Modern integrated circuits used in automotive, industrial, consumer, and IoT (Internet of Things) applications often have limited pin counts. Despite this, these devices can be complex, with significant digital and analog content. These features require rigorous testing to address the quality and reliability requirements of these applications. Because of their limited pin count, a TAP controller interface is often not an option or the TAP controller interface itself may not be an option for other reasons, such as die area. Further, the increasing number of IP based designs, along with the increasing availability of IP cores can result in an IP being integrated deep inside a design. Designers, DfT engineers, and test engineers are facing increasing challenges with the integration and testability of IP in their chips. They also have the task of having to test through interfaces that may change depending on the needs of the customers. IEEE P1687.1 is working on processes that will provide a means for automating communications through non-TAP interfaces, making these types of products ideally suited for the techniques currently under consideration for standardization. This paper, reviews the latest topics being discussed by the working group, including the framework for communicating through these interfaces. It discusses how proto buffers (protobufs) can be used to help bridge the gap between a host controller, like an ATE, and an IJTAG network. The approach leverages the concept of Remote Procedural Calls (RPCs) from the IT space and the integer bit vector (intbv) concept from myHDL to support communications through interfaces and between subroutines handling retargeting and handling control of the interface. A model is presented for evaluating the options and various criteria are reviewed with respect to the framework. The paper also explores debug concerns and potential security issues and how those can be addressed.

Many modern devices have a very limited number of digital pins, yet they are often quite complicated internally. These ICs can't afford the luxury of a traditional JTAG TAP controller and the associated 4 or 5 extra pins. Nonetheless, these devices often contain significant digital and analog content. This complexity makes testing very challenging. Moreover, IP-based design often results in having an instrument buried deep inside a device, the access of which requires transitioning through multiple interfaces and controllers. This is exactly the situation DfT and test engineers face when designing and implementing tests for embedded IP. Techniques proposed for IEEE P1687.1 enable an automated mechanism for retargeting tests through a variety of non-TAP interfaces. This makes these products ideal candidates for IJTAG and IJTAG.1 test strategies. In this paper, we focus on demonstrating how on-chip test functions and IP can be successfully controlled and observed through non-TAP interfaces by controlling data flow using RVF (Relocatable Vector Format) and callbacks. This unique and novel approach ensures tool interoperability and allows tools to model interfaces in the same way, without requiring special descriptions for each one. The paper proposes an automated tool flow for retargeting the tests and provides example implementations on several specialized designs including I2C, an In-System TAP, IEEE 1149.7like interface, and a security block.

The term CyberSecurity means many different things to many people - some think of data security, some think of identity protection, some think of intrusion attacks on the internet or USB ports. In reality, CyberSecurity represents any type of attack on computing machines. One of the type of attacks that is often overlooked are attacks by the supply chain to inject malfeasant circuitry into semiconductor devices as they are made. This is the one aspect of Design-for-Security and Design-for-Trust that is usually ignored. This innovative practice session will highlight three talks on hardware CyberSecurity attacks and defenses from both industry and academia.

The IEEE 1687-2014 standard introduced the concept of portable, retargetable tests for digital circuits and taught how to apply them via a JTAG Test Access Port. Two follow-on standardization efforts address the topics of portable, retargetable analog tests (IEEE P1687.2) and applying analog or digital tests via non-TAP interfaces (IEEE P1687.1). IEEE P2427 complements these efforts by defining how to measure and report coverage of analog tests. This session will use a running example to show how all three initiatives play together.

The IP session focuses on using Machine Learning (ML) techniques on several emerging applications. The first contribution discusses hotspot detection by using ML. The second presentation then talks a data-driven health monitoring solution. The last contribution discusses using ML to emulate hardware Trojans.

The number of on-chip embedded instruments required for testing, debugging, and monitoring integrated circuits (ICs) has increased dramatically. The IEEE 1687 (IJTAG) standard can allow efficient access to these embedded instruments by dynamically reconfiguring the scan chain using Segment Insertion Bits (SIBs). Unfortunately, instruments that require a large amount of test data and several accesses during test mode still result in long test times when the test data is shifted through the scan path serially. To provide high bandwidth access to the embedded instruments, we describe a SIB-based Parallel-IJTAG network architecture that can significantly reduce test times. The SIB programming access time overhead is equal to that of the corresponding serial network. Different ways of implementing Parallel-SIBs (P-SIBs) and the security implications of a Parallel-IJTAG network are explored. We show that despite the increased bandwidth of the scan path, the security provided by Locking SIBs can be maintained in a parallel network. For example, the expected amount of time for successful random brute force attacks on Locking Parallel SIBs of sufficient key sizes is over 12,000 years.

