Extraction of finite state machines from transistor netlists by symbolic simulation

Abstract

Boolean value a, then node q must be initialized to a to avoid unit delay oscillation. Furthermore, the initialization of state nodes and their related nodes has to be done during the appropriate clock phases. This makes this technique very tedious and unsuitable for automation. Kam and Subrahmanyam [12] use Anamos [4] to produce a set of network excitation functions for a switch-level network. These excitation functions are converted to a symbolic transition relation which is then transformed by means of a fixed point computation to yield a transition relation for the phase-level response of the network. Existential quantification to hide the clock yields the cycle-level transition relation. The fixed point computation done in this method computes the steady state phase-level response of a network. Our work shows that a symbolic simulator can compute the steady state phase-level response of a network and do so much more efficiently. As the number of phases increase in a clock cycle, the number of symbolic values introduced to compute the cycle-level transition relation increases. This can lead to very large Ordered Binary Decision Diagrams (OBDDs) [2]. Also for circuits like the one in figure 2, the fixed point computation will never converge [11]. Anamos identifies s1 and q as charge storage nodes and when Phi1 is 0, the circuit will not stabilize for similar initial values on s1 and q. Consider the symbolic values a on node s1 and

Identification of FSM State Registers by Analytics of Scan-Dump Data

“… can be determined by (5). In (5), N = [(Q 2 Q)× 40%]. sort(S)N denotes the N th element of S, where the elements in S are sorted in ascending order magnitude.…”

“…Optimizations and transformations applied at different design abstraction levels impose a natural barrier to recover the original state-space information from the final physical layout or the downstream designs. Because of this, it is claimed that retrieval of the STG or equivalent high-level description of a reasonably large FSM from its circuit netlist is computationally intractable [5]. This postulation is leveraged by adversaries to inflict subtle manipulation on FSM state registers.…”

Identification of State Registers of FSM Through Full Scan by Data Analytics

“…6, for the tree of register r1, node 1 is split by the attribute iN and node 2 is split by i2, so the entries in columns iN and i2 of row d1 are filled with '1' and all other columns of row d1 are filled with '0'. The column sum ij for j ∈ [1, N] in the correlation table is the impact for the register rj according to (1). The registers can then be sorted in descending order of impact.…”

“…Different abstractions and transforms applied in each design level forms a natural barrier to access the original FSM structure from the synthesized design or physical design. It is hence claimed to be computationally intractable to retrieve the FSM structure of a reasonably large design from the downstream design, such as the netlist [1]. Many security-oriented techniques rely on this argument to insert confidential copyright information into the original design by modifying the FSM design at the higher design abstraction level.…”