Tester for reverse engineering of electronic devices


Vast majority of the modern digital VLSI devices utilize a technique called 'full scan' for production testing. This technique chains all the device registers (flip-flops or latches) in a few shift registers called 'scan chains'. In this configuration, a production tester may use the scan chains to drive logic values to the inputs of combinatoric circuits, sample the results from their outputs, output the results via the same scan chains and check them with the expected results. This method allows testing every chip for correct behavior, and make sure no defects were inserted during chip production. The full scan technique is an effective technique that allows reaching high test coverage in a short development time. However, in applications where security (e.g. data confidentiality, IP protection, etc) is a concern, it can introduce a serious threat.


Project Description: In this project we will build a tester based on an FPGA platform, which will perform scan test of some VLSI device. The tester will drive scan vectors into the device and sample the outputs. The resulted data will be further provided to a partially real time processing algorithm, which will attempt to reconstruct the chip’s contents. During the project, the student will design:

  • Scan vector provision and sampling machine
  • Scan protocol controller
  • Processor interface for offline as well as for real time communication
  • Software for controlling the tester and running the learning algorithm

The project phases will include:

  • The tester architectural definition
  • Coding in a high level language (Verilog/VHDL)
  • Simulation
  • Implementation on a development board based on Xilinx Zynq SoC FPGA device
  • Coding the learning algorithm for embedded ARM processor
  • Testing the tester functionality with a synthetic model and at a later stage with a real life device.

Project prerequisite: digital systems, lab 1

Supervisor: Leonid Azriel    leonida@tx.technion.ac.il