In this paper, we describe the use of manufacturing scan-based vectors to structurally assess the frequency of any given semiconductor design, as opposed to the complex and costly effort of creating a functional set of vectors that can actually exercise all of the functions needed to accurately determine if the chip really operates at its rated or advertised frequency. Structural techniques reduce the problem to one of a finite measureable and deterministic set of tests whereas functional vectors can be somewhat subjective unless analyzed, simulated and assessed. The techniques developed and described here were developed on microprocessor designs and were then expanded to cover the general case of an ASIC, SoC, and even FPGA by using static timing analysis, automatic test pattern generation (ATPG) against a path-delay fault model, path selection from STA and using path filtering to eliminate false-paths that would result in an incorrect frequency assessment.

Today's chips often contain a wealth of embedded instruments, including sensors, hardware monitors, built-in self-test (BIST) engines, etc. They may process sensitive data that requires encryption or obfuscation and may contain encryption keys and ChipIDs. Unfortunately, unauthorized access to internal registers or instruments through test and debug circuitry can turn design for testability (DFT) logic into a backdoor for data theft, reverse engineering, counterfeiting, and denial-of-service attacks. A compromised chip also poses a security threat to any board or system that includes that chip, and boards have their own security issues. We will provide an overview of some chip and board security concerns as they relate to DFT hardware and will briefly review several ways in which the new IEEE 1687 standard can be made more secure. We will then discuss the need for an IEEE Security Standard that can provide solutions and metrics for providing appropriate security matched to the needs of a real world environment.

Today's chips often contain a wealth of embedded instruments and data, including sensors, hardware monitors, built-in self test (BIST) engines, and chip IDs, among others. IEEE P1687 was specifically designed to provide access to such instruments in an efficient manner, and some companies are already implementing the proposed standard on their chips. However, while instruments provide valuable information and features to authorized users who need to harness them for test, debug, diagnosis, and possibly counterfeit detection, it may be desirable to restrict unauthorized access to certain instruments through the P1687 network. Previous work proposed replacing some of the segment insertion bits (SIBs), which add scan path segments in a P1687 network, with locking SIBs (LSIBs). LSIBs use the data that is naturally scanned through the network as keys to hide instruments from attackers. However, that previous work did not investigate many of the techniques and structures that can be used to significantly increase the time an attacker is likely to need to unlock LSIBs and gain access to hidden instruments. In this work, we explore some of these techniques and show how simple modifications to a P1687 network protected with LSIBs can significantly increase the difficulty an attacker faces in attempting to access protected instruments.

Circuit boards are especially vulnerable to security attacks. Many routes and pins can be probed directly. Other pins may be controlled and observed through the JTAG boundary scan port. The JTAG port may also provide access to each chip's internal scan chains. Furthermore, modern chips may include embedded instruments that can be accessed through the chip's JTAG port and an internal IEEE P1687 scan network. If accessed by an attacker, these instruments may allow data to be leaked from the chips themselves or allow the attacker to drive other chips on the board. Finally, FPGA firmware is often stored in on-board memories and must be protected to prevent IP theft. In this paper, we describe some of the security issues facing boards. We then describe new chip access protocols that harness the use of licensed software and locking segment insertion bits (LSIBs) for secure Chip ID extraction. These methods enable authorized access while helping to prevent unauthorized access and counterfeiting of chips and IP on the board.

With shrinking geometries of PCBs, increasing interface speeds and corresponding loss of test point access to diagnose structural test defects, new standard test mechanisms are needed to test chip-to-chip connectivity and functionality at the board level. New requirements for an integrated circuit `BA' (Board-Assist) BIST to structurally test these interfaces will be presented. A standardized BA-BIST template and algorithms for industry leverage are proposed.

