Forensic science is the cornerstone of the modern justice system, as it allows us to analyze evidence in order to discover the truth behind a crime scene. As mobile phones became more important to our daily lives they've taken up a bigger part in forensic research as well. These devices contain digital traces telling us the story of our lives. Digital forensic research traditionally focused on recovering data, in particular data from broken or undocumented systems. While security was not the primary concern of most manufacturers, this has changed in recent times. Cryptography has become a major roadblock in forensic science, which has shifted the focus from recovery towards exploitation. Traditionally Digital forensic research focused on physical acquisition. While often tools supported logical extraction, this would leave many deleted traces inside of the memory chip intact. Instead methods such as Flasher tools, JTAG-based acquisition, In-System Programming and Chip-off were often used to make images of the physical contents of the memory chip. This would then be analyzed by data-analysts in order to extract evidence from the images. On many modern devices cryptography has ensured that these methods are no longer effective. Software exploitation techniques such as DirtyCow have proven to become much more important in digital forensic science, but more methods should be developed. JTAG is of particular interest in this regard. It is a testing system that was previously left unsecured and providing attackers with an easy way in. More recently manufacturers have started using novel ways of protecting JTAG from malicious use, but very little research exists testing these new security measures. This is a recipe for vulnerabilities. This thesis focuses on attacking Secure JTAG; Samsung's authentication module for ARM CoreSight. Several potential attacks have been highlighted that are potentially applicable to Secure JTAG. A novel model has been developed that allows an attacker to evaluate the complexity of their attacks. While models such as CVSS and DREAD exist, these focus on threat analysis rather than offensive research. Using this model two attacks were chosen: One focusing on reversing the internal JTAG boundary scan chains and the other attempting to force authentication through fault injection. In order to reverse the JTAG boundary scan chains a new set of tools had to be developed. Existing tools were often incapable of communicating with the internal scan chains or did not provide enough freedom to enable research. After their development these new tools were able to confirm that the internal scan chains were secured. The internal boundary scan chains will not be a viable attack vector until the authentication mechanism is circumvented. The second attack focused on a potential fault injection vulnerability in the Secure JTAG authentication scheme. Because Secure JTAG is a purely hardware component it provided a unique challenge. Where normally firmware is analyzed to prove the existence of a vulnerability, Secure JTAG has no such firmware available. This makes discerning between failure because the device is not vulnerable and failure because of chance nearly impossible. To increase confidence in the attack and decrease attack space this project focused on Electromagnetic Side-channel Analysis. By locating the signals produced by Secure JTAG authentication it is possible to greatly reduce the attack space, thereby increasing confidence in the attack. In the end correlating signals were located near the high-power processor of the chip, albeit not the hashing engine itself. This lowered the attack space enough for an eventual fault injection attack.

The aggressive downscaling of the transistor has led to gigantic improvements in the performance and func- tionality of electronics. As a result, electronics have become a significant part in our daily lives whose absence would be difficult to imagine. Our cars, for example, now consist of many sensors and small computers each controlling certain parts of the car. A downside of the aggressive downscaling of transistor sizes is that it nega- tively impacts the reliability and accelerated ageing, and thus a reduced lifetime, of electronics. Nevertheless, to ensure the reliable operation of electronics, it has therefore become essential to assess the reliability of any of its embedded components accurately. Conventionally, to combat ageing, designers use guardbanded design; adding design margins. These margins, however, lead to a penalty in area, power, and speed. Al- ternatively, one may investigate mitigation schemes that aim at reducing the impact of ageing to extend the reliability and lifetime. These mitigation schemes may lead to a higher performance compared with the con- ventional guardbanded design. This work focuses on an ageing mitigation scheme for SRAMs. SRAMs typi- cally have the highest contribution to the total area of integrated circuits. Therefore, they are highly optimised (i.e. their integration density is the lowest). This also makes them one of the most susceptible components to ageing. Hence, providing appropriate ageing mitigation schemes for SRAMs is essential for the overall reliability of ICs. Whereas prior work has mainly investigated hardware-based ageing mitigation schemes for SRAMs, this thesis investigates the possibility of mitigating the ageing through software. The advantages of this approach include that it does not require circuit changes (and, thus applicable to existing circuits) and it comes at zero area overhead. This study’s proposed software-based scheme is based on periodically running a mitigation routine. This mitigation scheme flips the contents of the memory cells to put the transistors into relaxation from BTI stress, the most crucial ageing mechanism in deeply scaled CMOS process. The results show that the software-based scheme can significantly reduce the ageing of the memory at a low overhead. For example, the degradation of the hold SNM metric of the memory cell is reduced with up to 40% at a runtime overhead of only 1.4%. Moreover, the scheme also mitigates the ageing of other components of the memory. For example, the degradation of the offset voltage of the sense amplifier is reduced by nearly 50%. This thesis shows that it is possible to use software to mitigate the ageing effects in the memory components and it is worthwhile to consider implementing it.

