International audience

The shift towards data-centric computing paradigms has given rise to new architectural approaches aimed at minimizing data movement and enhancing computational efficiency. In this context, In-Memory Computing (IMC) architectures have gained prominence for their ability to perform processing tasks within the memory array, reducing the recourse to data transfers. However, the susceptibility of these new paradigms to manufacturing defects poses a critical test challenge. This paper presents a novel March-like test algorithm for 8T SRAM-based IMC architectures, addressing the imperative need for comprehensive read port related defect coverage. The proposed algorithm achieves complete coverage of potential read port defects while maintaining the level of complexity equivalent to existing state-of-the-art test solutions.

Due to the globalization of the semiconductor industry, Integrated Circuits (ICs) and Intellectual Properties (IPs) are susceptible to specific threats. IP piracy, overproduction, and introduction of hardware Trojans can indeed compromise valuable design information and trust in the design flow. Logic Locking (LL) is one of the most popular Design-for-Trust techniques that aims to thwart these threats because of the wide range of risks it can prevent. This approach evolves from year to year in order to make it resistant to ever more advanced attacks. While most advanced LL solutions are assumed to be resistant against differential power analysis (DPA), we propose a new attack framework for challenging these approaches and show on several benchmarks that it is possible to reveal more than 88% of the key bits used for locking the designs thanks to DPA.

The adoption of In-Memory Computing (IMC) architectures is one of the promising approaches to efficiently solve the Von Neumann bottleneck problem. In addition to arithmetic operations, IMC architectures aim at integrating additional logic operations directly in the memory array or/and at the periphery for saving time and power consumption. In this paper, a comprehensive model of a 128x128 bitcell array based on a 28nm FD-SOI process technology has been considered to analyze the behavior of IMC 8T SRAM bitcells in the presence of resistive-open defects injected in the read port. A hierarchical analysis including a detailed study of each defect was performed in order to determine their impact both in memory and computing modes, both locally on the defective bitcell and globally on the array. Experimental results show that the IMC mode offers the most effective detectability of resistive-open defects.

A digital finite impulse response (FIR) filter is a ubiquitous block in digital signal processing applications and its behavior is determined by its coefficients. To protect filter coefficients from an adversary, efficient obfuscation techniques have been proposed, either by hiding them behind decoys or replacing them by key bits. In this article, we initially introduce a query attack that can discover the secret key of such obfuscated FIR filters, which could not be broken by the existing prominent attacks. Then, we propose a first of its kind hybrid technique, including both hardware obfuscation and logic locking using a point function for the protection of parallel direct and transposed forms of digital FIR filters. Experimental results show that the hybrid protection technique can lead to FIR filters with higher security while maintaining the hardware complexity competitive or superior to those locked by prominent logic locking methods. It is also shown that the protected multiplier blocks and FIR filters are resilient to existing attacks. The results on different forms and realizations of FIR filters show that the parallel direct form FIR filter has a promising potential for a secure design.

As any other circuits, secure devices need to be tested to ensure their reliability. Nevertheless, test infrastructures, such as JTAG or scan chains, can maliciously be used to steal secret data stored or processed in secure devices. In this paper, we explore a lightweight solution to protect JTAG access based on a challenge-response authentication protocol. A JTAG-authentication dedicated IP is presented. Design alternatives for quick IP plug-and-play, security, area and test time optimization are presented and evaluated.

Secure devices embed analog sensors in order to measure some physical/environmental parameters which can alter its behavior such as temperature, voltage and electromagnetic field. To ensure the device security all along its lifetime, it is necessary to rely on those analog sensors. Consequently, test solutions must be designed and proceed at each step of the system life cycle, considering inherent constraints of each cycle, i.e., absent or defective software in the chip or chip in user's hand for example. In this paper, we present a plug and play digital ABIST controller which allows to run external or internal autonomous built-in self-test phases on a temperature sensor used as case study. The external test mode is fully compliant with the IEEE Std. 1149.1 while the internal test one is controlled by the embedded CPU through a system bus.

