GrammaTech FVA – FPGA Vulnerability Analysis Tools

GrammaTech FVA is an FPGA design analysis platform that identifies vulnerabilities in FPGA implementations throughout their lifecycle. The tool addresses security concerns introduced through third-party IP, malicious design modifications, configuration data, and automated design tools. FVA performs automated reverse engineering of unknown designs to netlist or configuration files using its Bits2Netlist capability. The platform conducts automated vulnerability analysis to detect hardware Trojans and identify their locations within FPGA designs. It computes vulnerability metrics to quantify design security and provides design rewriting capabilities for hardening assurance techniques. The tool includes automatic high-level extraction to understand structure, IP, state machines, and functions. It performs configurable design analyses on extracted information. FVA provides both a graphical user interface for viewing and interacting with results, as well as a programmatic API for integration into workflows. The platform has been benchmarked on Trojan testbench designs and full-scale FPGA implementations, including OpenTitan, a Xilinx FPGA SoC implementation using over 128,000 LUTs. Analysis times range from 10-20 minutes on average to six hours for very large designs. Testing showed reduced false positives and clear identification of Trojan locations compared to existing vulnerability detection metrics. FVA is delivered as Linux software and libraries with both graphical and command-line interfaces, a Python API, and Xilinx part support data.