Secure edge devices and the need for hardware security are of paramount importance due to the growing demand for cybersecurity. Hardware security has been strengthened using complex architecture to provide uncompromisable security and prevent malicious cybersecurity attacks. To prevent unauthorized access using even the most advanced failure analysis (FA) techniques, the Hardware Security Module (HSM) implements cryptographic algorithms and data obfuscation using many raw combinational logic and state machines. When a newly taped-out device fails to operate or fails to come out of its secure boot-up sequence, how can we know whether a defect is present or if the security block reacted to a design error? This paper discusses various real-world examples of FA challenges related to first silicon debug, including secure IP. We explore the unique approaches required to make sense of collected Laser Voltage Probe (LVP), Photon Emission Microscopy (PEM), and Laser Logic State Mapping (LLSM) data. We discuss some of the most advanced FA techniques' strengths and weaknesses and illustrate how system architecture related to securing data can be modified to alter the effectiveness of each. We explain in detail why specific FA techniques can be defeated by built-in security and where FA techniques can be enabled by clever triggering schemes or looping on areas of code while looking for specific behaviors. This paper also talks about the limitations of analyzing complex architecture being good from a security point of view. We conclude by summarizing the threat FA tools present to secure IP and comment on steps that could be taken to further protect internal state machines and sensitive logic areas from even the most well-equipped FA labs. Thus, this work gives an introspective thought as to how Optical Fault Isolation (OFI) techniques could be perceived as a threat to various security applications and points to trade-offs between the ability to analyze versus hardware security.

We present the first experimental demonstration of on demand bit-level Static Random Access Memory (SRAM) validation and isolation through the exploitation of a continuous wave (CW) 785nm Laser-Induced Fault Analysis (LIFA) system. Through careful test pattern edits and the observation of a simple pass/fail flag, the ability to spatially map the physical location of pre-selected bits in 40nm, 16nm, and 5nm SRAM arrays using correlation units is confirmed. This work demonstrates a novel and highly-efficient methodology for rapid bit-level logical-to-physical identification. It also improves localization efficacy over conventional bitmap validation best-known methods (BKM) which typically rely on post-fail Photo-Emission Microscopy (PEM) and/or Soft Defect Localization / Laser-Assisted Device Alteration (LADA) performed on an actual fail unit. This new technique re-defines the state-of-the-art in SRAM bitmap validation and localization and offers a pathway to significantly improve cycle time for both product bitmap qualification and subsequent root cause identification.

High numerical aperture (NA) laser scanning for fault localization requires the use of special lenses aimed at creating a tightly focused laser spot within an integrated circuit. Typically, extrinsic solid immersion lenses are employed that optimize the refraction at the air-silicon surface. In this feasibility study we investigate with both simulations and experiments the use of integrated diffraction lenses for high-NA imaging. We take the limit to ultrathin silicon and discuss the implications for the lens design and performance.

We present the first experimental demonstration of stuck-at scan chain fault isolation through the exploitation of Single Event Upsets (SEU) in a Laser-Induced Fault Analysis (LIFA) system. By observing a pass/fail flag, we can spatially map all flops after a defect in a failing scan chain through induced SEU sites produced by a fiber-amplified 25 ps 1064 nm diode laser. In addition, a custom fault isolation methodology is presented in which the result highlights only the first working flop immediately after the defect mechanism causing the stuck-at chain failure. This work demonstrates a novel method for rapid scan chain fault isolation that significantly improves localization efficacy over conventional best-known methods (BKM) based on frequency mapping. Moreover, experimental results are presented to demonstrate that LIFA can be extended to interrogate the data state of flip flops in a scan chain. Results are also presented to establish that LIFA can be configured as a hardware-based diagnostics platform.