This paper presents a high-level circuit obfuscation technique to prevent the theft of intellectual property (IP) of integrated circuits. In particular, our technique protects a class of circuits that relies on constant multiplications, such as neural networks and filters, where the constants themselves are the IP to be protected. By making use of decoy constants and a key-based scheme, a reverse engineer adversary at an untrusted foundry is rendered incapable of discerning true constants from decoys. The time-multiplexed constant multiplication (TMCM) block of such circuits, which realizes the multiplication of an input variable by a constant at a time, is considered as our case study for obfuscation. Furthermore, two TMCM design architectures are taken into account; an implementation using a multiplier and a multiplierless shift-adds implementation. Optimization methods are also applied to reduce the hardware complexity of these architectures. The well-known satisfiability (SAT) and automatic test pattern generation (ATPG) based attacks are used to determine the vulnerability of the obfuscated designs. It is observed that the proposed technique incurs small overheads in area, power, and delay that are comparable to the hardware complexity of prominent logic locking methods. Yet, the advantage of our approach is in the insight that constants - instead of arbitrary circuit nodes - become key-protected.

Systems on a chip have seen their surface area increased by a factor of 10 and their consumption multiplied by 5 during the last ten years. Each technological node that enabled this integration has also added new constraints challenging the overall system reliability. In addition, the integration of analog/RF blocks adds specific issues, in particular the high cost of the required test equipment. It is therefore necessary to improve test and reliability solutions in order to guarantee the production yield and the system life-time. Moreover, the massive increase in the use of communicating systems has introduced security as a cornerstone of their development. The entire hardware production flow is therefore subject to security and trust issues requiring the development of dedicated test solutions. In this paper, we focus on LIRMM contributions in the HADES project especially with details on Embedded Test Instruments (ETIs) for reliability of digital ICs, low-cost RF test based on indirect DC measurements or digital ATE capture, management of secure scan access.

The globalized supply chain in the Integrated Circuit (IC) industry raises several security concerns such as overproduction, IP piracy and Hardware Trojan insertion. Logic locking has emerged as a potential countermeasure to address these issues. However, its efficiency is challenged by various attacks, especially oracle-guided attacks based on Boolean Satisfiability (SAT) solvers. These attacks rely on the possibility for an attacker to control and observe in the field the internal state of a functional IC, which acts as an oracle. This ability to control/observe the IC states is offered by scan chains, typically used for IC production testing. In this paper, we propose a method, complementary to logic locking, to prevent such attacks. This method introduces a scan chain controller with a key-based authentication mechanism, in order to prevent unauthorized access to the scan chains once the IC is deployed in the field. The solution can be coupled with any logic locking technique at the cost of negligible area overhead. Furthermore, it is secure against state-of-the-art attacks and supports full testing.

Standard test infrastructures, such as IEEE Std. 1149.1 (JTAG), IEEE Std. 1500 and IEEE Std. 1687 (IJTAG), are widely used in nowadays Integrated Circuits (ICs). However, they pose an important security challenge to the designers because of the high controllability and observability they offer through the Test Access Port (TAP). For instance, malicious users can exploit test infrastructures in order to access the internal scan chains of crypto-cores and perform scan attacks. Moreover, these infrastructures connect all the devices of the system to the same network. For this reason, the data sent to a target device are potentially visible to all the others. Consequently, this poses a threat to the confidentiality of data content. The encryption of test data is a countermeasure that has been conceived in order to overcome these threats. In this paper, we propose a new secure version of the JTAG infrastructure, relying on stream-based encryption.

