Marc Lacruche

Nicolas Borrel

Clément Champeix

C Roscian

A Sarafianos

Jean-Baptiste Rigaud

Jean-Max Dutertre

Edith Kussener

J.-B Rigaud

J.-M Dutertre

Laser Fault Injection into SRAM cells: Picosecond versus Nanosecond pulses

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

I. INTRODUCTION

Fault attacks are a subset of the wide array of physical attacks existing against secure circuits. Their goal is to disturb a circuit and then to exploit the resulting computation errors. Perturbations can be induced by different means: optical attacks [START_REF] Skorobogatov | Optical fault induction attacks[END_REF], voltage [START_REF] Blömer | Fault based cryptanalysis of the advanced encryption standard (aes)[END_REF] and clock glitches [START_REF] Agoyan | When clocks fail: On critical paths and clock faults[END_REF], electromagnetic pulses, etc.

Methods such as Differential Fault Analysis (DFA) [START_REF] Boneh | On the importance of checking cryptographic protocols for faults[END_REF]- [START_REF] Piret | A differential fault attack technique against spn structures, with application to the aes and khazad[END_REF] use the differences between the faulted and correct outputs of encryption algorithms to recover the encryption keys. The success and efficiency of the DFA is highly dependent on the fault model [START_REF] Otto | Fault attacks and countermeasures[END_REF], as such, knowing that a specific fault model is relevant and usable for a given target is important. Faults injected into memory cells are usually modeled using either the bit-set/bit-reset or the bit-flip fault model. A bit-set is the case where the cell state is changed from "0" towards "1" but unchanged if the cell state is already "0", while a bit-reset is the case where the cell state is changed from "1" towards "0" but unchanged if the cell state is already "1". In the case of a bit-flip, the cell state is inverted (i.e. flipped) regardless of its initial state.

In previous works, Sarafianos et al. [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an sram cell[END_REF] and Roscian et al. [START_REF] Roscian | Fault model analysis of laser-induced faults in sram memory cells[END_REF] both studied the fault models that apply to SRAM cells for laser-induced faults. They drew maps of the lasersensitive areas of a 5 transistors SRAM cell using a 50 ns laser pulse duration. It showed that one of the theoretical sensitive areas was hidden and did not allow to inject faults. They also came to the conclusion that the bit-set/bit-reset fault model is the relevant one as they did not obtain any bit-flip type fault. They also validated their results through simulation using the electrical model of transistors exposed to laser stimulation described in [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an sram cell[END_REF], [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an nmos transistor in 90nm technology[END_REF], [START_REF] Sarafianos | Building the electrical model of the photoelectric laser stimulation of a pmos transistor in 90nm technology[END_REF]. Finally, they obtained further validation of their results by performing fault injection experiments on the RAM memory of a microcontroller.

Having a robust simulation model to anticipate the behavior of a chip when submitted to fault injection attempts may permit to reveal a security weakness before actual production (hence saving the cost and time of a redesign).

In this paper, we report similar experiments carried out with 30 ps laser pulses. It revealed a laser-sensitive area which was masked at 50 ns laser pulse duration. We also confirmed the relevance of the bit-set/bit-reset fault model. These results are backed by experimental results obtained on a dedicated SRAM prototype and on the RAM memory of a microcontroller. We then improved the simulation model to fit with our new results. Note that a nanosecond range pulse duration is common for hardware security testing, whereas a picosecond range duration is mandatory for emulating radiation effects caused by ionizing particles [START_REF] Buchner | Pulsed-laser testing for single-event effects investigations[END_REF].

This article is organized as follows: First, we remind the mechanisms of laser fault injection, going from a PN-junction to a SRAM cell. Second, we review the results of previous works. Third, we present our experimental results and work in designing a simulation model. Finally, we draw a conclusion.

II. LASER FAULT INJECTION MECHANISM

A. Physical Phenomenon

Laser fault injection is achieved using the photoelectric effect [START_REF] Habing | The use of lasers to simulate radiation-induced transients in semiconductor devices and circuits[END_REF]. When a laser beam passes through silicon, if the photon energy is greater than the band-gap of the silicon, electron-hole pairs are created. In most cases, the pairs then just recombine and nothing happens. However, when the laser beam is targeted at a PN-junction, electrons and holes are drifted in opposite directions by the PN-junction electrical field, thus creating a transient current across the junction.

The phenomenon happens in three phases highlighted in figure 1: 1) Charges are created along the path of the beam, 2) Charges are drifted away by the PN-junction electric field, stretching the depletion region along the laser beam path. The charges nearby are then promptly collected, creating a current spike, 3) The remaining charges are then slowly collected in a diffusion phase: the current magnitude decreases slowly until all charges have been collected or have recombined.

B. Effect on an Inverter

Despite creating a transient current, laser illumination of a PN-junction may not be sufficient to alter the logic state Fig. 1: Laser-induced photocurrent generation in PN-junctions [10] [15]. of a target. Using an inverter as an example, there are 4 PNjunctions with an electrical field capable of creating a transient current, both drains and sources of the two transistors.

In the case where the input state of the inverter is "0", the PMOS transistor is "ON" and the NMOS transistor is "OFF" resulting in a "1" logic state output (as depicted in the left part of figure 2). A laser pulse targeting the NMOS' drain will have an effect on the output of the inverter. In this situation, the transient current goes from the drain towards the substrate, discharging the load capacitance. As a result, the output state of the inverter temporarily changes to a low-level until the transient current ends. Then, the load capacitance is re-charged through the "ON" PMOS transistor and the output state of the inverter goes back to a high state. This transient output voltage can propagate itself further in the logic. It is called a Single Event Transient (SET) [START_REF] Wang | Single event upset: An embedded tutorial[END_REF].

