Standard CAD T ool-Based Method for Simulation of Laser-Induced - - PowerPoint PPT Presentation

▶
standard cad t ool based method for simulation of laser
SMART_READER_LITE
LIVE PREVIEW

Standard CAD T ool-Based Method for Simulation of Laser-Induced - - PowerPoint PPT Presentation

Jan 05, 2024 192 likes •1.54k views

ISPD'18 March 28, 2018 Standard CAD T ool-Based Method for Simulation of Laser-Induced Faults in Large-Scale Circuits Raphael Viera - raphael@ieee.org Philippe Maurine, Jean-Max Dutertre and Rodrigo Bastos ISPD'18 March 28, 2018 Standard

slide-1
SLIDE 1

Standard CAD T

  • ol-Based Method for Simulation
  • f Laser-Induced Faults in Large-Scale Circuits

Raphael Viera - raphael@ieee.org Philippe Maurine, Jean-Max Dutertre and Rodrigo Bastos

ISPD'18

March 28, 2018

slide-2
SLIDE 2

Standard CAD T

  • ol-Based Method for Simulation
  • f Laser-Induced Faults in Large-Scale Circuits

Raphael Viera - raphael@ieee.org Philippe Maurine, Jean-Max Dutertre and Rodrigo Bastos

ISPD'18

March 28, 2018

slide-3
SLIDE 3

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-4
SLIDE 4

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-5
SLIDE 5

Why attack?

Fault Attacks on Secure Devices

01

slide-6
SLIDE 6

Why attack?

Fault Attacks on Secure Devices

Theft of service

01

slide-7
SLIDE 7

Why attack?

Fault Attacks on Secure Devices

Theft of service ID theft

01

slide-8
SLIDE 8

Why attack?

Fault Attacks on Secure Devices

Theft of service ID theft Denial of service Cloning, etc.

01

slide-9
SLIDE 9

Why attack?

Fault Attacks on Secure Devices

Theft of service ID theft Denial of service Cloning, etc. Means to attack are being constantly improved

01

slide-10
SLIDE 10

Why attack?

Fault Attacks on Secure Devices

Theft of service ID theft Denial of service Cloning, etc. Means to attack are being constantly improved Means to defend are being constantly improved

01

slide-11
SLIDE 11

Why attack?

Fault Attacks on Secure Devices

Theft of service ID theft Denial of service Cloning, etc. Means to attack are being constantly improved Means to defend are being constantly improved

Growing demand for secure chips:

Banking industry, service providers, military applications, etc.

01

slide-12
SLIDE 12

Categories and Methods

02

slide-13
SLIDE 13

Side-channel Software Non-invasive Power / Clock Glitches

1 88 88 88 88 88 88 NNNNNNNNNNN BBBBBBBBB EMISE LE 08/01/2005

carte d'assurance maladie

vitale

Control, Cyphertexts Cryptographic device (e.g., smart card and reader) Computer Control, Waveform data

Input

Oscilloscope

Picture by Mark Pellegrini [LGPL (http://www.gnu.org/licenses/lgpl.html), GFDL (http://www.gnu.org/copyleft/fdl.html)]

Categories and Methods

02

slide-14
SLIDE 14

Laser Fault injection Semi-invasive

Photo: http://www.nscnet.co.jp/e/pdt/ba102.html

Categories and Methods

02

slide-15
SLIDE 15

Microprobing Invasive

Photo: https://www.maschinewerkzeug.de/business-karriere/uebersicht/artikel/1130365

Al Al Al Probe

Passivation

Categories and Methods

02

slide-16
SLIDE 16

This work focuses on...

03

slide-17
SLIDE 17

Laser based attack

04

slide-18
SLIDE 18

Laser based attack

Effective and accurate fault injection tool

04

slide-19
SLIDE 19

Laser based attack

Effective and accurate fault injection tool

How to defend?

04

slide-20
SLIDE 20

Laser based attack

Effective and accurate fault injection tool

How to defend? Detection Design robust circuits

04

slide-21
SLIDE 21

Laser based attack

Effective and accurate fault injection tool

How to defend? Detection Design robust circuits Simulate the effects of laser shots on ICs

04

slide-22
SLIDE 22

Laser based attack

Effective and accurate fault injection tool

How to defend? Detection Design robust circuits Simulate the effects of laser shots on ICs Importance of having accurate laser-fault injection models

04

slide-23
SLIDE 23

In this presentation Laser-induced transient fault model with IR-drop contribution

[DSD'17]

05

slide-24
SLIDE 24

Methodology to simulate the effects of laser shots on ICs In this presentation Laser-induced transient fault model with IR-drop contribution

[DSD'17]

05

slide-25
SLIDE 25

Methodology to simulate the effects of laser shots on ICs Analyse the impact of laser-induced IR-drop in the fault injection process In this presentation Laser-induced transient fault model with IR-drop contribution

[DSD'17]

05

slide-26
SLIDE 26

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-27
SLIDE 27

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-28
SLIDE 28

CLoad '0' '1' '0'

>> IPh 2 - Classical model of laser fault injection and its limits

2.1 - Modeling laser effects on ICs

Classical model for simulating laser-induced transient currents on ICs

06

slide-29
SLIDE 29

CLoad '0' '1' '0'

>> IPh 2 - Classical model of laser fault injection and its limits

2.1 - Modeling laser effects on ICs

Classical model for simulating laser-induced transient currents on ICs

06

CLoad '1'

>> IPh

'1' '0'

slide-30
SLIDE 30

CLoad '0' '1' '0'

>> IPh 2 - Classical model of laser fault injection and its limits

2.1 - Modeling laser effects on ICs

Classical model for simulating laser-induced transient currents on ICs

06

CLoad '1'

