Error detection/correction and fault detection/recovery – Pulse or data error handling – Digital logic testing
Reexamination Certificate
2002-03-25
2004-04-20
Moise, Emmanuel L. (Department: 2133)
Error detection/correction and fault detection/recovery
Pulse or data error handling
Digital logic testing
C714S727000, C714S729000, C714S732000, C714S030000
Reexamination Certificate
active
06725407
ABSTRACT:
BACKGROUND OF THE INVENTION
Field of the Invention
The invention relates to a method and a configuration for protecting data during a self-test of a microcontroller. The configuration is in the form of an integrated circuit.
For the manufacture of integrated circuits (ICs), the production test is an aspect that plays a crucial part in the overall determination of the quality. Normally, the production test is performed by stimulating the integrated circuits on a test system using a multiplicity of test patterns on the input pins of the ICs, measuring the test responses on the output pins of the ICs, and comparing them with the nominal values stored in the test system.
This presents a problem for a particular class of ICs, the “security ICs”, as are used for data encryption or for the hardware-based protection of transfer protocols, for example. In the case of these ICs, configuration and operation are subject to certain security requirements that—couched in simple terms—require that the internal circuit elements of the IC must not be able to be accessed by unauthorized parties via the pins of the IC. For this reason, the test method outlined cannot be applied in this instance, since knowledge and storage of input data and of the associated nominal output data in a test system or a PC, for example, would allow the configuration and operation of the IC to be inferred. Nevertheless, a suitable production test needs to be conducted for this class of ICs too.
To solve this problem, self-tests (BIST, Built-In Self-Test) have been developed. A self-test normally requires only a start signal to be specified; after a prescribed time, the test response conditioned in the IC can then be read out. Since this test response contains the compression of a large number of individual test results to form a single data record, it is generally not possible for the configuration and operation of the IC to be inferred from this test response.
To implement a self-test, two different approaches can be distinguished for microcontrollers: A self-test containing the execution of a test program stored in the microcontroller itself; and a self-test such as described in IEEE standard 1149.1 “Standard Test Access Port and Boundary-Scan Architecture” under the term “RUNBIST” as an optional function.
The fundamental advantage of a self-test using a test program stored in the microcontroller itself is that the test program can check the authorization to perform the self-test in a variety of ways before the actual test is performed. This can be done, inter alia, by the external input of a password that is compared with a nominal value stored in the microcontroller, the self-test being started only if the result of the check is positive.
However, the approach using a test program stored in the microcontroller itself generally has substantial drawbacks. One drawback is that software cannot stimulate or observe all of the circuit elements within the microcontroller. The result of this is that the quality of the production test is not sufficiently high. Also, the additionally integrated memory required for the test instructions increases the chip area. Another drawback is that the execution of a test program—as compared with a normal test using a test machine—is generally at least ten times slower.
The approach via the self-test using the boundary scan described in IEEE standard 1149.1, for example, generally solves the problem of the accessibility of internal circuit nodes, since in this case all of the inputs and outputs of the IC are involved in the generation of test patterns and test responses. However, this self-test satisfies only minor security requirements, because the generation of test patterns takes place internally but the test responses are emitted serially by the boundary scan, and the flow control of the self-test by the standardized TAP controller can be altered from the outside at any time. Thus, a “hacker” could misuse this self-test in order to access secrets in the chip. To do so, he would repeat the self-test as often as desired, but would constantly and systematically vary the duration of the self-test by the number of clock cycles which keeps the system in the “Run-Test/Idle” state and would infer the chip content from the results which are then read out in each case. The control signals needed for this are freely accessible externally in line with the IEEE standard, and there is no kind of protection against such “spying”.
SUMMARY OF THE INVENTION
It is accordingly an object of the invention to provide a method and configuration for protecting data during a self-test of a microcontroller that overcomes the hereinaforementioned disadvantages of the heretofore-known devices of this general type and that allow a full and fast self-test that is protected against hacking attempts.
With the foregoing and other objects in view, there is provided, in accordance with the invention, a method for protecting data while self-testing a microcontroller and testing circuit elements within the microcontroller, a course of the self-test not being alterable via an external pin, and no intermediate results being passed to the outside. The method includes the step of providing the microcontroller with a boundary scan having registers. The next step is storing a built-in self-test (BIST) in the microcontroller. The next step is generating test patterns within the microcontroller with the BIST by using the registers of the boundary scan.
With the objects of the invention in view, there is also provided an integrated circuit configuration for protecting data during a self-test for a microcontroller including devices for starting the self-test and for performing the self-test internally. The self-test covers all fundamental elements of the microcontroller and outputs a corresponding test response. The configuration includes devices for storing a self-test program. In addition, the configuration includes devices for isolating external input and output devices from the devices for performing the self-test throughout execution of the self-test.
Accordingly, the microcontroller has a boundary scan, preferably in line with IEEE standard 1149.1. However, only the obligatory test instructions listed in the IEEE standard are implemented, as are provided for the production test on a printed circuit board (and not on the IC), in line with the intention of the boundary scan.
The BIST now uses the registers of the boundary scan in order to generate pseudo-random test patterns within the chip and to compress test responses. Since the boundary scan register encompasses the entire logic of the chip as far as the input and output cells, it is optimally suited to reaching a maximum number of internal circuit nodes using the self-test, which is in turn a prerequisite for the greatest possible fault coverage and hence quality of the production test.
In accordance with the invention, this BIST is not started directly from the outside (e.g. by the instruction “RUNBIST”, as indicated in the IEEE standard), however, but rather with the microcontroller. Beforehand, the microcontroller checks the authorization to perform the self-test. During the self-test, the microcontroller monitors correct execution of the self-test, which includes not allowing the self-test to be interrupted. This also includes not accepting any test instructions during the BIST using the boundary scan (in line with the IEEE standard), that is to say the TAP controller indicated in the IEEE standard is thus decoupled from the boundary scan cells by using logic. At the end of the test, the compressed test response can either be output by the microcontroller or can be compared with a nominal response stored in a read only memory in the microcontroller.
Thus, in principle, the invention combines the two known approaches and the associated logic sequence while preserving the advantages. First, the test program integrated in the microcontroller checks the authorization to execute the self-test. If this condition is satisfied, the test program starts the self-test by decoup
Otterstedt Jan
Richter Michael
Greenberg Laurence A.
Infineon - Technologies AG
Mayback Gregory L.
Moise Emmanuel L.
Stemer Werner H.
LandOfFree
Method and configuration for protecting data during a... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method and configuration for protecting data during a..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method and configuration for protecting data during a... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3255879