P.-E Roche

P Diribarne

T Didelot

O Franc ¸ais

L Rousseau

H Willaime

epl draft

Keywords: 67.40.Vs -Vortices and turbulence 47.37.+q -Hydrodynamic aspects of superfluidity, quantum fluids 67.57.De -Superflow and hydrodynamics in Quantum fluids and solids, liquid and solid helium

The fluctuations of the vortex density in a turbulent quantum fluid are deduced from local second-sound attenuation measurements. These measurements are performed with a micromachined open-cavity resonator inserted across a flow of turbulent He-II near 1.6 K. The power spectrum of the measured vortex line density is compatible with a (-5/3) power law. The physical interpretation, still open, is discussed.

Motivation. -Our understanding of the turbulent fluctuations in quantum fluid flows relies on a single direct measurement [1]. This lack of local experimental data [2] contrasts with the situation for counter-flow turbulence, which has been explored by a dozen of fluctuations studies ( [START_REF] Tough | Superfluid Turbulence[END_REF][START_REF] Donnelly | Quantized Vortices in Helium-II (Cambridge Studies in Low Temperature Physics[END_REF][START_REF] Nemirovskii | [END_REF]). It also contrasts with the detailed theoretical picture of the Kolmogorov-like cascade which emerged over the last decades [8] and with the diversity of numerical simulations, such as velocity spectrum studies [9][10][11].

In the isolated experiment mentioned above [1], a miniature total-head tube was configured to operate as an anemometer in a He-II co-flow (or "bulk flow"), at 2.08 and 1.4 K. In a two-fluid model picture, this probe senses a combinaison of the velocities of the superfluid and normal components. Its spatial and time resolution (typically 2 mm and 1 kHz) enabled to resolve one decade of power law scaling below the injection scale. This scaling was found to overlap with the scaling in the inertial range of classical flows. This strong result suggests that the largest scales structures in quantum turbulence undergo a Kolmogorov-type cascade.

Second sound probes have a several decades history as an efficient tool to measure quantum vortices line density (VLD), in particular in turbulent co-flows (for instance [12][13][14] and references within) and counter-flows (for instance [START_REF] Tough | Superfluid Turbulence[END_REF][START_REF] Donnelly | Quantized Vortices in Helium-II (Cambridge Studies in Low Temperature Physics[END_REF][START_REF] Nemirovskii | [END_REF][6][7] and references within). Unfortunately, the size of these sensors and their sidewall positionning made impossible space and time resolved measurements of flow fluctuations. The aim of this paper is to report such a local fluctuations measurement from a micromachined miniature second sound resonator. This probe therefore completes the inertial range characterization with a fully superfluid observable, independent of the earlier velocity measurements.

The flow set-up. -Our flow is a He-II loop confined in a nearly cylindrical cryostat and continuously powered by a centrifugal pump (see figure 1). Turbulence is probed in a Φ = 23 mm-diameter, 250 mm-long brass pipe, located upstream from the pump . Downstream the pump, the fluid returns to the pipe inlet flowing along the outside of it. On this return path, a 30 mm-long 3 mm-cell honeycomb breaks the spin motion generated by the pump. As a test, another 20 mm-long honeycomb has once been inserted in the pipe inlet without noticeable changes. A Pitot tube is located 130 mm before the pipe outlet. It provides a measurement of the mean velocity by mean of an in-situ capacitive differential pressure gauge. The usefull range of velocity is V = 0.3 -1.3 m/s. At lower velocities flow instabilities are detected and at higher velocities, typically at 1.5 m/s, a cavitation threshold is encountered. From in-situ measurements with a semiconducting miniature pressure sensors [16], we estimate a typical 35% velocity turbulence ratio in the pipe. With velocity V and pipe diameter Φ, several Reynolds numbers can be defined using different denominators. This multiplicity result from the extra degrees of freedom of quantum fluids compared to classical fluid. To assess the "instability" of the superfluid, a possible denominator is the quantum of circulation κ = h/m ≃ 0.997.10 -7 m 2 /s (h is Planck constant and m is the mass of the 4-He atom) which is the only available quantum parameter 1 . The corresponding Reynolds number Re κ = Φ.V /κ falls in the 6.10 4 -3.10 5 range.

Fluid temperature is regulated near 1.6 K, which -in the two-fluid model-corresponds to 84% of superfluid [15]. Regulation heaters are spatially distributed and located between the pump and the main honeycomb, near two doped germanium thermometers dedicated to regulation and monitoring. Cooling is provided by a pumped helium bath located above the flow. The excellent effective thermal conductivity of He-II makes possible an efficient regulation. The helium bath's weight pressurizes the flow and makes possible cavitation free operation.

The second sound probe. -The second-sound miniature probe is located 80 mm downstream the pipe inlet. It consists in an open cavity through which a small fraction of helium flows (see figure 2). Both "mirors" of the cavity are 15 microns thick silicon beams separated by a D ≃ 250 µm gap. The length and width of both beams is 1.5 mm x 1 mm and they are facing each other with a lateral positioning within a few tenths of mm typically. A granular Al film is deposited over a h ≃ 0.8 mm square area at the tip of one beam. This film is used as transition edge superconducting thermometer. Its critical temperature is roughly 1.6 K. On the center of the transition, its thermal sensitivity is T /R.∂R/∂T ∼ 30 and its typical resistance 350 Ω. A 250 Ω parasitic resistance (film residual resistance and CuNi wiring resistance) also 1 In the literature, another denominator is sometimes used : the kinematic viscosity based on normal fluid viscosity and He-II total density (0.90.10 -8 m 2 /s at 1.6 K [15]). In our case, it would result in Reynolds numbers a decade higher contributes to the total electrical resistance. Given such conditions (250 < 350), we chose to voltage bias the thermometer to prevent instabilities which can occur with a current bias across positive temperature coefficient thermistance. The typical voltage bias is a few mV. Facing this thermometer, a chromium heating film is deposited on the tip of the other beam. The cavity's volume is therefore geometrically estimated to be Ω ≃ h.h.D ≃ 1 mm x 1 mm x 250 µm. Mechanical assembly and electrical connections are provided at the other ends of both beams by a stack of 3 pieces of silicon wafers. The intermediate one sets the gap of the cavity and support on both sides the contact pads. The whole geometry is designed to reduce the influence on the flow. The micromachining process, assembly and packaging of the probe will be described in details elsewhere.

