Loic Zussa
email: zussa@emse.fr

Ingrid Exurville
email: ingrid.exurville@cea.fr

Jean-Max Dutertre

Jean-Baptiste Rigaud

Bruno Robisson

Assia Tria

Jessy Clediere
email: jessy.clediere@cea.fr

Evidence of an information leakage between logically independent blocks

Keywords: Delay-based countermeasure, information leakage, 'DPA-like' analysis, side effects

In this paper we study the information leakage that may exist, due to electrical coupling, between logically independent blocks of a secure circuit as a new attack path to retrieve secret information. First, an AES-128 has been implemented on a FPGA board. Then, this AES implementation has been secured with a delay-based countermeasure against fault injection related to timing constraints violations. The countermeasure's detection threshold was supposed to be logically independent from the data handled by the cryptographic algorithm. Thus, it theoretically does not leak any information related to sensitive values. However experiments point out an existing correlation between the fault detection threshold of the countermeasure and the AES's calculations. As a result, we were able to retrieve the secret key of the AES using this correlation. Finally, different strategies were tested in order to minimize the number of triggered alarm to retrieve the secret key.

INTRODUCTION

Security is a key component for information technologies and communication. Among the security threats, a very important one is certainly due to the vulnerabilities of the integrated circuits that implement cryptographic algorithms to ensure confidentiality, authentication or data integrity. These electronic devices could fall into the hands of malicious people and then could be subject to physical attacks.

Three different kinds of techniques are used to perform such attacks. The first one consists in getting information about the chip design by direct inspection of its hardware structure. The second technique consists in observing some physical characteristics (such as power consumption, electromagnetic radiation, response time, etc.) which change during the circuit's computation. The third technique consists in disrupting the circuit's behaviour by using fault injection means such as laser beam, voltage or clock glitches, electromagnetic pulses, etc. With such techniques the attacker may be able to: bypass the security functions (such as the PIN code ver-. ification), retrieve the details of their implementations, find out the manipulated data (cryptographic materials, personal data, etc.).

Somes techniques of key recovering are based on side channel measurements. The first one, called DPA-like, consists in building a set of mathematical models (i.e. mathematical formulae) from a priori knowledge about the circuit. Each model is associated with a hypothesis on the value of the key. Then, the models are compared with measurements. The model which matches the best with measurements is generally associated with the right key hypothesis [START_REF] Kocher | Differential Power Analysis[END_REF]. The second kind of side channel attacks needs a profiling step on another circuit. This circuit is supposed to be identical to the target and the attacker is supposed to be able to set the key value. In this case, the profiling step is used either to improve the model a priori (stochastic attacks, [START_REF] Schindler | A stochastic model for differential side channel cryptanalysis[END_REF]) or to build a statistical model only based on measurements (template attacks [START_REF] Chari | Template attacks[END_REF]).

To reduce sensitivity to side channel attacks, the correlation between physical values (such as power consumption or electromagnetic radiation) and the data processed has been reduced, for example, by using balanced data encoding and balanced place and route [START_REF] Tiri | A logic level design methodology for a secure dpa resistant asic or fpga implementation[END_REF], by using power filters or electromagnetic shields. Noise has also been added to the power consumption, for example, by masking the internal computations that have to be predicted by the attacker or by randomizing the program instructions [START_REF] Coron | On Boolean and arithmetic masking against differential power analysis[END_REF][START_REF] Rivain | Higher-order masking and shuffling for software implementations of block ciphers[END_REF]. To detect fault attacks, physical sensors give information about the state of the system either by measuring the light, the voltage, the frequency or the temperature of the chip [START_REF] Endo | An Efficient Countermeasure against Fault Sensitivity Analysis Using Configurable Delay Blocks[END_REF][START_REF] Dehbaoui | Electromagnetic Transient Faults Injection on a Hardware and Software Implementation of AES[END_REF]. These error detection schemes are independent of the computation of the sensitive variables contrary to other detection schemes based on spatial redundancy (i.e. making the same computation several times simultaneously), temporal redundancy (i.e. doing the same computation several times) or information redundancy (i.e. doing a computation with more bits than required) [START_REF] Joye | Strengthening hardware aes implementations against fault attacks[END_REF]. Several mechanisms are also proposed to detect a modification of the execution flow of a software.

The estimation of the security provided by these protections is a very challenging task. Indeed, the protections based on redundancy open the door to safe-error attacks because the error signal triggered by these schemes depends on the sensitive values. On the opposite, the physical sensors should not create such a path for safe-error attacks (because they are designed to be logically independent from the computation of sensitive values). In this article, we show that this assertion is unfortunately false for some kinds of physical sensors used to detect timing constraints violations.

In section 2 of this article a delay-based countermeasure is de- scribed along with its implementation to protect an AES implementation against timing constraints violations. Then, in section 3, the attack which uses this sensor detection threshold as an attack path is described. And finally, in section 4, its efficiency is estimated.

PRELIMINARIES 2.1 Motivation

As presented in the introduction, several attack paths both passive and active have been exploited to retrieve secret informations and then countermeasures have been designed. In this study we focused on the electrical coupling existing between implemented blocks and used this coupling as a new attack path.

To illustrate and validate this attack path, we monitored the detection threshold variations of a delay-based countermeasure. This countermeasure against timing constraints violations was used to protect a physical AES implementation on a Spartan3 700A FPGA board.

In fact, the implemented countermeasure is designed to be logically independent from the AES's calculations. However, registers' updates and internal calculations induce voltage drops into the circuit's core voltage [START_REF] Shang | Dynamic power consumption in virtex-ii fpga family[END_REF][START_REF] Zick | Sensing nanosecond-scale voltage attacks and natural transients in fpgas[END_REF]. These core voltage drops could have a significant influence on the countermeasure sensitivity (its detection threshold) as they share the same power supply grid. As a result, these detection threshold variations could be correlated with the secret information. Thereore, we assumed that this electrical coupling may be used as a new attack path to retrieve secret information.

Note that a related work about the existence of a similar information leakage through voltage levels at I/O pins have already been presented in [START_REF] Schmidt | Side-channel leakage across borders[END_REF].

Timing constraints

In synchronous digital ICs, a clock signal is used to synchronize internal operations. When the clock rises, data are released from a register, processed by the logic, and finally latched by another register on the next clock's rising edge. As a result, data have to be stable early enough at the input of the arrival register before the clock rising edge in order to be sampled properly.

On the one hand, the time between two clock's rising edges on two different registers is not exactly the clock period, T clk . T skew , the clock skew between the two registers and Tjitter the clock jitter have to be taken into account. On the other hand, the time needed for the last signal to be stabilized at the input of the arrival register is not exactly the largest data propagation time, DpMax. D clk2q , the time spent by a register to release a data after the clock rising edge has to be taken into account. And finally Tsetup is the amount of time a register's input data have to be stable before the clock's rising edge to ensure reliable sampling. This constraint is expressed in Eq. 1:

T clk > D clk2q + DpMax + Tsetup + T skew + Tjitter (1)
For the sake of brevity, the clock pulse width constraint and the hold time constraint were not described.

The violation of this timing constraint is a straightforward means to inject faults into a circuit. Clock and power supply glitches induce transient violations of Eq. 1. A clock glitch [START_REF] Endo | An on-chip glitchy-clock generator for testing fault injection attacks[END_REF] consists in reducing temporarily the clock period (left hand-side of Eq. 1) to obtain a negative slack, whereas a power glitch [START_REF] Zussa | From physical stresses to timing constraints violation[END_REF] induces a transient increase of the logic propagation times (right hand-side of Eq. 1).

Countermeasure

A delay-based countermeasure (CM) against timing violations [START_REF] Endo | An Efficient Countermeasure against Fault Sensitivity Analysis Using Configurable Delay Blocks[END_REF], [START_REF] Selmane | Security evaluation of application-specific integrated circuits and field programmable gate arrays against setup time violation attacks[END_REF] has been implemented into our target circuit. Fig. 1 illustrates the countermeasure principle. The countermeasure is based on a tunable guarding delay (Dcm) that is longer than the most critical path of the AES (DpMax) but shorter than the clock period (T clk ). Eq. 2 and Fig. 2 illustrate this constraint.

T clk -Tsetup + T skew > D clk2q + Dcm > D clk2q + DpMax (2)
A CONTROL signal is used to tune the delay of the countermeasure to fulfill the following constraints (see Fig. 3):

• The register (DFF) should sample a '1' when running in its nominal condition.

• The DFF should sample a '0' when undergoing a physical attack.

• The countermeasure's sensitivity (detection threshold) should be greater than the AES's one (fault sensitivity).

The critical path of the AES depends on both the input message and the key. To fix the value of the guarding delay, 10,000 [Plaintext, Key] couples have been tested. From our experiments, the guarding delay has been tuned in order to be longer (i.e 8.25 ns) than all the most critical path of the AES but shorter than the clock period (i.e. 10 ns).

Figure 2: Guarding delay longer than the AES path As a result, when the circuit is under attack the alarm should be triggered before any fault being injected into AES calculations. Thus the countermeasure protects the circuit against timing constraints violations. And the countermeasure sensitivity should not depend on the handled data. Thus, attacks such as Fault Sensitivity Analysis (FSA [START_REF] Li | Fault sensitivity analysis[END_REF]) cannot be performed. The efficiency of this countermeasure against clock, power and electromagnetic glitches has been studied in [START_REF] Zussa | Efficiency of a glitch detector against electromagnetic fault injection[END_REF]. The countermeasure implementation has to be close enough to the AES's implementation to be efficient against electromagnetic injection.

