of the multiplexer allows investigation of a variety of device types in a single sample cool down. In addition, the accessibility of large numbers of devices allows statistics to be gathered on the variation of key device parameter spreads with temperature.

Global surface soil moisture (SSM) mapping at a 9-km intermediate resolution from microwave remote sensing could play a pivotal role in advancing detailed global hydrological investigations. Despite the wide recognition of the soil moisture active passive (SMAP) mission’s 9-km SSM products based on oversampling of the L-band radiometry, concerns persist regarding its ability to capture higher SSM heterogeneity at finer resolutions. For addressing this concern, a novel methodological framework was proposed in this study. This framework advocates the downscaling of the SMAP 36-km dataset through a fusion with high-frequency (Ka-band) passive microwave (PMW) observations. The resultant 9-km all-weather SSM product, derived from this novel approach, is evaluated using ground-based measurements worldwide. The findings reveal a significantly enhanced accuracy compared to the SMAP conventional oversampling-based one, especially in areas exhibiting pronounced local variations in SSM patterns. The study therefore represents a substantial step forward, providing new insights into the design and use of a multifrequency satellite radiometer for global SSM mapping.

The research on design for testability and reliability of security-aware hardware has been important in both academia and industry. With ever-growing globalization, commercial hardware design, manufacturing, transportation, and supply now involve many different countries, resulting in aggravated vulnerability from hardware design to manufacturing. Hardware with malicious purposes implanted from the third-party manufacturing process may control the operation of a circuit and tamper its functions, causing serious security issues. However, hardware includes not only devices and circuits but also systems. An important fact is that testability, reliability, and security technologies come from different design layers, but the impact evaluation is conducted at the system level. In other words, the testability, reliability, and security design of different layers can be carried out in a holistic manner to achieve optimization for the whole system. In addition, the testability, reliability, and security design technologies of each design layer can be collaboratively conducted to achieve better performance. The testability, reliability, and security tradeoff has garnered attention from academia and industry, particularly in the Post-Moore Era, due to the complexities and opportunities arising from new architectures and technologies.

This paper studies the impact of accelerated aging of a circuit containing a large variety of 14 nm scan chains using elevated voltage stress. Both IDDQ and timing performance changes are monitored to observe the aging of the circuit. Particular attention is dedicated to discussing the impact of the test pattern selection for both stress and sensing. The scan chain results are compared against previous results from 14 nm ring oscillators, confirming a good agreement. Simplified models are developed to explain the results and help understand the impact of aging on the circuit. In addition, the application to the hardware security is suggested given the measured aging signature.

Heterogeneous SoCs integrate FPGAs and microprocessor cores on the same fabric to accelerate applications, such as cryptography and deep learning. Since FPGAs share resources with the microprocessor cores, they can launch noncacheable synchronous DRAM (SDRAM) transactions through direct FPGA-to-microprocessor SDRAM interface. Therefore, if the FPGA 3rd party IPs (3PIPs) are malicious, they can launch rowhammer attacks on the SDRAM. Today’s countermeasures based on performance counters cannot detect these attacks because memory transactions from FPGAs do not pass through the cache. In addition, today’s countermeasures that count the frequency of activation of memory rows cannot identify the intellectual property (IP) that launches the attack from the FPGA. We present a security solution that monitors the SDRAM transactions from IPs on the FPGA to each bank of the microprocessor SDRAM through the FPGA-to-microprocessor SDRAM interface. The proposed monitor is implemented on the FPGA fabric. It can detect attempts to launch a rowhammer attack before it causes bit flips in the SDRAM. It utilizes 6.3% of the adaptive logic modules (ALMs) available in an Intel Cyclone V FPGA, when multiple IPs are monitored.