Figure 3 shows the first thermal resonances of a typical probe with the fluid at rest. Abscissa is the frequency of the applied heating and ordinate is the magnitude of the measured temperature oscillation (arbitrary units). The n th mode resonance frequency is in good agreement with f n = n.c/2D, where c ≃ 20 m/s is the second sound velocity at 1.6 K [15]. For all the probes tested, the quality factor Q of the first resonance is of order 20. It is convenient to define ξ 0 = π.f 1 /c.Q as the equivalent bulk dissipation by length unit which accounts for the total attenuation on the first resonance. attenuation is attributed to a bulk dissipation by vortex lines ξ V LD : this is the signal of interest. Theory predicts that a second-order resonance frequency shift is generated by vortex dissipation ( [17] and references within) but, in our case, it is much smaller than the resonance bandwidth and we can neglect this effect. To probe the fluctuations of the VLD during experiments, the sensor is operated at the first resonance frequency. The measured temperature oscillation, called ∆T 0 (no flow) and ∆T (with flow) are demodulated by a lock-in amplifier with a 160 µs time constant and the oscillation's amplitude is stored for postprocessing. Basic oscillator theory relates VLD dissipation ξ V LD and the time dependent amplitude ∆T according to :

∆T ∆T 0 = sinh[ξ 0 .D] sinh[(ξ 0 + ξ V LD ).D] (1)
Attenuation ξ V LD is related to the projected vortex line density L ⊥ by :

ξ V LD = B.κ.L ⊥ 4c (2)
where the projected vortex line density L ⊥ is defined as :

L ⊥ = 1 Ω sin 2 θ.dl (3)
in which Ω is the cavity volume, the summation is performed along all the vortex line elements dl located inside the cavity and θ is the angle between the line elements and the axis of propagation of the second sound waves.

Heaters in He-II are well known to induce counterflows and -for large enough heating-the counterflow can undergo self-induced turbulent transitions [START_REF] Tough | Superfluid Turbulence[END_REF][START_REF] Donnelly | Quantized Vortices in Helium-II (Cambridge Studies in Low Temperature Physics[END_REF][START_REF] Nemirovskii | [END_REF]18]. Consequently, a special attention has been dedicated to properly choose the heating supplied to the probe, in order to keep the probe non-invasive. With the fluid at rest, a transition has been evidenced on the temperature oscillation for a 30 µW heating in the Cr film. The corresponding heat density, once amplified by the resonance gain Q is typical of the turbulence thresholds of counterflows turbulence [START_REF] Tough | Superfluid Turbulence[END_REF][START_REF] Donnelly | Quantized Vortices in Helium-II (Cambridge Studies in Low Temperature Physics[END_REF][START_REF] Nemirovskii | [END_REF]. During turbulence experiments, we operated the probe with driving power ranging up to 10 times higher that the above threshold, and down to 5 times below it. The normalized measured spectrum turns out to be independent of the driving heat, indicating that any self-induced turbulence transition in this range has a negligeable contribution on the signal. It is worth noting that Holmes and Van Sciver [12] conducted some second sound attenuation measurements with a probe heating density more than 4 decades above ours, across a He-II flow at similar temperature and velocites. These authors find average VLD fully consistent with ours.

To estimate the signal bandwidth, one needs to consider three time constants. First, the geometrically-limited time resolution of the probe : the time of flight h/V of order 1 ms. Second, the time constant of the resonator is Q/f 1 ≃ 0.5 ms, where Q is the quality factor. Third, the 0.6 ms time constant of the electronic set-up (-3 dB cutoff for cable/demodulation/acquisition) which has been measured without probes, using two frequency mixers to mimic the Joule effect frequency doubling and the modulation of the signal by vortex-line-attenuation. These three time scales are comparable and the expected bandwidth is therefore DC -1 kHz.

Result. -Figure 4 presents the main result of this letter : the power spectrum2 of the vortex line density L ⊥ for mean flow velocities of 0, 0.68, 0.90 and 1.25 m/s. The straight line eyes-guides the -5/3 power law. The insert in figure 4 shows the 3 same spectra after subtraction of the noise floor, which is fitted from the zero-velocity spectrum by a 5.10 15 m -4 Hz -1 white noise. The low frequency saturation is consistent with the integral scale plateau of order 1 cm. In between, over almost one decade, a local power exponent of 1.55 ± 0.15 is found. During other runs, this scaling has been observed down to the lowest stable mean velocity reachable in our set-up (0.3 m/s). The observed dependance is compatible with a -5/3 scaling.

The inverse root of the mean VLD is often seen as a typical inter-vortex spacing. This assumes a relative smoothness of the vortex lines at small scales (negligible "excesslength" at scales smaller than inter-vortex spacing). With this assumption and assuming isotropy of the tangle, we find an inter-vortex spacing of 4 µm for a mean velocity of 1 m/s.

We carried several tests to check the nature of the measured signal. Among these, we checked that the probe's output signal near f 0 wasn't modulated by residual temperature fluctuations through an hypothetical non-linear response of its thermometer. By comparison with the signal delivered by a specially designed miniature velocity probe [16], we also checked that the second sound probe wasn't simply measuring velocity, for exemple through the vorticity generated in the thin boundary layers. We also checked that the measured signal wasn't history dependent, as it sometimes happens with some superfluid sensors due to trapped vortex lines [19].

Interpretation and Conclusion. -The interpretation of the observed spectrum is still open. As a conclusion, we discuss two approaches of it. Due to a lack of theoretical prediction and numerical observation of the projected VLD L ⊥ power spectrum, we tried in both case to relate L ⊥ to a classical counterpart.

A first approach would amount to relate the VLD to the kinetic energy, or more precisely L ⊥ to second order statistics of the velocity components. Indeed, fourth order velocity statistics, such as power spectrum of the second order velocity components, are known to produce -5/3 power laws ( [21][22][23]). In a fully random tangle, the VLD is likely to be proportional to the kinetic energy ( [4] page 50-51), at least up to a log correction and assuming that the vortices are straight enough at scales smaller than the inter-vortex spacing. This linear relation can account for a -5/3 spectrum. Unfortunately, as pointed to us by J. Vinen, this simple relation probably no longer holds in a Kolmogorov-like tangle : the partial polarization of vortices should be strong enough to invalidate the random tangle hypothesis. A more detailed modeling is therefore necessary here.

Alternatively, the VLD can also be seen as the quantum analog of the enstrophy (vorticity square) or the absolute value of the vorticity in classical fluids [20]. Enstrophy in classical turbulence follows a +1/3 power law spectrum. Unfortunately we couldn't find any reports on the corresponding spectrum for the projected enstrophy (projectedvorticity square) nor for the absolute value of the projected vorticity. Nevertheless, with the sweeping theory in mind [21,22], we can conjecture that the inertial-range dynamics of the polarization of the vortices is controled by energy containing eddies, which would result in the observed -5/3 power law. This picture has some analogies with passive scalar fluctuations, which also have a similar scaling. * * *

Fig. 1 :

 1 Fig. 1: Scheme of the flow loop with probes.

Fig. 2 :

 2 Fig. 2: Left figure : Single silicon element before the probe assembling, with contact leads and heater layer (emitter) or thermometer layer (receiver). These layers are deposited over a 0.8 mm x 0.8 mm surface. Right figure : Side view of the tip of the assembled probe. The heater and thermometer are facing each other with a 250 µm-gap between their 15 µm-thick and 1.5 mm long support. The helium mainstream flows perpendicularly to the right-side figure.

Figure 3

 3 also shows the resonances with an He flow. Compared to the rest situation, the flow causes an extra attenuation on the temperature signal. A small fraction of it simply results from advection of the thermal wave out of the cavity. A simple ballistic model of this effect gives the equivalent bulk dissipation ξ adv = V /2h.c which turns out to be one order of magnitude below the signal of interest and will be neglected. The remaining of the extra

Fig. 3 :

 3 Fig. 3: The first modes of second-sound resonances of the probe, with flow (dash line) and without (solid line).

Fig. 4 :

 4 Fig. 4: Power spectrum density of the vortex line density L ⊥ for different mean flow velocities : from bottom to top 0, 0.68, 0.90 and 1.25 m/s. The straight line is a (-5/3) power law. The insert is a f -5/3 compensated spectrum for the 3 different mean flows after removal of a 5.10 15 m -4 Hz -1 white noise floor.