For sake of clarity, only clock glitches have been used in this work but results could be extended to other kinds of disturbances injection means. As presented previously, the countermeasure has been designed to detect this kind of attack. Fig. 3 illustrates a glitched clock signal and the countermeasure detection principle. CLOCK is the nominal clock signal. CLOCK + Glitch is the clock signal when the circuit is undergoing a timing attack (in this case one of the clock periods is reduced). D -CLOCK + Glitch is the delayed clock of the countermeasure. The countermeasure's register samples D-CLOCK +Glitch when CLOCK +Glitch rises. When the sampling result ALARM is '0' an alarm is triggered by another block and then the security policy is applied. As the guarding delay of the countermeasure is designed to be independent from the AES's calculation, the detection threshold should not be data dependent. However, practical measurements showed that this assertion is unfortunately false. Fig. 4 reports the measured alarm detection rate as a function of the number of decrements of the clock period during the AES first round. Each decrement, or stress step by using the terminology introduced by [START_REF] Li | Fault sensitivity analysis[END_REF], was equal to 35 ps. Alarm detection rates are given for 3 different input messages, or plain texts, but the same secret key. It is clearly observable that the sensitivity of the countermeasure (i.e. its detection threshold) depends on the input message. This is a fault injection-based evidence of an information leakage between the AES implementation and the countermeasure block. The aim of the next section is to confirm on experimental basis that this leakage is correlated with the sensitive data handle by the AES.

ELECTRICAL COUPLING BETWEEN LOGICALLY INDEPENDENT BLOCKS

In this section the electrical coupling between logically independent blocks is described as an attack path to retrieve secret information. In this work, the two considered blocks were the AES and the countermeasure previously described. Theoretically, the countermeasure is data independent but measurements exposed in Fig. 4 tend to show the opposite.

Attack description

In fact, the attack procedure is very similar to the DPA. However, this attack measures a side effect of the power consumption instead of measuring it directly. This attack could also be considered as a FSA targeting the countermeasure detection threshold instead of the fault injection threshold.

The assumption we made is the following one: AES calculations have an effect on the core voltage and the core voltage has an effect on the guarding delay of the countermeasure. These guarding delay variations can be monitored by measuring the alarm detection threshold. To measure the countermeasure sensitivity, the stress applied to the circuit is gradually increased until an alarm is triggered. Then the same protocol than the one used for a classical FSA or DPA is used to correlate the detection threshold to the handled data.

Measurements of a side effect of the power consumption

In this study, we considered the countermeasure detection threshold variations as a side effect of the power consumption. We measured the alarm sensitivity by decreasing a chosen clock period step by step until the alarm was triggered. More generally the sensitivity of the countermeasure could be monitored by increasing any kind of stress which has an effect on this countermeasure (underpowering, over-heating, electromagnetic pulse, etc.) [START_REF] Zussa | Efficiency of a glitch detector against electromagnetic fault injection[END_REF].

Divide and conquer strategy

In this work we targeted the 1 st round of the AES for several practical reasons:

• The 16 bytes are independent until the first MIXCOLUMN.

Every byte can be targeted one after each other.

• Only the first few steps of the AES have to be simulated to calculate the selection function. (see Sec. 3.4.2)

Analysis

Notation: M is the input message of the AES and Mi its i th byte. K0 is the secret key of the AES and K0i its i th byte. SB is the output of the first SUBBYTES block of the AES and SBi its i th byte. In round 1, SBi depends only on Mi and K0i.

In this specific case, the attack targeted only one byte after each other. If the u th byte is targeted then 0 ≤ Mi=u ≤ 255 and M i =u = 0 (other bytes are chosen equal to zero). As a result for a specific byte, there are only 256 different values for M . Moreover, in the following equations the byte index will be omitted.

Measurements

To perform the attack, the attacker first encrypts Nmax times the message M targeting round 1 with a stress S ∈ [0..60] (in this experiment the stress step is 35 ps). When S = 0 the circuit is running at its nominal value (i.e. 10 ns). For every encryption N ∈ [0..Nmax] of message M ∈ [0..255] with a stress S, the attacker saves the alarm state A[N, M, S] (active or not). At the end of the experiment, an alarm state matrix A[0..255, 1..Nmax, 0..60] is obtained. In other words the alarm state matrix give the alarm triggering state for a given stress S, applied during the the N th encryption of the M th plaintext.

The information of interest in this attack is the alarm detection rate for a given stress according to the considered message encrypted. The alarm detection rate considering the M th message for a given stress S is given by the equation Eq. 3 :

AlarmRate(M, S) = Nmax i=1 A[M, i, S] Nmax (3)

Prediction

In order to retrieve the correct key candidate, Kcorrect, predictions have to be made according to a specific key candidate K. Then, these predictions have to be verified to score the key candidate. As a result, predictions have to be related to an internal value which has an effect on the measured information (i.e. the alarm rate). The predicted value is called the selection function.

In this study, the selection function is the theoretical value of a given bit b of the targeted byte at the output of the first SUBBYTES block, SB. For a specific byte, there are only 256 different values for the key candidate K. For every message M ∈ [0..255] and for every key candidate K ∈ [0..255], the selection function is denoted

SB[M, K, b] ∈ [0, 1].

Correlation

Finally, the usual way to verify the assumption is to correlate the predictions to the measurements. In this study we assumed that a correlation existed between the selection function and the alarm detection rate

The Pearson's correlation has been used to score every key candidate. ρ(K, b, S) is the Pearson's correlation index of a key candidate K, of a given bit b, for a given stress S (Eq. 4).

EXPERIMENTAL RESULTS

In this section we focused on the first byte for the sake of clarity. As a result the attack presented in the following section was perfomed with a divide and conquer strategy. Only one byte of the input data was modified to recover the corresponding byte of the key. Results are very similar to those obtained targeting other bytes of the key. Final results are given in section 4.2.

"Information leakage" assumption verification

A first step was to verify experimentally if the countermeasure sensitivity variations observed in Fig. 4 was linearly correlated to sensitive data. If the correlation exists then a DPA-like analysis could be successfully performed.

Every message was encrypted 1000 times for every different stress. Then the alarm detection rate (AlarmRate(M, S)) obtained for a specific message M with M ∈ [0..255] and with a specific stress S ∈ [0..60] was correlated to the selection function (SB[M, K, b]).

Fig. 5 represents the Pearson correlation score for all the different key candidates with SB[M, K, 1] used as a selection function. In this case the correct key candidate does not appear (for every key candidate and for every stress, the correlation absolute value is smaller than 0.3). Thus, this bit does not leak information about the secret key. In Fig. 6 we turned our attention to the 4 th bit of the AES' first byte, SB[M, K, 4] was used as a selection function. In this case, the correct key candidate appears (for one and only one key candidate the correlation absolute value is greater than 0.3). As a result, the countermeasure sensitivity leaks enough information to retrieve the first byte of the secret key.

However in this case the attack was performed with 15,360,000 (256 plaintexts × 60 stress × 1000 encryptions) glitch injections (per byte). The following subsections report how to minimize the number of injections to perform the attack.

Targeting only one specific stress

The Pearson correlation is efficient at any stress within the nondeterministic zone of the countermeasure (S such as ∀M ∈ [0..255], 0 < AlarmRate(M, S) < 100) as illustrated in Fig. 6. As a result, targeting only one well-chosen stress could be enough to retrieve the secret key.

The effectiveness of different stresses were compared using the guessing entropy evaluation metric [START_REF] Standaert | A unified framework for the analysis of side-channel key recovery attacks[END_REF]. The guessing entropy GE(S) returns the average guessing position of the correct key Kcorrect after a side-channel attack. Concerning passive side channel attacks such as DPA or CPA, the guessing entropy is usually plotted as a function of the total number of observations. Concerning this attack which is an active side channel attack, the guessing entropy is plotted as a function of the total number of glitch injections (total number of messages × number of encryptions per message = 256 × Nmax).

Moreover, in this specific case, an alarm had to be triggered to retrieve the secret key. However, according to the attacker's ability to avoid the alarm triggering effects (security strategies), this number of triggered alarm could be more critical than the total number of queries. In order to obtain an average guessing position of the correct key candidate Kcorrect, the attack was performed 200 times and results are presented in Fig. 7 and Fig. 8.

In Fig. 7, the average guessing position when the attack was performed with a stress S (GE(S)) is plotted as a function of the total number of queries. In this figure, it appears that the guessing entropy tends faster to 1 when the stress applied lead to a medium range alarm rate (48 ≤ S ≤ 53). In our case, for a stress S = 49, around 7000 glitch injections were needed to retrieve a correct key byte. That represents around 1500 triggered alarms. As the number of triggered alarms could be a practical limitation for the attackers, Fig. 8 presents the same GE(S) as a function of the average number of triggered alarms. In this figure, it appears that targeting the circuit with a low stress could be an interesting strategy to minimize the number of triggered alarms needed to retrieve the secret key. In our case, targeting the circuit with a stress S = 49 minimize the total number of injections needed to retrieve the secret key (1500 alarms / 7000 injections) and a stress S = 46 minimize the total number of triggered alarms needed (800 alarms / 15000 injections).