Targeting the inverter's other PN-junctions would not create any SET. Indeed, transient currents created in the PMOS' drain or source would create leakage paths towards the N-Well which is biased at Vdd and therefore would not discharge the load capacitance. Any transient current induced in the NMOS source would also have no effect since it is isolated from the output by the "OFF" NMOS.

A similar reasoning may be done in the case where the input is in a "1" state (right part of figure 2), only a transient current created in the "OFF" PMOS' drain would create a SET and alter the inverter's output. The laser-sensitive areas for each state of the inverter are highlighted in red in figure 2. They match the drain of the "OFF" transistor.

C. Effect on a SRAM Cell and Fault Model

The core part of a SRAM cell is made of two cross-coupled inverters (figure 3a). If a SET is induced in one of the two inverters (figure 3b), it propagates through the second one (figure 3c), driving the cell in its opposite steady state. When the transient current vanishes, since the cell is in a steady state it doesn't revert to its previous state and the stored value is altered (figure 3d). This phenomenon is called a Single Event Upset (SEU) [START_REF] Wang | Single event upset: An embedded tutorial[END_REF].

1 0 0 1 0 1 1 1 Q Q Q Q Q Q Q Q a b d c Fig. 3: Single Event Upset mechanism.
As a result of the inverter analysis, we can assume that for each state of a SRAM cell ("0" or "1") the drains of the OFF transistors of the two core inverters can produce an SEU when targeted. This means that a SRAM cell should have 4 SEU-sensitive areas linked to its inverters (there are also laser-sensitive areas linked to the access transistors). Figure 4 displays the laser-sensitive areas of the 5 transistors SRAM cell we used during our experiments. In this instance, we define a bit-set (resp. bit-reset) as the switching of the cell's output node (Data_out) from "0" to "1" (resp. from "1" to "0") as a result of a laser shot.

Vdd Gnd Vdd Gnd Data_in Data_out Q Q Sel MP1 MN1 MP2 MN2 MN3 Bit-Set Laser-Sensitive Area
Bit-Reset Laser Sensitive Area Fig. 4: Schematic of the 5T SRAM cell with its sensitive areas.

D. SRAM Cell Layout and Sensitive Areas

The cell, which measures 4 µm by 9 µm, is embedded in a 0.25 µm CMOS technology chip. The chip was specifically designed for laser testing, with as few metal layers as possible above the cell to allow front side laser fault injection (metal paths reflect laser light, hence shielding a device against laser exposure). Figure 5a shows the layout of the cell along with the positions of its different laser-sensitive areas. Consider the drain of transistor MP1 (upper left part of figure 5a). It is lasersensitive only if the SRAM is in its "0" state: targeting it with a laser may induce a bit-set. In figure 5a, laser sensitive areas causing bit-sets are highlighted in red. Those corresponding to bit-resets are highlighted in blue. If the bit-set and bit-reset areas do not overlap (due to laser settings that limits its effect area) it should be impossible to inject bit-flip faults.

However, if the effect area of a laser shot is sufficiently large, the bit-set/reset areas may extend and overlap as exemplified in figure 5b. A laser beam targeted at an overlap area (a bit-flip area) may be able to induce a SEU regardless of the SRAM's state: this corresponds to the bit-flip fault model.

III. PREVIOUS WORKS FOR 50 NS PULSE DURATION

During their experiments Roscian et al. [START_REF] Roscian | Fault model analysis of laser-induced faults in sram memory cells[END_REF] used a 1064 nm laser source, a 1 µm spot size, and a pulse duration of 50 ns. Their target was a 5 transistors SRAM cell designed in CMOS 0.25 µm technology (see figure 4).

The first point that came out from their experiments is that only three of the four expected sensitive areas created SEUs. The drain of MP2 did not react as expected: the sensitive area was masked. In [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an sram cell[END_REF] Sarafianos et al. made the hypothesis that this phenomenon was due to the comparatively small surface of the drain of MP2 compared to a counter-balancing effect of the photocurrent induced in the shared drain of transistors MN2 and MN3, MN3 is the access transistor of the SRAM (see figure 5a). Note that MP2's drain has a drain surface smaller than that of MN2/MN3 which makes this phenomenon happen (the photocurrent magnitude is proportional to the drain surface). Figure 6 from [START_REF] Roscian | Fault model analysis of laser-induced faults in sram memory cells[END_REF] reports the obtained lasersensitivity map of the SRAM cell at 0.42 W laser power. Fig. 6: 5T SRAM laser-sensitivity map for 50 ns pulses [START_REF] Roscian | Fault model analysis of laser-induced faults in sram memory cells[END_REF].

The second point in these results was that no bit-flip type faults were obtained. Contrary to their previous hypothesis, no laser position allowed to create both a bit-set and a bit-reset faults.

A. Simulation Results

Using the electrical model introduced by Sarafianos et al. in [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an sram cell[END_REF], [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an nmos transistor in 90nm technology[END_REF], [START_REF] Sarafianos | Building the electrical model of the photoelectric laser stimulation of a pmos transistor in 90nm technology[END_REF], they were able to validate their results on simulation basis: the obtained map of laser-sensitive areas is given in figure 7 for a laser pulse duration of 50 ns. This laser-sensitivity map matches the experimental results (see figure 6): no bit-flip faults were obtained (there is no overlap between bit-set and bit-reset areas, given in red and blue respectively), the fourth laser-sensitive area of transistor MP2 is also missing. The electrical models they built was tuned for laser pulses ranging from 50 ns to 20 µs. It allowed the authors of [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an sram cell[END_REF] and [START_REF] Roscian | Fault model analysis of laser-induced faults in sram memory cells[END_REF] to explain the counterbalancing effect that leads to the masking of the MP2 drain sensitive area and also to explain the infeasibility of bit-flip type faults. B. Application to a Commercial Microcontroller [START_REF] Roscian | Fault model analysis of laser-induced faults in sram memory cells[END_REF] reports similar experiments conducted on the RAM of a 0.35 µm CMOS technology commercial microcontroller using the same laser settings. The results are shown in figure 8 (the size of one SRAM cell is highlighted with a black square). Similarly, no bit-flip type faults were obtained and two sensitive areas per cell were missing.