The power spectrum density L ⊥ (f ).L ⊥ (f ) is normalized such that its integral over positive frequencies equals < (L ⊥ -< L ⊥ > ) 2 >, where < . > denotes time averaging. A Welch algorithm is used for spectral averaging.

The idea of an in-flow probe was proposed by P. Tabeling and macroscopic protoypes were done with the help of J. Maurer at the Ecole Normale Supérieure. Present work results from a collaboration between three laboratories. The ESPCI designed the emitter and receiver parts of the probes, and made the Al thermometry. The ESIEE micro-machined the emitter and receiver. The CRTBT completed the probe design / machining and made the experiment and analysis. P.-E. R. thanks Pr T. Haruyama and F. Gauthier for assistance with pressure probes, C. Lemonias and T. Fournier of NanoFab, E. André for a bright idea on probe assembly, J. Vinen for his comments, B. Chabaud, B. Hébral, C. Baudet, Y. Gagne and more especially B. Castaing for numerous discussions. We acknowledge financial support of Grenoble Institut de Physique de la Matière Condensée, of the Région Rhônes-Alpes and of the Agence National pour la Recherche (TSF project).


David Keaton

Jens Gustedt

Underspecified Aspects of Threads in C

Keywords:

To provide a standard method for using threads in C, a threads interface had been added to C11. It unifies various existing application programming interfaces (APIs) so that software developers could write portable multithreading code. C11 threads were deliberately defined with the least constraints such that they could be implemented as a standard veneer over native threads of a given platform. However, in some cases too much was left out of the specification. This document lists such cases and tracks the proposed solutions by the C standards committee.

Aspects sous-specifiés des processus légers en C

Résumé : Pour fournir une méthode standardisée d'utilisation de processus légers à partir de C, une interface de processus légers a été ajouté à C11. Pour permettre aux développeurs de logiciel d'écrire du code multi-processus de façon portable, elle unifie plusieurs interfaces de programmation. Les processus légers C11 ont délibérément étés spécifiés avec le moins de contraintes possibles pour permettre de les implanter en tant que revêtement standardisé au dessus des processus légers d'une plate-forme donnée. Néanmoins, dans quelques cas trop a été omis de la spécification. Ce document liste de tels cas et trace les solutions proposés par le comité de standardisation.

Mots-clés : standard C, processus légers 1 Introduction Today, even many embedded devices contain multicore processors. As squeezing additional performance out of each core becomes more and more difficult, new devices will continue to adopt multicore solutions, and the number of cores per processor will increase as well. To keep up with the evolving hardware, software developers have no choice but to use multithreading. An underspecified thread API can lead developers to make incorrect assumptions, or to be unsure of the expected behavior. This can cause deadlock, dangling pointers, and other conditions that can make code insecure.

When this occurs in ordinary equipment, such as devices purchased by a consumer, it can lead to the devices being used as part of a botnet to attack infrastructure. When it occurs in defense-critical systems, it can cause even more severe security problems.

Threads were recently added to the C programming language. The purpose was to provide a standard method for using threads in C, unifying various existing application programming interfaces (APIs) so that software developers could write portable multithreading code. C threads were defined such that they could be implemented on top of any of the existing thread implementations, providing a standard veneer over native threads.

To implement this standard veneer, C threads needed to be flexible enough to accommodate all the idiosyncrasies of different underlying thread packages. This was accomplished by specifying various aspects of C threads more loosely than other thread packages, so that the behavior of existing APIs would be considered valid. This is a helpful approach because it enables the development of a portable API, which was not available before. However, there are some cases where too much was left out of the specification.

In the present work, the C standard as presented in C ( 2011) was studied to identify underspecified aspects of C threads. The section below indicates the clauses of the C standard that are affected and relates it to existing defect reports (DR, summarized in Section 4) and other documents of the C committee (in the bibliography).

2 Items in the C Standard

Multi-threaded executions and data races

Introducing a concept of a blocked thread may help clarify some of the other items. If so, ISO vocabulary standard (Vocab (2015)) may be helpful.

The call_once function

This function is used when a collection of threads all execute the same code, and there is some initialization that must be performed by just one of those threads before any of the threads can proceed.

Paragraph 2 states that completion of an effective call "synchronizes with all subsequent calls," implying that the side effects of the first call will be visible to all calls initiated after the end of the first call. This is insufficient, because the completion of the first call must synchronize with all calls that occur after the beginning of the first call as well. Otherwise, some threads will proceed with their work without the side effects of the first call being visible.

It is unclear what happens if the flag argument to call_once has not been initialized with ONCE_FLAG_INIT. This should probably be undefined behavior.

Mutex functions

The tss_create function

This function creates thread-specific storage and assigns a destructor for it. The standard does not specify when the destructor is called. DR 416 remedies this by specifying that the destructor is called by thrd_exit.

The tss_delete function

This function releases thread-specific storage. In the standard, it is unclear what tss_delete will do with storage that was created after destructors began executing (including storage that is created within a destructor).

DR 416 attempted to remedy this by specifying that a call to tss_delete on such storage would result in undefined behavior. However, DR 416's statement of the condition is flawed. It specifies that for the behavior to be defined, the associated call to tss_create must complete before destructors began executing. This is necessary but not sufficient. Not only must the call to tss_create complete, but its side effects must be visible to the destructors as well.

The tss_get function

This function retrieves a value from thread-specific storage. In the standard, it is unclear what will happen if tss_get is called on storage that was created after destructors began executing (including storage that is created within a destructor).

DR 416 attempted to remedy this by specifying that a call to tss_get on such storage would result in undefined behavior. However, DR 416's statement of the condition is flawed. It specifies that for the behavior to be defined, the associated call to tss_create must complete before destructors began executing. This is necessary but not sufficient. Not only must the call to tss_create complete, but its side effects must be visible to the destructors as well.

The tss_set function

This function stores a value into thread-specific storage. In the standard, it is unclear what will happen if tss_set is called on storage that was created after destructors began executing (including storage that is created within a destructor).

DR 416 attempted to remedy this by specifying that a call to tss_set on such storage would result in undefined behavior. However, DR 416's statement of the condition is flawed. It specifies that for the behavior to be defined, the associated call to tss_create must complete before destructors began executing. This is necessary but not sufficient. Not only must the call to tss_create complete, but its side effects must be visible to the destructors as well.

K.3.6.1 Runtime-constraint handling

Annex K specifies a set of bounds checking functions to be used in place of less safe legacy functions. In case of a bounds violation, these functions call a constraint handler. However, Annex K was written before threads were added to the language, and the specification of constraint handlers assumes a single-threaded execution model. Constraint handlers need to be updated to take threads into account. For example, a library routine in one thread should be able to change its constraint handler without affecting application code in another thread. See O 'Donell and Sebor (2015a,b) for a general discussion about Annex K, and Sebor (2015b,a) for the problems with runtime constraint handlers.