It is important to note that the number of triggered alarms could be a technical limitation of this attack. Indeed, a detection can lead to a key erasing. However, in the field of smart card for instance, key material could be kept in the EEPROM and erasing the information stored in the floating gate of a memory cell has a significant impact on the power consumption. This variation on the power consumption due to the injected glitch detection could be monitored by the attacker and then the chip could be reset and the sensitive information will be trapped [START_REF] Anderson | Tamper resistance-a cautionary note[END_REF] Fig. 9, illustrates the successful recovery of the whole bytes of the secret key with a stress S = 49 and Nmax = 1000 using the most leaking bit as selection function SB[M, K, b leaking ].

CONCLUSION AND FURTHER WORKS

In this paper a new attack path has been introduced. This attack exploits electrical coupling between logically independent blocks to retrieve secret information. To illustrate this statement an AES has been implemented on a FPGA board. The AES was protected against fault injection with a delay-based countermeasure. This countermeasure and the AES implementation were supposed to be two logically independent blocks (i.e. the countermeasure sensitivity should not dependent on the AES's calculations).

However, experiments point out the existence of a correlation between the attack detection threshold of the countermeasure and the data handled by the AES. This information leakage led us to find the AES key. This result is especially worrying because it casts doubt on a kind of countermeasure [START_REF] Endo | An Efficient Countermeasure against Fault Sensitivity Analysis Using Configurable Delay Blocks[END_REF] which was designed to prevent FSA. However, this new attack path involved a large number of alarm triggering, which may be a limitation for its practical effectiveness. Thus, we have completed this study by trying to minimize the number of these triggered alarms.

Next step of our work will be to perform similar attack on masked AES's implementation and discuss the results. Also, a better model to represent the power consumption and voltage drops propagation through the power supply grid could be built. With this model we could probably extract more information from these detection threshold variations such as voltage drops localization.

Figure 1 :

 1 Figure 1: Tunable delay-based countermeasure principle

Figure 3 :

 3 Figure 3: Delay-based countermeasure undergoing a clock glitch injection

Figure 4 :

 4 Figure 4: Measure of the countermeasure's sensitivity in round 1 for 3 different plain texts

  ρ(K, b, S) = PearsCorr(SB[0..255, K, b], AlarmRate(0..255, S))(4)

1 Figure 5 :

 15 Figure 5: PearsonCorr(SB[M, K, 1], AlarmRate(M,S)), no leakage

Figure 6 :

 6 Figure 6: PearsonCorr(SB[M, K, 4], AlarmRate(M,S)), leakage

Figure 7 :

 7 Figure 7: Guessing entropy function of the total number of injections

Figure 8 :

 8 Figure 8: Guessing entropy function of the average number of triggered alarms

Figure 9 :

 9 Figure 9: Key recovering for every byte of the secret key with a stress S = 49 and Nmax = 1000 using the most leaking bit as selection function

  CS2'15 Proceedings of the Second Workshop on Cryptography and Security in Computing Systems

https://doi.org/10.1145/2694805.2694810

Acknowledgements

This work was supported in part by the European Commission through the ICT programme under contract FP7-ICT-2011-317930 HINT and was partially supported by a DGA-MRIS scholarship.


N Borrel A-B

C Champeix

E Kussener

W Rahajandraibe

M Lisart

A Sarafianos

J-M Dutertre

Influence of triple-well technology on laser fault injection and laser sensor efficiency

Keywords: Laser, fault injection, triple-well, body biasing, countermeasure I

This study is driven by the need to understand the influence of a Deep-Nwell implant on the sensitivity of integrated circuits to laser-induced fault injections. CMOS technologies can be either dual-well or triple-well. Triple-well technology has several advantages compared to dual-well technology in terms of electrical performances. Single-event responses have been widely studied in dual-well whereas SEE (single event effects) in triplewell is not well understood. This paper presents a comparative analysis of soft error rate and countermeasures sensors with for these two techniques in 40 nm and 90 nm CMOS technology. First, laser fault injection on registers were investigated, showing that triple-well technology is more vulnerable. Similarly, we studied the efficiency of Bulk Built-In Current Sensors (BBICS) in detecting laser induced fault injection attempts for both techniques. This sensor was found less effective in triple-well. Finally, a new BBICS compliant with body-biasing adjustments is proposed in order to improve its detection efficiency.

INTRODUCTION

The first faults called SEEs have been notified in the 1960s when it was found that radioactive particles were causing errors in electronic circuits [START_REF] Binder | Satellite anomalies from galactic cosmic rays[END_REF], [START_REF] May | Alpha-Particle-Induced Soft Errors in Dynamic[END_REF]. The aerospace industry directly affected by this issue began research on the physical effects of these particles in silicon. In this context, the use of pulsed-lasers was introduced to emulate SEEs at the experimenter's bench [START_REF] Habing | The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits[END_REF]. Laser-fault injection and radiative particles have indeed similar effects on system on chip. However, pulsed-laser may also be used to induced faults (as a result of SEEs) into the computations of security-dedicated ICs for the purpose of retrieving the secret data they may contain [START_REF] Skorobogatov | Optical fault induction attacks[END_REF], [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF]. BBICS [START_REF] Neto | Using Built-In Bulk Current to detect Soft Errors[END_REF] were introduced to monitor the unusual currents induced in the bulk of integrated circuits (ICs) by ionizing particle hits.

A. Laser-induced Single Event Effects in Integrated Circuits

When an ionic particle or a laser beam passes through silicon it generates electron-hole pairs along its path. These electrical charges generally recombine without any significant effect on the IC computations. However the electric field found in reverse-biased PN junctions may separate the electron-hole pairs, inducing a parasitic transient current. This transient current may in turn disturb the voltage of the IC's internal nodes leading to computational errors. This pulsed laser phenomenon may appear provided that its photons energy is bigger than the silicon bandgap (electron-hole pairs are then induced by photoelectric effect [START_REF] Buchner | Pulsed-Laser Testing for Single-Event Effects Investigations[END_REF]). This effect is called 'photocurrent' [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF]. The way how a transient photocurrent is turned into a SEE is illustrated in Fig. 1 for the inverter case when its input is at low logical level.

In this configuration, the SEE sensitive area is the drain of the NMOS transistor (shaded in pink), which is in OFF state. A laser-induced photocurrent, depicted by a current source in Fig. 1, may be injected there through the reverse-biased PN junction between the N-type drain of the NMOS (biased at VDD) and the P-type substrate (grounded). As a result of the latter, the inverter output voltage may drop from '1' to '0' provided that the injected photocurrent is higher than the PMOS transistor saturation current. Note that a similar phenomenon may also take place when the inverter input is at a high logical state (in this instance the laser-sensitive place is the drain of the OFF PMOS): the photocurrent then flows from VDD through the biasing contact (or tap) of the Nwell (i.e. the PMOS bulk) to ground. This voltage transient, also known as SET (Single Event Transient), may thus propagate through the circuit logic, creating errors. Furthermore, if a SET is induced directly in a memory element, as a latch, the stored data may be flipped, characterizing the so-called SEU (Single Event Upset;; i.e. a bit set from '0' to '1' or a bit reset from '1' to '0').

B. Triple-well isolation

The use of a triple-well layer is used to electrically isolate the Pwell in order to reduce the electronic noise and cross talk from the substrate. It may also be used to adjust power consumption and speed of the transistors by modifying the threshold voltage using well bias. Typically, devices are regularly distributed along cell array in dual-well (also called in bulk technology): Nwell and Psubstrate rows (Fig. 2a). In triple-well, a Deep-Nwell implant (DeepNwell) is used to isolate the substrate of the NMOS transistors from the Psubstrate of the chip, hence creating Pwells. The biasing of the DeepNwell at VDD (generally) is provided through the Nwell. Such as, Psubstrate potential and Pwell may be at different voltage potential (but generally grounded). In triplewell, cells are places in Nwell and Pwell array (Fig. 2b).

Since the first SEEs, semiconductor industry searches to improve architecture and process technology against soft error. The use of triple-well has been widely studied against SER in radiation evaluation. In 1984, Momose et al. [START_REF] Momose | A P-Type buried layer for protection against soft errors in high density CMOS static RAMs[END_REF] showed that the use of a Deep P-type implant in an N substrate of a RAM memory is an excellent protection against SEE. It decreases the soft error rate (SER) susceptibility by a factor of 10 +03 . Then between 1985 and 1993, similar studies [START_REF] Minami | A new soft-errorimmune static memory cell having a vertical driver MOSFET with a buried source for the ground potential[END_REF] and with Deep N-type implant in a P substrate [START_REF] Fu | Alpha-Particle-Induced Charge Collection Measurements 'and the Effectiveness of a Novel p-Well Protection Barrier on VLSI Memories[END_REF] and [START_REF] Burnett | Soft-Error-Rate Improvement in Advanced BiCMOS SRAMs[END_REF] also showed significant reduction factors of SER between 100 and 10 +03 . Afterward, studies of more recent technology nodes showed less conclusive results. [START_REF] Noda | An Ultrahigh-Density High-Speed Loadless Four-Transistor SRAM Macro with Twisted Bitline Architecture and Triple-Well Shield[END_REF] and [START_REF] Roche | Impacts of front-end and middle-end process modifications on terrestrial soft error rate[END_REF] found gains of 40% on 0.18μm and 0.15μm for SRAM with triple-well. Then [START_REF] Cannon | SRAM SER in 90,130 and 180 nm Bulk and SOI Technologies[END_REF], [START_REF] Chatterjee | Single-Event Charge Collection and Upset in 40-nm Dual-and Triple-Well Bulk CMOS SRAMs[END_REF], [START_REF] Chatterjee | Effects of charge confinement and angular strikes in 40 nm dual-and triple-well bulk CMOS SRAMs[END_REF] proved that the more technologies become thin (180 nm, 130 nm, 90 nm, 65 nm and 40 nm), the more the SER becomes important. And [START_REF] Gasiot | Multiple Cell Upsets as the Key Contribution to the Total SER of 65 nm CMOS SRAMs and Its Dependence on Well Engineering[END_REF] shows that the triple-well may even have a negative impact on SER.

