Name of the Department where Registered : Electronics and Communication Engineering

Title of the Thesis Name of the Student : A RECONFIGURABLE LOGIC BIST ARCHITECTURE FOR SECURE TESTING OF VLSI CIRCUITS : Ramesh Bhakthavatchalu Year of Registration : 2009 Name of the Department where Registered : Electronics and Communication Engineering Name of the Thesis Advisor : Dr. Nirmala Devi M. Name of the School Name and Address of the University : Amrita School of Engineering : Amrita Vishwa Vidyapeetham Amrita Nagar P.O., Ettimadai, Coimbatore- 641112

Synopsis of the PhD Thesis A RECONFIGURABLE LOGIC BIST ARCHITECTURE FOR SECURE TESTING OF VLSI CIRCUITS by RAMESH BHAKTHAVATCHALU Department of Electronics and Communication Engineering Amrita School of Engineering Coimbatore 641 112, India October - 2015 1

1 Introduction The functionality of electronics equipments and gadgets has achieved a phenomenal growth over the last two decades while their physical sizes and weights have come down drastically. The major reason is due to the rapid advances in integration technologies, which enables fabrication of many millions of transistors in a single integrated circuit (IC) or chip. Every IC in the industry follows Moore s law. According to Moore s law, number of transistors (transistor density) in an IC doubles in every 1.5 years. With the recent advances in the technology, device shrinks to nanometer scale, but density and complexity of the ICs keep on increasing. This may result in many manufacturing faults and device failure. To accommodate more number of transistors, the device feature size is reduced. Reduction in the feature sizes results in increasing the manufacturing faults and fault detection becomes very difficult. VLSI testing is becoming more and more important and challenging to verify whether a device functions properly or not. Conventional automatic test equipment (ATE) based testing method is no longer able to handle the ever-growing test challenges. Logic built-in self-test (LBIST) is widely being adopted as the testing technique for most current day scan based designs. Logic BIST does not alter the scan structure of the designs permitting them to have both ATE based testing and also Logic BIST. The nature of vectors in Logic BIST are usually pseudo random and so even for a moderately sized design, several thousands of patterns are to be generated in the Logic BIST compared to a few hundreds of deterministic test patterns in ATPG to achieve adequate fault coverage. So, methods to improve the fault coverage of Logic BIST by increasing the pattern efficiency are constantly explored. LBIST found its use mainly in safety-critical (automotive, medical, military), mission-critical (deep-space, aviation) and high-availability (telecom) applications. However, process technologies plunging below 22nm, LBIST will become compulsory for applicationspecific integrated circuits (ASICs), application specific standard products (ASSPs) and complex commercial ICs (Nan Li, et al., 2015). Any electronic system employed in safety critical applications is expected to have a periodical self testing scheme for sustained error free operation. For example, medical electronic devices need to test themselves to assure continued safety of the patients. Another example is automotive electronics. With the explosion in the growth of the automotive semiconductors industry comes an associated and intense focus on high silicon quality and reliability. The last thing anyone wants is a brake 2

system failure due to a latent silicon defect, and concerns over reliability are driving changes in the testing requirements for these chips. The electronics must meet certain safety standards to accommodate the fast growing technological revolution. 2 Motivation Very large scale integrated circuits, especially system-on-chip (SoC) designs, become increasingly complex with each generation, the amount of test data required to achieve acceptable test quality is also proportionately very large. Hence, the test data storage requirements on an external tester and the test data bandwidth requirements between the tester and chip are growing rapidly. As test data volume increases, test power also increases rapidly. Test data compression techniques provide a means to reduce these requirements thereby allowing less expensive testers to be used. Moreover, it reduces the test time. Compressing the output response is relatively easy since lossy compression techniques can be employed, e.g., using a multiple-input signature register (MISR). However, compressing input test vectors is much more difficult because lossless compression techniques must be used. Recently, a significant amount of research has been done on lossless compression techniques for test vectors. This proposal approaches the test vector compression using an efficient seed selection algorithm rather than compressing the input or output test vectors. On-chip pseudo random patterns generation based Logic BIST has emerged as a primary solution to test current day large complex designs. The ATE based testing was using deterministic test patterns. Both the deterministic and pseudorandom test patterns which are generally used for testing have their advantages and drawbacks. In the on-chip testing scenario, it is comparatively easy to generate pseudo-random pattern generator circuits than deterministic pattern generator circuits. It is because, generation of deterministic patterns requires design of highly complex digital circuits adding a tremendous overhead on area, size and complexity. LBIST logic coverage typically falls in the range of 75% to 80%. The number of faults detected by a random pattern is usually high for the first few or many patterns and then reduces with further patterns (Agrawal, 2002). The undetected faults in Logic BIST are usually referred as random pattern resistant (RPR) faults. It is not known precisely when to stop generating these random patterns and is usually done when no more improvement in fault coverage is seen. Wang (wang, 2006) observed that LBIST requires more test patterns than conventional testing, which may take an extra 3