BISTLock is a recently proposed logic-locking technique that integrates a barrier finite-state-machine (FSM) with the built-in self-test (BIST) controller. We demonstrate the vulnerability of BISTLock to removal/bypass attacks and develop countermeasures to make it resilient against not only removal attacks but any form of Oracle-guided attack. Removal resilience is achieved through the incorporation of an input-signal scrambler. We demonstrate the vulnerability of the standalone scrambler to the SAT attack and present a reconfigurable LFSR-based dynamic authenticator that achieves SAT resilience. The proposed solution provides dynamic obfuscation upon the application of an incorrect key and prevents Oracle access to the attacker. We also present a security analysis of the overall system against Oraclefree attacks such as BMC-based sequential SAT and the FSM reverse engineering attack. We evaluate the security strength of the proposed solution and show that hardware overhead is low for a broad set of benchmark circuits.

Heterogeneous SoCs integrate FPGAs and microprocessor cores on the same fabric to accelerate applications such as cryptography and deep learning. Since FPGAs share resources with the microprocessor cores, they can launch non-cacheable SDRAM transactions through direct FPGA-to-microprocessor SDRAM interface. Therefore, if the FPGA 3rd party IPs (3PIPs) are malicious, they can launch rowhammer attacks on the SDRAM. Today's countermeasures based on performance counters cannot detect these attacks because memory transactions from FPGAs do not pass through the cache. In addition, countermeasures that count the frequency of activation of memory rows require structural changes to the memory controller or DRAM chips. Moreover, today's countermeasures cannot identify the IP that launches the attack. We present a security solution that monitors the SDRAM transactions from IPs on the FPGA to each bank of the microprocessor SDRAM through the FPGA-to-microprocessor SDRAM interface. The proposed monitor is implemented on the FPGA fabric. It can detect attempts to launch a rowhammer attack before it causes bit flips in the SDRAM. It utilizes only 1% of the adaptive logic modules (ALMs) available in an Intel Cyclone V FPGA to monitor the transactions from one IP.

The globalization of IC manufacturing has increased the likelihood for IP providers to suffer financial and reputational loss from IP piracy. Logic locking prevents IP piracy by corrupting the functionality of an IP unless a correct secret key is inserted. However, existing logic-locking techniques can impose significant area overhead and performance impact (delay and power) on designs. In this work, we propose BISTLock, a logic-locking technique that utilizes built-in self-test (BIST) to isolate functional inputs when the circuit is locked. We also propose a set of security metrics and use the proposed metrics to quantify BISTLock's security strength for an open-source AES core. Our experimental results demonstrate that BISTLock is easy to implement and introduces an average of 0.74% area and no power or delay overhead across the set of benchmarks used for evaluation.

The term CyberSecurity means many different things to many people - some think of data security, some think of identity protection, some think of intrusion attacks on the internet or USB ports. In reality, CyberSecurity represents any type of attack on computing machines. One of the type of attacks that is often overlooked are attacks by the supply chain to inject malfeasant circuitry into semiconductor devices as they are made. This is the one aspect of Design-for-Security and Design-for-Trust that is usually ignored. This innovative practice session will highlight three talks on hardware CyberSecurity attacks and defenses from both industry and academia.

The land parameter retrieval model (LPRM) has been widely used for the retrieval of microwave-based global surface soil moisture (SSM). In the original LPRM algorithm, soil surface effective temperature (SSET) was retrieved from the Ka-band (36.5 GHz) brightness temperature (BT) and then used as input data for the estimation of SSM. In this study, SSET retrieved from the Advanced Microwave Scanning Radiometer of the Earth Observing System Radiometer (AMSR-E) Ka-band BT was validated against MODIS land surface temperature (LST) data, and the results show that when the fraction of water surface (FWS) within an AMSR-E pixel increases in the range from 0-0.01 to 0.15-0.4, the root-mean-square error (RMSE) increases drastically from 1.98 to 11.42 Kelvin (K). When validation was conducted on SSET data retrieved with the K-band (18.7 and 23.8 GHz) BT, the RMSEs were maintained below 2.0 K for FWS ranging from 0 to 0.4. Therefore, in the original LPRM, we substituted the Ka-band BT with the K-band BT to produce more accurate estimations of SSET and hence improved SSM retrievals. Our results show that for FWS ranges of 0-0.01, 0.01-0.05, 0.05-0.15, and 0.15-0.4, the correlation coefficients (R -values) between SSM retrieved with the improved LPRM and Global Land Data Assimilation System (GLDAS) measurements are 0.78, 0.75, 0.77, and 0.46, respectively, compared with the corresponding R -values of 0.78, 0.65, 0.56, and 0.34 for SSM retrieved with the original LPRM. This demonstrates that against the original LPRM, our improved LPRM can produce more accurate SSM retrievals under water-land mixed pixels.