>> IPh

'1' '0'

sensitive areas (reverse biased PN junction between the drain and the substrate)

slide-31
SLIDE 31

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5 2 - Classical model of laser fault injection and its limits

2.1 - Modeling laser effects on ICs

Spatial distribution of the laser-induced photocurrent

5µm

07

slide-32
SLIDE 32

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5 2 - Classical model of laser fault injection and its limits

2.1 - Modeling laser effects on ICs

Spatial distribution of the laser-induced photocurrent

5µm

07

Itransient (µA) t (ps)

  • A. Sarafianos et al., “Building the electrical model of the pulsed photoelectric

laser stimulation of an nmos transistor in 90nm technology”

peak

slide-33
SLIDE 33

Standard cell(s) illuminated by a 5μm laser spot diameter

A Z

tech: 250 nm

12.5 μm

2 - Classical model of laser fault injection and its limits

2.2 - Limits of the classical transient fault model

08

slide-34
SLIDE 34

Standard cell(s) illuminated by a 5μm laser spot diameter

A Z

tech: 250 nm

12.5 μm

2 - Classical model of laser fault injection and its limits

2.2 - Limits of the classical transient fault model

08

tech: 28 nm

1.2 μm

slide-35
SLIDE 35

Standard cell(s) illuminated by a 5μm laser spot diameter

A Z

tech: 250 nm

12.5 μm

2 - Classical model of laser fault injection and its limits

2.2 - Limits of the classical transient fault model

08

tech: 28 nm

1.2 μm

5 μm 5 μm

slide-36
SLIDE 36

Standard cell(s) illuminated by a 5μm laser spot diameter

A Z

tech: 250 nm

12.5 μm

2 - Classical model of laser fault injection and its limits

2.2 - Limits of the classical transient fault model

08

tech: 28 nm

1.2 μm

5 μm 5 μm How does the standard cell height influence in the fault injection process?

slide-37
SLIDE 37

Case 1: Only NMOS transistors are illuminated by the laser beam

2 - Classical model of laser fault injection and its limits

2.2 - Limits of the classical transient fault model

A Z

tech: 250 nm

12.5 μm CLoad '0' '1'

09

slide-38
SLIDE 38

Case 1: Only NMOS transistors are illuminated by the laser beam

2 - Classical model of laser fault injection and its limits

2.2 - Limits of the classical transient fault model

A Z

tech: 250 nm

12.5 μm CLoad '0' '1'

09

5 μm

'0'

>> IPh

slide-39
SLIDE 39

Case 1: Only NMOS transistors are illuminated by the laser beam

2 - Classical model of laser fault injection and its limits

2.2 - Limits of the classical transient fault model

A Z

tech: 250 nm

12.5 μm CLoad '0' '1'

09

5 μm

'0'

>> IPh

Weak laser-induced currents in the Nwell-Psub junction (classical model is OK)

slide-40
SLIDE 40

2 - Classical model of laser fault injection and its limits

2.2 - Limits of the classical transient fault model

Case 2:

NMOS and PMOS transistors are always illuminated by the laser beam

tech: 28 nm

1.2 μm CLoad '0' '1'

10

slide-41
SLIDE 41

2 - Classical model of laser fault injection and its limits

2.2 - Limits of the classical transient fault model

Case 2:

NMOS and PMOS transistors are always illuminated by the laser beam

tech: 28 nm

1.2 μm CLoad '0' '1'

10

5 μm

'0'

>> IPh

slide-42
SLIDE 42

2 - Classical model of laser fault injection and its limits

2.2 - Limits of the classical transient fault model

Case 2:

NMOS and PMOS transistors are always illuminated by the laser beam

tech: 28 nm

1.2 μm CLoad '0' '1'

10

5 μm

'0'

>> IPh

Laser-induced currents in the Nwell-Psub junction (classical model is incomplete)

slide-43
SLIDE 43

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-44
SLIDE 44

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-45
SLIDE 45

Upgraded Electrical Model

3.1 - Upgraded electrical model

Classical Model

3 - Proposed model

13

slide-46
SLIDE 46

Upgraded Electrical Model

3.1 - Upgraded electrical model

Classical Model

3 - Proposed model

13

slide-47
SLIDE 47

Upgraded Electrical Model

3.1 - Upgraded electrical model

Classical Model

3 - Proposed model

13 CLoad '1' '0'

>> '1'

IPpsub_nwel IPh

Power grid model Power grid model

CLoad '1' '0'

>> '1'

IPh

slide-48
SLIDE 48

Upgraded Electrical Model

3.1 - Upgraded electrical model

Classical Model

3 - Proposed model

13 CLoad '1' '0'

>> '1'

IPpsub_nwel IPh

Power grid model Power grid model

CLoad '1' '0'

>> '1'

IPh

J.M. Dutertre et al., “Improving the ability of Bulk Built-In Current Sensors to detect Single Event Effects by using triple-well CMOS

(>10)

slide-49
SLIDE 49

Upgraded Electrical Model

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

3 - Proposed model

3.1 - Upgraded electrical model

(>10) 13

slide-50
SLIDE 50

Upgraded Electrical Model

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

3 - Proposed model

3.1 - Upgraded electrical model

(>10) 13

Main issue: dimensioning the RC network!

