This lesson has one job: make the fuse values stick where they matter across the die's whole life. Repair fuses must travel from the tester log to the SRAM wrapper pins at every reset; lifecycle state must advance from manufacture to field without ever retreating; and test modes that bypass security must lock as the lifecycle advances. A repair that applies only on the tester is a yield loss, and a debug port that stays open in the field is a security escape.
Repair flows in three hops: the tester records failing addresses during MBIST, the fuse programmer blows the repair field, and at every reset the shadow registers drive the wrapper repair pins before the first access. The chain is checked end to end, never hop by hop, because each hop looks correct alone while the combination silently drops bits. Lifecycle is a monotonic ladder of NanoSoC teaching states: manufacture, test, OEM provisioning and field, each enabling less than the last. Return (a returned-material analysis state) is not a rung: it is a terminal state, reachable from field only by an authorised command, that never leads back to field, keeps the secrets locked, and opens debug only inside a scoped, logged window. Test mode and scan access live at the top of the ladder and lock below it; the debug infrastructure that remains in the field answers only through the authenticated path the security architecture defines.
State | Repair writable | Test mode | Debug | Rule |
|---|---|---|---|---|
Manufacture | Yes, on tester | Open | Open | No secrets present yet |
Test | Yes, on tester | Open | Open | Repair fields still writable |
Provisioning | No, blown | Restricted | Authenticated | Secrets programmed here |
Field | No | Locked | Authenticated only | Only an authorised command can move on, and only to Return |
Return (terminal) | No | Scoped, authorised window | Authorised, scoped | Reached from Field only; never goes back to Field; secrets stay locked; every reopen is logged |
The repair chain has one end-to-end test: planted fault, tester log, blown fuse model, reset, retest passes.
Lifecycle transitions are monotonic in the controller RTL with an assertion that fires on any retreat, and Return has no outgoing transition.
Every test and debug path names the lifecycle states where it is open, restricted and locked.
Model the full repair chain in simulation with a stuck-at fault: run MBIST, capture the repair address, load it through the fuse model, reset, and confirm the retest passes with the wrapper repair pins showing the expected values. Then attempt each lifecycle retreat in a scratch build and confirm the assertion fires. If repair works on the tester model but not after reset, the shadow-to-wrapper path was never connected.
Authorised move to the terminal return state: authenticated, logged, and scoped to the analysis, with the secrets still locked and no path back to field. Silent unlocks, shared passwords and permanent reopening each convert a debug feature into an attack path.