Start of the above-titled section of the conference proceedings record.

This paper presents a novel methodology that allows one to reveal SRAM memory content by observing the spontaneous photon emission collected from the backside of the chip. This method is based on our proposed tester-based optical methodology [1] that combines different test patterns, time-integrated and time-resolved emission measurements to localize gates, detect logic states, and identify functional block activity inside a chip in a non-invasive fashion. In this paper, the capability of the technique is demonstrated using a 64 Mb SRAM test chip fabricated in 14 nm SOI technology node. This technique has useful applications for chip debugging, reverse engineering, hardware and software security applications.

The proliferation of counterfeit Integrated Circuits (ICs) poses a big challenge for the electronics industry as today's supply chain of ICs becomes more complex and expensive. For this reason, it is imperative to mitigate these risks by developing counterfeit IC detection techniques, especially at the chip level. In this paper, a novel counterfeit IC detection method is proposed. It is based on the measurement of intrinsic light emission from CMOS ICs that is a strong function of the device threshold voltage (Vt) for a given technology. In contrast to currently available counterfeit IC detection techniques, the proposed method measures IC degradation after it has been used for a long time and does not require a reference IC to provide a baseline signature. A differential technique is used to detect different levels of degradation inside the same chip in order to determine if it is counterfeit. Experimental results presented in this paper show that emission can be effectively used to detect degradation, thus making this technique a very effective way to detect counterfeit ICs.

This paper presents a novel and powerful methodology for extracting functional blocks in hardware security and Trojan detection applications. The method is based on our proposed tester-based optical methodology that combines different test patterns, time-integrated and time-resolved emission measurements to identify and localize logic state changes and functional block activity inside a chip in a non invasive fashion. Detailed examples using a mixed-signal chip are presented and discussed to explain our proposed method.

The Semiconductor Industry Associates (SIA) estimates that counterfeiting costs the US semiconductor companies $7.5B in lost revenue, and this is indeed a growing global problem. Repackaging the old ICs, selling the failed test parts, as well as gray marketing, are the most dominant counterfeiting practices. Can technology do a better job than lawyers? What are the technical challenges to be addressed? What EDA technologies will work: embedding IP protection measures in the design phase, developing rapid post- silicon certification, or counterfeit detection tools and methods?

In this paper, we will present a diagnostic test case of a hard-to-find fail condition causing an unexpected partial power on of a chip fabricated in IBM 65 nm bulk technology. In particular, we will describe the fail condition as well as the combined use of electrical testing, optical methodologies, and detailed circuit analysis that were used to reach a successful root cause identification of the problem. In addition, we will show how high resolution mapping of the Light Emission from Off-State Leakage Current (LEOSLC) from the chip was instrumental in leading the investigative effort to the right root cause. The problem was successfully traced to a p-FET used for IDDQ measurement during manufacturing test that caused an undesirable coupling path. Fortunately this specific configuration was unique to this particular design and was easy to fix with a single mask change.

This paper details tester-based optical and electrical diagnostic system and techniques that aim at diagnosing various types of problems that exist in today's VLSI chips, especially during initial bring-up stage. The versatility of the electrical test creates flexible test controls while optical diagnostic tools, such as emission-based systems, provide a deep understanding of what is going on inside the chip. Tightly integrating both methods produces a powerful diagnostic system and it also opens a door for creating a series of new diagnostic techniques for resolving new families of problems as illustrated in this paper with several examples.