millisecond or two to work, and probably would not provide high enough test coverage without additional test vectors. For manufacturing test, the most common approach is the combination of LBIST and ATPG driven tests for the majority of users. During ATPG testing, LBIST is turned off and treated like functional logic. Instead of running both ATPG and BIST, this proposal suggests a pseudo random test pattern set selected from the ATPG patterns. Thus it generates the same fault coverage of ATPG at the speed of LBIST. Another important motivation of this work is the security of testing structures. JTAG is a widely used IEEE 1149.1 compatible test and debug standard interface for chip, board and systems. Several solutions are being proposed for securing JTAG during debugging and testing. Some of the previous protection methods are explained below. As per the literature survey, to the best of our knowledge, no protection mechanisms were suggested /applied to logic BIST till date. Outcome of literature survey in reduction in test data volume shows that there is a need to explore possible pattern reduction techniques to realize a fault coverage as equal to ATPG based testing and also without any overhead in area and power. The necessary parameters evaluation, possibility of BIST structural changes and modifications in testing architectures are to be investigated. There is sufficient scope for improvements and enormous potential research outcome is possible. The survey results and industry based white papers motivate to carry out this research work to attempt research in certain grey areas of deterministic BIST based on structural modifications. Our focus is the Logic BIST test vector reduction using ATPG patterns and security of the test structures to protect a hacker to intrude in to the hardware details of the chip. 3 Objectives and Scope Main objectives of this work is to 1. Reduce the random test pattern set size by suitably selecting the subset of the total number of random patterns generated from the LFSR (PRPG) incorporated in to the Logic BIST of any given design. The algorithm is called as Seed Selection Logic based Pattern Reduction Technique. 2. Design and Develop a unique secure architecture for testing of VLSI circuits using Logic BIST which has the following features:- 4

Reconfigurable BIST modules Logic BIST control using Boundary scan. Authentication and Authorization Module and an Access Provider Logic. Multiple cryptographic algorithm based encrypted private key storage technique. Early work on LFSR designs for random patterns based testing was performed two decades before. (Wang and McCluskey, 1986) Wang presented a design technique for LFSR that generate test patterns for pseudo-exhaustive testing. This technique is applicable only to combinational network in which none of the outputs depends on all inputs. Several flavors of scan chain re-ordering and broadcasting the input test vectors set were proposed between the years 1990 to 2000. Januz (Janusz Rajski et al., 1997) proposed a new and very efficient scheme to decompress deterministic test vectors, to be used as part of a built-in test strategy using mixed-mode pattern generation. The scheme is based on the reseeding of an LFSR and exploits variable-length seeds to encode the deterministic test vectors. A synthesis procedure for generating sequence altering logic to embed deterministic test cubes in a pseudorandom sequence has been presented (Kedarnath et al., 2006). It constructs a sequential multilevel circuit that very efficiently encodes the deterministic test cubes. Peter (Peter et al., 2003) presented DBIST, a deterministic BIST method that combines test-generation, LFSR-seed encoding and fault simulation to achieve the same high fault coverage as deterministic ATPG while applying patterns in logic BIST architecture. The number of patterns encoded into a single LFSR seed varies continuously to accommodate the most efficient encoding. LFSR seeds control all care bits in all patterns which need extra hardware to be added into the design. A core with a virtual scan chain reduces test costs for the system integrator (wang, et al., 2006). Thus, core vendors may find virtual scan chains a means to achieve a competitive advantage in selling their cores. But in this work, the default ordering of the scan chains was used. Ahmad (Ahmad et al., 2005) presented a seed-ordering technique based on the transition matrix of the PRPG and efficiently exploiting the don t care bits in the test patterns. This technique avoids high complexity like previous analytical solutions and avoids long simulation times. But the fault coverage was not enough to reach that of ATPG. Two other methods for improving the compression of linear compression schemes, scan inversion, and reconfiguration of the de-compressor, have been proposed (Kedarnath, et al., 2006). A systematic procedure based on linear algebra was described for selecting the set 5