Next steps

Tightening up the specification is tricky. It must be done in a way that still allows all the differing behaviors of the underlying thread packages. Therefore, to tighten up the C threads specification, each relevant operating system needs to be studied to make sure its needs are taken into account.

These areas of underspecification need to be evaluated against POSIX (2009) to ensure that any remedy does not make it impossible to implement C threads on top of POSIX threads.

The areas of underspecification also need to be evaluated against Windows and against a representative set of embedded operating systems to ensure that C threads remain implementable on top of those threading models.

Finally, once all the relevant operating systems have been taken into account, proposals to remedy the areas of underspecification can be written and submitted to the C committee.

4

  Defect Reports related to the C11 thread interface DR 405 The mutex specification Status closed, adds a TC that clarifies the total ordering of lock and unlock operations on a mutex. DR 406 Visible sequences of side effects are redundant. Status open, only relevant in connection with the optional C11 atomics interface and other memory consistency models than memory_order_seq_cst. DR 408 Intra-thread synchronization. Status closed, no TC. DR 414 Typos in 6.27 Threads <threads.h>. Status closed, a TC with editorial changes. DR 416 tss_t destruction unspecified. Status closed, a TC elaborates the committee's intent for the exit of threads and the destruction feature for tss_t. DR 424 Underspecification of tss_t. Status closed, solution integrated with DR 416. DR 449 What is the value of TSS_DTOR_ITERATIONS for implementations with no maximum? Status closed, no TC. DR 469 Lock ownership vs. thread termination. Status open, work to clarify the semantics of recursive mutexes is ongoing. DR 470 mtx_trylock should be allowed to fail spuriously. Status open, discussion converges to a TC that allows mtx_trylock to fail spuriously.

  [START_REF] Riegel | Lock ownership vs. thread termination[END_REF] asks about the state of a mutex if its locking thread exits. Ongoing DR 469 treats this problem. 7.26.4.5 The mtx_trylock function Riegel and Boehm (2014) asks if mtx_trylock may fail spuriously, that is if it may fail without an apparent reason. Such a behavior is allowed by POSIX (2009). Ongoing DR 470 treats this problem. 7.26.5.1 The thrd_create function This function creates a new thread that executes a specified function. The standard does not specify what happens when that specified function returns. Defect Report 416 (resolved but not yet published) remedies this by clarifying that such a return is equivalent to calling thrd_exit with the returned value. 7.26.5.5 The thrd_exit function This function terminates the current thread. It is unclear what happens if it is called from within a thread-specific-storage destructor.

rue du Jardin Botanique CS20101 54603 Villers-lès-Nancy Cedex Publisher Inria Domaine de Voluceau -Rocquencourt BP 105 -78153 Le Chesnay Cedex inria.fr ISSN 0249-0803


Clément Champeix

Nicolas Borrel

Jean-Max Dutertre

Bruno Robisson

Mathieu Lisart

Alexandre Sarafianos

SEU sensitivity

Keywords: D Flip-Flop cell, Hardware Security, Photoelectric Laser Stimulation, Single Event Effects, Laser Fault Injection, Electrical Modeling

teaching and research institutions in France or abroad, or from public or private research centers.

I. INTRODUCTION

When exposed to a harsh environment in space, high atmosphere or even on earth, integrated circuits (ICs) may undergo soft errors. The related phenomena have been known and studied for more than forty years [START_REF] Binder | Satellite anomalies from galactic cosmic rays[END_REF][START_REF] Normand | Single event upset at ground level[END_REF][START_REF] Baumann | Radiation-induced soft errors in advanced semiconductor technologies[END_REF]. Among the various existing phenomena, single event effects (SEEs) due to ionizing particles may result in a faulty behavior of the hit circuit. For this reason and in order to cope with the effects of such events, a lot of research work has been devoted to the understanding and mitigation of SEEs. In this context, the use of pulsedlasers was introduced to emulate SEEs [START_REF] Habing | The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits[END_REF], [START_REF] Buchner | Pulsed-Laser Testing for Single-Event Effects Investigations[END_REF]. However, another usage of the pulsed-laser is to intentionally induce faults (as a result of SEEs) in security-dedicated ICs in order to retrieve or modify the secret data they may contain [START_REF] Skorobogatov | Optical fault induction attacks[END_REF], [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF]. Fortunately, other techniques introduced by researchers from the radiation community to mitigate SEEs may be adapted to cope with the issue of laser fault-injection. Electrical models have been created in order to propose a fast and simulated analysis (SPICE) of a circuit under laser stimulation. These electrical models make it possible to simulate the response of integrated circuits to laser pulses in very small amount of calculation times by comparison with physical experiments on laser equipment or TCAD simulation. The novelty of this paper is that our model takes into account very short laser pulse durations with a thin spatial accuracy to identify sensitive areas for a recent CMOS technology (40 nm instead of 0.25 µm or 90 nm).

This paper is organized as follows: Section II describes the principles of laser fault injection. Section III introduces the D Flip-Flop architecture used in our experiments. Hypothesis are made and validated both with experiments (Section IV) and modeling (Section V). Weaknesses and strengths, revealed during the testing, are discussed afterward. A laser pulse duration in the picosecond range for emulating SEEs [START_REF] Buchner | Pulsed-Laser Testing for Single-Event Effects Investigations[END_REF] was used. Then, Section VI draws a conclusion.

II. STATE OF THE ART

ICs are known to be impacted by SEEs caused by ionizing particles in radioactive environments. The related electrical phenomenon and the laser impacts on gates, as latches, SRAM (Static Random Access Memory) or D Flip-Flop, are reviewed in the following subsections.

A. Single Event Effects in Integrated Circuits

When an ionic particle passes through silicon, it generates electron-hole pairs along its path. These electrical charges generally recombine without any significant effect on IC computations. However the electric field found in reverse-biased PN junctions may separate the electron-hole pairs, inducing a parasitic transient current. This transient current may in turn disturb the voltage across the IC's internal nodes, leading to computational errors. A pulsed laser may be used to mimic (or emulate) this phenomenon provided that its photons energy is bigger than the silicon bandgap (electron-hole pairs are then induced by photoelectric effect [START_REF] Habing | The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits[END_REF], [START_REF] Buchner | Pulsed-Laser Testing for Single-Event Effects Investigations[END_REF]). At first, pulsed lasers were used to emulate SEE generation in ICs for radiation hardness evaluation. Since then, they have also been used to induce faults into secure circuits for the purpose of retrieving confidential data stored into these devices [START_REF] Skorobogatov | Optical fault induction attacks[END_REF], [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF]. In the following, laser-induced SEEs are described. A laser-induced transient current is then called a 'photocurrent' [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an SRAM cell[END_REF][START_REF] Roscian | Fault Model Analysis of Laser-Induced Faults in SRAM Memory Cells[END_REF][START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF][START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of a PMOS transistor in 90nm technology[END_REF][START_REF] Sarafianos | Robustness improvement of an SRAM cell against laser-induced fault injection[END_REF][START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser stimulation[END_REF][START_REF] Champeix | Experimental validation of a Bulk Built-In Current Sensor for detecting laser-induced currents[END_REF][START_REF] Borrel | Electrical model of an NMOS body biased structure in triple-well technology under photoelectric laser stimulation[END_REF][START_REF] Lacruche | Laser Fault Injection into SRAM cells: Picosecond versus Nanosecond pulses[END_REF].