Although they didn't have any knowledge of the RAM layout, this result is coherent with their previous hypothesis of a counterbalancing effect due to the access transistors. Standard SRAM cells used in microcontroller RAM usually have two access transistors, leading to a masking effect in one additional sensitive area (remember that the 5T SRAM has only one access transistor).

IV. RESULTS FOR 30 PS PULSE DURATION

A. Laser Test Bench

The laser source we used has the following characteristics: 1030 nm wavelength, a laser pulse duration of 30 ps and an energy ranging from 0 to 100 nJ. The optical path outputs a Fig. 8: Laser-sensitivity map of a portion of the memory of a microcontroller using 50 ns pulses [START_REF] Roscian | Fault model analysis of laser-induced faults in sram memory cells[END_REF].

spot of 1 µm, 5 µm or 20 µm depending on the chosen lens. An infra-red camera was used to adjust the focus of the spot.

Fault injection was performed through the front-side of the chip. The optical lens is attached to a motorized XYZ stage with a minimum step of 0.1 µm.

B. Laser-Sensitivity Map Drawing Process

Using a PC to automate the process, we moved the laser over the area of the cell by steps of 0.2 µm. For each position we shot the laser after writing the cell to 0, then shot again after writing it to 1 and read the stored value after each shot. This allowed us to draw a map of the results where for each X/Y position of the laser spot on the cell where a fault has been recorded, we draw a colored dot depending on the fault type (red for a bit-set and blue for a bit-reset). Lastly, if we can obtain a bit-set and a bit-reset on the same position it means that bit-flips are possible on this specific position.

Such laser-sensitivity maps were drawn at various laser energies.

C. Experimental Results

We carried out our laser-induced fault injection experiments on the 5T SRAM cell already described (see figure 4) using similar settings. However, we used a 30 ps laser pulse duration. Our intent was to test whether the bit-set/reset fault model and the absence of some laser-sensitive areas were still valid or not.

Figure 9 displays the laser-fault sensitivity map we obtained at 3.2 nJ laser energy (higher energies led to the destruction of the cell). Four laser-sensitive areas were obtained, which is consistent with the laser-sensitivity assumptions depicted in figure 5a. The previously hidden laser-sensitive area of transistor MP2 is no longer missing. Moreover, similarly with the results of Roscian et al., no bit-flip faults were induced.

We drew the assumption that the use of a 30 ps laser pulse reduces the effect area of a laser spot as compared with a nanosecond range laser pulse. As a result, a picosecond range laser shot may not permit the existence of the counterbalancing effect at the origin of the masking of laser-sensitive areas. We studied further this assumption on the basis of simulations and experiments as reported in the next subsections.

D. Adaptation of the Simulation Model to Picosecond Pulses

Douin et al. [START_REF] Douin | Influence of laser pulse duration in single event upset testing[END_REF] reported the most complete research work in modeling at electrical level the effect of pulse duration on laser fault injection into a SRAM cell. They introduced two different electrical models: one for short laser pulses and the other for long laser pulses (the threshold between short and long pulses was around one nanosecond). We chose another approach: using the electrical model already introduced by Sarafianos et al. [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an sram cell[END_REF], [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an nmos transistor in 90nm technology[END_REF], [START_REF] Sarafianos | Building the electrical model of the photoelectric laser stimulation of a pmos transistor in 90nm technology[END_REF] for laser pulses in the nanosecond range. However, we changed several parameters of their model in order to take into account the laser pulse duration and our assumption of a reduced effect area for shorter laser pulses.

For the sake of brevity we refer the reader to the corresponding bibliography [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an sram cell[END_REF], [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an nmos transistor in 90nm technology[END_REF], [START_REF] Sarafianos | Building the electrical model of the photoelectric laser stimulation of a pmos transistor in 90nm technology[END_REF] for a complete description of this electrical model. It is mostly built to take into account the laser-induced photocurrents. To that end, PN-junction photocurrents are modeled with voltage controlled current sources, which are added to the electrical model of the target. The laserinduced photocurrent model they built is given in Eq. 1:

I ph (t) = [a(E).V r + b(E)].A.↵ topology .⌦ shape (t) (1)
The laser-induced current pulse is shaped in the time domain thanks to the term ⌦ shape (t) in Eq. 1 which takes into account the laser shot duration. At 30 ps laser pulse duration, ⌦ shape (t) has the shape of a double exponent lasting 100 ps. The other three multiplicative terms model the photocurrent pulse magnitude according to the other parameters of interest:

• a(E).V r + b(E):
where V r is the junction's reverse voltage, and a(E), b(E) are coefficients depending on the laser energy E. This term models the impact of both the laser energy and the reverse bias voltage of the PNjunction,

• A: the junction's area, • ↵ topology : this coefficient models the influence of the topology, i.e. the fact that the photocurrent magnitude decreases as the laser spot distance from the PN-junction increases. As mentioned, the term ↵ topology is used to model the effect area of a laser shot, i.e. the effect of the distance between the laser spot and a given PN-junction on the magnitude of the corresponding laser-induced photocurrent. Sarafianos et al. obtained its value experimentally for laser pulse durations in the nanosecond range. It is depicted in deep blue in figure 10 for a 50 ns laser pulse duration: the effect of the laser extents over several micrometers. Following our assumption of a reduced effect area at 30 ps laser pulse duration, we adjusted ↵ topology to a narrower shape as depicted in light blue in figure 10 (the photocurrent magnitude is halved as the laser spot is moved of a distance of 0.5µm away from the PN-junction of interest). The resulting lasersensitivity map is given in figure 11: it has four distinct lasersensitive areas (similarly to the experimental map displayed in figure 9). The laser-sensitive area corresponding to the drain of transistor MP2 is no longer missing. In addition, because bit-set and bit-reset areas do not overlap in figure 11, it is a further validation that the bit-set/reset fault model is valid for picosecond range laser pulse duration. Note that the experimental sensitivity maps were drawn from frontside laser injection, as a result the shielding effect of the SRAM's metal interconnections is discernable in the shape of the sensitive areas. This phenomenon is not taken into account at simulation level, this partly explains the discrepancies between experimental and simulation-based sensitivity maps.