of inverted scan cells. Experimental results show that scan inversion can dramatically improve the encoding efficiency of combinational linear decompressors bringing it close to that of sequential decompressors. Scan inversion can also significantly improve the encoding efficiency for sequential linear decompressors. Scan inversion can be implemented with no hardware overhead. A single cycle access structure is discussed in various implementations with and without hold mode as well as gated and partial implementation methods are presented (Tobias, 2012). The aspects feasibility, peak power consumption, switching activity during test, area, test cycles, at-speed testing and debugging features are compared. However this method also adds considerable area overhead. To provide security features to the testing structures some research were proposed in last decade. Rosenfeld and Karri (2010) analyzed various possible JTAG attacks and proposed protection scheme. Security problems arise when there is a discrepancy between what people expect and what assurances a given system can provide. It presents different ways in which an attacker can exploit a JTAG interface, different capabilities of attacker, and its countermeasures. (Luke pierce and Spyros Tragoudas, 2011) Luke proposed a multilevel privilege security system for JTAG controller. It monitors and controls the individual scan chain and hence restricts the malicious data being loaded into the JTAG controller. All techniques proposed in literature can be classified based on their features and drawbacks. 4 Description of Research Work Logic BIST test structures are embedded in to the integrated circuit (IC) with the design unit, thus, add a small permissible area overhead (Wang, 1988). The nature of vectors in LBIST are usually pseudo random and so even for a moderately sized design, several thousands of patterns are to be generated in the LBIST compared to a few hundreds of deterministic test patterns in ATPG to achieve adequate fault coverage. So fault coverage is usually much less than 100% and very long test sequences are needed in LBIST. To overcome these difficulties, the following techniques are proposed in this thesis. 1. Reconfigurable LBIST blocks 2. Seed Selection Algorithm(SSA) 3. Bit-Fixing in Pseudorandom sequences after SSA 4. A multilevel security based authentication module for the JTAG. 5. A multi-access security feature for the Logic BIST. 6

Reconfigurable LBIST will help in rearranging the pattern generator, ROM memory, MISR and other modules in accordance with the DUT scan and test specifications. All the parameters like the register width, size, initial values, expected values, number of clock cycles to run can be modified at run time. A typical LBIST architecture is shown in Figure.1. Figure 1. Logic BIST Architecture Seed selection algorithm compresses the exhaustive test pattern generated by LBIST. It provides high compression ratio, as a result the number of test vectors applied to DUT are reduced, which in turn reduces the test application time and power as well. In BitFixing in Pseudorandom Sequences, deterministic test cubes that detect the random-patternresistant faults are embedded in a pseudorandom sequence of bits generated by a linear feedback shift register (LFSR). The proposed method uses STUMPS (Self-Test Using a MISR and Parallel Shift register) architecture which is widely used in practice (Agarwal, 2002). In STUMPS architecture, it is proposed to have the primary inputs and scan inputs of the circuit are fed by separate LFSRs to have better pattern controllability of the shift and capture cycles. A parallel LFSR structure is used as the Pseudo Random Pattern Generator (PRPG) to feed the scan inputs and primary inputs of the design which in turn reducing the BIST area compared to a serial LFSR structure. All the proposals are implemented on ISCAS 89 and ISCAS 99 benchmarks designs for comparison and analysis of the results with the literature methods. Experimental results show that even for the small sized ISCAS bench mark designs, the seed selection algorithm has produced multifold reduction in test vectors ranging from 13 folds (s400) reduction to 2 7

fold (s349) reductions in the size of the exhaustive test vectors. The indicator test cycles per net [TCPN(COV)] for a certain coverage (COV) is introduced to compare the effectiveness of the test structure. It is the number of test cycles divided by the number of nets (NETS) of the given net list. TCPN(COV)=TC/NETS. (5.13) where, TCPN = test cycle per net, TC = test cycle. This is a measure which can be used to compare different test methods and algorithms in terms of number of test cycles for equal design sizes. It is an indicator showing the degree of dependency a test method is having on the size of the design. Usually as the design size increases the TCPN increases, and then the necessity of such a test for the bigger design arises. The TCPN results of the seed selection algorithm are found to be less than all the existing methods in literature as seen in Figure 2. 8 7 6 T C P N 5 4 3 2 1 [32] TCPN [24] SCAhS [24] SCAS-TCPN Cadence ATPG - TCPN 0 Figure 2. Comparative TCPN results of the proposed method with literature methods A secured Logic BIST access is proposed by providing two stage multilevel security schemes to the design. The first stage, multi-level locking mechanism is incorporated in the JTAG that prevents the unauthorized access to interfere with the scheduled functions of the device. A multiple cryptographic algorithm based encrypted private key storage technique is 8