1V 1V

slide-51
SLIDE 51

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-52
SLIDE 52

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-53
SLIDE 53

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform electrical simulation for a laser spot location (x,y) 8 END

4 - Simulation methodology

14

slide-54
SLIDE 54

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform electrical simulation for a laser spot location (x,y) 8 END

4 - Simulation methodology

14

slide-55
SLIDE 55

Define simulation parameters 1

Laser beam diameter - Laser shot power

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

5µm

4 - Simulation methodology

14

slide-56
SLIDE 56

Define simulation parameters 1

Laser beam diameter - Laser shot power

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

5µm

Itransient (µA) t (ps)

Peak value defined by (1) = IPh_peak

Fall time Rise time

Laser shot duration 4 - Simulation methodology

14

slide-57
SLIDE 57

Define simulation parameters 1

Laser beam diameter - Laser shot power

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

5µm

Itransient (µA) t (ps)

Peak value defined by (1) = IPh_peak

Fall time Rise time

Laser shot duration Time at which the laser shot occurs w.r.t. the zero of the simulation

Time (ns)

0.5 1 1.5 2 2.5 3

Volts

CLK

0.5 1

µA

Ipeak

4 - Simulation methodology

14

slide-58
SLIDE 58

Define simulation parameters 1

Laser beam diameter - Laser shot power

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

5µm

Itransient (µA) t (ps)

Peak value defined by (1) = IPh_peak

Fall time Rise time

Laser shot duration Time at which the laser shot occurs w.r.t. the zero of the simulation

Time (ns)

0.5 1 1.5 2 2.5 3

Volts

CLK

0.5 1

µA

Ipeak

X axis (µm) Y axis (µm)

110 70

5µm 5µm

(X, Y ) displacement step of the laser spot when one aims to draw a fault sensitivity map 4 - Simulation methodology

14

slide-59
SLIDE 59

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform electrical simulation for a laser spot location (x,y) 8 END

4 - Simulation methodology

15

slide-60
SLIDE 60

SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

2 ARM 7 - 5.21 k instances

Cadence Voltus

4 - Simulation methodology

15

slide-61
SLIDE 61

SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

2 ARM 7 - 5.21 k instances

Cadence Voltus

DFF

4 - Simulation methodology

15

slide-62
SLIDE 62

SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

2 ARM 7 - 5.21 k instances

Cadence Voltus

DFF

1V 1V

4 - Simulation methodology

15

slide-63
SLIDE 63

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform electrical simulation for a laser spot location (x,y) 8 END

4 - Simulation methodology

16

slide-64
SLIDE 64

Set the (x,y) spatial location of the laser spot 3

X axis (µm) Y axis (µm)

110 70

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

4 - Simulation methodology

16

slide-65
SLIDE 65

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform electrical simulation for a laser spot location (x,y) 8 END

4 - Simulation methodology

17

slide-66
SLIDE 66

Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

1.2 μm

100%

5 μm 5 μm

85% 20%

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

4 - Simulation methodology

17

slide-67
SLIDE 67

Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

1.2 μm

100%

5 μm 5 μm

85% 20%

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

A Z

4 - Simulation methodology

17

slide-68
SLIDE 68

Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

1.2 μm

100%

5 μm 5 μm

85% 20%

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

A Z

0.5 μm 0.6 μm

Nwell Nwell area: 0.30 μm2 4 - Simulation methodology

17

slide-69
SLIDE 69

Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

1.2 μm

100%

5 μm 5 μm

85% 20%

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

A Z

0.5 μm 0.6 μm

Nwell Nwell area: 0.30 μm2

0.3 μm 0.1 μm

Drain NMOS Drain area: 0.03 μm2 4 - Simulation methodology

17

slide-70
SLIDE 70

Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

1.2 μm

100%

5 μm 5 μm

85% 20%

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

A Z

0.5 μm 0.6 μm

Nwell Nwell area: 0.30 μm2

0.3 μm 0.1 μm

Drain NMOS Drain area: 0.03 μm2 0.30 μm2 0.03 μm2 10.00 4 - Simulation methodology

17

slide-71
SLIDE 71

Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

1.2 μm

100%

5 μm 5 μm

85% 20%

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

A Z

0.5 μm 0.6 μm

Nwell Nwell area: 0.30 μm2

0.3 μm 0.1 μm

Drain NMOS Drain area: 0.03 μm2 0.30 μm2 0.03 μm2 10.00

create_current_region -current {1.500ns 0.000mA 1.505ns 0.820mA 1.510ns 1.000mA 1.515ns 0.950mA ... 1.800ns 0.000mA} -layer M2 -intrinsic_cap C -loading_cap C -region "1.50 1.50 1.75 1.75"

Itransient (µA) t (ps)

4 - Simulation methodology

17

slide-72
SLIDE 72

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform electrical simulation for a laser spot location (x,y) 8 END

4 - Simulation methodology

18

slide-73
SLIDE 73

Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5

Spot pos. 130 U205: 0.554 V U1942: 0.554 V U1088: 0.555 V

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

1 1.2 1.4 1.6 1.8 2.0 2.2 2.4 2.6 2.8 3 Time (ns) VDD and GND (V)

Voltage swing = 554 mV

X axis (µm) Y axis (µm)

110 70

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

Perform IR drop analysis for a laser spot location (x,y)

Voltage Swing

4 - Simulation methodology

18

slide-74
SLIDE 74

Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5

Spot pos. 130 U205: 0.554 V U1942: 0.554 V U1088: 0.555 V

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

1 1.2 1.4 1.6 1.8 2.0 2.2 2.4 2.6 2.8 3 Time (ns) VDD and GND (V)

Voltage swing = 554 mV

X axis (µm) Y axis (µm)

110 70

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

Perform IR drop analysis for a laser spot location (x,y)

Voltage Swing

X axis (µm) Y axis (µm)

110 70

Spot pos. 132 Voltage Swing U205: 0.670 V U1942: 0.677 V U1088: 0.669 V

4 - Simulation methodology

18

slide-75
SLIDE 75

Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5

Spot pos. 130 U205: 0.554 V U1942: 0.554 V U1088: 0.555 V

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

1 1.2 1.4 1.6 1.8 2.0 2.2 2.4 2.6 2.8 3 Time (ns) VDD and GND (V)