E. Analysis at Electrical Level

Figure 12a from [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an sram cell[END_REF] displays the internal nodes voltages and currents of the SRAM cell in state "1" for a 50 ns laser pulse targeting the drain of MP2. The photocurrent induced in the drain of MP2 (Iph DMP2) that should be the root cause of a SEU is too weak to lead to a flip of the SRAM cell: the photocurrent simultaneously induced in the common drain of transistors MN2 and MN3 (Iph DMN2_MN3) has a decisive counterbalancing effect. For a 30 ps laser pulse the counterbalancing photocurrent (Iph DMN2_MN3 in figure 12b) is almost equal to zero because the effect area of the laser spot targeting MP2 is reduced. The photocurrent induced in the drain of MP2 (Iph DMP2) goes rapidly above the current flowing through transistor MN2 (IDS MN2): a SEU is induced.

F. Application to a Commercial Microcontroller

We also performed laser fault injection in the RAM memory of the same microcontroller used by Roscian et al. [START_REF] Roscian | Fault model analysis of laser-induced faults in sram memory cells[END_REF]. We used the laser bench previously described, but contrary to the test performed on a single cell, the injection was performed through the backside of the chip. We drew a 40 µm by 40 µm laser-sensitivity map of a part of its memory plane.

Figure 13 displays the obtained laser-sensitivity map (a black rectangle delimits the surface of a single cell). 4 lasersensitive areas per cell are clearly observable, which is coherent with our previous results. This map also seems to confirm the hypothesis of Roscian et al. that the two access transistors of 6T SRAM cells were masking two sensitive areas per cell when using a 50 ns pulse duration.

Moreover, no occurrence of any bit-flip type fault was observed. While some bit-set and bit-reset areas on the map appeared to overlap, these cases are actually a bit-set occurring on one cell and a bit-reset occurring on an adjacent cell for the same laser spot position.

Note that a recent work from Courbon et al. [START_REF] Courbon | Adjusting laser injections for fully controlled faults[END_REF] conducted on a CMOS 90 nm D flip-flop also confirms the relevance of the bit-set/reset fault model over the bit-flip fault model. 40µm 40µm Fig. 13: Cartography of a portion of the memory of a microcontroller using 30 ps and 3.2nJ pulses.

V. CONCLUSION

In this paper, we showed that pulse duration has to be carefully considered when performing laser fault injection tests on SRAM cells. Be it during simulations at design time, or postproduction during tests on actual chips, limiting the study to nanosecond range pulse durations may hide vulnerabilities.

The experimental results showed that the masking effect which was leading to the disappearance of a sensitive area in [START_REF] Roscian | Fault model analysis of laser-induced faults in sram memory cells[END_REF] does not occur with shorter pulses. This has for notable consequence that the robustness improvement relying on this masking effect presented in [START_REF] Sarafianos | Robustness improvement of an sram cell against laser-induced fault injection[END_REF] may not be valid for picosecond range pulses.

Our results are consistent with those of [START_REF] Roscian | Fault model analysis of laser-induced faults in sram memory cells[END_REF]: the bit-set/reset fault model is relevant to describe laser-fault injection in SRAMs.

We then improved the simulation model presented in [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an sram cell[END_REF], [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an nmos transistor in 90nm technology[END_REF], [START_REF] Sarafianos | Building the electrical model of the photoelectric laser stimulation of a pmos transistor in 90nm technology[END_REF] by adapting it to picosecond range pulse durations. The new model fits correctly with our experimental results. Such a picosecond range model has also the interest to be usable to emulate the effect of ionizing particles on ICs. This extends the scope of this work.

Finally, these results were confirmed by running laser-fault injection campaigns on the RAM memory of a commercial microcontroller.

In future works we will aim to apply and extend these works to more complex structures such as full standard cells with the end goal of integrating the simulation process in the standard design workflow.

Fig. 2 :

 2 Fig. 2: Laser-sensitive areas (red) of an inverter depending on its state.

  Fig. 5: 5T SRAM cell layout.

Fig. 7 :

 7 Fig. 7: Simulation-based laser-sensitive map of a 5T SRAM at 50 ns laser pulse duration.

Fig. 9 :

 9 Fig. 9: Laser-fault sensitivity map of a 5T SRAM at 30 ps.

Fig. 10 :

 10 Fig. 10: ↵ topology curves for 50 ns (deep blue) and 30 ps (light blue) laser pulses.

Fig. 11 :

 11 Fig. 11: Simulation-based SRAM cell laser-sensitivity map for 30 ps laser pulse duration.

Fig. 12 :

 12 Fig. 12: Extracted waveforms from the electrical simulator at the drain of MP2 for (a) 50 ns [9] and (b) 30 ps pulse duration.


Clément Champeix

Nicolas Borrel

Jean-Max Dutertre

Bruno Robisson

Mathieu Lisart

Alexandre Sarafianos

Experimental validation of a Bulk Built-In Current Sensor for detecting laser-induced currents

Keywords: Bulk Built-In Current Sensor, Hardware Security, Photoelectric Laser Stimulation, Single Event Effects, Laser Fault Injection, Countermeasures

Bulk Built-In Current Sensors (BBICS) were developed to detect the transient bulk currents induced in the bulk of integrated circuits when hit by ionizing particles or pulsed laser. This paper reports the experimental evaluation of a complete BBICS architecture, designed to simultaneously monitor PMOS and NMOS transistors, under Photoelectric Laser Stimulation (PLS). The obtained results are the first experimental proof of the efficiency of BBICS in laser fault injection detection attempts. Furthermore, this paper highlights the importance of BBICS tapping in a sensitive area (logical gates) for improved laser detection. It studies the performances of this BBICS architecture and suggests modifications for its future implementation.

