Secure edge devices and the need for hardware security are of paramount importance due to the growing demand for cybersecurity. Hardware security has been strengthened using complex architecture to provide uncompromisable security and prevent malicious cybersecurity attacks. To prevent unauthorized access using even the most advanced failure analysis (FA) techniques, the Hardware Security Module (HSM) implements cryptographic algorithms and data obfuscation using many raw combinational logic and state machines. When a newly taped-out device fails to operate or fails to come out of its secure boot-up sequence, how can we know whether a defect is present or if the security block reacted to a design error? This paper discusses various real-world examples of FA challenges related to first silicon debug, including secure IP. We explore the unique approaches required to make sense of collected Laser Voltage Probe (LVP), Photon Emission Microscopy (PEM), and Laser Logic State Mapping (LLSM) data. We discuss some of the most advanced FA techniques' strengths and weaknesses and illustrate how system architecture related to securing data can be modified to alter the effectiveness of each. We explain in detail why specific FA techniques can be defeated by built-in security and where FA techniques can be enabled by clever triggering schemes or looping on areas of code while looking for specific behaviors. This paper also talks about the limitations of analyzing complex architecture being good from a security point of view. We conclude by summarizing the threat FA tools present to secure IP and comment on steps that could be taken to further protect internal state machines and sensitive logic areas from even the most well-equipped FA labs. Thus, this work gives an introspective thought as to how Optical Fault Isolation (OFI) techniques could be perceived as a threat to various security applications and points to trade-offs between the ability to analyze versus hardware security.

Hard failures, especially the Stuck at Reset failures insensitive to voltage, frequency, and temperature, are among the toughest to debug using the conventional Electrical Fault Isolation Methodology. These types of failures have no test data and no diagnostic information. Because of the failure being stuck at the reset sequence and being a hard failure, methodologies like Laser-Assisted Device Alteration (LADA) cannot be carried out. Photon Emission Microscopy (PEM) may exhibit numerous differences for good vs. bad die, however, most emission signatures typically indicate where IP is stuck in reset but do not indicate the actual root cause. Laser Voltage Probe (LVP) is the most logical way to proceed, but since Power-on Reset (POR) signals typically transition only once per test in conjunction with hard power cycling, the LVP averaging became very difficult as the hard power cycling increased the time of the loop drastically. This paper discusses a novel methodology of modulating power supply voltages within a looping pattern to optically probe the critical internal POR signal transitions effectively and debug the power sequencing of the device. This method is carried out through a custom test setup where a particular power supply of interest is modulated within the test loop without powering down other supplies connected, thereby avoiding the time penalty required for complete power down and power up. The method also synchronizes internal signals associated with POR to a tester-generated trigger in order to successfully obtain recognizable internally extracted POR-associated waveforms. This methodology is conveyed by explaining a complex functional failure analysis case study while highlighting where conventional failure analysis methods could not be used directly to identify the root cause of failure. This paper also describes another case study to explain how parametric information, such as the current profile using the current probe obtained during the test on a pass vs. fail device, can provide valuable information and help debug stuck-in reset failures.

In this work, we present three case studies that highlight the novelty and effectiveness of using multiple plasma FIB trenches to simultaneously access multiple metal layers for nanoprobing failure analysis. Multilayer access enabled otherwise impossible two-tip current imaging techniques and allowed us to fully characterize suspect logic gate transistors by exposing internal nodes, while preserving higher metal inputs and outputs. The presented case studies focus on late node planar and established FinFET technologies. The delayering techniques used are not necessarily technology dependent, but highly scaled and advanced processes generally require smaller trench areas for multilayer access. The minimum trench dimensions are limited by ion beam imaging resolution and trench-nanoprobe tip geometry.

Low power mode current is a very important parameter of most microcontrollers. A non-production prototype microcontroller had high current issues with certain SRAM modules which were produced using a new memory compiler. All devices were measuring 100’s μA of low power mode current which was an order of magnitude higher than the requirement. Many failure analysis (FA) techniques had to be used to determine the root cause: Optical Beam Induced Resistance Change (OBIRCh), photo emission microscopy (PEM), microprobing, and nanoprobe device characterization. Transistor models and measurements of probe structures from the effected lots both predicted that the device low power mode current would meet expectations; however, all first silicon samples had elevated low power mode current. A knowledge of low power design methodology was needed to ensure all issues were discovered.

Laser-assisted device alteration (LADA) is an established technique used to identify critical speed paths in integrated circuits. LADA can reveal the physical location of a speed path, but not the timing of the speed path. This paper describes the root cause analysis benefits of 1064nm time resolved LADA (TR-LADA) with a picosecond laser. It shows several examples of how picosecond TR-LADA has complemented the existing fault isolation toolset and has allowed for quicker resolution of design and manufacturing issues. The paper explains how TR-LADA increases the LADA localization resolution by eliminating the well interaction, provides the timing of the event detected by LADA, indicates the propagation direction of the critical signals detected by LADA, allows the analyst to infer the logic values of the critical signals, and separates multiple interactions occurring at the same site for better understanding of the critical signals.