A truly embedded test structure for design-for-manufacturability, hardware security and VLSI testing

As the feature sizes continue to shrink in advanced VLSI technologies, the impact of process variations on yield losses has become significant. Moreover, the process variations in path delays are increasingly dependent on circuit context. Given this “neighborhood” dependence, characterization of path delays is best carried out using embedded techniques applied to actual product macros, as opposed to scribe line test structures or embedded ring oscillators (RO). In addition to characterizing performance, such delay measurement techniques can be used to improve model-to-hardware correlation. Furthermore, these techniques can also be used in several contexts including defect detection, post-silicon debug and hardware-security. In this dissertation, I propose a high-precision and low-overhead embedded test structure, called REBEL, for measuring path delays in the circuit context. REBEL is minimally invasive to the design, as it leverages the existing scan structures, and easy to integrate because it can be completely automated within the DFT synthesis flow. The proposed embedded test structure and two of it's applications, namely path delay variability characterization and hardware Trojan detection, are verified in silicon. REBEL architecture for both level sensitive scan design (LSSD) and MUX-D scan designs are proposed and verified in 90nm ASICs and 130nm FPGAs respectively. The LSSD-based REBEL structure is integrated into a 32-bit pipelined floating point unit (FPU), implemented in IBM's 90nm technology, and the path delay measurements from 62 copies of the chip are used to analyze die-to-die and within-die variations. The MUX- D-based REBEL is integrated into a pipelined Advanced Encryption Standard (AES) design and wrapped with random built-in self test (BIST) architecture. The system is then implemented in Xilinx Virtex2Pro FPGAs and the data collected from 30 copies of FPGA are used to analyze the variability in path delays. As a second application, REBEL's effectiveness for detecting delay anomalies introduced by Hardware Trojans is demonstrated. Trojan emulation circuits, designed to model internal wire loads introduced by a hardware Trojan, are inserted into the design at multiple places. The emulation cell incorporates an analog control pin to allow a variety of hardware Trojan loading scenarios to be investigated. Using the hardware data collected from 62 chips fabricated in 90nm CMOS technology, I demonstrate that REBEL can detect the small delay anomalies introduced by hardware Trojans. I evaluate the detection sensitivity of REBEL for detecting hardware Trojans using linear regression analysis, which deals with the chip-to-chip variation effectively and improves the detection sensitivity.Computer EngineeringDoctoralUniversity of New Mexico. Dept. of Electrical and Computer EngineeringJim, PlusquellicPayman, Zarkesh-HaChintan, PatelAbhishek, Sing