I. INTRODUCTION

When exposed to harsh environments in space, high atmosphere or even on Earth, integrated circuits (ICs) may undergo soft errors. The related phenomena are known and have been studied for more than forty years [START_REF] Binder | Satellite anomalies from galactic cosmic rays[END_REF], [START_REF] Normand | Single event upset at ground level[END_REF], [START_REF] Baumann | Radiation-induced soft errors in advanced semiconductor technologies[END_REF]. Among the various existing effects, single-event effects (SEEs) due to ionizing particles may result in a faulty behavior of the affected circuit. Since then, for the purpose of coping with the effects of such events, much research work has been devoted to the understanding and mitigation of SEEs. In this context, the use of pulsed lasers was introduced to emulate SEEs at the experimenter's bench [START_REF] Habing | The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits[END_REF], [START_REF] Buchner | Pulsed-Laser Testing for Single-Event Effects Investigations[END_REF]. However, pulsed laser may also be used to induce faults (as a result of SEEs) into the computations of security-dedicated ICs for the purpose of retrieving the secret data they may contain [START_REF] Skorobogatov | Optical fault induction attacks[END_REF], [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF]. Fortunately, other techniques introduced by researchers in the radiation community to mitigate SEEs may be adapted to better cope with the issue of laser fault-injection. A fertile idea was the monitoring of the currents that happen with SEEs [START_REF] Gill | An Efficient BICS Design for SEUs Detection and Correction in Semiconductor Memories[END_REF], [START_REF] Vargas | Seu-tolerant sram design based on current monitoring[END_REF]. This idea found its development in the principle of Bulk Built-In Current Sensors (BBICS) which were developed to detect transient currents induced in the bulk of ICs when hit by ionizing particles or a pulsed laser [START_REF] Neto | Using Built-In Bulk Current to detect Soft Errors[END_REF], [START_REF] Neto | Tbulk-BICS : A Built-In Current Sensor Robust to Process and Temperature Variations for SET Detection[END_REF]. This paper describes the principles underlying BBICS. It also introduces the architecture of the double-access BBICS. Only simple-access BBICS were, to date, once experimentally tested [START_REF] Zhang | A Bulk Built In Voltage Sensor to Detect Physical Location of Single Event Transients[END_REF]. Based on this research, a new architecture has been implemented. Its weaknesses and strengths, revealed during the testing, are discussed below. Note that the reported work was done from a secure circuit point of view: we used laser pulse durations in the nanosecond range whereas a maximum pulse duration of a few tens of picoseconds should be used for emulating SEEs [START_REF] Buchner | Pulsed-Laser Testing for Single-Event Effects Investigations[END_REF]. This paper is organized as follows: Section II describes the principle underlying BBICSs. The architecture of the doubleaccess BBICS is introduced in Section III. The laser experiments of the single BBICS are described in Section IV. Its weaknesses and strengths, revealed during the testing of the test chip, are discussed. Then, Section V presents a conclusion.

II. STATE OF THE ART

ICs are known to be impacted by SEEs caused by ionizing particles in radioactive environments. The related electrical phenomena and the detection principles using BBICSs are reviewed in the following subsections.

A. Single-Event Effects in Integrated Circuits

When an ionic particle passes through silicon it generates electron-hole pairs along its path. These electrical charges generally recombine without any significant effect on the IC computations. However the electric field found in reversebiased PN junctions may separate the electron-hole pairs, inducing a parasitic transient current. This transient current may in turn disturb the voltage of the IC's internal nodes leading to computational errors. A pulsed laser may be used to mimic (or emulate) this phenomenon provided that its photons energy is greater than the silicon bandgap (electron-hole pairs are then induced by photoelectric effect [START_REF] Habing | The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits[END_REF], [START_REF] Buchner | Pulsed-Laser Testing for Single-Event Effects Investigations[END_REF]). At first, pulsed lasers were used to emulate SEE generation in ICs for radiation hardness evaluation. Since then, they are also used to induce faults into secure circuits for the purpose of retrieving confidential data stored into that devices [START_REF] Skorobogatov | Optical fault induction attacks[END_REF], [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF]. The following describes laser-induced SEEs and the principles of their detection by BBICS. A laser-induced transient current is then called a 'photocurrent' [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF], [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of a PMOS transistor in 90nm technology[END_REF], [START_REF] Sarafianos | Robustness improvement of an SRAM cell against laser-induced fault injection[END_REF], [START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser stimulation[END_REF].

The way a transient photocurrent is turned into a SEE is illustrated in Fig. 1 for the inverter case when its input is at 1, may be injected there through the reverse-biased PN junction between the N-type drain of the NMOS (biased at VDD) and the P-type substrate (grounded). As a result of the latter, the inverter output voltage may drop from '1' to '0' provided that the injected photocurrent is higher than the PMOS transistor saturation current. This voltage transient, also known as SET (Single Event Transient), may thus propagate through the circuit logic, creating errors. Furthermore, if a SET is induced directly in a memory element, as a latch, the stored data may be flipped, characterizing the so-called SEU (Single Event Upset; i.e. a bit set from '0' to '1' or a bit reset from '1' to '0'). Note that a similar phenomenon may also take place when the inverter input is at a high logical state (in this instance the laser-sensitive place is the drain of the OFF PMOS): the photocurrent then flows from VDD through the biasing contact (or tap) of the Nwell (i.e. the PMOS bulk) to ground. An interesting feature of such SEE transient currents is that they flow through the bulk of the sensitive transistors.