IEEE P1687 is a valuable tool for accessing on-chip instruments during test, diagnosis, debug, and board configuration. However, most of these instruments should not be available to an end user in the field. We propose a method for hiding instruments in a P1687 network that utilizes a “locking” segment insertion bit (LSIB) that can only be opened when pre-defined values, corresponding to a key, are present in particular bits in the chain. We also introduce “trap” bits, which can further reduce the effectiveness of brute force attacks by permanently locking an LSIB when an incorrect value is written to the trap's update register. Only a global reset will allow the LSIB to become operable again. In this paper, we investigate the cost and effectiveness of LSIBs and traps in several different configurations and show that these relatively small modifications to the P1687 network can make undocumented instrument access exceedingly difficult.

Testpoint erosion, the continuously increasing loss of physical net/node access at the In-Circuit Test process step is putting board test strategies at risk [1]. In response, the International Electronics Manufacturing Industry (iNEMI) [2] 2009 road map and gap analysis [3] efforts launched a Technology Integration Group (TIG) ‘Built-in Self-Test Project’ or ‘BIST projecty’ [4] to drive a new test strategy. Integrated Circuit (IC) BIST was identified as a solution and the electronics industry was surveyed to ratify the decision. After analysis of the survey, the TIG determined that a two-tier strategy was needed. This paper presents key survey findings and the two tier strategies for both the long and short term to identify standardization requirements for IC BIST usage at the board-level.

The use of embedded test instrumentation in ASIC designs has changed dramatically over the last decade. This is due to a variety of forces that affect the semiconductor industry. Unfortunately, processes surrounding test creation and validation this instrumentation has become significantly more complicated in recent years. IEEE P1687, which is now nearing completion and ballot, addresses these issues and makes the access and control of embedded instruments nearly automatic. This poster session will illustrate the latest innovations in the standard.

Modern semiconductor designs include an incredible amount of embedded logic in the name of DFx (which is largely comprised of design-for-test, design-for-debug, and design-for-yield content and will be called "instruments" in this paper). Most of this logic has the IEEE 1149.1 (JTAG) Test Access Port (TAP) and the JTAG TAP Controller as its primary access mechanism or, if not the primary, as one of its access mechanisms. The IEEE P1687 (IJTAG) Working Group is working to create a standard to deal with the "instrument" interfaces and optimal connection schemes. Part of that effort includes dealing with legacy logic and what some users have claimed are inefficient 1149.1 embedded logic connection schemes. This paper explores the advantages and efficiencies of restricting the instrument interfaces and connection scheme to exclude most legacy schemes.

There have been numerous attempts at adding ring-oscillator counters to measure IR-Drop on chips. The difficulty with this approach has been that any reading of the ring count always combined the effects of Temperature and Voltage versus Voltage only reading. The technique relied primarily on the fact that temperature effects take a long time to affect the ring-oscillator counter value. This paper will validate this premise by using two identical ring-oscillator counters next to each other but powered by two separate power supplies. One ring-oscillator counter will be connected to the core under test, the second ring-oscillator counter will be connected to a clean supply. By comparing the different readings, we can accurately remove temperature from the ring-oscillator counter reading and arrive at an accurate IR-Drop measurement.

In recent times, the 1149.1 TAP and TAP controller have begun to play a more important role in accessing embedded logic that is not specifically limited to 1149.1's scope as a board-test standard. This logic, referred to by the generic term instruments, includes manufacturing test and design-for-test (DFT) logic; design-for-debug/diagnosis (DFD) logic; design-for-yield (DFY) logic and monitors; and in-system verification logic (such as hardware assertions). The P1687 IJTAG standard working group was created to investigate formalizing and standardizing this use of the 1149.1 controller - and after a little more than a years worth of effort has produced a hardware architecture proposal that is currently being used as a strawman to investigate and develop the description and protocol language effort.

Many modern designs have transient and localized failures which can be attributed to excessive instantaneous power consumption known as di/dt or IR drop. IR drop is problematic because power rails may not be sized correctly for the load they must handle in both function and test, and so there might be localized "hot spots". The current technique for mitigating this issue is at design time, when the power rails are analyzed using tools attempting to predict the actual current spikes and limiting their effect on device performance. This paper describes a methodology using on-chip process monitoring circuits to help identify and localize IR drop "hot spots". This methodology utilizes a circuit that is easy to integrate on chip and use in a production environment. Furthermore, a comparison between the predicted IR drop and the actual was presented

The effort to standardize a methodology for accessing embedded instrumentation as IEEE PI687 continues to progress. This paper captures the current state of mind of the IJTAG working group with respect to the framework built to date and presents a discussion of other issues on which decisions are pending. The key elements of an architectural description language, a procedural language, and a hardware interface scheme are all taking shape, but still have many details to complete. Since this is a snapshot taken during the standard development process, the final form of the draft standard may differ from what is described here; any feedback to the working group is welcome