Machine learning on edge devices performs crucial identification or prediction tasks while limiting the amount of data that needs to be transmitted to more centralized computing nodes. However, strict area and energy requirements necessitate specialized hardware developed for the requirements of the device and model. This thesis is concerned with developing an area and energy arithmetic unit as part of the implementation of a stacked machine learning model in embedded automotive devices. The model in question was previously designed to perform lifetime prediction with the goal of improving the reliability of semiconductor devices used in various automotive applications. This thesis aims to achieve area and energy efficiency by exploiting the commonalities in the arithmetic operations of several of the internal learners of the stacked machine learning model. The use of a weighted figure of merit, taking into account area, energy and delay, allow for simple comparisons of designs at any operation frequency and easy insight into the changes in the merit of designs if device requirements were to change. A sweep of the percentage of multiplications in the workload also gave insight into how design choices may change due to future redesigns of the stacked machine learning model. It was found that the MAC, multiply, divide and accumulate operations of the internal learners can best be supported by one arithmetic unit containing a "Reduced Area" parallel multiplier (still taking up most of the area), a small, dedicated accumulator and invariant integer division using the multiplier. It was also found that the ability to reconfigure the multiplier for different levels of bit-precision does not yield performance improvement for the expected precision distribution.

This report discusses one part of a project consisting of three parts. The goal of the project is to design a battery less sensor powered by RF energy fields present in an office environment. The sensor is able to measure the temperature and is able to communicate wirelessly using a low power communication protocol.In this report the energy conversion and storage of the system will be discussed. A high-frequency signal coming from an antenna must be converted to an output signal which is functional for the communication module. Therefore a steady 3.3 V DC output needed to be created with a rectifier circuit. In order to achieve maximum power transfer to the load, a matching circuit with the RF energy harvesting antenna needed to be designed. The main challenges were to achieve a high enough input voltage to reach the threshold voltage of the diodes of the rectifier and to rectify the AC input as efficient as possible. To tackle these challenges a design with a Greinacher rectifier with low-threshold Schottky diodes and a DC/DC booster is presented.

Some server hosters facilitate cyber crime either intentionally (so called “bulletproof hosters”) or unintentionally (“bad hosters”). When dealing with uncooperative hosters during forensic investigations, it may sometimes be necessary to collect data or information on the servers without help from the owner of the server. Data within the RAM might prove insightful in, for example, determining active processes or reveal crypto graphically interesting information like encryption keys. The thesis explains key concepts within memory organization and the PCIe standard.Afterwards, it discusses several techniques for RAM acquisition and categorizes and evaluates them using a model-based approach. The thesis then dives deeper into DMA-based memory acquisition using PCIe and proposes several improvements to current DMA attacks in order to create a better memory acquisition technique. A novel memory acquisition technique is created by hot-plugging aPCIe device and skipping over the regular enumeration procedure. This techniqueal lows the memory acquisition to be executed without a reboot and provides a stealth approach to accessing the memory.  