B. BBICS principles

Bulk currents induced during the normal operation of an IC are in the µA range; whereas particle-or laser-induced bulk currents have to be above two orders of magnitude to generate an SET on the related gate output [START_REF] Neto | Using Built-In Bulk Current to detect Soft Errors[END_REF]. BBICSs are designed to take advantage of this property; they monitor bulk currents, hence they are able to detect unusual currents and, consequently, the advent of SEE [START_REF] Dutertre | Sensitivity tuning of a bulk built-in current sensor for optimal transient-fault detection[END_REF], [START_REF] Simionovski | Simulation Evaluation of an Implemented Set of Complementary Bulk Built-In Current Sensors With Dynamic Storage Cell[END_REF], [START_REF] Dutertre | Improving the ability of Bulk Built-In Current Sensors to detect Single Event Effects by using triple-well CMOS[END_REF]. Fig. 2 depicts the insertion of a BBICS between the bulk (i.e. the Psubstrate) of NMOS transistors and the ground. Hence, as illustrated, any transient photocurrent necessarily flows through the BBICS. The purpose of the BBICS is then to raise a warning flag indicating that the circuit function may be affected. Note that the BBICS has also to provide the biasing of the transistor's bulk, a ground biasing in case of NMOS. In Fig. 2, the BBICS used to monitor NMOS transistors is named nBBICS. There also exists pBBICS dedicated to the monitoring of PMOS transistors. Even if pBBICS and nBBICS have different architectures they rely on the same principle, i.e. the monitoring of bulk currents.

Among various BBICS architecture proposals [START_REF] Neto | Tbulk-BICS : A Built-In Current Sensor Robust to Process and Temperature Variations for SET Detection[END_REF], [START_REF] Zhang | A New Bulk Built-In Current Sensing Circuit for Single-Event Transient Detection[END_REF],

'1' '0' GND VDD '0' GND FLAG Photocurrent IN OUT nBBICS Fig. 2.
Principle of SEE detection by a NMOS dedicated nBBICS [START_REF] Simionovski | Simulation Evaluation of an Implemented Set of Complementary Bulk Built-In Current Sensors With Dynamic Storage Cell[END_REF], only one was, to date, experimentally tested [START_REF] Zhang | A Bulk Built In Voltage Sensor to Detect Physical Location of Single Event Transients[END_REF]. The authors designed both NMOS-and PMOS-BIVS (Built-In Voltage Sensor according to the authors' denomination) to monitor NMOS and PMOS.

C. BBICS experimental validation

Most of the research was based on simulations [START_REF] Gill | An Efficient BICS Design for SEUs Detection and Correction in Semiconductor Memories[END_REF], [START_REF] Wirth | Bulk built in current sensors for single event transient detection in deep-submicron technologies[END_REF], [START_REF] Zhang | A New Bulk Built-In Current Sensing Circuit for Single-Event Transient Detection[END_REF], [START_REF] Torres | by using Modular Built-In Current Sensors[END_REF], [START_REF] Simionovski | A Bulk Built-in Current Sensor for SET Detection with Dynamic Memory Cell[END_REF], [START_REF] Bastos | A Bulk Built-in Sensor for Detection of Fault Attacks[END_REF]. The only experimental tests was investigated with a 1 ps laser source with a 800 nm wavelength and a 1.6 µm spot size diameter. Their paper proves that a NMOS-BIVS standalone is less sensitive than PMOS-BIVS. The sensitivity threshold for NMOS-BIVS is 110 pJ whereas it is only 15 pJ for PMOS-BIVS (results with 10 contacts to the sensors) [START_REF] Zhang | A Bulk Built In Voltage Sensor to Detect Physical Location of Single Event Transients[END_REF]. Our evaluations are dedicated to improve the efficiency of the sensor by merging both NMOS-and PMOS-BIVS. Futhermore our investigations will provide spatial information of the sensitivity detection regarding the tapping of the target.

III. ARCHITECTURE OF THE SINGLE BBICS USED IN THE EXPERIMENTS

A. BBICS architecture Fig. 3 depicts the architecture of the BBICS we designed and used for practical validation with a laser. Its main feature is its ability to simultaneously monitor NMOS and PMOS transistors. Two cross-coupled inverters are used to store the content of a warning flag: OUT node. OUT goes to high level to indicate the detection of any unusual bulk current, and stays low in monitoring mode. The INNWELL and INPWELL nodes are the respective BBICS connections to the biasing contacts of the PMOS and NMOS bulks. Transistors MP1 and MN1 are used to bias the INNWELL and INPWELL nodes, respectively, at VDD and ground. In this way, they ensure the proper biasing of the corresponding bulk. These transistors are always in ON state. The purpose of transistor MP2 and MN2, whose drains are connected to the OUTB and OUTA nodes, is to raise the alarm flag in case of the advent of a SEE according to the process explained below. The single BBICS architecture also has a reset mechanism (RESET input) thanks to transistors MP3 and MN3. Finally an inverter and an OR2 gate inserted between OUTA and OUTB nodes make it possible to aggregate several alarm flags into a single one by using the INSENSOR input.

When a bulk current is induced by the laser, OUTA and OUTB change their stable state in the latch, so consequently, the output of the sensor (OUT) is at '1'. The latch has to be very sensitive to be able to detect small variations of their input voltage. The latch memorizes a state if there was a transient bulk current, so it needs to be reset at every acquisition. Fig. 3 also highlights (in purple) the chain of events involved in bulk current detection by the single BBICS. Consider the case of a radiative-or laser-induced SEE targeting a NMOS monitored by the single BBICS: a bulk current will flow through transistor MN1 in order to reach ground (the red arrow denoted 'Photocurrent' in Fig. 3). As a result the voltage at INPWELL node will rise (denoted 'up') causing the MN2 transistor to switch from the OFF to the ON state, hence connecting node OUTA to ground. Then node OUTB will go to high level latching the BBICS in alarm mode. The alarm flag OUT will also go to a high logical level revealing the induction of a bulk current. A similar behavior takes place (due to transistors MP1 and MP2) for bulk currents related to PMOS transistors.