This paper is organized as follows: Section II describes comparative experiments of laser fault injection in dual-well and triple-well technology in 40 nm technologies. In section III, the principles underlying BBICS and its architecture are described. A comparison for both in dual-well and triple-well has been experimentally drawn. Its weaknesses on the basis of measurements, revealed during the testing, are discussed. In section IV, we propose BBICS architectural modification to obtain an improved detection capability. A new design well suited for triple-well CMOS is introduced. Then, section V draws a conclusion

II. FAULT INJECTIONS COMPARISON

Fault injection were performed with a pulsed-laser at 1064 nm wavelength, a laser spot diameter of 1 μm and a wide range of laser pulse duration from short nanosecond to long microsecond. The laser beam was centered on flip-flops in dual-well and triple-well structures through their backside. Our test structures were designed in 40 nm CMOS STMicroelectronics technology for both techniques (dual and triple-well). The targeted flip-flop design and layout were similar. All the datas in this paper were normalized with a single percentage factor (instead of power in watts) for effective presentation and due to confidentiality constraints. These laser settings are not consistent with the emulation of an ionizing particle strike. However, we were more interested in comparing the magnitude of laser power needed for a fault injection than in precisely emulating an SEE.

Multiples faults were recorded during the experiments on the test structures. In figure 3 are compared the minimum laser power needed for a fault injection on the structure with and without triple-well.

These data show that the minimum laser power needed for an SEE on a FF in triple-well are around 2 times lower than in dual-well. This trend and order of magnitude for the slight decrease are in agreement with the other works published in the literature [START_REF] Gasiot | Multiple Cell Upsets as the Key Contribution to the Total SER of 65 nm CMOS SRAMs and Its Dependence on Well Engineering[END_REF]. Nowadays, for a 40 nm CMOS technology, the use of a triple-well has a negative impact regarding SEE generation with a laser.

III. SENSOR BBICS COMPARISON

A fecund idea of countermeasure was the monitoring of the currents that happen with SEEs [START_REF] Gill | An Efficient BICS Design for SEUs Detection and Correction in Semiconductor Memories[END_REF], [START_REF] Vargas | Seu-tolerant sram design based on current monitoring[END_REF]. Bulk Built-In Current Sensors (BBICS) were developed to detect the transient bulk currents induced in the bulk of integrated circuits when hit by ionizing particles or pulsed laser [START_REF] Neto | Using Built-In Bulk Current to detect Soft Errors[END_REF], [START_REF] Neto | Tbulk-BICS : A Built-In Current Sensor Robust to Process and Temperature Variations for SET Detection[END_REF], [START_REF] Zhang | A New Bulk Built-In Current Sensing Circuit for Single-Event Transient Detection[END_REF]. Among various BBICS architecture proposals, only few were, to date, experimentally tested [START_REF] Zhang | A New Bulk Built-In Current Sensing Circuit for Single-Event Transient Detection[END_REF], [START_REF] Champeix | Experimental Validation of a Bulk Built-In Current Sensor Detecting Laser-Induced Currents[END_REF]. A simulationbased evaluation of a BBICS used to monitor a triple-well architecture was done by [START_REF] Dutertre | Improving the ability of Bulk Built-In Current Sensors to detect Single Event Effects by using triple-well CMOS[END_REF]. Their conclusion was to recommend the use of triple-well to obtain an optimal use of BBICS.

Our experimental evaluations are dedicated to compare and validate the efficiency of the sensor of a BBICS architecture, designed to simultaneously monitor PMOS and NMOS transistors in dual-well and triple-well structures, under Photoelectric Laser Stimulation (PLS). The obtained results are the first silicon experimental proof of the efficiency of BBICS in triple-well and the mitigated results compared with the dual-well BBICS. Furthermore our investigations will give spatial information of the sensitivity detection.

A. BBICS principles

Bulk currents induced during normal operation of an IC are in the µA range, whereas particles or laser-pulsed induce bulk currents are above by two orders of magnitude for the generation of SEEs [START_REF] Neto | Using Built-In Bulk Current to detect Soft Errors[END_REF]. BBICSs are designed to take advantage of this property: they monitor bulk currents, hence they are able to detect unusual currents and, consequently, the advent of SEEs [START_REF] Dutertre | Sensitivity tuning of a bulk built-in current sensor for optimal transient-fault detection[END_REF], [START_REF] Simionovski | Simulation Evaluation of an Implemented Set of Complementary Bulk Built-In Current Sensors With Dynamic Storage Cell[END_REF].

Fig. 4 depicts the insertion of BBICS between the bulks of the MOS transistors and their biasing voltages. The BBICS used pBBICS to monitor PMOS bulk transistors (i.e. the Nwell), and nBBICS to monitor NMOS bulk transistors (i.e. the Psubstrate in dual-well and the Pwell in triple-well structure).

Hence, as illustrated, any transient photocurrent necessarily flows through the BBICS. The purpose of the BBICS is then to raise a warning flag indicating that the circuit function may be affected. Note that the BBICS has also to provide the biasing of the transistor's bulk.

B. BBICS architecture

Fig. 5 depicts the architecture of the BBICS we designed and used for practical validation with a laser in [START_REF] Champeix | Experimental Validation of a Bulk Built-In Current Sensor Detecting Laser-Induced Currents[END_REF]. Its main feature is its ability to simultaneously monitor NMOS and PMOS transistors. Two cross-coupled inverters are used to store the content of a warning flag: OUT node. OUT goes to high level to indicate the detection of any unusual bulk current, and stays low in monitoring mode. The INNWELL and INPWELL nodes are the respective BBICS connections to the biasing contacts of the PMOS and NMOS bulks. Transistors MP1 and MN1 are used to bias the INNWELL and INPWELL nodes, respectively at VDD and ground. In this way they ensure the proper biasing of the corresponding bulks. These transistors are always in ON state. The purpose of transistors MP2 and MN2, whose drains are connected to nodes OUTB and OUTA, is to raise the alarm flag in case of the advent of a SEE according to the process explained hereafter. Fig. 5 also highlights (in violet) when a bulk current is induced by the laser, OUTA and OUTB change their stable state in the latch, so consequently, the output of the sensor (OUT) is at '1'. The sensitive latch detects small variations of their inputs and memorizes a state if there was a transient bulk current. It needs to be reset at every acquisition.

C. Experimental measurements

For the purpose of analyzing the weakness of the BBICS, we performed a set of experiments on a test chip we designed in 90nm CMOS STMicroelectronics technology. Note that the technology node differs from the fault injection evaluation presented in part II. But the tendency stays the same in 40 nm (simulation have been done in the next part). Manufacturing silicon BBICSs in 40 nm are in progress. Sensor detection measurements will be evaluated soon.

Our test structure in 90 nm, is the same as used for our results presented in [START_REF] Champeix | Experimental Validation of a Bulk Built-In Current Sensor Detecting Laser-Induced Currents[END_REF]. We focused our study on two same areas of a purely combinational logic block, in dual-well and triple-well technologies, monitored by a single BBICS. These measurements were carried out by the same infrared laser source used in section II, for a laser power = 100% (minimum power fault threshold in dual-well) and for a wide range of laser pulse duration from short ns to long µs.

To understand the different detection maps reported in Fig. 6, description of how the blocks are distributed in the layout is important. The 45 µm x 13 µm monitored area (also called target) is 14 µm far from the BBICS in order to avoid any perturbation during acquisitions. This target is a combinatorial gates area whose bulks are biased by the BBICS. Two version of this gates area have been designed in dual-well and triplewell technologies in order to have a comparative sensitive detection area. The BBICS, is always designed in dual-well. The laser detection maps will cover both the monitored area and the BBICS (80 µm x 60 µm with a step size of 1 µm).

A first detection (or sensitivity) maps at 100% laser power, is shown on Fig. 6a. The target sensitive area is almost fully covered in triple-well. Our measurements were caring out, first in triple-well in order to have the laser power needed to have a full coverage. Firstly, it is the proof of the effectiveness of a laser sensor in triple-well technology. Unfortunately, for this coverage, the laser power is 2 times higher than the power requested for a SEE in a flip-flop (cf part II).

Then, a second maps in dual-well (Fig. 6b) was built experimentally to have a comparative detection trend from the previous detection maps. The sensitive area in dual well is 6.4 times bigger than in triple-well. This result is contradictory with [START_REF] Dutertre | Improving the ability of Bulk Built-In Current Sensors to detect Single Event Effects by using triple-well CMOS[END_REF]. Our hypothesis is that the current generated on the wells in triple-well are less important than in dual-well.