Resistive Random-Access Memory (RRAM) is an emerging memory technology that has the possibility to compete with mainstream memory technologies such as Dynamic Random-Access Memory (DRAM) and flash memory. The reason why RRAM has not seen mass adoption yet is due to its defect-prone nature. The resistance of RRAM can assume any value within its operating range and its resistance can be divided into five states instead of the regular two logic states. Conventional test techniques are incapable of detecting unique faults due to their inability to distinguish between all five cell states, resulting in a large number of test escapes. Therefore, new test methods, such as Design-For-Testability (DFT), need to be developed to reduce the number of test escapes and ensure customer satisfaction. This work proposes two new DFTs: Parallel-Reference Read (PRR) and Closed-Loop Write (CLW). The PRR DFT is a replacement for the regular read circuit, which enables the detection of all five cell states, while the CLW DFT is an addition to the regular write circuit, which introduces feedback during the write operation. From these two DFTs, the PRR DFT is selected for further development and its design is validated. From the validation, it is concluded that the PRR DFT can detect all five cell states. Moreover, under process variations, the PRR DFT will provide the correct output in 95.90% of the cases. Furthermore, the PRR DFT improves the overall resistive-defect detection capability by 14.79% when compared to a regular read circuit. Finally, the PRR DFT offers 100% identified fault coverage while only requiring 4N write operations, 5N read operations and an area overhead of 14Nc transistors, where N and Nc are the total number of cells and the total number of columns in the RRAM array, respectively.

Resistive RAM, or RRAM, is one of the emerging non-volatile memory (NVM) technologies, which could be used in the near future to fill the gap in the memory hierarchy between dynamic RAM (DRAM) and Flash, or even completely replace Flash. RRAM operates faster than Flash, but is still non-volatile, which enables it to be used in a dense 3D NVM array. It is also a suitable candidate for computation-in-memory, neuromorphic computing and reconfigurable computing. However, the show stopping problem of RRAM is that it suffers from unique defects, which is the reason why RRAM is still not widely commercially adopted. These defects differ from those that appear in CMOS technology, due to the arbitrary nature of the forming process. They can not be detected by conventional tests and cause defective devices to go unnoticed. Therefore, new tests need to be developed that properly include the physics of a defective device in a RRAM model. Device-aware testing (DAT) is the state-of-the-art solution to this problem. By accounting for the unique physics of an RRAM device, DAT is able to detect unique RRAM defects. However, DAT bases its results on relatively compact electrical models, which do not account for randomness present in e.g. the forming of the filament and local temperature fluctuations. Meanwhile, many low-level physical models exist already that can model this randomness and provide accurate insights into the physical specifics of RRAM. These models do, however, hardly ever analyze the effects of defects. The contribution of this work is to expand and improve one of the state-of-the-art physical models to analyse manufacturing defects on a low, near atomic-level scale. For the first time, the characteristics of a defect can be described in the physical shape of the defect, rather than only the electrical consequences of a black box device. This enables deep level analysis and characterization of defects, the results of which improves DAT to detect even more unique defects. The model is applied to four types of RRAM-related defects: oxygen vacancy density fluctuation, oxide thickness variation, electrode roughness, and contamination by impurities. The effect of the defects on the conductivity of the device are observed and explained, and their unique non-linear behavior is confirmed by simulation. Dynamic defects are not yet included, but the model does provide an extensive static characterization of unique RRAM defects, providing insights into their behavior and improving the quality of DAT. Finally, a discussion is presented which criticizes the reproducability of the referenced defect-free model, but also shows the potential of this work's model to be improved.