Voltage swing = 554 mV

X axis (µm) Y axis (µm)

110 70

7.5 2.5 2.5 7.5 7.5 2.5 2.5 7.5 20 40 60 80 100

Distance (µm) Distance (µm) Beam intensity (%)

5 5 5 5

Perform IR drop analysis for a laser spot location (x,y)

Voltage Swing

X axis (µm) Y axis (µm)

110 70

Spot pos. 132 Voltage Swing U205: 0.670 V U1942: 0.677 V U1088: 0.669 V

X axis (µm) Y axis (µm)

110 70

Voltage Swing U205: 0.815 V U1942: 0.818 V U1088: 0.814 V Spot pos. 139

4 - Simulation methodology

18

slide-76
SLIDE 76

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform electrical simulation for a laser spot location (x,y) 8 END

4 - Simulation methodology

19

slide-77
SLIDE 77

Replace the nominal supply voltage from the original netlist 6

U527 (net21866 n134 gnd! gnd! vdd! vdd!) STD_CELL_IVX8 (original) input

  • utput

pwell nwell instance std cell

4 - Simulation methodology

19

slide-78
SLIDE 78

Replace the nominal supply voltage from the original netlist 6

U527 (net21866 n134 gnd! gnd! vdd! vdd!) STD_CELL_IVX8 (original) input

  • utput

pwell nwell instance std cell U527 (net21866 n134 GND_U527 GND_U527 VDD_U527 VDD_U527) STD_CELL_IVX8

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

1 1.2 1.4 1.6 1.8 2.0 2.2 2.4 2.6 2.8 3 Time (ns) VDD and GND (V)

Voltage swing = 554 mV

CLoad '1' '0'

>> '1'

IPpsub_nwel

Power-grid Model Power-grid Model

4 - Simulation methodology

19

slide-79
SLIDE 79

Replace the nominal supply voltage from the original netlist 6

U527 (net21866 n134 gnd! gnd! vdd! vdd!) STD_CELL_IVX8 (original) input

  • utput

pwell nwell instance std cell U527 (net21866 n134 GND_U527 GND_U527 VDD_U527 VDD_U527) STD_CELL_IVX8

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

1 1.2 1.4 1.6 1.8 2.0 2.2 2.4 2.6 2.8 3 Time (ns) VDD and GND (V)

Voltage swing = 554 mV

CLoad '1' '0'

>> '1'

IPpsub_nwel

Power-grid Model Power-grid Model

VU527_VDD (vdd! VDD_U527) vsource type=pwl val0=0 wave=[ 1.5n 1 ... 1.65 0.78 ... tn vn ]

4 - Simulation methodology

19

slide-80
SLIDE 80

Replace the nominal supply voltage from the original netlist 6

U527 (net21866 n134 gnd! gnd! vdd! vdd!) STD_CELL_IVX8 (original) input

  • utput

pwell nwell instance std cell U527 (net21866 n134 GND_U527 GND_U527 VDD_U527 VDD_U527) STD_CELL_IVX8

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

1 1.2 1.4 1.6 1.8 2.0 2.2 2.4 2.6 2.8 3 Time (ns) VDD and GND (V)

Voltage swing = 554 mV

CLoad '1' '0'

>> '1'

IPpsub_nwel

Power-grid Model Power-grid Model

VU527_VDD (vdd! VDD_U527) vsource type=pwl val0=0 wave=[ 1.5n 1 ... 1.65 0.78 ... tn vn ] VU527_GND (GND_U527 gnd!) vsource type=pwl val0=0 wave=[ 1.5n 0 ... 1.68 0.23 ... tn vn ]

4 - Simulation methodology

19

slide-81
SLIDE 81

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform electrical simulation for a laser spot location (x,y) 8 END

4 - Simulation methodology

20

slide-82
SLIDE 82

Add IPh current to each cell in the circuit 7

U527 (net21866 n134 GND_U527 GND_U527 VDD_U527 VDD_U527) STD_CELL_IVX8 VU527_GND (GND_U527 gnd!) vsource type=pwl val0=0 wave=[ 1.5n 0 ... 1.68 0.23 ... tn vn ] VU527_VDD (vdd! VDD_U527) vsource type=pwl val0=0 wave=[ 1.5n 1 ... 1.65 0.78 ... tn vn ] U527 (net21866 n134 gnd! gnd! vdd! vdd!) STD_CELL_IVX8

CLoad '1' '0'

>> '1'

IPpsub_nwel

Power-grid Model Power-grid Model

4 - Simulation methodology

20

slide-83
SLIDE 83

Add IPh current to each cell in the circuit 7

U527 (net21866 n134 GND_U527 GND_U527 VDD_U527 VDD_U527) STD_CELL_IVX8 VU527_GND (GND_U527 gnd!) vsource type=pwl val0=0 wave=[ 1.5n 0 ... 1.68 0.23 ... tn vn ] VU527_VDD (vdd! VDD_U527) vsource type=pwl val0=0 wave=[ 1.5n 1 ... 1.65 0.78 ... tn vn ] U527 (net21866 n134 gnd! gnd! vdd! vdd!) STD_CELL_IVX8

CLoad '1' '0'

>> '1'

IPpsub_nwel

Power-grid Model Power-grid Model

Time (ns)