Scan attacks exploit facilities offered by scan chains to retrieve embedded secret data, in particular, secret keys used by the device for data encryption/decryption in mission mode. This paper presents a scan attack countermeasure based on the encryption of the data written to or read from the scan chains. The secret-key management system already embedded in the device is used to provide appropriate keys for encryption of data flowing on the scan chains. The goal of the proposed solution is to counteract the scan-related security threats while preserving test and diagnosis efficiency provided by conventional design-for-testability techniques, as well as to allow debugging capabilities in mission mode. The proposed solution can deal with both stuck-at and transition-faults test schemes as well as single and multiple scan chain configurations using test data compression schemes. We will show that the proposed scheme provides expected test/diagnostic and debug facilities as classical scan design with marginal impacts on area, test time and design flows, while successfully preventing control and observation of data flowing in the scan chains by unauthorized users.

S. Skorobogatov and R. Anderson identified laser illumination as an effective technique to conduct fault attacks in 2002. In these early days of laser-induced fault injection, it was proven to be possible to inject single-bit faults into integrated circuits. This corresponds to the more restrictive fault model found in the fault attack bibliography. The target area under laser illumination (a few micrometers, down to ~1 µm) broadly matched that of a single transistor. It was consistent with a single-bit fault model. However, since then the technology of secure devices has evolved. In current circuits even the smallest laser spots may illuminate several logic cells. This raises the question of the validity of the single-bit fault model: does it still hold? In this work, we report an assessment of its validity through experimental results obtained from circuits designed at the 28 nm CMOS technology node. We also describe the main properties of the corresponding fault model obtained from both static and dynamic experiments.

At first used to emulate the effects of radioactive ionizing particules passing through integrated circuits (ICs), laser illumination is also used to inject faults into the computations of secure ICs for the purpose of retrieving secret data. The CMOS FD-SOI technology is expected to be less sensitive to laser faults injection than the more usual CMOS bulk technology. We report in this work an experimental assessment of the interest of using FD-SOI rather than CMOS bulk to decrease laser sensitivity. Our experiments were conducted on test chips at the 28nm node for both technologies with laser pulse durations in the picosecond and nanosecond ranges.

Scan attacks exploit facilities offered by scan chains to retrieve embedded secret data, in particular secret keys used in crypto-processors for encoding information in such a way that only knowledge of the secret key allows to access it. This paper presents a scan attack countermeasure based on the encryption of the scan chain content. The goal is to counteract the security threats and, at the same time, to preserve test efficiency, diagnosis and debugging abilities. We propose to use the secret-key management policy embedded in the device under test in order to encrypt both control and observed data at test time. This solution does not require additional key management, provides same test/diagnostic and debug facilities as under classical scan design with marginal impacts on area and test time.

The development of cryptographic devices was followed by the development of so-called implementation attacks, which are intended to retrieve secret information exploiting the hardware itself. Among these attacks, fault attacks can be used to disturb the circuit while performing a computation to retrieve the secret. Among possible means of injecting a fault, laser beams have proven to be accurate and powerful. The laser can be used to illuminate the circuit either from its frontside (i.e., where metal interconnections are first encountered) or from the backside (i.e., through the substrate). Historically, frontside injection was preferred because it does not require the die to be thinned. Nevertheless, due to the increasing integration of metal layers in modern technologies, frontside injections do not allow targeting of any desired location. Indeed, metal lines act as mirrors, and they reflect and refract most of the energy provided by the laser beam. Conversely, backside injections, although more difficult to set up, allow an increase of the resolution of the target location and remove the drawbacks of the frontside technique. This article compares experimental results from frontside and backside fault injections. The effectiveness of the two techniques is measured in terms of exploitable errors on an AES circuit (i.e., errors that can be used to extract the value of the secret key used during the encryption process). We will show, conversely to what is generally assumed, that frontside injection can provide even better results compared to backside injection, especially for low-cost beams with a large laser spot.