implemented in the logic BIST module. Proposed module consists of a security configuration register, a security extension module, a storage module, an identity module, a comparator and associated multiplexers. Boundary Cells Figure 3. JTAG structure with dual stage security blocks A complete JTAG structure with both security modules is shown in Figure 3. There are four levels of access defined. User (level 1), engineer (level 2), designer (level 3) and architect (level 4). Each of these levels has different access to the circuit s internal logic. a. User level have the permission to access all the internal logic circuits. It does not have the permission to write or modify the contents of the internal registers. b. Engineer level: The users in this level can write into some of the internal registers. c. Designer level: The users in this level are allowed to write, configure and modify the contents of some of the registers. 9

d. Architect level: the users in this level have the full control over the circuit s internal logic. They can write, enable/disable, configure and modify the contents of the registers and even change the size of all the internal registers. The results of the addition of security modules show that the area and power overhead is negligible even for these small benchmark designs. For ISCAS 89 area overhead is < 3.9% and power overhead is < 7.7%. For ISCAS 99 area overhead is < 4.7% and power overhead is < 8.5% 5 Conclusions In a nutshell, this work contributes three important techniques for efficient secure testing of VLSI IC s. First, it presented the addition of programmable feature in the LBIST blocks for better reusability between multiple designs. Second, a new pattern mapping algorithm has been proposed for shortest random test pattern set and seed selection and more generally for test set embedding LBIST schemes. The new mapping method exploits the maneuverability and the compactness of the ATPG patterns function representation. Evaluations performed on the ISCAS 89 and ISCAS 99 benchmark designs have revealed that both runtime and patterns size reduction are improved by several orders of magnitude as compared to the original exhaustive patterns set approach. This reduction in size of the random patterns by several orders of magnitude becomes the major strength of this proposed method. Moreover, this efficiency gain of the proposed method can be used to obtain even better solutions in terms of test power reduction and fault coverage. As a lead to this improvement, the effectiveness of the test sequences obtained by a metric called TCPN (test cycles per net) and compared with the existing methods in literature. Another major contribution of this work is the multilevel security method which provides several magnitudes of difficulty to any unintended user to operate the circuitry. Many of the literature methods propose implementation of the crypto algorithms inside the design leading to prohibitive increase in the area, timing and power overhead. The particularity of this method is that it combines the crypto methods with designer programmable difficulty levels to access. Evaluations performed on the ISCAS 89 and ISCAS 99 benchmark designs have revealed that both reduction in area overhead and cracking difficulty are improved by several orders (20 to 30 times on ISCAS benchmark designs) of magnitude as compared to the existing methods. The main contributions of this work are, 10

Scalable Pattern Mapping Approach: An innovative approach has been introduced for mapping deterministic patterns to a pseudo-random test sequence. This approach relies on the condensed LFSR concept and proposes the definitive nature of the deterministic patterns being a subset in the exhaustive test set. This method does not add any circuitry and can be employed on already LBIST inserted designs also. Seed selection approach for shortest test sequence: An innovative approach has been introduced for selecting a particular seed (starting value of the LFSR). This method uses the full exhaustive pattern set of the Logic BIST and the ATPG pattern set for comparison and analysis. The output of this method is the shortest random patterns test set which includes all the ATPG patterns. The fault coverage of stuck at fault (modeled defects) by pseudo-random sequences is evaluated and analyzed. Evaluation of impact on TCPN (Test Cycle Per Net) and Test coverage: The impact of the length of the seed selection based test sequences on the test coverage of the modeled defects and test cycles per net has been investigated as well. Multi level security for Logic BIST circuits: An innovative multilevel security approach for on-chip test structures is employed. In order to improve cracking difficulty, the programmable key length scheme has been implemented with a combinational logic module for comparison of different levels of access. Possible key length, hardware overhead and cracking difficulty level have been presented. Innovative Crypto keys based security register approach: An important achievement of this work is a crypto keys based security register, which is used to enable and improve the security based on multiple crypto algorithms, different levels of access and reconfigurable register structure. 6 References Michael L Bushnell, Vishwani D Agrawal. (2002). Essentials of Electronic Testing For Digital, Memory And Mixed Signal VLSI Circuits. Kluwer Academic Publishers,. L.-T. Wang, C.-W. Wu, and X. Wen, Eds. (2006). VLSI Test Principles and Architectures: Design for Testability, Morgan Kaufmann. Kedarnath J. Balakrishnan, and Nur A. Touba. (2006). Improving Linear Test Data Compression. IEEE Transactions On Very Large Scale Integration Systems. 14(11):1227-1237. 11

