We describe a method for finding security flaws in source code by way of static analysis. The method is notable because it allows a user to specify a wide range of security properties while also leveraging a set of predefined common flaws. It works by using an automated theorem prover to analyze verification conditions generated from C source code and a set of specifications that define security properties. We demonstrate that the method can be used to identify real vulnerabilities in real programs.

Diagnostic fault simulation can generate enormous amounts of data. The techniques used to manage this data can have significant effect on the outcome of the fault diagnosis procedure. We first demonstrate that if information is removed from a fault dictionary, its ability to diagnose unmodeled faults may be severely curtailed even if dictionary quality metrics remain unaffected; we, therefore, focus on methods for producing small, lossless dictionaries, We present a new dictionary organization based on error sets, which is amenable to standard data-compression techniques. We compare several dictionary organizations and the effect of standard data-compression techniques on each of them. An appropriate organization and encoding makes dictionary-based diagnosis practical for very large circuits.

Published approaches to fault diagnosis almost always assume the existence of an ideal environment: a sterile room where faults always behave according to their textbook definition, test patterns always propagate errors the way they are supposed to, and tester measurements are never wrong. Such an environment is clearly a fantasy. The starting point for diagnosis is that something has gone wrong; the behavior of a real silicon defect does not necessarily follow the strictures of any idealized fault model. In order to make fault diagnosis more successful, do we need to change the way circuits are designed? I say no-design-for-test techniques meet the needs of diagnosis. Instead of design-for-debug, we need to replace our assumption of ideal behavior with realistic expectations and robust techniques.

Previously-proposed strategies for VLSI fault diagnosis have suffered from a variety of self-imposed limitations. Some techniques are limited to a specific fault model, and many will fail in the face of any unmodeled behavior or unexpected data. Others apply ad-hoc or arbitrary scoring mechanisms to fault candidates, making the results difficult to interpret or to compare with the results from other algorithms. This paper outlines an approach to fault diagnosis that is robust, comprehensive, extendable, and practical. By introducing a probabilistic framework for diagnostic prediction, it is designed to incorporate disparate diagnostic algorithms, different sets of data, and a mixture of fault models into a single diagnostic result. Results from diagnosis experiments on a Hewlett-Packard ASIC and FIB inserted defects are presented.

Automated fault diagnosis based on the stuck-at fault model is not always effective. This paper presents practical experiences in applying a bridging fault based diagnosis technique to a TI ASIC design. Results are presented for units into which known bridging defects have been introduced via a focused ion beam (FIB) machine.

We describe a system for simulating and generating accurate tests for bridging faults in CMOS ICs. After introducing the Primitive Bridge Function, a characteristic function describing the behavior of a bridging fault, we present the Test Guarantee Theorem, which allows for accurate test generation for feedback bridging faults via topological analysis of the feedback-influenced region of the faulty circuit. We present a bridging fault simulation strategy superior to previously published strategies, describe the new test pattern generation system in detail, and report on the system's performance, which is comparable to that of a single stuck-at ATPG system. The paper reports fault coverage as well as defect coverage for the MCNC layouts of the ISCBS-85 benchmark circuits.

Successful failure analysis requires accurate fault diagnosis. This paper presents a method for diagnosing bridging faults that improves on previous methods. The new method uses single stuck-at fault signatures, produces accurate and precise diagnoses, and takes into account imperfect fault modeling; it accomplishes this by introducing the concepts of match restriction, match requirement, and match ranking.

Effective bridging fault diagnosis requires reducing the (/sub 2//sup n/) number of bridging faults to a handful of candidates. A preliminary step can reduce the O(n/sup 2/) candidates to a manageable O(n) candidates by using layout information to eliminate those bridging faults that are very unlikely to be shorted together. This step removes from consideration those faults that match the fault signature but are physically impossible. However, sometimes-perhaps due to issues of intellectual property or because the degree of information stored about a circuit changes over its lifecycle-the physical design of the circuit is not available, and the number of nodes is too large to explicitly consider all pairs. In this paper we present two ways to provide successful diagnoses without access to physical information. The second method produces optimal diagnoses under our ranking criteria. Either technique can be used in conjunction with information extracted from the physical design to allow for diagnoses of much larger circuits than previously possible.

Physical defects cause behaviors unmodeled by even the best fault simulators, which complicates predictive diagnosis. This paper reports on a diagnosis procedure that uses modified composite signatures constructed from single stuck-at information combined with a lexicographic matching and ranking algorithm. The diagnosis procedure is used to perform high-quality bridging fault diagnosis for more than 400,000 diagnostic experiments involving dropping or adding behaviors from the simulations of faulty circuits.

Precise failure analysis requires accurate fault diagnosis. A previously proposed method for diagnosing bridging faults using single stuck-at dictionaries was applied only to small circuits, produced large and imprecise diagnoses, and did not take into account the Byzantine Generals Problem for bridging faults. We analyze the original technique and improve it by introducing the concepts of match restriction, match requirement, and failure recovery. Our new technique, which requires no information other than that used by standard stuck-at methods, produces diagnoses that are an order of magnitude smaller than those produced by the original technique and produces many fewer misleading diagnoses than that of traditional stuck-at diagnosis.

It is assumed that tests generated using the single stuck-at fault model will implicitly detect the vast majority of fault-causing defects within logic elements. This may not be the case. In this paper we characterize the possible shorts in the combinational cells in a standard cell library. The characterization includes errors on the cell outputs, errors on the cell inputs, and excessive quiescent current. The characterization provides input vectors to stimulate these errors. After characterizing the faults that occur due to possible electrical shorts, we compare the coverage of the logic faults using a single stuck-at test set and tests developed specifically to detect these shorts. We discuss the effectiveness of I/sub DDQ/ testing for these faults.

Compares the accuracy, speed and applicability to test generation of existing bridge fault modeling solutions. The authors identify some previously undiscussed anomalous circuit behaviors, and describe the extent to which they affect bridge fault simulation and testing. Finally, they present a system for evaluating bridge fault models in a test generation environment, and present an experiment that provides an assessment of how defect coverage can be affected by a generating and checking model.>

Afier introducing the Primitive Bridge Function, a characteristic function describing the behavior of bridged components, we present a theorem for detecting feedback bridge faults.We discuss two diflerent methods of bridge fault simu- lation, one of which is new, and present experimental results relating the relative eficiency of the two njethods.We conclude that the new simulation method, Wire Memory bridge fault simulation, is more e#icient-especially for larger circuits.