This paper presents an original solution to the test scheduling problem for 3D stacked integrated circuits. We explore a session-less approach where the test procedure of any core can start at any time as long as Test Access Mechanisms (TAMs) are available and constraints in terms of power and thermal limits are respected. Given a set of test procedure with fixed length and a set of test resources (TAM width), we determine test procedure start times such that the system test time is minimized. The proposed greedy heuristic is applied on fully detailed benchmarks and is compared with solutions obtained from session-based approaches. The results show that the session-less solutions outperforms the session-based ones. This is so even though the session-based solution is optimal, which is generally not the case for scheduling solutions resulting from heuristics used for dealing with large systems.

Hardware piracy is a threat that is becoming more and more serious these last years. The different types of threats include mask theft, illegal overproduction, as well as the insertion of malicious alterations to a circuit, referred to as Hardware Trojans. To protect circuits from overproduction, circuits can be encrypted so that only authorized users can use the circuits. In this paper, we propose an encryption technique that also helps thwarting Hardware Trojan insertion. Assuming that an attacker will attach a Hardware Trojan to signals with low controllability in order to make it stealthy, the principle of the encryption is to minimize the number of signals with low controllability.

Laser is an effective mean to inject faults in a secure circuit and then to perform a subsequent fault attack. While high-precision laser beams are very expensive, a large-spot laser is far more affordable and easier to set-up for fault injection. In this paper, we discuss hardware countermeasures against laser-induced fault attacks and we propose a new laser detector based on customized logic gates. This detector is smaller and more sensitive than most standard cells. According to simulation results, it is very effective in detecting large spot laser attacks.

Lasers have become one of the most efficient means to attack secure integrated systems. Actual faults or errors induced in the system depend on many parameters, including the circuit technology and the laser characteristics. Understanding the physical effects is mandatory to correctly evaluate during the design flow the potential consequences of a laser-based attack and implement efficient counter-measures. This paper presents results obtained within the LIESSE project, aiming at defining a comprehensive approach for designers. Outcomes include the definition of fault/error models at several levels of abstraction, specific CAD tools using these models and new counter-measures well-suited to thwart laser-based attacks. Actual measures on components manufactured in the new 28 nm FDSOI technology are also presented.

In this paper we present a BIST method for TSV pre-bond testing. A dedicated test circuitry per TSV is designed and simulated w.r.t a variety of defects and PVT variations. Based on discharge delay evaluation, the BIST scheme supports concurrent testing, requires small-area implementation and it is robust against PVT variations.

Hardware implementation of cryptographic algorithms is subject to various attacks. It has been previously demonstrated that scan chains introduced for hardware testability open a back door to potential attacks. Here, we propose a scan-protection scheme that provides testing facilities both at production time and over the course of the circuit's life. The underlying principles to scan-in both input vectors and expected responses and to compare expected and actual responses within the circuit. Compared to regular scan tests, this technique has no impact on the quality of the test or the model-based fault diagnosis. It entails negligible area overhead and avoids the use of an authentication test mechanism.

International audience

Structural testing is one important step in the production of integrated circuits. The most common DIT technique is the insertion of scan-chains, which increases the observability and the controllability of the circuit's internal nodes. Nevertheless, malicious users can use the scan chains to observe confidential data stored in devices implementing cryptographic primitives. Therefore, scan chains inserted in secure ICs can be considered as a source of information leakage. Several countermeasures exist to cope with this type of problem. However, they either introduce high area overheads or they require modifications to the original design or the test protocol. In this paper we present a smart test controller that is able to prevent all known scan attacks. The controller does not require any additional signals, it is transparent to the designer and it does not require any modifications of the test protocol and procedure. Moreover, it introduces a very small area overhead.

Scan chains insertion is the most common technique to ensure the testability of digital cores, providing high fault coverage. However, for ICs dealing with secret information, scan chains can be used as back doors for accessing secret data thus becoming a threat to system security. So far, advanced test structures used to reduce test costs (e.g., response compaction) and achieve high fault coverage (e.g., X's masking decoder) have been considered as intrinsic countermeasures against these threats. This work proposes a new generic scan-based attack demonstrating that these test structures are not sufficiently effective to prevent leakage through the test infrastructure. This generic attack can be easily adapted to several cryptographic implementations for both symmetric and public key algorithms. The proposed attack is demonstrated on several ciphers.

