1 EVALUATION OF THE NEAR-FIELD INJECTION METHOD AT INTEGRATED CIRCUIT LEVEL A. Boyer 1,2, B. Vrignon 3, J. Shepherd 3, M. Cavarroc 1,2 1 CNRS, LAAS, 7 avenue du colonel Roche, F-31400 Toulouse, France 2 Univ. de Toulouse, INSA, LAAS, F-31400 Toulouse, France 3 Freescale Semiconductor, Inc., Toulouse 31023, France
2 Near-field injection - Context Promising method for various applications such as electromagnetic attacks on secured circuits (e.g. Differential Failure Analysis) or investigations of integrated circuits (ICs) susceptibility to electromagnetic disturbances. This method has been mainly used for analysis of IC susceptibility with injection coupled at PCB or package level. What about the performances of direct near-field injection at die level? What is the nature of the coupling between injection probe and IC under test? E-Mata-Hari Project
3 Near-field injection test bench RF signal / Pulse generator Disturbance generator control Near field probe Power amplifier (50 W) Direc3onal coupler Scan table Positioning control IC status IC die Bonding wire IC monitoring
4 Near-field injection probes Miniature and wideband antennas which produce either intense electric or magnetic fields in their vicinity. They are usually based on small loops and opened tips. Two figures of merit: ü Resolution (distinction of the effect between to adjacent lines) ü Injection efficiency (coupled voltage vs. probe excitation) Two handmade probes are tested: Probe name H1 E1 Nature Magnetic Electric Field orientation Tangential Normal Construction Semi-rigid coaxial based (RG405) Wire diameter 0.45 mm 0.45 mm Loop diameter 2.5 mm _ Tip length _ 3.1 mm 3 db resolution 0.65 mm 0.8 mm Coupling on a 50 mm long 0.15 mm wide microstrip line. termination. Scan altitude = 0.4 mm. P RF = 13 dbm
5 Experimental set-up test chip Test chip designed with Freescale 0.25 µm SMARTMOS Contains various interconnect structures with high frequency on-chip voltage sensors (OCS) to measure local voltage fluctuations induced by the near-field injection Mounted in CQFP64 package with a removable metallic lid Analog pad connected to V ref Line 0 µm Metal 2 connected to V ref Line 0.455 µm Line 5.5 µm Line 10 µm Line30µm Line70µm On-chip sensors Line120µm Line320µm Bandgap V ref Struct1 15 14 13 12 Y (mm) Lines 0 & 0.455 µm pad & bonding Line 120 µm Line 320 µm Struct1 11 12 13 14 X (mm)
6 Experimental set-up OCS Ext. acquisition card - Sensor control Synchronization reference Disturbance generator Near-field probe Delay control Delay cell ü ü ü ü On-chip sensor Sampling command S/H cell Bandwidth: 2.7 GHz Time resolution up to 100 ps Measurement uncertainty +/- 2mV Supply an internal voltage regulator, deep N-well isolation, top metal layer shielding Amplifier IC interconnect Ext. acquisition card - Post-processing & Signal reconstruction Voltage bounce measured on IC interconnect Extraction of disturbance amplitude/phase map
Injection with magnetic field probe Scan at 1.4 GHz, P RF = 43 dbm, Scan altitude = 400 µm, Scan step = 50 µm, two orthogonal probe orientations 7 H H Struct1 Struct1 V REF pad 300 µm Evolution of the voltage coupled on Struct1 lines vs probe position Separation of two lines separated by more than 100 µm
Injection with magnetic field probe 8 Evolution of the coupled voltage vs. Scan altitude (F=400 MHz, P RF = 43 dbm) Evolution of the coupled voltage vs. disturbance frequency (P RF = 43 dbm, scan altitude = 400 µm) Injection efficiency increases with frequency Asymptotic behavior above 100 MHz in +10 db/dec (due to loss e.g. P+ substrate)
Injection with electric field probe Scan at 1.4 GHz, P RF = 43 dbm, Scan altitude = 400 µm 9 Struct1 Global injection, no separation between the different lines of Struct1. Current injection on V REF plane Nearly constant coupling up to 1.5 GHz.
Magnetic field injection modeling Frequency domain modeling 10 H field probe electrical model RF generator I RF (f) Probe model Emitted magnetic field I RF H ü Magnetic dipole model ü Numerical integration:! jβr e A( P) = µ 0I dl 4πr! H probe 1 µ! ( P) = A( P) 0 IC interconnect model ü RLCG model Load model IC lines V REF plane SiO 2 Si P+ substrate Field coupling modeling ü Taylor model: ( f ) = jωµ H ( x) Vinduced 0 line SPICE model tg h line dx
Magnetic field injection modeling Simulation of the frequency evolution of the coupled voltage during injection with magnetic field probe Scan altitude = 400 µm, harmonic disturbance, P RF = 20 W 11 The frequency behaviour of the coupling is predicted correctly.
12 Conclusion Near-field injection method at die level is very promising for electromagnetic attacks on secured ICs or investigations of susceptibility to electromagnetic disturbances. Magnetic field probes provide a resolution sufficient to distinguish the coupling between two lines separated by 100 µm (dependent on scan altitude). Magnetic field probes are enough efficient to trigger failures in digital/analog circuits. Pulsed disturbances are recommended to ensure high excitation current without excessive heating. The nature of the coupling is predicted correctly.