B. Device under test

Our target, or device under test (DUT), was designed in the 90 nm STMicroelectronics CMOS technology (its core voltage is 1.2 V ). We focused our study on the area of a purely combinational logic block monitored by a single BBICS.

To understand the different detection maps reported in Section IV, Fig. 4 describes how the blocks are distributed in the layout. The monitored area is 14 µm from the BBICS to avoid any perturbation during acquisitions. The laser detection maps will cover both the monitored area and the BBICS (80 µm ⇥ 60 µm with a step size of 1 µm).

As stated previously, a BBICS is also in charge of providing the substrate and well biasing of the logic it monitors. In our design, we chose to provide this biasing through the BBICS as well as through the IC's power/ground network (PGN). Our The cells of the monitored logic gates are located on the three Nwell and three Psubstrate rows highlighted in Fig. 5. Classical well taps are alternated with BBICS taps every 25 µm. That tapping can be called an hybrid tapping or a 50% BBICS tapping because it merges classical well tapping at the power supply and BBICS tapping.

However, such hybrid taping may weaken the BBICS efficiency in detecting laser-induced bulk currents as illustrated in Fig. 6. Indeed, the photocurrents flowing from VDD to ground may follow two paths: one through the BBICS taps and the other to or from the PGN. The thicker arrow indicates the less resistive path for the photocurrent. The photocurrent will choose preferentially this less resistive path: so, depending on Cross sectional view of a BBICS monitored logical gate with photocurrent paths the position of the laser spot (w.r.t. the biasing contacts), the photocurrent may flow partly through the PGN or the BBICS taps according to the resistivity of these two paths. As a result, the laser-induced bulk current flowing through the BBICS may be reduced, hence lowering its SEE detecting ability. Our test chip was designed to test experimentally this phenomenon.

IV. EXPERIMENTS

A. Experimental set-up

The laser source we used during our experiments produces laser pulses in the nanosecond range (it was set to 200 ns, 100 ns or 50 ns pulse duration for the test series we reported in this paper). It has a 1064 nm wavelength (near IR), which makes it possible to access the sensitive areas of a target through its backside (i.e. through its silicon substrate). Our tests were actually performed through the target backside, which was thinned to ⇠ 150 µm thickness to minimize the amount of power lost along the laser beam path. The laser beam was focused on the DUT's sensitive parts: given the ⇥100 optic we used, we obtained a laser spot with a diameter of ⇠ 1 µm (refer to [START_REF] Buchner | Pulsed-Laser Testing for Single-Event Effects Investigations[END_REF] for a complete description of laser beam propagation through silicon and beam focusing). Three laser pulse durations and two laser powers were chosen to have a full coverage area and evaluate the sensitivy map for lower laser pulse duration and lower laser power. Detection maps were drawn to have a spatial representation of the BBICS area of detection.

To plot the sensitivity maps (i.e. the XY coordinates at which a laser shot make the BBICS alarm flag to rise), the laser moves thanks to a XYZ stage (accurate to 0.1 µm) whereas the wafer is fixed. At every point, all the input signals are set with an FPGA, and the acquisitions are captured by a remote oscilloscope.

The laser is shot when the reset signal is stable, the acquisition of the output needs to be done after a delay. Indeed, the BBICS will flag after a delay because of the capacitor (and resistivity) of the net and the gate delay. It depends also on the layout topology. In our case, the detection response is after a few nanoseconds.

For our experiments, the main objective was to understand double-access BBICS detection, with the BBICS plugged in a sensitive area (logical gates) with different well taps and different BBICS taps (see Fig. 5).

B. Evaluation at 300 mW laser power (BBICS sensitivity maps)

The first detection (or sensitivity) maps at 300 mW laser power (Fig. 7a, Fig. 7b and Fig. 7c) show that the sensitive area is fully covered at 200 ns but exhibits some hidden areas at 100 ns and 50 ns. In Fig. 7b the Gnd and VDD power supply taps hide part of the detection area. This is because the photocurrent generated close to these taps chooses the less resistive path and this path is the Gnd or VDD power supply taps path compared to the BBICS taps. So the BBICS does not flag close to Gnd and VDD taps.

In Fig. 7c, some detection areas are missing, those ones close to BBICS taps (N and P standalone). The couple of P and N BBICS taps detect more than only one BBICS taps. This can be explained by the latch inside the BBICS which is toggled on the two sides close to the couple P and N BBICS taps and on only one side close the N or P BBICS taps. The more there are BBICS taps, the more effective the detection is.

A detection area is also present in the BBICS itself. It is not due to the photocurrent in the BBICS taps, but to an SEU in the latch of the BBICS. Indeed a latch changes states from '0' to '1' when the laser is close to sensitive junction of the inverters [START_REF] Sarafianos | Robustness improvement of an SRAM cell against laser-induced fault injection[END_REF].

C. Evaluation at 250 mW laser power (BBICS sensitivity and photocurrent maps)

The second detection maps at 250 mW (Fig. 7d, Fig. 7e and Fig. 7f) confirm the trend in the previous detection maps. Their coverage is smaller than the previous ones because the photocurrent is reduced (the photocurrent depends on the laser power). These detection maps confirm that the sensitive area is hidden because of the Gnd and VDD power supply taps compared to the BBICS taps. The detection areas are localized close to the BBICS taps but precisely close to the couple of P and N BBICS taps. Indeed close to the single P and N BBICS taps there is not any detection in Fig. 7e and Fig. 7f, for example in the upper corners. The couple P and N BBICS are more effective than single taps. This can be explained because the latch in the design is toggled on both sides. The more there are BBICS taps, the more effective the detection is.