0.5 1 1.5 2 2.5 3

Volts

CLK

0.5 1

µA

Ipeak

IU527_VDD (VDD_U527 n134) isource dc=0 type=exp val0=0 td1=fstart

IPh

4 - Simulation methodology

20

slide-84
SLIDE 84

Add IPh current to each cell in the circuit 7

U527 (net21866 n134 GND_U527 GND_U527 VDD_U527 VDD_U527) STD_CELL_IVX8 VU527_GND (GND_U527 gnd!) vsource type=pwl val0=0 wave=[ 1.5n 0 ... 1.68 0.23 ... tn vn ] VU527_VDD (vdd! VDD_U527) vsource type=pwl val0=0 wave=[ 1.5n 1 ... 1.65 0.78 ... tn vn ] U527 (net21866 n134 gnd! gnd! vdd! vdd!) STD_CELL_IVX8

CLoad '1' '0'

>> '1'

IPpsub_nwel

Power-grid Model Power-grid Model

Time (ns)

0.5 1 1.5 2 2.5 3

Volts

CLK

0.5 1

µA

Ipeak

IU527_VDD (VDD_U527 n134) isource dc=0 type=exp val0=0 td1=fstart

IPh

tau1=rise_time

4 - Simulation methodology

20

slide-85
SLIDE 85

Add IPh current to each cell in the circuit 7

U527 (net21866 n134 GND_U527 GND_U527 VDD_U527 VDD_U527) STD_CELL_IVX8 VU527_GND (GND_U527 gnd!) vsource type=pwl val0=0 wave=[ 1.5n 0 ... 1.68 0.23 ... tn vn ] VU527_VDD (vdd! VDD_U527) vsource type=pwl val0=0 wave=[ 1.5n 1 ... 1.65 0.78 ... tn vn ] U527 (net21866 n134 gnd! gnd! vdd! vdd!) STD_CELL_IVX8

CLoad '1' '0'

>> '1'

IPpsub_nwel

Power-grid Model Power-grid Model

Time (ns)

0.5 1 1.5 2 2.5 3

Volts

CLK

0.5 1

µA

Ipeak

IU527_VDD (VDD_U527 n134) isource dc=0 type=exp val0=0 td1=fstart

IPh

tau1=rise_time val1=154.69u

4 - Simulation methodology

20

slide-86
SLIDE 86

Add IPh current to each cell in the circuit 7

U527 (net21866 n134 GND_U527 GND_U527 VDD_U527 VDD_U527) STD_CELL_IVX8 VU527_GND (GND_U527 gnd!) vsource type=pwl val0=0 wave=[ 1.5n 0 ... 1.68 0.23 ... tn vn ] VU527_VDD (vdd! VDD_U527) vsource type=pwl val0=0 wave=[ 1.5n 1 ... 1.65 0.78 ... tn vn ] U527 (net21866 n134 gnd! gnd! vdd! vdd!) STD_CELL_IVX8

CLoad '1' '0'

>> '1'

IPpsub_nwel

Power-grid Model Power-grid Model

Time (ns)

0.5 1 1.5 2 2.5 3

Volts

CLK

0.5 1

µA

Ipeak

IU527_VDD (VDD_U527 n134) isource dc=0 type=exp val0=0 td1=fstart

IPh

tau1=rise_time val1=154.69u td2=fall_start

4 - Simulation methodology

20

slide-87
SLIDE 87

Add IPh current to each cell in the circuit 7

U527 (net21866 n134 GND_U527 GND_U527 VDD_U527 VDD_U527) STD_CELL_IVX8 VU527_GND (GND_U527 gnd!) vsource type=pwl val0=0 wave=[ 1.5n 0 ... 1.68 0.23 ... tn vn ] VU527_VDD (vdd! VDD_U527) vsource type=pwl val0=0 wave=[ 1.5n 1 ... 1.65 0.78 ... tn vn ] U527 (net21866 n134 gnd! gnd! vdd! vdd!) STD_CELL_IVX8

CLoad '1' '0'

>> '1'

IPpsub_nwel

Power-grid Model Power-grid Model

Time (ns)

0.5 1 1.5 2 2.5 3

Volts

CLK

0.5 1

µA

Ipeak

IU527_VDD (VDD_U527 n134) isource dc=0 type=exp val0=0 td1=fstart

IPh

tau1=rise_time val1=154.69u td2=fall_start tau2=fall_time

4 - Simulation methodology

20

slide-88
SLIDE 88

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform an electrical simulation for a laser spot location (x,y) 8 END

4 - Simulation methodology

21

slide-89
SLIDE 89

Perform an electrical simulation for a laser spot location (x,y) 8

10 20 30 40 50 60 70 80 90 100 110 10 20 30 40 50 60 70

μm μm

4 - Simulation methodology

21

slide-90
SLIDE 90

Perform an electrical simulation for a laser spot location (x,y) 8

10 20 30 40 50 60 70 80 90 100 110 10 20 30 40 50 60 70

μm μm

5μm

4 - Simulation methodology

21

slide-91
SLIDE 91

Perform an electrical simulation for a laser spot location (x,y) 8

10 20 30 40 50 60 70 80 90 100 110 10 20 30 40 50 60 70

μm μm

5μm

10 20 30 40 50 60 70 80 90 100 110 10 20 30 40 50 60 70

μm μm

5μm

... ... ... ... ... ... ... ...

CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD

4 - Simulation methodology

21

slide-92
SLIDE 92

Perform an electrical simulation for a laser spot location (x,y) 8

10 20 30 40 50 60 70 80 90 100 110 10 20 30 40 50 60 70

μm μm

5μm

10 20 30 40 50 60 70 80 90 100 110 10 20 30 40 50 60 70

μm μm

5μm

... ... ... ... ... ... ... ...

CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD

  • ption( ?categ 'turboOpts

'numThreads ncpus_active 'mtOption "Manual" 'apsplus t 'digitalInstValue digital_inst_list 'uniMode "XPS MS" ) Hybrid simulation

4 - Simulation methodology

21

slide-93
SLIDE 93

Perform an electrical simulation for a laser spot location (x,y) 8

10 20 30 40 50 60 70 80 90 100 110 10 20 30 40 50 60 70

μm μm

5μm

10 20 30 40 50 60 70 80 90 100 110 10 20 30 40 50 60 70

μm μm

5μm

... ... ... ... ... ... ... ...

CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD

  • ption( ?categ 'turboOpts

'numThreads ncpus_active 'mtOption "Manual" 'apsplus t 'digitalInstValue digital_inst_list 'uniMode "XPS MS" ) Hybrid simulation Number of instances simulated with the logic abstraction level for different threshold voltages and different spot locations.

Threshold

  • No. of cells
  • No. of cells

(IR drop + bounce) (spot loc.130) (spot loc.133) 5% 1676 1646 10% 4744 4866 15% 4878 5033

  • No. of instances: 5.21k

4 - Simulation methodology

21

slide-94
SLIDE 94

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform electrical simulation for a laser spot location (x,y) 8 END

4 - Simulation methodology

22

slide-95
SLIDE 95

Define simulation parameters SPEF LEF DEF CPF SDC VCD GDS Verilog Timing Libs Spice Subckts Power Pads EMIR CAD T

  • ol

1 2 Set the (x,y) spatial location of the laser spot 3 Define the amplitude of IPpsub_nwell current for each cell in the design according to Eq. 1 4 Perform IR drop analysis for a laser spot location (x,y) Save a table containing the evolution in time of the supply voltage of each cell in the circuit 5 Replace the nominal supply voltage from the original netlist Add IPh current to each cell in the circuit 6 7 Perform electrical simulation for a laser spot location (x,y) 8 END

Back to Step 3

4 - Simulation methodology

22

slide-96
SLIDE 96

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-97
SLIDE 97

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-98
SLIDE 98

5.1 - Case study

5 - Simulation Results

ARM 7 processor CMOS 28 nm VDD = 1 V 110 μm x 70 μm Laser spot diameter = 5 μm

23

slide-99
SLIDE 99

mV 50 20 40 60 80 100 10 20 30 40 50 60 70 μm μm

5.2 - Maximum Voltage Drop

5 - Simulation Results

Without laser illumination

24

slide-100
SLIDE 100

mV 50 20 40 60 80 100 10 20 30 40 50 60 70 μm μm

5.2 - Maximum Voltage Drop

5 - Simulation Results

Without laser illumination

24

20 40 60 80 100 10 20 30 40 50 60 70 μm μm mV 446

Without laser spot 5µm laser spot Without laser spot

With laser illumination

Voltage swing = 554 mV

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

1 1.2 1.4 1.6 1.8 2.0 2.2 2.4 2.6 2.8 3

Time (ns) VDD and GND (V)

slide-101
SLIDE 101

mV 50 20 40 60 80 100 10 20 30 40 50 60 70 μm μm

5.2 - Maximum Voltage Drop

5 - Simulation Results

Without laser illumination

24

20 40 60 80 100 10 20 30 40 50 60 70 μm μm mV 446

Without laser spot 5µm laser spot Without laser spot

With laser illumination

Voltage swing = 554 mV

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

1 1.2 1.4 1.6 1.8 2.0 2.2 2.4 2.6 2.8 3

Time (ns) VDD and GND (V)

1.0 0.9 0.8 0.7 0.6 0.5 60 30 45 15 105 75 90 10 20 30 40 50 60 70

Volts X (μm) Y (μm)

slide-102
SLIDE 102

mV 50 20 40 60 80 100 10 20 30 40 50 60 70 μm μm

5.2 - Maximum Voltage Drop

5 - Simulation Results

Without laser illumination

24

20 40 60 80 100 10 20 30 40 50 60 70 μm μm mV 446

Without laser spot 5µm laser spot Without laser spot

With laser illumination

Voltage swing = 554 mV

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

1 1.2 1.4 1.6 1.8 2.0 2.2 2.4 2.6 2.8 3

Time (ns) VDD and GND (V)

1.0 0.9 0.8 0.7 0.6 0.5 60 30 45 15 105 75 90 10 20 30 40 50 60 70

Volts X (μm) Y (μm)

1.0 0.9 0.8 0.7 0.6 0.5 60 30 45 15 105 75 90

Volts X (μm)

  • Volt. swing (V)