A detection area is also present in the BBICS itself. It is not due to the photocurrent in the BBICS taps but to an SEU in the core latch of the BBICS itself.

The architecture of this single BBICS demonstrated that the detection is very effective in dual-well technology but not enough in triple-well. So the design need to consider those aspects to perfectly tune the BBICS detection threshold. It can be tuned by changing the W/L ratio of MN1 and MP1 transistors. The more resistive these transistors are, the more effective the detection at low photocurrent is. Unfortunately, after the design the sensor coverage can't be adjusted.

IV. THE USE OF BODY-BIASING FOR THE SENSOR

Based on these results, we developed a new BBICS architecture well suited for the monitoring of triple-well CMOS logic and with the goal to adjust the BBICS coverage.

With technology scaling down, performance and power consumption play an increasingly important role in logic design. The body biasing technique presented in [START_REF] Liu | Trading Speed for Low Power by Choice of Supply and Threshold Voltages[END_REF] and [START_REF] Keshavarzi | Technology scaling behavior of optimum reverse body bias for standby leakage power reduction in CMOS IC's[END_REF] is one well-known solution to adjust consumption and performance. This low power technique uses threshold voltage scaling by reverse or forward body bias. In 40 nm CMOS technology, the power supply is 1.2 V and the body biasing range is +/-400 mV applied on both NMOS and PMOS bulks (i.e. applied on the N and P wells). Body-biasing technique can only be obviously used for the triple-well CMOS. The Psubstrate potential is always grounded, DeepNwell = 0. This biasing tuning will have the impact to help the BBICS detection. Thus, in RBB condition the potential are inversed and then the impact will disadvantage the BBICS detection. Based on this assumption, we designed a BBICS compliant with body-biasing adjustments (see Fig. 7). MP1 and MN1 ensure the proper biasing of the corresponding bulk.

Then, the source potential instead of being directly connected to VDD and GND, they are connected on adjustable voltage source in green and orange on Fig. 7.

For the purpose of analyzing the BBICS coverage, we performed a set of experiments on stand-alone structures to measure the currents involved in SEE generation. These measurements were carried out on NMOS and PMOS transistors for both dual-well and triple-well [START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser[END_REF], [START_REF] Borrel | Electrical model of an NMOS body biased structure in triple-well technology under photoelectric laser stimulation[END_REF] and [START_REF] Borrel | Electrical model of a PMOS body biased structure in triple-well technology under pulsed photoelectric laser stimulation[END_REF]. Based on these measurements, we created SPICE simulation models which make it possible to simulate the photocurrent generated on the test structure. The first three columns show the body-biasing condition and the voltage potential of the Nwell and Pwell. The fourth and fifth columns are some currents extract values of the photocurrent generated on the wells. The photocurrent generated on Nwell is around 50% higher than in Pwell. This is because one part of this current flows to Psubstrate. And this current is not monitored by the BBICS structures. And the last column is the minimum laser power needed for BBICS detection (also called detection threshold).

As we expected, the FBB condition contributes to help BBICS detection and the RBB condition limits this impact. In FBB condition, the Pwell/DeepNwell junction is less reversed biased (0.8 -0.4 = 0.4 V) than in RBB condition (1.6 + 0.4 = 2 V). It is well known that the more the PN junction is reverse biased, the more the photocurrent is generated. Thus, in RBB condition the photocurrent on DeepNwell is 309 µA and only 23.7 µA in FBB. This current generation should be limiting the BBICS detection in FBB. However, the threshold voltage Vth of the transistor MP2 and MN2, decrease in FBB condition than in RBB. In addition, FBB changes the gate potential of MP2 and MN2. Then, it drastically helps the sensor detection by reaching the voltage gates of MP2 and MN2 to the ON state.

Therefore, in maximal FBB condition, the minimal laser power needed for a BBICS detection is 15.32%. Compare to, the previous results, this laser power is now too weak to induce a SEE in flip-flops. Thus, the use of FBB on BBICS compliant with body-biasing in triple-well structure appears to solve the weakness for detecting a SEE.

V. CONCLUSION

This paper compares the triple-well structure to a classical dual-well. Test results for laser fault injection show that triplewell flip-flops cells are more vulnerable compared to dualwell. Additionally, triple-well BBICS countermeasures are less sensitive than in dual-well. Our experiments revealed an unexpected weakness in using triple-well contrary to the work simulated by [START_REF] Dutertre | Improving the ability of Bulk Built-In Current Sensors to detect Single Event Effects by using triple-well CMOS[END_REF]. Then, we proposed a new BBICS compliant with body-biasing adjustments. This solution shows the effective impact on detection and can easily used as an adjustment of the sensor threshold, in order to improve its detection efficiency.

Figure 1 .

 1 Figure 1. Laser-sensitive area of an inverter with its input at low level..

Figure 2 .

 2 Figure 2. Cross section view of CMOS gates (a) without triple-well and (b)with triple-well.

Figure 3 .

 3 Figure 3. Comparative study of the laser sensitivity threshold of a flip-flop in dual-well and triple-well.

Figure 4 .

 4 Figure 4. Principle of SEE detection by a combinated n & p BBICS

  Figure 6. BBICS laser cartographies in (a) triple-well and (b) dual-well, for a laser power = 100%.

Figure 7 .

 7 Figure 7. BBICS architecture compliant with body-biasing variation.

  Fig. 8 reports the signals of interest during a laser shot: the transient currents generated on Nwell, the voltage of INPWELL (NMOS bulk's voltage) and INNWELL (PMOS bulk's voltage) and the flag signal OUT. The next step was to obtain the detection threshold (i.e. the transient current magnitude sufficient to trigger an alarm) of the new BBICS with body-biasing well adjustments. The transient current magnitude was progressively increased (the pulse timings were left unchanged) until reaching the magnitude sufficient to trigger the alarm. We ran simulations for different FBB & RBB variations. The obtained results are given in table 1.

TABLE I .

 I EFFECT OF BODY-BIASING ON BBICS DETECTION

			THRESHOLD
	Body-	DeepNwell	Pwell	DeepNwell	Pwell	Laser
	biasing	potential	potential	Current	current	power
		(V)	(V)	(µA)	(µA)	(%)
	RBB	1.6 1.4	-0.4 -0.2	309 231.5	204 152.8	199.74 149.64
	No	1.2	0	154.7	102.1	100
	FBB	1 0.8	0.2 0.4	82.9 23.7	54.7 15.64	53.59 15.32

Figure 8. Electrical BBICS simulation whithout body-biasing.


Nicolas Borrel
email: nicolas.borrel@st.com

Clément Champeix

Edith Kussener

Wenceslas Rahajandraibe

Mathieu Lisart

Jean-Max Dutertre

Alexandre Sarafianos

N Borrel A-B

J-M Dutertre

Electrical model of an Inverter body biased structure in triple-well technology under pulsed photoelectric laser stimulation

Electrical model of an Inverter body biased structure in triple well technology under pulsed photoelectric laser stimulation

I. INTRODUCTION

The first faults called SEE (single event effects) have been notified in 1960s when it was found that radioactive particles were causing errors in electronic circuits [START_REF] Binder | Satellite anomalies from galactic cosmic rays[END_REF], [START_REF] May | Alpha-Particle-Induced Soft Errors in Dynamic[END_REF]. The aerospace industry directly affected by this issue began research on the physical effects of these particles in silicon. In this context, the use of pulsed-lasers was introduced to emulate SEEs at the experimenter's bench [START_REF] Habing | The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits[END_REF]. Nowadays, SEE is yet a major threat for semiconductor manufacturers. Photoelectric Laser Stimulation (PLS) is commonly used in reliability evaluation and failure analysis methodologies [START_REF] Glowacki | Systematic characterization of integrated circuit standard components as stimulated by scanning laser beam[END_REF]. However this kind of experiments could be very expensive and time consuming. In this context, it is interesting to use a simulation tool at gate level in order to simulate with good accuracy the effect of PLS on a chip in order to analyze its impact in a very small amount of calculation time.

PLS generates electron-hole pairs in silicon, as the laser energy is greater than the silicon band gap. Our PLS experiments were carried out using a pulsed-laser at 1064 nm wavelength on the active parts of an inverter device in triple-well (designed in 90 nm STMicroelectronics CMOS technology) through their backside, a laser spot diameter of 1 µm and a laser shoot duration of 5 µs. The measurements were used to validate and calibrate the electrical model in order to create a fast and simulated SPICE solution under laser stimulation. This electrical model makes it possible to simulate the response of an inverter in a triple-well structure to laser pulses. The behavior of an inverter in triple-well under light stimulation is a good entry point to understand others more complex logic cells.