An increasing amount of critical applications use DRAM as main memory in its computing systems. It it therefore extremely important that these memories function correctly during their lifetime in order to prevent catastrophic failures. Already during the design phase, the reliability of the circuit needs to be predicted so that a reasonable lifetime expectation can be given. Although the importance of reliability analysis is clear, in literature not much research on DRAM reliability is available to designers. This thesis proposes a two phased DRAM reliability prediction model that can be used in the circuit design phase. During the first phase, the circuit performance is analyzed for different wear-out mechanisms affecting different subcomponents in the design. In the second phase, the results of the first phase are then used to determine the reliability of the circuit. In the first phase, the wear-out effects of Bias Temperature Instability (BTI) Hot Carrier Injection (HCI) and radiation trapping as well as transistor mismatch are examined. BTI is modeled using the RD-model, HCI with the lucky electron model, transistor mismatch with Pelgrom’s model. Wear-out caused by radiation trapping is modeled as Gate Induced Drain Leakage (GIDL), the data for which are derived from retention time degradation measurements of an irradiated commercial DRAM. The circuit performance is analyzed per subcomponent of the DRAM design in a range of different metrics. Furthermore, the aging effects on a dwonscaled version of the circuit are investigated. In the second phase, reliability functions are derived from the results from phase one per wear-out mechanism and per subcomponent. These reliability functions are used in an analytical reliability model which yields the overall circuit reliability. The results from the first phase show degradation of the retention time as well as degradation of sensing delay metrics. Due to the relative low duty factor of memory cells, BTI and HCI have minor impact on the memory cell circuit performance. Radiation however, renders the circuit useless once the Total Ionizing Dose (TID) becomes more than 126 krad. On other subcomponents than the memory cells, BTI and HCI shift the reference voltage which results in an increase of retention time. BTI and HCI stressing of the sense amplifier also slightly increases retention time but mainly increases sensing delay. For both reference cells and the sense amplifier it holds that higher radiation doses break down the circuit completely. The same effects hold for the downscaled circuit, although the observed effects are more severe than in the unscaled device. The system reliability prediction in the second phase shows the importance of individual reliability prediction of the subcircuits and wear-out mechanisms. Via the individual analysis, it becomes clear that the system reliability is mostly impacted by the degradation of the sense amplifier delay due to BTI and HCI. Other metric variations, like the increase in retention time caused by the reference cells, have less impact. It was found that the system reliability decreases to 0.84 after 1·108s at a stressing temperature of 300K.

This thesis focuses on identifying and classifying defects in STT-MRAM technology using novel and machine learning approaches. The thesis discusses the basic principles of STT-MRAM and the semiconductor chip manufacturing process and test stages. The research aims to develop novel methods and explore machine-learning approaches to diagnose defects in STT-MRAM devices. The current defect identification methodologies have shown certain cost, speed, and scalability limitations. The thesis presents DAT-based and ML-based Diagnosis methodologies to identify and classify STT-MRAM unique defects to address these challenges. The methods are evaluated and validated on experimental wafers performed at IMEC in Leuven, Belgium. DAT-based Diagnosis involves automated defect identification in STT-MRAM based on identifying features automatically extracted from specialized measurements targeting the unique defects, Pinhole, Intermediate State, SAF Flip, and Back-Hopping. ML-based Diagnosis uses machine learning techniques to classify defects using MTJ features extracted from low-cost measurements. Data collected from electrical measurements on experimental STT-MRAM devices serve as the basis for evaluating the developed methodologies. The thesis also discusses data analysis, including data visualization, feature correlations, and outlier analysis for future research. Furthermore, a machine learning training process is performed, including hyperparameter optimization and evaluation using F-score and B-accuracy metrics to assess the model's performance and the ability to generalize on unseen data. DAT-based Diagnosis aims to maximize the defect detection accuracy at the expense of measurement costs. In contrast, ML-based Diagnosis minimizes the measurement cost while maximizing the detection accuracy for robust and balanced classification. However, the DAT-based Diagnosis is not verified using PFA to validate the defect types identified by the developed methodology. Furthermore, the ML-based Diagnosis uses training data labeled by the unverified DAT-based Diagnosis approach to train machine learning models. Despite these limitations, the results have shown valuable insights into defect identification and classification, proving a robust framework for diagnosing STT-MRAM devices. Additionally, a scientific paper is submitted on march-based diagnosis, adapting the DAT-based Diagnosis method to industrial chips that are limited in extracting the identifying features.