1.0 0.9 0.8 0.7 0.6 0.5

slide-103
SLIDE 103

5.3 - Simulated Scenarios and Fault Injection Maps

5 - Simulation Results

Data_out<x> Addr_out<x> Etc_out<x>

25

ARM7

Cell X

D<x> Di<x>

slide-104
SLIDE 104

5.3 - Simulated Scenarios and Fault Injection Maps

5 - Simulation Results

Data_out<x> Addr_out<x> Etc_out<x>

25

Volts

CLK

0.5 1

D<x>

0.5 1

Volts

Fault at 1.5 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

48 faults ARM7

Cell X

D<x> Di<x>

slide-105
SLIDE 105

5.3 - Simulated Scenarios and Fault Injection Maps

5 - Simulation Results

Data_out<x> Addr_out<x> Etc_out<x>

25

Volts

CLK

0.5 1

D<x>

0.5 1

Volts

Fault at 1.5 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

48 faults

Data_out<x> Addr_out<x> Etc_out<x> ARM7

Cell X

D<x> Di<x>

slide-106
SLIDE 106

5.3 - Simulated Scenarios and Fault Injection Maps

5 - Simulation Results

Data_out<x> Addr_out<x> Etc_out<x>

25

Volts

CLK

0.5 1

D<x>

0.5 1

Volts

Fault at 1.5 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

48 faults ARM7

Cell X

D<x> Di<x>

slide-107
SLIDE 107

5.3 - Simulated Scenarios and Fault Injection Maps

5 - Simulation Results

Data_out<x> Addr_out<x> Etc_out<x>

25

Volts

CLK

0.5 1

D<x>

0.5 1

Volts

Fault at 1.5 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

48 faults

Data_out<x> Addr_out<x> Etc_out<x> ARM7

Cell X

D<x> Di<x>

slide-108
SLIDE 108

5.3 - Simulated Scenarios and Fault Injection Maps

5 - Simulation Results

Data_out<x> Addr_out<x> Etc_out<x>

25

Volts

CLK

0.5 1

D<x>

0.5 1

Volts

Fault at 1.5 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

48 faults

CLoad 'X' 'Y' IPh IPh PU PD

ARM7

Cell X

D<x> Di<x>

slide-109
SLIDE 109

5.3 - Simulated Scenarios and Fault Injection Maps

5 - Simulation Results

Data_out<x> Addr_out<x> Etc_out<x>

25

Volts

CLK

0.5 1

D<x>

0.5 1

Volts

Fault at 1.5 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

48 faults

CLoad 'X' 'Y' IPh IPh PU PD

Fault at 1.7 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

76 faults ARM7

Cell X

D<x> Di<x>

slide-110
SLIDE 110

5.3 - Simulated Scenarios and Fault Injection Maps

5 - Simulation Results

Data_out<x> Addr_out<x> Etc_out<x>

25

Volts

CLK

0.5 1

D<x>

0.5 1

Volts

Fault at 1.5 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

48 faults

CLoad 'X' 'Y' IPh IPh PU PD

Fault at 1.7 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

76 faults

Simulations using

  • nly the IPh

current component

Fault at 1.9 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

140 faults ARM7

Cell X

D<x> Di<x>

slide-111
SLIDE 111

5.3 - Simulated Scenarios and Fault Injection Maps

5 - Simulation Results

Data_out<x> Addr_out<x> Etc_out<x>

25

Volts

CLK

0.5 1

D<x>

0.5 1

Volts

Fault at 1.5 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

48 faults

CLoad 'X' 'Y' IPh IPh PU PD

Fault at 1.7 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

76 faults

Simulations using

  • nly the IPh

current component

Fault at 1.9 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

140 faults

Volts Time (ns)

0.5 1 1.5 2 2.5 3

D<x>

0.5 1 CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

Fault at 1.5 ns Fault at 1.7 ns Fault at 1.9 ns 108 faults 181 faults 198 faults

Simulations using IPh + IPpsub_nwell

ARM7

Cell X

D<x> Di<x>

slide-112
SLIDE 112

5.3 - Simulated Scenarios and Fault Injection Maps

5 - Simulation Results

Data_out<x> Addr_out<x> Etc_out<x>

25

Volts

CLK

0.5 1

D<x>

0.5 1

Volts

Fault at 1.5 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

48 faults

CLoad 'X' 'Y' IPh IPh PU PD

Fault at 1.7 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

76 faults

Simulations using

  • nly the IPh

current component

Fault at 1.9 ns

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

140 faults

Volts Time (ns)

0.5 1 1.5 2 2.5 3

D<x>

0.5 1 CLoad 'X' 'Y' IPpsub_nwel IPh Power grid model Power grid model IPh PU PD

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

Fault at 1.5 ns Fault at 1.7 ns Fault at 1.9 ns 108 faults 181 faults 198 faults

Simulations using IPh + IPpsub_nwell

108/48 = 2.25 181/76 = 2.38 198/140 = 1.41 ARM7

Cell X

D<x> Di<x>

slide-113
SLIDE 113

Simulation performance regarding one laser shot

(hybrid simulation)

Circuit

  • No. of instances

Simulation time ARM 7 5,210 1min 02s

5.4 - Simulation Performance

5 - Simulation Results

26

slide-114
SLIDE 114

Simulation performance regarding one laser shot

(hybrid simulation)

Circuit

  • No. of instances

Simulation time ARM 7 5,210 1min 02s

5.4 - Simulation Performance

5 - Simulation Results

26

S38584 (ISCAS’89) 20,705 1min 20s

slide-115
SLIDE 115

Simulation performance regarding one laser shot

(hybrid simulation)

Circuit

  • No. of instances

Simulation time ARM 7 5,210 1min 02s

5.4 - Simulation Performance

5 - Simulation Results

26

S38584 (ISCAS’89) 20,705 1min 20s B18 (ITC’99) 52,601 3min 05s

slide-116
SLIDE 116

Simulation performance regarding one laser shot

(hybrid simulation)

Circuit

  • No. of instances

Simulation time ARM 7 5,210 1min 02s

5.4 - Simulation Performance

5 - Simulation Results

26

S38584 (ISCAS’89) 20,705 1min 20s B18 (ITC’99) 52,601 3min 05s B19 (ITC’99) 105,344 6min 35s

slide-117
SLIDE 117

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-118
SLIDE 118

Outline

1 2

Motivation

3

Classical model of laser fault injection and its limits

4 5

Proposed model Simulation methodology Simulation results

6 Conclusions

slide-119
SLIDE 119

IPpsub_nwell current component is always present (causing IR-drops)

27

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

slide-120
SLIDE 120

IPpsub_nwell current component is always present (causing IR-drops)

27

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

Methodology to simulate the effects of laser shots on ICs based on standard CAD tools

10 μm 10 μm
slide-121
SLIDE 121

IPpsub_nwell current component is always present (causing IR-drops)

27

CLoad 'X' 'Y' IPpsub_nwel IPh

Power grid model Power grid model

IPh PU PD

Methodology to simulate the effects of laser shots on ICs based on standard CAD tools