It has been shown [START_REF] Haraguchi | Microscopic optical seam induced current measurements and their applications[END_REF], that inside the space charge region of a PN junction, electron-hole pairs will be separated by the internal electric field and then generate an optical beam induced current. The photoelectric currents created during the light stimulation flow through the PN junctions and may corrupt voltage outputs of the cells. In this paper, we also consider the parasitic bipolar junction transistors inherent to CMOS bulk devices. We show that these parasitic transistors contribute to the output cell corruption at a higher rate than just the PN junctions of the OFF MOS side. Furthermore, an electrical model of inverter biased in Psubstrate under PLS has been studied in [START_REF] Hériveaux | Electrical Modeling of the Effect of Photoelectric Laser Fault Injection on Bulk CMOS Design[END_REF]. The novelty of this paper is that our model based on actual electrical measurements takes into account the parasitic bipolar transistors topologically added by the use of a triple-well implant for the body biasing techniques (see Fig. 1). With technology scaling down, performance and power consumption play an increasingly important role in logic design. The body biasing technique presented in [START_REF] Liu | Trading Speed for Low Power by Choice of Supply and Threshold Voltages[END_REF] and [START_REF] Keshavarzi | Technology scaling behavior of optimum reverse body bias for standby leakage power reduction in CMOS IC's[END_REF] is one well-known solution to optimize consumption and performance. This low power technique uses threshold voltage scaling by reverse or forward body bias. In 90 nm CMOS technology with a power supply V DD = 1.2 V, the body biasing range is +/-400 mV applied on both NMOS and PMOS bulks (i.e. applied on the N and P wells), where the implant DeepNwell is needed. The first electrical models of MOS transistors under pulsed laser stimulation were generally made of a current source which represents the photocurrent induced by the laser. In this paper we proposed an improvement of these electrical models in order to be capable to take into account the triple-well implant.

This article begins by explaining our models of the PN junctions under PLS as well as parasitic bipolar effects. Secondly, it shows the measurements of the inverter inside the triple-well when Input = Gnd and Input = V DD . Finally, our electrical model and 3D simulation methods are proposed.

II. PHOTOCURRENT ELECTRICAL MODEL

Photocurrent generated by a pulsed-laser on an IC, were generally modeled by current sources on PN junctions. We took the choice to improve the electrical model already introduced by Sarafianos et al. in [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF] and [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of a PMOS transistor in 90nm technology[END_REF], which takes into accounts the laser's spot size, power, pulse duration, focus of the laser beam and the spatial parameters, location, geometry, wafer thickness.

A. PN junction modeling

Using the laser beams to study each junction of our structure lets us create PN junctions models (called Subckt_Iph_diode) which contain a voltage-controlled current source. The amplitude value of this current source is defined by I ph as expressed in [START_REF] Binder | Satellite anomalies from galactic cosmic rays[END_REF]:

𝐼 = (𝑎 𝑉 + 𝑏) 𝛼 𝑃𝑢𝑙𝑠𝑒 𝑊 𝐼 _ (1)
where, V is the reverse biased voltage, a and b depend on the laser power, γ is an amplitude attenuation coefficient, α gauss is the sum of two Gaussian functions which take into account the spatial dependency, Pulse width considers the laser pulse duration dependency, W coef is an exponential function allowing for the wafer thickness effect and I ph_z is a curve function which considers the focus effect of the z axis of the laser lens:

𝛼 = 𝛽 𝑒 ( ² ) + 𝜌 𝑒 ( ² ) (2)
𝑃𝑢𝑙𝑠𝑒 = 1 -𝑒 ( • ) (3)
𝑊 = 𝑒 . (4)
𝐼 _ = (𝑐 𝑧 + 𝑐 𝑧 + 𝑐 𝑧 + 𝑐 𝑧 + 𝑐 𝑧 + 𝑐 𝑧 + 𝑐 )𝑐 𝑒 [START_REF] Haraguchi | Microscopic optical seam induced current measurements and their applications[END_REF] where, d is the distance (in µm) between the laser spot and the center of the PN junction, t pulse is the laser pulse duration (in second), Wafer thickness is the thickness of the wafer (in µm) and z is the laser lens distance (in µm) with z = 0 when focused on the active area. The other coefficients depend on the CMOS technology and laser lens type.

In order to simulate this photocurrent effect, the sub circuit (see figure 2) which contains a voltage controlled current source was built. The current amplitude of the current source is described by [START_REF] Binder | Satellite anomalies from galactic cosmic rays[END_REF] and the start and duration of the laser pulse is set by the laser_trigger signal.

B. Parasitic bipolar transistor modeling

We have already introduced electrical models of a triple-well structure in [START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser[END_REF], [START_REF] Borrel | Electrical model of an NMOS body biased structure in triple-well technology under photoelectric laser stimulation[END_REF] and [START_REF] Borrel | Electrical model of a PMOS body biased structure in triple-well technology under pulsed photoelectric laser stimulation[END_REF], where the parasitic vertical PNP and NPN bipolar transistors were modeled as voltage-controlled current sources [START_REF] Gray | Analysis and Design of Analog Integrated Circuits[END_REF]. Parasitic bipolar transistor models can be generalized by ( 6):

𝐼 = 𝐼 𝑒𝑥𝑝 | | (6)
where, I S is a constant used to describe the transfer characteristic of the transistor in the forward-active region (typically 10 -14 to 10 -16 A), δ is a modeling coefficient in order to fit the simulation and the measurements, V T is the thermal voltage and V EB is the voltage between N and P potentials. In order to simulate this bipolar effects, the sub circuits (see figure 3), which contains a voltage-controlled current source, were built. The current amplitude of the current source is described by [START_REF] Hériveaux | Electrical Modeling of the Effect of Photoelectric Laser Fault Injection on Bulk CMOS Design[END_REF].

III. INVERTER MEASUREMENTS UNDER PLS

The experiments were performed with a laser spot diameter of 1 µm and a laser shoot duration of 5 µs. The Device Under Test (DUT) is an inverter inside a 70 × 70 µm triple-well stand-alone structure (see Fig. 1 for a cross-sectional view). The inverter is composed by an NMOS 630 × 90 nm and a PMOS 880 × 90 nm. The Inverter is a very basic structure but the phenomenon under PLS can be easily understood and are similar for other and more complex logical cells. Some simulation under PLS have been presented in [START_REF] Hériveaux | Electrical Modeling of the Effect of Photoelectric Laser Fault Injection on Bulk CMOS Design[END_REF] but the novelty of this paper are the electrical measurements in order to calibrate our model of the inverter in the triple-well structure. In all the results presented, we consider that the output of the inverter holds an opposite logical state of the input. But when this inverter is stimulated by a pulse Laser, it may induce an error on the output by a logic state change. This method determines the physical effects of a SEE on the inverter in triple-well.

First of all, it is important to well understand the different currents behavior for modeled the photocurrents generated on the PN junctions and bipolar transistors activations. From Fig. 1, we can see that three PNP bipolar junction transistors are attached to the source and drain of the PMOS transistor which may contribute to fault injection. In our measurements, the Nwell and V DD of our DUT were always at 1.2 V however the Psubstrate, Pwell and Gnd electrodes were grounded. The inverter is fully illuminated by the laser spot.

A. Input = 0V

Firstly, the input of the inverter was biased at 0 V. Then, the PMOS is used in their ON state, the NMOS in their OFF state consequently the output = 1.2 V. As shown and modeled in [START_REF] Borrel | Electrical model of an NMOS body biased structure in triple-well technology under photoelectric laser stimulation[END_REF] and [START_REF] Borrel | Electrical model of a PMOS body biased structure in triple-well technology under pulsed photoelectric laser stimulation[END_REF], for laser power below 50 mW, the laser induced photocurrents on the PN junctions. There are mainly 6 PN junctions (shown in green in Fig. 4 The shapes of the photocurrents measured (see Fig. 11) are similar for these interfaces but the amplitude value are widely different. Therefore the study is made independently for each PN junctions. These photoelectric effects are modeled by six sub-circuits Subckt_Iph expressed by equation ( 1) with different attenuation coefficients. Table I shows these coefficients for the six junctions. The main photoelectric current flows from DeepNwell to Psubstrate due to the large size of this junction. The second contributor is the DeepNwell to Pwell one, the amplitude of this photocurrent is attenuated by a coefficient 35 due to its smaller size and the Pwell doping concentration. The next contributors are significantly smaller still due to their size: the DeepNwell/PMOS Source junction, DeepNwell/PMOS Drain junction, the NMOS drain/Pwell junction and finally the NMOS Source/Pwell junction. It is well known than more the PN junction is reversed biased, more the photocurrent generated is. Consequently, the NMOS Drain/Pwell junction is more sensitive to photoelectrical stimulation than the others because it is more reversed biased (NMOS Drain = 1.2 V & Pwell = 0 V). Then its attenuation coefficient γ = 300 is instead of 500.

It is well known that these photoelectric currents created during the light stimulation flow through the PN junctions corrupt the voltage output of the inverter. The photocurrent injected on NMOS drain/Pwell junction discharges the load capacitor and the output voltage drops. The PMOS transistor then drives current thanks to its Vds potential, which increases with the decrease of the output node. The PMOS try to maintain the output voltage high.

In addition, for laser power higher than 50 mW, a large photocurrent flows through the potential V DD during the laser pulse. As depicted on Fig. 5, the current on V DD is pulled down (negative value) as an input current direction convention. The photocurrents generated on the DeepNwell have for consequences to decrease the local DeepNwell potential. When this local potential becomes smaller than V DD -0.6 V, the P+/DeepNwell junction starts conducting whereas the Psubstrate/DeepNwell junction stays reverse biased. The effect induced is the activation of the two vertical PNP parasitic bipolar transistors P+/DeepNwell/PSubstrate (shown in blue in Fig. 4).