Fig. 1. Laser-sensitive area of a CMOS inverter with its input at low level Fig. 1 illustrates the way how a transient photocurrent is turned into SEE for the inverter case when its input is at low logical level. In this configuration, the sensitive SEE area is the drain of the NMOS transistor (shaded in pink), which is in OFF state. A laser-induced photocurrent, depicted by a current source in Fig. 1, may be injected there through the reverse-biased PN junction between the N-type drain of the NMOS (biased at VDD) and the P-type substrate (grounded). As a result of the latter, the inverter output voltage may drop from '1' to '0' provided that the injected photocurrent is higher than the PMOS transistor saturation current. This voltage transient, also known as SET (Single Event Transient), may thus propagate through the circuit logic, creating errors. Note that a similar phenomenon may also take place when the inverter input is at a high logical state (in this instance the lasersensitive place is the drain of the OFF PMOS): the photocurrent then flows from VDD through the biasing contact (or tap) of the Nwell (i.e. the PMOS bulk) to ground. Furthermore, if a SET is induced directly in a memory element, as a latch, the stored data may be flipped, characterizing the so-called SEU (Single Event Upset; i.e. a bit set from '0' to '1' or a bit reset from '1' to '0'). Fig. 2. Single Event Upset (SEU) description on a latch Fig. 2 shows the behavior of a latch when a SEU is induced. The increasing or decreasing potential of nodes is symbolized by purple arrows. If the arrow is oriented to the top the potential increases from '0' to '1' whereas if the arrow is oriented to the bottom the potential decreases from '1' to '0'.

B. D Flip-Flop principles

In an integrated circuit, a D Flip-Flop is a fundamental element for the storage of information and many other uses. A large number of basic Flip-flops cells (more than thousands) can be implemented in circuits, so the protection of these cells becomes mandatory to thwart laser attacks (it has been revealed that a D Flip-Flop is a security weakness point). Our studies on this basic cell will permit to fine tune the photoelectric model in order to evaluate more complex circuits.

A D Flip-Flop is a memory cell, which memorizes data in an electronic circuit following the truth table in Table I. This cell functions regarding a clock signal. At rising edge on the clock signal, the data in the input of the cell will be in the output but the particularity is to memorize the state when the clock signal is at '0' (non rising).

0 Qnext = D = 0 Rising Edge 1 1 Qnext = D = 1 Non Rising X Q Memorizing

C. Memory cells under pulsed photoelectrical laser stimulation

Roscian et al. [START_REF] Roscian | Fault Model Analysis of Laser-Induced Faults in SRAM Memory Cells[END_REF], Sarafianos et al. [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an SRAM cell[END_REF], [START_REF] Sarafianos | Robustness improvement of an SRAM cell against laser-induced fault injection[END_REF] and Lacruche et al. [START_REF] Lacruche | Laser Fault Injection into SRAM cells: Picosecond versus Nanosecond pulses[END_REF] describes the laser sensitivity of SRAM cells. They also develop an effective model for laser pulse durations above 50 ns. Their research permits to identify the critical junctions in a circuit and the importance of the topology (layout) with an old CMOS technology (0.25 µm) and a low spatial resolution (0.5 µm). Indeed, long laser pulse durations have not permitted the precise identification of the sensitive areas (one area was hidden both with experiments and model). Roscian et al. [START_REF] Roscian | Fault Model Analysis of Laser-Induced Faults in SRAM Memory Cells[END_REF] proved that a 1 µm spot size was perfect to accurately characterize the sensitive areas. On the other hand, Courbon et al. [START_REF] Courbon | Combining image processing and laser fault injections for characterizing a hardware AES[END_REF] led his researches on SEUs on D Flip-Flop laser sensitivity but without controlling the clock signal and so without divulging if he impacted the master or slave latch. He demonstrated that he was able to obtain one failure mode by reducing the laser power. Unfortunately the layout recognition were not communicated and the sensitivity junctions was not identified precisely. Indeed the step size of the maps they chose was too high compared to the size of transistors to identify a large amount of gates in his circuit but they were able to identify Flip-Flops and their orientation in a glue logic. In previous works, Lacruche et al. [START_REF] Lacruche | Laser Fault Injection into SRAM cells: Picosecond versus Nanosecond pulses[END_REF] ameliorated the electrical model for picosecond laser pulses based on the comparison of 50 ns and a 30 ps laser pulse durations of faults on an SRAM cell in 0.25 µm CMOS technology. It has been shown that with a picosecond source the sensitive areas are more distinguishable than with a nanosecond source. Considering their works, we chose to draw accurate maps in order to precisely reveal the sensitive areas by choosing a thin spot size (1 µm) and a picosecond source on a recent CMOS technology circuit (40 nm).

To control laser impacts either on the master or the slave latch, the input signals must be perfectly set as it is explained in Fig. 3 and Fig. 4, the test are in static mode. First at CLK='0' the data is not yet in the master latch, it will be transferred and memorized at the rising edge. If CLK stays at '1', the impacted latch is the master one (Fig. 3a and Fig. 4a) but if the CLK goes back to '0' the data will be transferred and memorized in the slave latch (Fig. 3b and Fig. 4b). The cell studied in this section of the paper is a D Flip-Flop made of 24 transistors similar to those used in secure integrated circuits (Fig. 6) and based on a basic architecture using two latches: a master latch and a slave one (Fig. 3). There is no reset in that structure in order to simplify the studies by minimizing the number of transistors. Indeed, basically a D Flip-Flop requires several stages: inverting input buffers, two latches, output buffers, clock inverters and asynchronous reset signal. Note that this standalone Flip-flop is embedded in a test chip designed in a CMOS 40 nm process.

IEEE International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFTS)

B. Theoretical photoelectric sensitive

In the D Flip-Flop, the fault areas are separated in two parts: master latch and slave latch. Fig. 3 reminds the settings for those both parts in depending on the input signals (Fig. 4). In this subsection, the D Flip-Flop cell sensitivity is studied from a theoretical point of view (considering its schematic and its state).

In order to simplify the explanation, the theoretical photoelectric sensitive junctions are described on a simple latch. Obviously it is similar for both latches composing the D Flip-Flop. Two cases are considered: input at '0' and input at '1'.

1) Input at '0': When the input is at '0', the OUT node is at '1'. Based on [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an SRAM cell[END_REF], [START_REF] Roscian | Fault Model Analysis of Laser-Induced Faults in SRAM Memory Cells[END_REF], [START_REF] Sarafianos | Robustness improvement of an SRAM cell against laser-induced fault injection[END_REF], [START_REF] Lacruche | Laser Fault Injection into SRAM cells: Picosecond versus Nanosecond pulses[END_REF], [START_REF] Hérivaux | Electrical Modeling of the Effect of Photoelectric Laser Fault Injection on Bulk CMOS Design[END_REF], the sensitivity of the cell can be investigated by considering which PN junctions are the most reverse-biased according to the latch state. Indeed, these Consequently, in Fig. 5a, the two areas most sensitive to laser illumination are the drain junctions of the MN4 and MP5 transistors.