10 μm 10 μm

Ignoring the laser-induced IR drop may result in underestimating the risk of fault injection

181/76 = 2.38

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

76 faults

60 30 45 15 105 75 90 10 20 30 40 50 60 70

X (μm) Y (μm)

181 faults

slide-122
SLIDE 122

Standard CAD T

  • ol-Based Method for Simulation
  • f Laser-Induced Faults in Large-Scale Circuits

Raphael Viera - raphael@ieee.org Philippe Maurine, Jean-Max Dutertre and Rodrigo Bastos

ISPD'18

March 28, 2018

slide-123
SLIDE 123

Appendix

slide-124
SLIDE 124

Case 4: Both NMOS and PMOS transistors are illuminated by the laser beam

A Z

tech: 250 nm

12.5 μm CLoad '1' '0'

5 μm

'1'

>> IPh

Laser-induced currents in the Nwell-Psub junction (classical model is incomplete)

slide-125
SLIDE 125

Case 6:

NMOS and PMOS transistors are always illuminated by the laser beam

tech: 28 nm

1.2 μm CLoad '1' '0'

5 μm

'1'

>> IPh

Laser-induced currents in the Nwell-Psub junction (classical model is incomplete)

slide-126
SLIDE 126

Run a fault free electrical simulation ARM7

Cell X

Nwell Pwell

D<x> Di<x>

Save a golden table with all inputs and outputs of each cell as a function of time

Volts Time (ns)

0.5 1 1.5 2 2.5 3

CLK

0.5 1

D<x>

0.5 1

Volts

Upgraded model still not in use

slide-127
SLIDE 127

Qo

Soft Error

CLK Di Qi Do

tQi2Do

thold tsetup tclk2Q tclk2Q

1ns 2ns

1.2 1.4 1.6 1.8

3ns

2.2 2.4 2.6 2.8

Time TCLK

Qo FF

CLK

Qi

CLK

Do Di tclk2Qi tQi2Do VDD FF GND CLoad '1' '0' >>'1' IPh (a) (b) (c) Qo FFo

CLK

Qi

CLK

Do Di tQi2Do VDD FFi GND

tclk2Qi

VDD GND

slide-128
SLIDE 128

Qo

Timing Error

CLK Di Qi Do

thold tsetup tclk2Q tclk2Q

1ns 2ns

1.2 1.4 1.6 1.8

3ns

2.2 2.4 2.6 2.8

Time

tQi2Do + delay

TCLK

tsetup

(c) Qo FFo

CLK

Qi

CLK

Do Di

Qi2Do

D non ideal V FFi D Qo FF

CLK

Qi

CLK

Do Di

Qi2Do

D non ideal V FF D tclk2Qi

tclk2Qi

(a) (b) D non ideal V D

slide-129
SLIDE 129

Qo

Soft / Timing Error

CLK Di Qi Do

thold tsetup tclk2Q tclk2Q

1ns 2ns

1.2 1.4 1.6 1.8

3ns

2.2 2.4 2.6 2.8

Time TCLK

tQi2Do + delay

(c) Qo FFo

CLK

Qi

CLK

Do Di

Qi2Do

D non ideal V FFi D Qo FF

CLK

Qi

CLK

Do Di

Qi2Do

D non ideal V FF D tclk2Qi (a) (b) D non ideal V D

tclk2Qi

slide-130
SLIDE 130

60 120 180 240 300 200 400 600 800

Vout (mV) ∆Vdrop (mV)

CLoad

'0' '1'

IP

Vout

IPhNMOS Time (ns)

0.5 1 1.5 2 2.5 3

Vout

0.5 1

Volts

IPhNMOS

14

slide-131
SLIDE 131

60 120 180 240 300 200 400 600 800

Vout (mV) ∆Vdrop (mV)

CLoad

'0' '1'

IP

Vout

IPhNMOS Time (ns)

0.5 1 1.5 2 2.5 3

Vout

0.5 1

Volts

IPhNMOS

14

IPpsub_nwel ΔVout

Power-grid Model Power-grid Model

0.5 1

Volts

0.5 1

Volts

Vout Vout IPpsub_nwell IPhNMOS + IPpsub_nwell

slide-132
SLIDE 132

60 120 180 240 300 200 400 600 800

Vout (mV) ∆Vdrop (mV)

CLoad

'0' '1'

IP

Vout

IPhNMOS Time (ns)

0.5 1 1.5 2 2.5 3

Vout

0.5 1

Volts

IPhNMOS

14

IPpsub_nwel ΔVout

Power-grid Model Power-grid Model

0.5 1

Volts

0.5 1

Volts

Vout Vout IPpsub_nwell IPhNMOS + IPpsub_nwell

slide-133
SLIDE 133

60 120 180 240 300 200 400 600 800

Vout (mV) ∆Vdrop (mV)

CLoad

'0' '1'

IP

Vout

IPhNMOS Time (ns)

0.5 1 1.5 2 2.5 3

Vout

0.5 1

Volts

IPhNMOS

14

IPpsub_nwel ΔVout

Power-grid Model Power-grid Model

0.5 1

Volts

0.5 1

Volts

Vout Vout IPpsub_nwell IPhNMOS + IPpsub_nwell

60 120 180 240 300 1 1.4 1.8 2.2 2.6 3

Amplification ∆Vdrop (mV) Simulated Equation

slide-134
SLIDE 134

Probability of soft error occurrence IPh: IPh contribution only IPh + IPsub: IPh + IPsub_nwell contribution Shot_t: Laser shot time

IPh

1

1ns 2ns

1.2 1.4 1.6 1.8

3ns

2.2 2.4 2.6 2.8 3.2

Shot_t IPh + IPsub

1

Path X

CLK

Path Y