Furthermore, the current which flow through the Drain of the PMOS by this parasitic transistor increase the discharges of the load capacitor and the output voltage drops. This phenomenon is a second contributor to discharge the output capacitance. Finally, when the injected photocurrent is higher than the PMOS transistor saturation current, the output capacitor will be discharged and fully drop the output voltage (see in blue on Fig. 6). When the output voltage becomes smaller than V DD /2, around 450 mW, then a fault appears. This fault is called bit-reset.

B. Input = V DD

Secondly, the laser spot was still centered on the inverter but the input of the inverter was biased at 1.2 V. Then, the PMOS is used in their OFF state, the NMOS in their ON state consequently the output = 0 V. As previously, first the photocurrents generated on the PN junctions have been studied independently and then parasitic bipolar activations have been highlighted (see Fig. 7). Table II shows these coefficients for the six junctions. For the same reason as part III.A, the main photoelectric current flows from DeepNwell to Psubstrate and the second one is the DeepNwell to Pwell. On the other hand, the next contributor is the DeepNwell/PMOS Drain junction due to the reverse biased condition (Nwell = 1.2 V & PMOS Drain = 0 V). The photocurrent injected on DeepNwell/PMOS drain junction has for effect to charge the load capacitor and then the output voltage rise. In this case, this is the NMOS which try to maintain the output voltage down. As previously noted, for laser power higher than 50 mW, a large photocurrent flows through the potential V DD during the laser pulse. As depicted on Fig. 8, the current on V DD is pulled down (negative value) as an input current direction convention. The photocurrents generated on the DeepNwell have for consequences to decrease the local DeepNwell potential and then induced the activation of one vertical PNP parasitic bipolar transistor P+/DeepNwell/PSubstrate and one lateral PNP parasitic bipolar transistor P+/DeepNwell/P+ (shown in blue in Fig. 7). Finally, when the injected photocurrent is higher than the NMOS transistor saturation current, the output capacitor will be charged and fully raise the output voltage (see in red on Fig. 6). When the output voltage becomes higher than V DD /2, around 75 mW, then a fault appears. This fault is called bit-set.

The collector current which flows from V DD to PMOS Drain by this lateral bipolar transistor have a significant impact on output voltage drop. From Fig. 6, we can easily notice how this parasitic PNP bipolar transistor plays an important role by drastically increased the output voltage.

The red curve (for a bit-set) stops above 170 mW because for this laser power the structure was damaged.

C. Sensitivity mapping measurements

Previous theoretical work [START_REF] Roscian | Fault Model Analysis of Laser-Induced Faults in SRAM Memory Cells[END_REF] (who only take into account photoelectric effects) showed that when the input = 0 V, the drain of the NMOS is 'the sensitive' part for a bit-reset and when the input = 1.2 V the drain of the PMOS is 'the sensitive' one for a bit-set. In order to validate this, experimental maps were performed. The laser power was increased progressively, until the first faults appear (for bit-set or bit-reset).

The SEE sensitivity mapping (8 µm x 8 µm with a step size of 0.5 µm) we have obtained is drawn in Fig. 9. Blue color is used to depict a bit-reset at laser power = 426.4 mW and the red for a bit-set at laser power = 93.275 mW. The two cartographies are for different laser powers due to the difference sensitivity of a fault between the two failure modes. The two maps revealed that: NMOS Drain is the sensitive area for a bit-reset; on the other hand, all the Nwell area is sensitive for the bit-set. This is due to the photocurrent generated on Nwell which induce the activation of parasitic bipolar.

IV. ELECTRICAL MODELING OF THE INVERTER UNDER PLS

In this section we present post-layout SPICE simulation of our DUT with the various photoelectric and parasitical bipolar transistors model effects we built. The aim of this modeling is to validate our methodology in order to explore some specific results with a very fast calculation time.

A. Model and electrical simulation

For every PN junction and parasitic bipolar transistor, a sub circuit which contains a specific controlled voltage current source (presented in part II) is added to the netlist. These models were validated and tuned thanks to electrical measurements (presented in part III), in order to take into account laser condition and body biasing variations. Photocurrents have been simulated with our model on the PMOS, NMOS and different wells of our DUT. Fig. 11 presents the current on VDD and the output potential. A very good correlation is obtained between simulation and measurements.

B. Sensitivity mapping simulation

Moreover, our model takes into account the spatial parameters, making it possible to draw current cartographies.

Firstly it is necessary to create a meshing (in our case, a step equal to 0.125 µm) on the layout of the cell. For each point of the mesh, the distance between this point and all the PN junction centers are measured. Mainly thanks to Equation (2), for each point of the mesh, the photocurrent generated by every PN junction is simulated. Sensitivity maps obtained from simulations (Fig. 12) and measurements (Fig. 9) showed a very good correlation. This confirms the good results already obtained on single test transistors [START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser[END_REF], [START_REF] Borrel | Electrical model of an NMOS body biased structure in triple-well technology under photoelectric laser stimulation[END_REF], [START_REF] Borrel | Electrical model of a PMOS body biased structure in triple-well technology under pulsed photoelectric laser stimulation[END_REF] and validates the relevance of our simulation tool for more complex logic gates.

V. CONCLUSION This paper describes an accurate electrical model of an inverter in triple-well in 90 nm CMOS technology that takes into account parasitic bipolar activations under pulsed-laser stimulation. This model combines all various photoelectrical phenomenon revealed by measurements during the PLS. The effectiveness of our approach has demonstrated a very good correlation between measurements and our model. In failure analysis, this proposed simulation technique may serve as a reference to detect defaults by comparison with a device under pulsed-laser stimulation. Future works will consist in characterizing and modeling complex logic gates inside a triple-well process.

Fig. 1 .

 1 Fig. 1. Inverter DUT in triple-well technology with parasitic bipolar transistors representation

Fig. 2 .

 2 Fig. 2. Electrical modeling of a PN junction under pulsed laser embedded in a sub circuit called Subck_Iph

Fig. 3 .

 3 Fig. 3. Electrical modeling of the parasitic PNP and NPN bipolar transistors in a sub circuits called Subck_Ibip

  ) which may give rise to a photoelectric effect (DeepNwell/Psubstrate junction, DeepNwell/Pwell junction, DeepNwell/PMOS Drain junction, DeepNwell/PMOS Source junction, NMOS Drain/Pwell junction and NMOS Source/Pwell junction).

Fig. 4 .

 4 Fig. 4. Representation of the photocurrents and parasitic bipolar activations on inverter in triple-well technology when input = 0 V under PLS.

Fig. 5 .

 5 Fig. 5. Current Measurements on Gnd, DeepNwell, Pwell and VDD potential when Input = 0 V.

Fig. 6 .

 6 Fig. 6. Output voltage measurements on the inverter when input = 0 V & input = 1.2V.

Fig. 7 .

 7 Fig. 7. Representation of the photocurrents and parasitic bipolar activations on inverter in triple-well technology when input = 1.2 V under PLS.

Fig. 8 .

 8 Fig. 8. Current Measurements on Gnd, DeepNwell, Pwell and VDD potential when Input = 1.2 V.Furthermore, the current which flow through the Source to the Drain of the PMOS by the lateral parasitic transistor increase the charges of the output load capacitor. Then, this phenomenon is a second contributor to charge the output capacitance. This lateral bipolar (PMOS Source/DeepNwell/PMOS Drain) have

Fig. 9 .

 9 Fig. 9. SEE sensitivity measurements maps of the inverter in triple-well for a bit-reset at laser power = 426.4 mW (a) and a bit-set at laser power = 93.275 mW (b).

Fig. 11 .

 11 Fig. 11. Comparison of experimental and simulation results of the current on VDD (a) and output potential (b) of an inverter in triple-well under PLS when input = 0 V.

Fig. 10 .

 10 Fig. 10. Electrical model of an inverter in triple-well structure under PLS.

Fig. 12 .

 12 Fig. 12. SEE sensitivity simulation maps of the inverter in triple-well for a bit-reset at laser power = 426.4 mW (a) and a bit-set at laser power = 93.275 mW (b).

Table I -

 I ATTENUATION COEFFICIENTS MEASURED ON PHOTOELECTRIC AMPLITUDE FOR ALL PN JUNCTIONS WHEN INPUT= 0 V.

	Junction	Attenuation coefficient (γ)
	DeepNwell/Psubstrate	1
	DeepNwell/Pwell	35
	DeepNwell/PMOS Source	500
	DeepNwell/PMOS Drain	500
	NMOS Drain/Pwell	300
	NMOS Source/Pwell	500

Table II -

 II ATTENUATION COEFFICIENTS MEASURED ON PHOTOELECTRIC AMPLITUDE FOR ALL PN JUNCTIONS WHEN INPUT = 1.2 V.

	Junction	Attenuation coefficient (γ)
	DeepNwell/Psubstrate	1
	DeepNwell/Pwell	35
	DeepNwell/PMOS Source	500
	DeepNwell/PMOS Drain	300
	NMOS Drain/Pwell	500
	NMOS Source/Pwell	500


Clément Champeix
email: clement.champeix@emse.fr|clement.champeix@st.com

Jean-Max Dutertre

Vincent Pouget

Bruno Robisson

Mathieu Lisart

Nicolas Borrel

Alexandre Sarafianos

Laser testing of a double-access BBICS architecture with improved SEE detection capabilities

Keywords: Bulk Built-In Current Sensor, Radiation-hardening by design, Single-Event Effects, Laser fault injection, SEE detection

The paper reports the experimental validation of a new Bulk Built-In Current Sensor (BBICS) designed and implemented in a 40nm CMOS technology. The double-access architecture provides improved SEE detection as confirmed by laser experiments.

