Detection of Sequential Trojans in Embedded System Designs Without Scan Chains

Small, low-cost embedded systems implemented as sequential circuits often do not contain scan chains. Malicious trojan circuits, which themselves may be state machines, inserted into such systems are hard to detect. We present an effective methodology to detect sequential trojan circuits inserted into sequential hardware designs without scan chains. The methodology consists of three steps: We use sequential testability metrics, model checking and signal tracing to progressively separate the trojan gates from legitimate circuit gates. We show experimental results demonstrating the effectiveness of the methodology using several test cases.