2) Input at '1': When the input is at '1', the OUT node is at '0'. Based on the same investigations, the photocurrent direction and its strength are depicted on Fig. 5b. Consequently, the two areas most sensitive to laser illumination are the drain junctions of the MP4 and MN5 transistors.

Therefore, four sensitive areas are expected on the latch: two with the input at '0' and two others with the input at '1'.

According to the previous paragraphs, fourteen photoelectrical sensitive D Flip-Flop junctions can be identified, on the schematics and layout (Fig. 6 and Fig. 7), eight on latches and six on pass gates. The blue circles are the areas where laser injection changes the data from '1' to '0' (bit reset) whereas the red circles are the areas where the laser injection changes the data from '0' to '1' (bit set).

IV. EXPERIMENTS

A. Device under test

The device under test (DUT), was designed in the 40 nm STMicroelectronics CMOS technology and its core voltage is 1.2 V .

To understand the different detection maps reported in section IV-C, Fig. 7 describes how the transistors are distributed in the layout. The laser maps cover the whole D Flip-Flop (10 µm × 6 µm with a step size of 0.2 µm).

B. Experimental set-up

The fiber laser source used during the experiments produces laser pulses in the picosecond range (30 ps pulse duration for the test series we reported in this paper). It has a 1030 nm wavelength (near Infra-Red), which makes it possible to access the sensitive areas of a target through its backside (i.e. through its silicon substrate). Our tests were actually performed through the target backside, which was thinned to ∼ 150 µm thickness to minimize the amount of power lost along the laser beam path due to absorption phenomena. The laser beam was focused on the DUT's sensitive parts: given the ×100 optic we used, we obtained a laser spot with a diameter of ∼ 1 µm (refer to [START_REF] Buchner | Pulsed-Laser Testing for Single-Event Effects Investigations[END_REF] for a complete description of laser beam propagation through silicon and beam focusing). Fault maps were drawn to have a spatial representation of the faults area.

To plot the sensitivity maps, the laser moves thanks to a XYZ stage (accurate to 0.1 µm) whereas the test chip is fixed. At every point, all the input signals are set with an FPGA, and the acquisitions are captured by a remote oscilloscope.

The experiments are divided into four steps in accordance with Fig. 4. These four cases are reported in Table II. Then the four results are merged in only one maps to simplify visualization and understanding. The laser is shot when all signals are stable (Fig. 3 and Fig. 4). The acquisition of the output needs to be done after a delay, the time need by the D Flip-Flop to change states (a few nanoseconds here because of the capacitor and resistivity of the net and gate delay).

For our experiments, the main objective was to understand the sensitivity maps in order to enhance the electrical model of pulsed photoelectrical laser stimulation (PLS).

C. Evaluation at 0.7 nJ laser energy (SEU sensitivity maps) Fig. 8 gives the experimental fault (or sensitivity) map at 0.7 nJ laser energy. It shows that the sensitive areas are the same as the photoelectrical hypothesis ones but exhibits one hidden area (Bit set in the slave latch when CLK='0' and D='0'). This hidden area can be explained because of the capacitor on L2_O node. Indeed the transistor Gate-Bulk capacitors of the Buffer/Inverter are bigger than the inverters in 2015 IEEE International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFTS) the latch (Table III). Also there is no common junction for the same fault with a pass gate on MN8 transistor so it needs more energy is required for this area to appear. A common junction shared, for the same fault, with two transistors is more sensitive than only one junction. Note that the first faults appear at a laser power duration of 0.5 nJ and the D Flip-Flop has been broken bellow 0.9 nJ.

V. ELECTRICAL MODELING OF THE PULSED PLS

The photocurrent generated by a pulsed-laser in an IC is generally modeled by current sources plugged in parallel to its PN junctions. The electrical models under pulsed laser stimulation (N+ on Psubstrate, P+ on Nwell and Nwell on Psubstrate) were previously introduced [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF], [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of a PMOS transistor in 90nm technology[END_REF], [START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser stimulation[END_REF], [START_REF] Borrel | Electrical model of an NMOS body biased structure in triple-well technology under photoelectric laser stimulation[END_REF]. We have also already published electrical models, based on these preliminary studies made from measurements and simulations, on basic structures, which create photoelectrical effects. These models use a current source controlled by voltage to model the laserinduced photocurrent. They take into accounts the laser spot size, power, pulse duration, the focus of the laser beam, spatial parameters (location, geometry, wafer thickness) and the PN junction voltage biasing. This is the first electrical stimulation test compared to measurements of a relatively complex CMOS cell in 40 nm.

A. PN junction modeling

Using the laser beams to study each junction of our structure lets us create PN junctions models (called Subckt Iph diode) which contain a voltage-controlled current source. The amplitude value of this current source is defined by I ph as expressed in Eq. 1:

I ph = 1 γ (αV + b)α gauss P ulse width W coef I ph z (1)
where, V is the reverse-biased voltage, a and b depend on the laser power, γ is an amplitude attenuation coefficient, α gauss is the sum of two Gaussian functions, which take into account the spatial dependency, P ulse width considers the laser pulse duration dependency, W coef is an exponential function allowing for the wafer thickness effect and I ph z is a curve function which considers the focus effect of the z-axis of the laser lens: (5)

α gauss = βe
where, d is the distance (in µm) between the laser spot and the center of the PN junction, t pulse is the laser pulse duration (in second), W afer thickness is the thickness of the wafer (in µm) and z is the laser lens distance (in µm) with z = 0 when focused on the active area. The other coefficients depend on the CMOS technology and laser lens type. All coefficients values are available and detailled in [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF]. In order to simulate this photocurrent effect, we built the sub-circuit (see Fig. 9) which contains a voltage controlled current source. Eq. 1 describes the current amplitude of the current source and the laser trigger signal sets the start and duration of the laser pulse. Fig. 9 also represents the simulated photocurrent generated by the model.

B. Modeling results

By upgrading and tuning our model described in Section V, we adjusted the parameters of the photocurrent shape for short pulses. Given that measurements with a 50 ns laser pulse duration showed the absence of bipolar effects, for the modeling we neglected these effects and focused only on photoelectrical effects. The sensitivity map (Fig. 10) was extracted with low energy and a laser pulse duration of 30 ps. For accuracy purposes we used a step size of 0.1 µm for the modeling. At each point of the map, each transistor received a Fig. 10 shows the SEUs in both the master and slave latches. It corresponds perfectly with the theoretical photoelectrical sensitive junctions (Fig. 7) but presents differences compared to the experiments (Fig. 8). This can be explained by the fact that the model does not integrated the capacitors and the resistivity of each transistor. Our model is based on the classical netlist (created with the schematic) and layout topology but not based on the postlayout simulations because it is currently difficult to merge both netlists but may be possible in future works.

VI. CONCLUSION

This paper reports the analysis of the laser injection of a CMOS40 nm D Flip-Flop cell and the upgrading photoelectric laser stimulation models. The preliminary conclusion of this theoretical analyze was that there are seven sensitive areas of the D Flip-Flop cell which modify the output from '0' to '1' and seven others for an output state modification from '1' to '0'. This conclusion has been verified in practice (except for one hidden area). The topology of the cell has a strong impact on the sensitivity of a CMOS gate. The sensitive areas revealed by measurement cartographies was also confirmed by proper electrical simulations that take into account the topology of the target but without the capacitor and resistors of the nets and transistors (in a future work we will propose a model that will take account of these parameters). The validity of the approach was assessed by the good correlation obtained between electrical simulations (based on SPICE language) and measurements for this advanced CMOS technology node (40 nm) which had never been analyzed either in simulation or experiments. This model could permit us to propose and to validate (on simulation basis) a new layout of a standard D Flip-Flop cell more robust against SEU. As a conclusion we can say that the electrical model presented in this paper could be an interesting tool for designers who wants to build CMOSgates more robust against SEU effects or fault injection in the security field or, who want to test the robustness of their designs.