A detection area is also present in the BBICS itself. As in the IV-B, detection does not occur because of the photocurrent in the BBICS taps but because of the SEU in the latch of the BBICS. Indeed a latch will change states from '0' to '1' when the laser is close to the sensitive junction of the inverters.

As well as drawing BBICS detection maps, we also measured the laser-induced photocurrents at 0.25 W laser power. Fig. 8 displays maps of the magnitude of the transient photocurrent pulses obtained at 100 ns (Fig. 8a) or 50 ns (Fig. 8b) laser pulse duration: the maximum current magnitude is given according a color scale for each location (XY coordinates) of the laser shots on the BBICS monitored part of the DUT. Given practical issues of the test bench, Fig. 8 reports the magnitude of the whole photocurrent flowing through the ground connection of the DUT: i.e. the sum of two photocurrents components 2) the BBICS Ptap connections (marked respectively GND and P BBICS in Fig. 6). Hence, we were not able to measure the individual values of these two components. The shapes of the three Nwells of the monitored logic (see Fig. 5) are clearly visible: they correspond to the highest magnitude of the laser-induced photocurrents. At 100 ns laser pulse duration and 0.25 W laser power a maximum photocurrent magnitude of 1.2 mA was obtained.

The maximum photocurrent magnitude is only 300 µA at 50 ns laser pulse duration for the same laser power. The shape of the Nwell is also more precisely drawn at 50 ns. This is no surprise that a photocurrent map reveals the Nwells because they are the place where the biggest reverse-biased PN junctions of the device are.

It has been proven that the photocurrent is higher on Nwell/Psub junctions compared to MOS/Wells junctions (N+/Psub or Nwell/P+) [START_REF] Sarafianos | Robustness improvement of an SRAM cell against laser-induced fault injection[END_REF], [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of a PMOS transistor in 90nm technology[END_REF], [START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser stimulation[END_REF]. To conclude, these photocurrent maps allow us to estimate of the BBICS limit threshold. The reader will also notice that the middle part of each Nwell exhibits a photocurrent magnitude lower than at its right and left ends. We have not yet a valid explanation of this phenomenon. These measures provide a broad idea of the photocurrent that may be detected by the single BBICS.

D. Results analysis

The BBICS detection threshold can be tuned by changing the W/L ratio of MN1 and MP1 transistors. The more resitive these transitors are, the more effective the detection at low photocurrent is; but if the MOS are too resistive, the BBICS will not detect very short pulses. So the design needs to consider those two aspects to perfectly tune the BBICS.

The efficiency of the detection is low close to Gnd/VDD taps because there is not enough transient current for the BBICS. A Ptap and Ntap standalone close to Gnd/VDD also present weakness described by [START_REF] Zhang | A Bulk Built In Voltage Sensor to Detect Physical Location of Single Event Transients[END_REF]. Only one access is not adequate for a good detection: this validates the single BBICS design which uses two accesses respectively to the Psubstrate and to the Nwells. Some parts of the monitored logic gates are not covered by the sensors whereas some SEU are present in the BBICS itself. It proves that these laser settings may disturb the behavior of an IC without being detected. The use of an hybrid well-taping seems to be the root cause of this weakness because it reduces the laser-induced bulk current flowing through the BBICS. Our experiments underline the efficiency of a BBICS architecture that collects SEE currents from both the Psubstrate and Nwells.

V. CONCLUSION

The architecture of this single BBICS demonstrated that the detection is very effective for long laser pulse durations close to P and N taps couples but may fail for short pulses. Furthermore, this distributed tapping allows us to think that a full BBICS tapping will enhance the sensitive detection area (the more there are BBICS taps, the more effective the detection is). If the resistive MOS transistors in the circuit are too resistive, the BBICS will not detect very short pulses but they will permit to detect low photocurrents. So the design needs to consider these two aspects to perfectly tune the BBICS. In order to validate this hypothesis, new BBICS will be tested with different well tapping (100% BBICS taps), different spacing between the taps and different resistive MOS in the circuit, to ameliorate the coverage detection. Finally, picosecond range laser evaluations will be done on these structures, for the radiation field, in order to have a complete evaluation of the double access BBICS.

Fig. 3 .

 3 Photocurrent

Fig. 4 .Fig. 5 .

 45 Fig. 4. Area of interest: layout of the single BBICS and of the logic gates it monitors

  Photocurrent

  (a) Laser pulse duration of 200 ns (b) Laser pulse duration of 100 ns (c) Laser pulse duration of 50 ns Laser pulse duration of 200 ns (e) Laser pulse duration of 100 ns (f) Laser pulse duration of 50 ns BBICS sensitivity maps for a laser pulse power of 300 mW BBICS sensitivity maps for a laser pulse power of 250 mW 0

Fig. 7 .

 7 Fig. 7. BBICS laser detection at 0.3 W and 0.25 W and for a laser pulse duration of 200 ns, 100 ns and 50 ns

Fig. 8 .

 8 Fig. 8. Laser-induced map of the photocurrent flowing through the test chip ground connection for 100 ns and 50 ns pulse duration at 0.25 W

  http://dx.doi.org/10.1109/IOLTS.2015.7229849 On-Line Testing Symposium (IOLTS), 2015 IEEE 21st International

		VDD
		Photocurrent
	IN	'0'	'1'	'0'	OUT
		GND	GND
	Fig. 1. Laser-sensitive area of a CMOS inverter with its input at low level
	low logical level. In this configuration, the SEE sensitive area
	is the drain of the NMOS transistor (shaded in pink), which
	is in OFF state. A laser-induced photocurrent, depicted by a
	current source in Fig.