Hardware implementations of secure applications, e.g. cryptographic algorithms, are subject to various attacks. In particular, it has been demonstrated that scan chains introduced by Design for Testability open a backdoor to potential attacks. In this paper we propose a scan protection scheme that provides testing facilities both at production time and during the circuit's lifetime. The underlying principle is to scan-in both input vectors and expected responses, and to perform the comparison between expected and actual responses within the circuit. Compared to regular scan test, this technique has no impact on test quality and no impact on diagnostic of modeled faults. It entails a negligible area overhead and it avoids the use of an authentication test mechanism.

Standard Design for Testability (DfT) structures are well known as potential sources of confidential information leakage. Scan-based attacks have been reported in publications since the early 2000s. It has been shown for instance that the secret key for symmetric encryption standards (DES, AES) could be retrieved from information gathered on scan-out pins when scan-chains are fully observed through these pins. However DfT practices have progressed to adapt to large and complex designs such as test response compaction, associated X-masking structure, partial scan, etc. As a side effect, these techniques mask part of the information collected on scan outputs. Thus, at first glance, they may appear as countermeasures against scan-based attacks. Nevertheless, in this paper we show that DfT structures, regardless of their nature, do not inherently enhance security and that specific additional countermeasures are still needed. We propose a new-scan attack able to deal with designs where only part of the internal circuit's state is observed for test purpose.

Cryptographic devices can be subject to side-channel attacks. Among those attacks, Differential Power Analysis (DPA) has proven to be very effective and easy to perform. Several countermeasures have been proposed in the literature. However, the effectiveness of these counter measures is still evaluated by resort-ing to intensive DPA simulations and constitutes a very time-consuming design task. In this paper we show that the knowledge of the structure of the circuit can be exploited to improve performances of the DPA. We propose to realign power consumption traces according timing information (i.e., path delays). We show the usefulness of the proposed method by comparing the efficiency of classic DPA w.r.t. timing aware DPA.

The conflict between security and testability is still a concern of hardware designers. While secure devices must protect confidential information from unauthorized users, quality testing of these devices requires the controllability and observability of a substantial quantity of embedded information, and thus may jeopardize the data confidentiality. Several attacks using the test infrastructures (and in particular scan chains) have been described. More recently it has been shown how test response compaction structures provide a natural counter-measure against this type of attack. However, in this paper, we show that even in the presence of response compactors the scan-based attack is still possible and it requires low complexity computation. We then give some perspectives concerning the techniques that can be used to increase the scan-based attack complexity without affecting the testability of the device.1

Cryptographic algorithms are used to protect sensitive information when the communication medium is not secure. Unfortunately, the hardware implementation of these cryptographic algorithms allows secret key retrieval using different forms of attacks based on the observation of key-related information: physical information (side-channel attacks), faulty behaviors (fault-based attacks), or internal states (DFT-based attacks) for instance. Dedicated design for security techniques have been proposed so far, ranging from the development of specific cell libraries to the implementation of extra functions for preventing the leakage of useful information for key identification. On the other hand, users can expect high quality product for secure applications and this expectation requires the development of test solutions for every component of the secure device. However, testing those devices faces a double dilemma: (i) how to test and, possibly, develop design-for-testability schemes providing high testability (high controllability/observability) while maintaining high security (no leakage), (ii) how to provide high security using dedicated design rules while maintaining high testability. This tutorial will address these issues presenting the security weaknesses generated by classical DFT techniques, pros and cons of security-dedicated DFT, BIST and Fault tolerance solutions, and impact of design for security techniques on testability.