Fig. 3 .

 3 Fig. 3. Flip-Flop settings with input at '1' in order to impact either master or slave latch

Fig. 5 .

 5 Fig. 5. Schematic of a latch cell laser sensitivity with input at '0' and '1'

Fig. 6 .Fig. 7 .

 67 Fig. 6. D Flip-Flop architecture with theoretical photoelectric sensitive junctions

Fig. 8 .

 8 Fig. 8. Experimental results of a photoelectrical laser stimulation on a D Flip-Flop with a laser pulse duration of 30 ps and a laser energy of 0.7 nJ

W

  coef = e -0.001W af er thickness (4)I ph z = (c 1 z 6 + c 2 z 5 + c 3 z 4 + c4z 3 + c 5 z 2 + c 6 z + c 7 )c 8 e -z 2 20000

Fig. 9 .

 9 Fig. 9. Electrical modeling of a PN junction under pulsed laser stimulation

Fig. 10 .

 10 Fig. 10. Modeling results of a photoelectrical laser stimulation on a D Flip-Flop with a laser pulse duration of 30 ps

TABLE I .

 I TRUTHTABLE OF THE D FLIP-FLOP

	CLK	D Qnext	Comments
	Rising Edge	0

TABLE II .

 II TABLE OF D FLIP-FLOP EXPERIMENTAL STEPS

	Steps number	Input (D)	Clock (CLK)	Comments
	Step 1	0	0	Bit set / Slave impacted
	Step 2	0	1	Bit set / Master impacted
	Step 3	1	0	Bit reset / Slave impacted
	Step 4	1	1	Bit reset / Master impacted

TABLE III .

 III DESCRIPTION TABLE OF TRANSISTORS SIZE RATIO

	Transistors	Ratio W/L	Comments
	MN1, MN10	5	NMOS BUF/INV
	MN2, MN3, MN6, MN7	3.5	NMOS Pass gates
	MN4, MN5, MN8 MN9, MN11, MN12	3.5	NMOS INV
	MP1, MP10	10	PMOS BUF/INV
	MP2, MP3, MP6, MP7	3.5	PMOS Pass gates
	MP4, MP5, MP8 MP9, MP11, MP12	7	PMOS INV

978-1-4799-8606-4/15/$31.00 c ⃝2015 IEEE http://dx.doi.org/10.1109/DFT.2015.7315158 Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFTS),

IEEE International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFTS)

IEEE International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFTS)


N Borrel

C Champeix

M Lisart

A Sarafianos

E Kussener

W Rahajandraibe

J-M Dutertre

Electrical model of an NMOS body biased structure in triple-well technology under photoelectric laser stimulation

Keywords: NMOS transistor, triple-well, body biasing, pulsed PLS, parasitic bipolar transistor

This study is driven by the need to optimize failure analysis methodologies based on laser/silicon interactions with an integrated circuit using a triple-well process. It is therefore mandatory to understand the behavior of elementary devices to laser illumination, in order to model and predict the behavior of more complex circuits. This paper presents measurements of the photoelectric currents induced by a pulsed-laser on an NMOS transistor in triple-well Psubstrate/DeepNwell/Pwell structure dedicated to low power body biasing techniques. This evaluation compares the triple-well structure to a classical Psubstrate-only structure of an NMOS transistor. It reveals the possible activation change of the bipolar transistors. Based on these experimental measurements, an electrical model is proposed that makes it possible to simulate the effects induced by photoelectric laser stimulation.

INTRODUCTION

Photoelectric Laser Stimulation (PLS) is commonly used in failure analysis methodologies [START_REF] Glowacki | Systematic characterization of integrated circuit standard components as stimulated by scanning laser beam[END_REF]. PLS generates electronhole pairs in silicon, as the laser energy is greater than the silicon band gap. Our PLS experiments were carried out using a pulsed-laser at 1064 nm wavelength on the active parts of NMOS devices (designed in 90 nm STMicroelectronics CMOS technology) through their backside, a laser spot diameter of 1 µm and a laser pulse duration of 5 µs. The measurements were used to validate and calibrate the electrical model in order to create a fast and simulated SPICE solution under laser stimulation. This electrical model makes it possible to simulate the response of an NMOS transistor in a triple-well structure to laser pulses in a very small amount of calculation time by comparison with physical experiments on laser equipment or TCAD simulation.

It has been shown [START_REF] Haraguchi | Microscopic optical seam induced current measurements and their applications[END_REF], that inside a space charge region of a PN junction, electron-hole pairs will be separated by the internal electric field and then generate an optical beam induced current. Furthermore, an electrical model of an NMOS biased in Psubstrate under PLS has been studied in [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF]. The novelty of this paper is that our model takes into account the parasitic bipolar transistor topologically added by the use of a triple-well implant for the body biasing techniques (see figure 1).

With technology scaling down, performance and power consumption play an increasingly important role in logic design. The body biasing technique presented in [START_REF] Liu | Trading Speed for Low Power by Choice of Supply and Threshold Voltages[END_REF] and [START_REF] Keshavarzi | Technology scaling behavior of optimum reverse body bias for standby leakage power reduction in CMOS IC's[END_REF] is one well-known solution to adjust consumption and performance. This low power technique uses threshold voltage scaling by reverse or forward body bias. In 90 nm CMOS technology, the body biasing range is +/-400 mV applied on both NMOS and PMOS bulks (i.e. applied on the N and P wells). The first electrical models of MOS transistors under pulsed laser stimulation were generally made of a current source which represents the photocurrent induced by the laser. In this paper we proposed an improvement of these electrical This article begins by explaining our models of the PN junctions under PLS as well as parasitic bipolar effects. Secondly, it shows the measurements and modeling of the NMOS inside and outside the triple-well. Thirdly, impact of body biasing techniques is studied. Finally, our 3D electrical simulation methods are proposed.

II.

PHOTOCURRENT MODELING Photocurrent generated by a pulsed-laser on an IC, were generally modeled by current sources on PN junctions. We took the choice to improve the electrical model already introduced by Sarafianos et al. in [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF] and [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of a PMOS transistor in 90nm technology[END_REF], which takes into accounts the laser's spot size, power, pulse duration, focus of the laser beam and the spatial parameters, location, geometry, wafer thickness.

