IPROG is an internal command sent through the ICAPE3 interface that clears the FPGA configuration memory, all flip-flop contents, and key expansion memory, but does not clear the key itself. IPROG is equivalent to the assertion of the external PROGRAM_B pin. This command effectively clears configuration memory (configuration data, block RAM, UltraRAM, and flip-flop states).
After both of the KEYCLEARB and IPROG penalties are invoked, the FPGA becomes inoperable because the existing bitstream can no longer be decrypted by the FPGA. The fact that device configuration is no longer possible with the encrypted bitstream is an indication that a tamper event has occurred. At this point, your design might choose to load in an unencrypted bitstream after the KEYCLEARB and IPROG penalties so that there is some basic functionality without exposing any of the CT. Of course, an unencrypted bitstream cannot be loaded if using an eFUSE-based key and the cfg_aes_only eFUSE is also programmed.
To send an IPROG command to the configuration engine, the ICAPE3 primitive must be instantiated in your design and the appropriate sequence of commands must be written to the ICAPE3. For more information, refer to the IPROG Reconfiguration sections in the UltraScale Architecture Configuration User Guide (UG570).