In nowadays technologies, circuits are more and more sensitive to aging phenomenon, as well as soft errors. Furthermore several attacks that used a fault to derive secret information have been demonstrated on cryptosystems. Concurrent fault detection is thus of prime interest for such systems. The purpose of this paper is to compare several code-based concurrent fault detection schemes dedicated to the hardware implementation of the Advanced Encryption Standard. The protection schemes under comparison are either directly issued from the literature, or built from several complementary solutions for protection of the full implementation. The evaluation of these schemes is performed in terms of costs with particular emphasis on fault injection vs errors detection capabilities.

Due to the shrinking of transistors dimensions in nowadays technologies, circuits are more and more sensitive to aging phenomenon, as well as soft errors. Furthermore cryptographic circuits are prone to fault attacks, which intend to retrieve secret data by mean of fault injection. Thus, concurrent fault detection is of prime interest for such crypto devices. The purpose of this paper is to compare several concurrent fault detection schemes dedicated to the hardware implementation of the advanced encryption standard. The schemes under comparison are directly issued from the literature or built from several complementary solutions. The evaluation of these schemes is performed in terms of costs and performance with particular emphasis on errors vs faults detection capabilities.

This paper describes a generic built-in self-test strategy for devices implementing symmetric encryption algorithms. Taking advantage of the inner iterative structures of crypto-cores, test facilities are easily set-up for circular self-test of the crypto-cores, built-in pseudorandom test generation and response analysis for other cores in the host device. Main advantages of the proposed test implementation are an architecture with no visible scan chain, 100% fault coverage on crypto-cores with negligible area overhead, availability of pseudorandom test sources, and very low aliasing response compaction for other cores.

In this paper we propose an on-line self-test architecture for hardware implementations of advanced encryption standard (AES). The solution assumes a parallel architecture and exploits the inherent spatial replications of this implementation. We show that our solution is very effective for on-line fault detection while keeping the area overhead very low. Moreover, it does not weak the device with respect to side-channel attacks based on power analysis.

Contact-based wafer testing of complex integrated systems presents several drawbacks: inherent limitations in terms of pad pitch reduction and number of devices tested in parallel, eventual "touchdown" damage to the chip when recursive test is required. This paper presents a solution based on a wireless communication between the test equipment and the device under test.

In this paper we propose an on-line fault detection architecture for bijective Substitution Boxes used in cryptographic circuits. Concurrent fault detection is important not only to protect the encryption/decryption process from random and production faults, it also protects the system against side-channel attacks, in particular those based on fault injection. We will prove that our solution is very effective while keeping the area overhead very low. Besides, we will analyze the correlation between the information processed by the circuit and the power consumption in order to asses the quality of the solution with respect to other side- channel attacks such as Power Analysis techniques.

Test Data Compression (TDC) techniques have been developed for reducing requirements in terms of Automatic Test Equipment resources. These techniques generally deal with stand alone circuits. In this paper, we explore the benefits of using TDC techniques in the context of core-based SoCs. TDC is used to reduce the test time by improving the parallelism of core tests without the expense of additional ATE channels. We first detail the constraints on test architectures and on the design flow inferred by the use of TDC. We propose a method for seeking an optimal architecture in terms of total test application time. The method is independent of the compression scheme used for reduction of core test data. The gain in terms of test application time for the SoC is over 50% compared to a test scheme without compression.

It has been proven that scan path is a potent hazard for secure chips. Scan based attacks have been recently demonstrated against DES or AES and several solutions have been presented in the literature in order to securize the scan chain. Nevertheless, the different proposed techniques are all ad hoc techniques, which are not always easy to integrate into a completely automated design flow or in an IP reuse environment. In this paper, we propose a scan chain integrity detection mechanism, which respects both automated design flow and IP reuse environment

Designing secure ICs requires fulfilling many design rules in order to protect access to secret data. However, these security design requirements may be in opposition to test needs and testability improvement techniques that increase both observability and controllability. Nevertheless, secure chip designers cannot neglect the testability of their chip; a high quality production testing is primordial to ensure a good level of security since any faulty devices could induce major security vulnerability. In this paper, we present different techniques securing the scan chain technique and compare them to point out their pros and cons

The authors' goal is to produce validation data that can be used as an efficient (pre) test set for structural stuck-at faults. In this paper, we detail an original test-oriented mutation sampling technique used for generating such data and we present a first evaluation on these validation data with regard to a structural test.