In this paper, a new emission-based method for measuring the amplitude of on-chip power supply noise is presented. This technique uses Time Resolved Emission (TRE) waveforms of Light Emission from Off-State Leakage Current (LEOSLC) from CMOS gates, which are used as local probe points for the noise. In order to demonstrate the capabilities of this technique, we discuss the results obtained for two early microprocessor chips fabricated in 65 nm and 45 nm Silicon On Insulator (SOI) technologies.

As design complexity increases and process technologies shrink, high resolution and quick turnaround diagnostics are always in high demand. This is especially important for the development of high performance microprocessors, where not only the gross defects are a big concern, but small "AC" defects (soft defects) are as well. To diagnose these "AC" defects, conventional electrical diagnostic techniques, such as software-based and tester-based approaches, might not be effective. In this paper, a dynamic laser stimulation technique is described. When combined with the Picosecond Imaging Circuit Analysis (PICA) technique, very high diagnostic resolution can be achieved. Several IBM Power6TM(P6) microprocessor [1] diagnostic examples are given to demonstrate the effectiveness of the proposed diagnostic strategy and methods.

In this paper, the paper discuss a diagnostics methodology based on the combined use of advanced chip cooling technology and high-resolution time-integrated images of the light emission due to off-state leakage current (LEOSLC). The methodology was successfully applied to the debug of an IBM microprocessor chip fabricated in the 90 nm SOI technology generation

We study the simultaneous switching noise(SSN) generated by the digital I/O buffers and its impact on VCO. A simple yet accurate model is developed to analyze the ground bounce and power supply fluctuation in each region respectively. Calculation results with the models show good agreements with HSPICE simulation results. Based on the noise model, we investigate the SSN effects on the timing jitter of a current starved VCO. In this study, the RMS jitter and jittery signal spectrum are characterized.

In this paper, we describe an advanced optical diagnostic technique used for diagnosing the IBM z990 eServer microprocessor (Slegel et al., 2004). Time-to-market pressure demands quick diagnostic turnaround time and high diagnostic resolution while the ever increasing design complexity, density, cycle time, and shrinking technologies dramatically add difficulties to diagnostics. Although design-for-test (DFT) and design-for-diagnostics (DFD) features are implemented in the latest microprocessors to help easing the diagnostic efforts, they may still not be sufficient to diagnose certain fails. The well-known picosecond imaging circuit analysis (PICA) (Kash and Tsang, 1997) tool, equipped with the high quantum efficiency superconducting single-photon detector (SSPD,) shows a unique diagnostic capability for optically probing the internal nodes of a chip. Several hard-to-diagnose examples will be used to demonstrate the unique capabilities of this technique

In this paper, we presents a programmable jitter generator. Different from the traditional jitter generator that uses the analog phase modulation (PM) technique to generate only non-Gaussian distributed jitter components, the proposed jitter generator uses digital techniques. It consists of a voltage controlled delay chain, jitter control block, and some basic digital components. It can generate not only the non-Gaussian distributed jitter component, but also the Gaussiandistributed jitter component. In addition, almost all jitter characteristics are controllable. This jitter generator can be used in jitter tolerance test and jitter transfer function measurement. A Xilinx XC4010 FPGA chip is used to validate this design.

Scan chain diagnostics have become more important than ever due to the increasing complexity of VLSI designs, as more and more scan latches/flip-flops are utilized in designs, especially in microprocessors. At the same time, the off-state leakage current of CMOS technology grows exponentially from one generation to the next one. This fact imposes a big challenge on the chip design, packaging, cooling, etc. However, innovative applications, based on the detection of light emission due to off-state leakage current (LEOSLC) have been developed for testing and diagnosing modern VLSI circuits. We show that LEOSLC can be used to effectively debug, diagnose, and localize defects in a broken scan chain.