Ahmad A. Al-Yamani, Subhasish Mitra, and Edward J. McCluskey. (2005). Optimized Reseeding by Seed Ordering and Encoding. IEEE Trnsactions On Computer-Aided Design Of Integrated Circuits And Systems, 24(2):264-270. Castillo, E., Meyer-Baese, U., Garcia, A., Parrilla, L., Lloris, A. (2007). IPP@HDL: Efficient Intellectual Property Protection Scheme for IP Cores. IEEE Transactions On Very Large Scale Integration Systems. 15(5):578-591. Nan Li, Gunnar Carlsson, Elena Dubrova, Kim Petersen. (2015). Logic BIST: State-of-the- Art and Open Problems. IEEExplore. Mohammad Tehranipoor and Cliff Wang. (2011) Introduction to Hardware Security and Trust. Chapter 17. Springer, pages 385-409. Kurt Rosenfeld and Ramesh Karri. (2011). Security-Aware SoC Test Access Mechanism. IEEE 29 th VLSI Test Symposium (VTS), pages 100-104. Luke pierce and Spyros Tragoudas. (2011) Multilevel Secure JTAG Architecture. IEEE 17 th International On-Line Symposium, pages 208-209. Amitabh Das, Barıs Ege, Santosh Ghosh, Lejla Batina and Ingrid Verbauwhede. (2013). Security Analysis of Industrial Test Compression Schemes. IEEE Transactions on Computer-aided Design of Integrated circuits and Systems. 32(12). Mitra, S., McCluskey, E J., Makar, S. (2002). Design for testability and testing of IEEE 1149.1 TAP controller. Proceedings 20 th IEEE VLSI Test Symposium (VTS 02), pages 247-252. Janusz Rajski, Katarzyna Radecka, Jerzy Tyszer. (1997). Arithmetic Built-In Self-Test for DSP Cores. IEEE Transactions On Computer-Aided Design Of Integrated Circuits And Systems.16(11):1-7. Peter Wohl, John A. Waicukauski, Sanjay Patel and Minesh B. Amin. (2003). Efficient Compression and Application of Deterministic Patterns in a Logic BIST Architecture. DAC 2003, pages. 566-569. Tobias Strauch. (2012). Single Cycle Access Structure for Logic Test. IEEE Transactions On Very Large Scale Integration Systems. 20(5):878 891. L.T. Wang, E.J. McCluskey. (1986). Concurrent Built-In Logic Block Observer (CBILBO). IEEE International Symposium on Circuits and Systems(ISCAS), pages 1054-1057. 7 List of publications based on research work A. International Journal Publications: 1. Ramesh Bhakthavatchalu and Nirmala Devi.M. (2015). Deterministic Test Data Compression in Logic BIST. International Journal of Applied Engineering Research 10(3):7537-7551. 12

2. Ramesh Bhakthavatchalu and Nirmala Devi.M. (2015). Crypto Keys Based Secure Access Control for JTAG and Logic BIST Architecture. International Journal of Engineering and Technology. 7(3):973-984. 3. Ramesh Bhakthavatchalu and Nirmala Devi.M. (2015).Verilog Design of Programmable JTAG Controller for Digital VLSI IC s. Indian Journal of Science and Technology. 8(17): 62664. 4. Ramesh Bhakthavatchalu and Nirmala Devi.M. Analysis of Test Cycles Reduction in Logic BIST based Testing of VLSI designs, Int. J. of High Performance Systems Architecture, Inderscience Publications (submitted). B. International Conference Publications 5. Ramesh Bhakthavatchalu and Nirmala Devi.M. (2014). Deterministic Seed Selection and Pattern Reduction in Logic BIST. IEEE VLSI Design And Test. 6. Ramesh Bhakthavatchalu and Nirmala Devi.M. (2014). Reconfigurable Logic Built in Self-Test technique for SoC Applications, Elsevier International Conference on Communication and Computing. 13