The widespread use of the IEEE 1149.1 standard test access port as the interface for not only boundary scan but also for access to device-internal test features has led to a highly useful but highly fragmented opportunity for the test community. The need for a standard description of internal test features and protocols is elucidated, and the framework for the extension of the boundary scan standards as launched by the ad hoc IJTAG working group is described

Recently, low cost and desktop structural testers have become popular for various reasons. Although originally aimed at reducing production test costs, they have quickly migrated to other niches and have proven useful in reducing not only cost, but time-to-market. Tracking the "use" spaces has resulted in identifying three clearly different areas of application: design-desktop, correlation-lab, and the production-test floor. These spaces have defined tasks such as characterization, first silicon bring-up, test program development, yield-learning diagnosis, and production probe, some of which be described as case studies.

In today's large designs, especially large SOC (system-on-a-chip) designs, vector volume for a single core could dominate the memory resources of the target tester and leave little or no room for other vectors. To this end, delivery of an "optimized" or "reduced" vector set, without any loss of coverage, is preferred. One commercial means of delivering an optimized vector set is to compress the vectors during vector generation. Another applicable solutions to understand the overlapping faults among various fault models and remove them from the fault lists for certain pattern types. The main problem with these optimization approaches is that compressed vectors create more switching activities, which could potentially cause average power dissipation, instantaneous and peak power during test to be significantly higher than normal operation. Test power is such a big concern in large SOC designs that the power associated with the "reuse" vectors must be understood. This paper presents a case study of a Motorola Version 3 ColdFire(R) microprocessor core, with a focus on the various vector optimizations and their ramifications on test power.

A description of the DFT and test challenges faced, and the solutions applied, to the newest member of the ColdFire/sup (R)/ microprocessor family, the MCF5307, is described. The MCF5307 is the first member of the family to have on-chip, PLL-sourced, dual clock domains where the bus interface and the internal core microprocessor operate at different, but selectable, frequency ratios; and the internal microprocessor core of the MCF5307 was designed as a separate stand-alone core that contained multiple embedded memory arrays. The DFT challenges and solutions described involve the development of the at-speed AC scan test architecture and scan vectors in a multiple clock domain environment; the application of memory BIST to multiple embedded memories in a cost effective manner; and the handling of an on-chip PLL clock source.

A case study of the development of the design for test methodology of the second generation of the ColdFire/sup R/ Microprocessor Family is described from the viewpoint of goals, initial strategy and implementation. Methodology includes at-speed scan path design, path delay testing, I/sub DDQ/ and direct access test modes for embedded memories. Scan tests are applied with timing identical to that specified for peak performance normal operation.

This report describes the testability design goals, constraints, and strategies used in the development of the MC68060 microprocessor. It explores the design choices that were made and the considerations that led to those choices. It presents the architectures and methodologies used to implement the design choices, and ends by describing the successes, failures, and future refinements of the test methodologies and architectures.

The requirements of a low power mode, built into complex VLSI IC's such as microprocessors, seem to conflict with the IEEE 1149.1 Standard (JTAG). The perception that the TAP Pins-T~R~S~T~, TMS, and TDI-must be equipped with power-consuming pullup resistors or that low power and 1149.1 modes of operation are mutually exclusive is erroneous. Certain techniques can be used during the design and implementation of the TAP and the TAP controller that will allow the IC to enter low power mode without interference or unnecessary power consumption from the JTAG logic and will allow JTAG operations during low power mode while maintaining full compliance to the 1149.1 standard.

Conventional logic devices incorporating boundary scan with the proposed IEEE P1149.1 interface have been shown to offer great improvements in board testing. These improvements are contrasted with traditional approaches for the design verification, debugging, and testing of a prototype system. The incorporation of boundary scan has been demonstrated to impose a minimal real estate overhead and change the process of design verification and testing making it beneficial to both the design engineer and test engineer. The use of devices incorporating boundary scan will reduce the cost of testing. By using the devices that support the P1149.1 architecture in the prototype system considered, some of the problems and questions associated with the verification and testing of prototype systems (or even production systems) were solved. In addition to solving the problems, the verification and testing processes were simplified.>