Designing secure ICs requires fulfilling many design rules in order to protect access to secret data. However, these security design requirements may be in opposition to test needs and testability improvement techniques that increase both observability and controllability. Nevertheless, secure chip designers cannot neglect the testability of their chip; a high quality production testing is primordial to ensure a good level of security since any faulty devices could induce major security vulnerability. In this paper, we propose to merge security requirements with testability ones in a control-oriented design for security scan technique.

We propose a method for reducing test data volume of integrated circuits or cores in a System-on-Chip. This method is intended to reduce the required number of Automatic Test Equipment (ATE) output channels compared to the number of scan-in input pins in a classical multi-chain implementation (horizontal compression). Compression and decompression are based on arithmetic operations and structures which present a very low area overhead. The proposed compression scheme does not impact the fault coverage achieved by the original test sequence before compression.

International audience

Summary form only given. This paper considers the test-scheduling problem of a SoC. The proposed approach is based on a "sessionless" test scheme. It minimizes the system test time while respecting a power dissipation limit and test resource sharing constraints. Experimental results show that our approach outperforms other related test scheduling solutions.

This paper proposes a method to select observation points and flip-flops for partial reset. The method does not target minimum DFT insertion but a maximum improvement on testability. The proposed non-scan approach allows a at-speed testing. Experimental results show that the method achieves 100% fault coverage and 100% fault efficiency for benchmark circuits while requiring less ATPG effort (CPU time) with no scan necessity.

Even if a datapath has been synthesized with testability in view, its testability may strongly decreases once it is connected to its controller. In this paper, we propose controller modifications for restoring the testability of the datapath to a level close to the initial one. Those modifications concern the next state logic as well as the decoder part of the controller. The method is based on the results of a testability analysis of the datapath at RT level and on finite automata theory.

This paper presents a method for deriving a BIST specification directly from the initial specification of datapath architectures. It minimizes BIST area overhead while guaranteeing user chosen fault coverage. The results show great improvements over lower level techniques.

This paper presents a method to carry out the register allocation phase of high level synthesis with testability considerations. Testability problems are identified and eliminated during this step turning testability/area trade-off to account. It allows one to decrease the cost related to the application of low-level DFT techniques.

Partial scan DFT is a commonly used technique for improving testability of sequential circuits while maintaining overhead as low as possible. In this context, the selection of the partial scan chain is usually performed at gate-level. In this paper, we present a method for quickly selecting the partial Scan Chain (SC) in datapath-like circuits. The so-obtained SC is such that the number of scan FFs is optimized and such that the achievable fault coverage is the same than with full scan approach.

In this paper, we present a high level synthesis method for partial scan designs. High level testability information are used to guide the synthesis process towards designs with a minimal number of scan registers. The maximal fault coverage is achievable for these designs. This method mainly leans on ad-hoc modifications of the register allocation process.

High level synthesis (HLS) is defined as a topdown translation from the behavioral domain to the structural domain where the circuit is represented by a set of connected storage elements and functional units for the datapath and a logic level specification of the corresponding control unit. Testing is a bottom up approach process aiming at detecting realistic faults. Realistic faults depend on the physical domain, the technology process data and on the geometry of inner structures (inductive fault analysis). HLS cannot solve all the testing problems, but it may facilitate solutions by providing easier control or observation of internal units. Furthermore, the so produced designs exhibit less area and speed penalties than those obtained by applying a posteriori DFT techniques on synthetized gate level descriptions.