I. INTRODUCTION

When exposed to an harsh environment in space, high atmosphere or even on earth, integrated circuits (ICs) may undergo soft errors. Among the various existing effects, Single-Event Effects (SEEs) due to ionizing particles may result in a faulty behavior of the circuit. Many radiation hardening by design (RHBD) techniques have been proposed in order to deal with SEE at cell or circuit level. Those techniques rely on various strategies including critical charge increase, critical node redundancy, event detection and correction. A fruitful idea was the monitoring of the currents that happen with SEEs [START_REF] Gill | An Efficient BICS Design for SEUs Detection and Correction in Semiconductor Memories[END_REF]. This idea found its development in the principle of Bulk Built-In Current Sensors (BBICS) which were developed to detect the transient current induced in the bulk of ICs when hit by ionizing particles [START_REF] Neto | Using Built-In Bulk Current to detect Soft Errors[END_REF], [START_REF] Neto | Tbulk-BICS : A Built-In Current Sensor Robust to Process and Temperature Variations for SET Detection[END_REF]. BBICS are particularly well suited at detecting dynamic errors associated to single-event transients (SET) that can not be detected by more classical static error detection and correction (EDAC) architectures. This paper introduces the architecture of the double-access BBICS we developed. This BBICS architecture was embedded in a 40 nm CMOS test chip. Its ability at detecting SEEs was tested with a picosecond range laser source. These experiments revealed its high efficiency: the BBICS detection threshold was found lower than the SEE occurrence threshold.

II. BBICS PRINCIPLES

Bulk currents induced during normal operation of an IC are typically in the µA range; whereas particle-induced bulk currents have to be above two orders of magnitude to generate an SET on the related gate output [START_REF] Neto | Using Built-In Bulk Current to detect Soft Errors[END_REF]. BBICSs are designed to take advantage of this property: they monitor bulk currents (i.e. currents passing through P-taps and N-taps), hence they are able to detect unusual radiation-induced currents and, consequently, the appearance of SEEs [START_REF] Simionovski | Simulation Evaluation of an Implemented Set of Complementary Bulk Built-In Current Sensors With Dynamic Storage Cell[END_REF], [START_REF] Dutertre | Improving the ability of Bulk Built-In Current Sensors to detect Single Event Effects by using triple-well CMOS[END_REF].

Fig. 1 depicts the insertion of a BBICS between the bulk (i.e. the Psubstrate) of NMOS transistors and the ground. Hence, as illustrated, any SEE transient current necessarily flows through the BBICS. The purpose of a BBICS is then to raise a warning flag indicating that the circuit function may be affected. Note that the BBICS has also to provide the biasing of the transistor's bulk, a ground biasing in case of NMOS. In Fig. 1, the BBICS used to monitor NMOS transistors is named nBBICS. There also exists pBBICS dedicated to the monitoring of PMOS transistors. When a bulk current is induced by an ionizing particles, OUTA and OUTB change their stable state in the latch, so consequently, the output of the sensor (OUT) is at '1'. The latch should be very sensitive to detect small variations of their input voltage. The latch memorizes a state if there was a transient bulk current, so it needs to be reset at every acquisition.

B. Simulations

Electrical simulations may be done to determine the ability of BBICS at detecting SEEs, with an ideal current source, modeling transient current induced by SEE [START_REF] Pouget | SPICE Modeling of the Transient Response of Irradiated MOSFETs[END_REF]. Current amplitudes and pulse durations (respectively from 1 µA to 300 µA and from 5 ps to 320 ps) were simulated in order to determine the detection sensitivity. Two circuits are evaluated: a nBBICS (which architecture was derived from that of Fig. 2 by removing transistors MP1 and MP2) and a double-access BBICS to validate the usage of the second circuit. In Fig. 4, the detection threshold of nBBICS is 94 µA for 30.61 ps of current pulse duration. For the same current pulse duration, the detection threshold of double-access BBICS is 49 µA for 30.61 ps of current pulse duration. The doubleaccess BBICS requires 48% less charge than the nBBICS to toggle.

C. Device under test

The double-access BBICS was embedded in a 40 nm STMicroelectronics CMOS test chip (with a core voltage of 1.2 V ). The BBICS was connected to a test element designed to mimic the kind of logic blocks a BBICS is supposed to monitor against SEEs. It consists of Nwells and Pwells shaped in a donut-like shape as depicted in the upper part of Fig. 5. The monitored area is 13 µm away from the BBICS to avoid any perturbation during acquisitions.

A. Experimental set-up

The laser source (Fig. 6) we used during our experiments produces laser pulses in the picosecond range. It has a 1030 nm wavelength, which makes it possible to access to the sensitive areas of a target through its backside. Our tests were actually performed through the target backside, which was thinned to 150 µm thickness to minimize the amount of power lost along the laser beam path. The laser beam was focused on the DUT's sensitive parts: given the ×100 objective lens we used, we obtained a laser spot with a diameter of ∼ 1 µm. Several laser pulse energies were chosen to have a full coverage area and evaluate the sensitivity maps.

To compare the BBICS results, Fig. 7 represents an SEU mapping from previous work [START_REF] Champeix | SEU sensitivity and modeling using picosecond pulsed laser stimulation of a D Flip-Flop in 40 nm CMOS technology[END_REF] on a D Flip-Flop cell with exactly the same experimental settings. The measured SEU threshold energy was 0.5(±0.1) nJ.

Mappings are performed by moving the backside microscope that injects the laser beam thanks to a XYZ stage (accurate to 0.1 µm) whereas the wafer is stationary. At every points, all the input signals are set with an FPGA, and the acquisitions are captured by a remote oscilloscope.

For our experiments, the main objective was to validate the efficiency of the double-access BBICS at detecting Single-Event Effects related currents close to the SEU threshold.

B. Experimental results (BBICS sensitivity maps)

Fig. 8 and Fig. 9 present detection sensitivity mappings of the double-access BBICS obtained while exposing the monitored element to laser pulses of 30 ps duration. These four detection maps were drawn respectively at 0.1 nJ, 0.2 nJ, 0.3 nJ and 0.4 nJ. Note that these energy levels correspond to the settings of our bench, the energy actually reaching the sensitive parts of the target is lower due to attenuation through the optical path and silicon. At 0.1 nJ, the monitored area is fully covered: the laserinduced photocurrent has always triggered the BBICS alarm flag. At higher energies, the detection area extends largely The usefulness of BBICS is linked to their ability at detecting bulk currents with a magnitude lower than what is necessary to induce SEEs: i.e. no SEE in the monitored logic would escape detection. We validated the efficiency of the double-access BBICS on the basis of laser testing. As a result, practical laser experiments demonstrated a detection threshold of 0.1 nJ for BBICS design (at this energy the whole monitored area is covered) whereas the SEU threshold was higher at 0.5 nJ. This is a promising evidence of the efficiency of double-access BBICS at detecting SEEs.

The SEE appearance is completely detected by the BBICS. The flag of the sensor may now be used to correct the error using different techniques of fault tolerance or resilience techniques [START_REF] Baumann | Radiation-induced soft errors in advanced semiconductor technologies[END_REF][START_REF] Sootkaneung | On Techniques for Handling Soft Errors in Digital Circuits[END_REF][START_REF] Sawadpong | Exception Handling Defects: An Empirical Study[END_REF][START_REF] Zhu | Handling Soft Error in Embedded Software for Networking System[END_REF].

V. CONCLUSION

This paper reports the first successful laser testing of a double-access BBICS embedded in an advanced technology node (40 nm CMOS). We measured a 0.1 nJ detection threshold corresponding to a coverage of the whole BBICS monitored element. At higher energies, the detection area extends largely outside the monitored element. This detection threshold is

Fig. 1 .Fig. 2 .

 12 Fig. 1. Principle of SEE detection by an NMOS dedicated nBBICS

Fig. 2

 2 Fig. 2 also highlights (in violet) the chain of events involved in bulk current detection by the BBICS when a transient current flow through P-taps.

Fig. 3

 3 Fig.3depicts the transient voltages inside the sensor with a comparison between a nBBICS and a double-access BBICS for the same transient current parameters (200 ps and 12 µA) emulating a SEE. The nBBICS failed at detecting the event whereas the double-access BBICS succeeded thanks to the toggle of latch on the both sides.

Fig. 3 .Fig. 4 .

 34 Fig. 3. Simulation results of nBBICS and double-access BBICS detecting transient currents (200 ps and 12 µA)DetectionNo detection

Fig. 5 .

 5 Fig. 5. Layout of double-access BBICS and layout of the monitored wells (not to scale)

Fig. 6 .Fig. 7 .

 67 Fig. 6. Laser bench used for our experiments (injection through backside)

Fig. 8 .

 8 Fig. 8. BBICS laser detection maps on monitored wells at 0.1 nJ and 0.2 nJ

Fig. 9 .

 9 Fig. 9. BBICS laser detection maps on monitored wells at 0.3 nJ and 0.4 nJ

  of pulsed-laser[pJ]

Fig. 10 .

 10 Fig. 10. Coverage area of BBICS detection with a laser pulse duration of 30 ps