Inserting malicious sub-circuits that may destroy a logical circuit or provide leakage of confidential information from a system containing the logical circuit demands detection of such sub-circuits followed their masking if possible. We suggest a method of finding a set of sequential circuit nodes in which Trojan Circuits (TC) may be inserted. After simulating the sequential circuit on the proper input sequences we may find TC if it is present and mask it by the special sub-circuit. The method is based on applying the precise (not heuristic) random estimations of internal nodes control-lability and observability calculated with using a structural description of the combinational part of the sequential cir-cuit. These estimations are computed with applying a State Transition Graph (STG) description, if we suppose that TC may be inserted out of the working area (out of the specification) of the sequential circuit. In addition the algorithms of transfer sequence detection for a set of internal states are used. Reduced Ordered Binary Decision Diagrams (ROBDDs) for the combinational part and its fragments are applied for getting both the estimations and transfer se-quences by means of operations on ROBDDs. It is known that these operations have a polynomial complexity. Note that if TCs are inserted out of the working area, they cannot be detected both under verification and testing in the working area. Techniques of masking TCs are proposed. The experimental results on ISCAS and MCNC benchmarks show applicability of the approach. Masking sub-circuits overhead is appreciated.