Resistive random access memory (RRAM) is a promising emerging memory technology that offers dense, non-volatile memories that do not consume any static power. Furthermore, RRAMdevices can be written and read out in nanoseconds, and it is possible to use them to performcomputation-in-memory (CIM). These benefits make this technology a potential replacement for Flash or even dynamic random access memory (DRAM). This is also clearly seen by the community; both universities and companies are prototyping RRAMs, and there are already some commercial RRAMs available. In order to deliver high-quality products, the RRAMs need to be tested properly so that a manufacturer can guarantee the quality. This dissertation focuses on test development for RRAMs. Traditionally, production defects in memories, such as DRAM, are modeled as linear resistors in or between two nodes of the circuit. In literature, many researchers have applied a similar approach for RRAMs. However, we demonstrate that this method of modeling defects is inappropriate, because the models fail to describe the defective behavior of the RRAM device. Instead, those models describe defects in the interconnections that surround the RRAM device. To overcome this, we propose the Device-Aware Test (DAT) approach that consists of three steps. First, the approach models the actual physics of defective devices and thus leads to realistic defectmodels. Second, the defect models are used to performaccurate faultmodeling and analysis. Third, the results from this step are used to develop high-quality RRAM tests. We do this by first characterizing the defect. We analyze the complete production process of a RRAM. During this analysis, we identify what can go wrong in every step, and in what kind of defects this may result. All identified defects need to be properly modeled, so that a high-quality test can be developed.Next,we analyze howit affects the performance of a defect-free device, and incorporate the resulting defective behavior in a compact defect model. This model is calibrated and accurately describes the effects of the defect. Second, we apply this defect model in a RRAM circuit to perform fault modeling and analysis. We systematically define the complete space of all faults that could occur, and then apply an analysis methodology to validate which faults actually occur in the circuit. Third, we develop a test for the validated faults. This test only needs to detect faults that are actually sensitized, and thus is shorter than generic tests, while it also has a better fault coverage. We apply the DAT approach to RRAM forming defects and RRAM intermittent undefined state faults. The results show that these two defect models sensitize different faults than the traditional defect models do. Since the DAT defect models describe the actual physics of the defects, we can conclude that the traditional approach will lead to lowquality tests that generate test escapes and reduce the production yield. Furthermore, we demonstrate that the faults cannot easily be detected by existing test algorithms, and that special tests need to be developed to detect them. We also apply the DAT approach to a RRAM-based computation-in-memory (CIM) architecture to develop a test for it. We shows that a CIM device needs to be tested both in its memory and computation configuration, as there are unique faults in both configurations. We define the complete fault space for CIM faults and validate it using the DAT approach. Subsequently, we develop a test that detects the faults in both configurations. Furthermore, we study how process, voltage and temperature variations affect the performance of the CIM architecture. We demonstrate that certain operations are more susceptible to these variations than other ones. @en

Memristive devices are promising candidates as a complement to CMOS devices. These devices come with several advantages such as non-volatility, high density, good scalability, and CMOS compatibility. They enable in-memory computing paradigms since they can be used for both storing and computing. However, building in-memory computing systems using memristive devices is still in an early research stage. Therefore, challenges still exist with respect to the development of devices, circuits, architectures, design automation, and applications. This thesis focuses on developing memristive device-based circuits, their usage in in-memory computing architectures, and design automation methodologies to create or use such circuits. Circuit Level – We propose two logical operation schemes based on memristive devices. The first one uses resistive sensing to perform logical operations. It modifies the sense amplifier in such a way that it can compare the overall current with references and output the logical operation result. During sensing, the resistance of memristive devices remains unchanged. Therefore, endurance and lifetime are not reduced. This scheme provides a solution for maintaining a relatively long lifetime in logic operations for memristive devices that have low endurance. The second scheme is the enhanced version of the first one. It uses two different sensing paths for AND and OR operations. In this way, the correctness of logic operations can be guaranteed even if large resistance variation exists in memristive devices. Architecture Level – We present three in-memory computing architectures based on memristive devices. The first one is a heterogeneous architecture containing an accelerator for vector bit-wise logical operations and a CPU. The accelerator communicates with the CPU or accesses the external memory directly. The second one is to accelerate automata processing. In this architecture, memristive memory arrays store configuration information and conduct computation as well. This architecture outperforms similar ones that are built with conventional memory technologies. The third one is an improved version of the second one. It breaks the routing network into multiple pipeline stages, each processing a different input sequence. In this way, the architecture achieves a higher throughput with a negligible area overhead. Design Automation – A synthesis flow for computation-in-memory architectures and a compiler for automata processors are presented. The synthesis flow is proposed based on the concept of skeletons, which relates an algorithmic structure to a pre-defined solution template. This solution template contains scheduling, placement, and routing information needed for the hardware generation. After the user rewrites the algorithm using skeletons, the tool generates the desired circuit by instantiating the solution template. The automata processor compiler generates configuration bits according to the input automata. It uses multiple strategies to transform given automata, so that constraint conflicts can be resolved automatically. It also optimizes the mapping for storage utilization. @en