Backside light emission and electrical measurements were used to evaluate the susceptibility to latchup of externally cabled I/O pins for a 0.13 µm technology generation [1,2] test chip, which was designed in a flip-chip package. Case studies of several Inputs/Outputs (I/Os) are shown along with conclusions regarding layout and floorplanning to ensure the robustness to various types of latchup trigger events.

Summary form only given. Large powerful networks coupled to state-of-the-art processors have traditionally dominated supercomputing. As technology advances, this approach is likely to be challenged by a more cost-effective System-On-A-Chip approach, with higher levels of system integration. The scalability of applications to architectures with tens to hundreds of thousands of processors is critical to the success of this approach. Significant progress has been made in mapping numerous compute-intensive applications, many of them grand challenges, to parallel architectures. Applications hoping to efficiently execute on future supercomputers of any architecture must be coded in a manner consistent with an enormous degree of parallelism. The BG/L program is developing a peak nominal 180 TFLOPS (360 TFLOPS for some applications) supercomputer to serve a broad range of science applications. BG/L generalizes QCDOC, the first System-On-A-Chip supercomputer that is expected in 2003. BG/L consists of 65,536 nodes, and contains five integrated networks: a 3D torus, a combining tree, a Gb Ethernet network, barrier/global interrupt network and JTAG.

This paper gives an overview of the BlueGene/L Supercomputer. This is a jointly funded research partnership between IBM and the Lawrence Livermore National Laboratory as part of the United States Department of Energy ASCI Advanced Architecture Research Program. Application performance and scaling studies have recently been initiated with partners at a number of academic and government institutions,including the San Diego Supercomputer Center and the California Institute of Technology. This massively parallel system of 65,536 nodes is based on a new architecture that exploits system-on-a-chip technology to deliver target peak processing power of 360 teraFLOPS (trillion floating-point operations per second). The machine is scheduled to be operational in the 2004-2005 time frame, at price/performance and power consumption/performance targets unobtainable with conventional architectures.

This paper describes strategies and techniques used to diagnose failures in the IBM 600 MHz G5 (Generation 5) CMOS microprocessor and associated cache chips. Time-to-market pressure demands quick diagnostic turnaround time while the complexity, density, cycle time, and technology issues of the hardware increase the difficulty of diagnosis. Since G5 first silicon, intense diagnostics and physical failure analysis (PFA) have successfully identified the root cause of many failures, including examples of process, design, and random manufacturing defects. This success is attributed to the three techniques described in this paper. For each technique, an example is presented to demonstrate its effectiveness.

Technological advances such as flip-chip packaging, multiple hierarchical wiring planes, and ultra-high frequencies reduce the effectiveness of conventional diagnostic techniques. It has recently been demonstrated that light pulses emitted during circuit switching can be used to characterize the behaviour of integrated circuits. In this paper, a new method of circuit characterization using this technique is described. An example of the diagnosis of a timing failure caused by a resistive path to a single transistor is described.

This paper describes the test tool methodology used for the IBM S/390 microprocessor. An efficient, effective, and automated process providing correct-by-construction test pattern generation, an effective test pattern set, and diagnostics were required. This paper explains the techniques used to accomplish this along with explaining why the method was chosen and how it helped expedite the process.

In this paper, fundamental principles of design of position/force controller for robot manipulators executing constrained task are enunciated. The principles are based on stability considerations, and are addressing the dynamic interaction between position and force subcontrollers. The principles could serve as design guidelines that would guarantee overall stability and reduction of the interactions between the subcontrollers. The concept of consistency introduced in this paper forms the cornerstone of proper implementation of position/force (P/F) controllers, in terms of reduction of the interaction between the two subcontrollers. The principle of consistency indicates that the direct interaction is canceled via the design of a stable P/F controller, however the indirect interaction can only be removed if a Jacobian condition is satisfied, independent of the subcontrollers design.