A. PN junction modeling

Using the laser beams to study each junction of our structure lets us create PN junctions models (called Subckt_Iph_diode) which contain a voltage-controlled current source. The amplitude value of this current source is defined by I ph as expressed in [START_REF] Glowacki | Systematic characterization of integrated circuit standard components as stimulated by scanning laser beam[END_REF]:

𝐼 = (𝑎 𝑉 + 𝑏) 𝛼 𝑃𝑢𝑙𝑠𝑒 𝑊 𝐼 _ (1)
where, V is the reverse biased voltage, a and b depend on the laser power, γ is an amplitude attenuation coefficient, α gauss is the sum of two Gaussian functions which take into account the spatial dependency, Pulse width considers the laser pulse duration dependency, W coef is an exponential function allowing for the wafer thickness effect and I ph_z is a curve function which considers the focus effect of the z axis of the laser lens:

𝛼 = 𝛽 𝑒 ( ² ) + 𝜌 𝑒 ( ² )
(2)

𝑃𝑢𝑙𝑠𝑒 = 1 -𝑒 ( • ) (3)
𝑊 = 𝑒 . (4)
𝐼 _ = (𝑐 𝑧 + 𝑐 𝑧 + 𝑐 𝑧 + 𝑐 𝑧 + 𝑐 𝑧 + 𝑐 𝑧 + 𝑐 )𝑐 𝑒 [START_REF] Keshavarzi | Technology scaling behavior of optimum reverse body bias for standby leakage power reduction in CMOS IC's[END_REF] where, d is the distance (in µm) between the laser spot and the center of the PN junction, t pulse is the laser pulse duration (in second), Wafer thickness is the thickness of the wafer (in µm) and z is the laser lens distance (in µm) with z = 0 when focused on the active area. The other coefficients depend on the CMOS technology and laser lens type. In order to simulate this photocurrent effect, the sub circuit (see figure 2) which contains a voltage controlled current source was built. The current amplitude of the current source is described by (1) and the start and duration of the laser pulse is set by the laser_trigger signal.

B. Parasitic bipolar transistor modeling

We have already introduced electrical models of a triplewell structure in [START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser[END_REF], where the parasitic vertical Pwell/DeepNwell/Psubstrate bipolar transistor was modeled as a voltage-controlled current source [START_REF] Gray | Analysis and Design of Analog Integrated Circuits[END_REF]. Parasitic bipolar transistor model can be generalized by ( 6):

𝐼 = 𝐼 𝑒𝑥𝑝 | | (6)
where, I S is a constant used to describe the transfer characteristic of the transistor in the forward-active region (typically 10 -14 to 10 -16 A), δ is a modeling coefficient in order to fit the simulation and the measurements, V T is the thermal voltage and V EB is the voltage between N and P potentials. In order to simulate this bipolar effects, the sub circuits (see figure 3), which contains a voltage-controlled current source, were built. The current amplitude of the current source is described by [START_REF] Gray | Analysis and Design of Analog Integrated Circuits[END_REF].

III. NMOS MEASUREMENT AND MODELING UNDER PLS

The experiments were performed with a laser spot diameter of 1 µm and a laser pulse duration of 5 µs. The Device Under Test (DUT) are 10 × 1 µm NMOS inside and outside a 6 × 30 µm triple-well stand-alone structure (see figure 1 for a crosssectional view). The NMOS transistor in the Psubstrate has been studied and modeled in [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF]. Firstly, it is important to understand and model this case in order to secondly compare with the same NMOS in the triple-well structure. In this section the NMOS transistors was used in their OFF state (the drain was at 1.2 V and the gate source and Psubstrate electrodes were grounded). Furthermore for the NMOS in the triple-well, the Nwell = 1.2 V and the Pwell = 0 V.

A. NMOS transistor biased in Psubstrate

Firstly, the laser spot was centered in the middle of an NMOS transistor in the Psubstrate. For laser power below 50 mW, the photocurrent on the Drain/Psubstrate and Source/ Psubstrate junctions varies linearly with the laser power. Similarly with [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF], when the Psubstrate voltage is greater than 0.6 V, the Psubstrate/Source junction starts conducting and the Psubstrate/Drain junction stays in reverse bias conditions. The effect induced is the activation of the NPN parasitic bipolar (Drain/Psubstrate/Source).

The modeling of the effects (See figure 5) of an NMOS transistor under PLS involved two sub circuits Subckt_Iph (one for the Psubstrate/Source junction and another for the Psubstrate/Drain junction). It must also involve the effect of the parasitic bipolar transistor between Source and Drain: Subckt_Ibip. Resistors and capacitances are tuned to set the time constant of that phenomenon (dielectric relaxation). Figure 6 displays the currents simulated and measured for a laser of 5 µs on the NMOS drain and source in Psubstrate under PLS. Note the good correlation obtained between measurements and simulation

B. NMOS biased in triple-well

Secondly, the laser was centered on an NMOS in the triplewell. There are mainly 4 PN junctions which may give rise to a photoelectric effect (DeepNwell/Psubstrate junction, DeepNwell/Pwell junction, Drain/Pwell junction and Source/Pwell junction). Similarly than NMOS in Psubstrate and the structure triple-well stand alone describe in [START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser[END_REF]. For laser power less than 50 mW, the laser induced photocurrent on each PN junction linearly with the laser power. Current are flowing from DeepNwell to Psubstrate, from DeepNwell to Pwell and from Drain & Source to Pwell. The linear shapes of the photocurrents measured are similar for these four interfaces but the amplitude value are widely different. Therefore the first step is the study and the modeling of these PN junctions under PLS independently. These photoelectric effects are modeled by four sub circuits Subckt_Iph expressed by equation ( 1) with different attenuation coefficients. Table 1 shows these coefficients for the four junctions. Furthermore, this parasitic bipolar activation also imposed a current flow from NMOS source and drain to Psub. Figure 7 shows the currents measured on Pwell, NMOS drain and source electrodes. In addition, it revealed that in a triple-well structure, the parasitic NPN bipolar (Drain/Pwell/Source) is now omitted. The modeling of these bipolar effects involved three sub circuits Subck_Ibip (one between Pwell to Psub due to the triple-well implant, and the others between Drain to Psub and Source to Psub). Based on our measurements, we built our model (see figure 8) with the addition of different parasitic PN junctions (Nwell/Psub, DeepNwell/Psub and DeepNwell/Pwell), resistors and capacitances and current sources. Finally, the measurements and simulations of the current on NMOS drain, source and Pwell electrode is presented figure 9 for a laser pulse of 5 µs. It is possible to notice the good correlation between measurements and the simulation.

IV. BODY BIASING TECHNIQUES IMPACT

The aim of the present work is to investigate the influence of Forward Body Biasing (FBB) and Reverse Body Biasing (RBB) conditions on the parasitic PNP bipolar transistor activation. As we shown in [START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser[END_REF], for the DeepNwell/Psub and DeepNwell/Pwell junctions, Psubstrate is always grounded, DeepNwell = 0.8 V and Pwell = 0.4 V in FBB and DeepNwell = 1.6 V and Pwell = -0.4 V in RBB condition. Then, the photocurrents generated are more important in RBB than in FBB due to higher junctions reverse biasing. In addition, for the maximum FBB condition DeepNwell = 0.8 V and Pwell = 0.4 V, the V EB bipolar Pwell/DeepNwell/Psubstrate activation condition is closer. Figure 10 the creation of a mesh on the structure's layout of the transistor. Every cross-section of the mesh is a laser spot position. For each step, the distance between the center of the laser spot and the center of each junction is evaluated. The step of the meshing and the distances calculated are defined in the spice netlist. Based on equation ( 2), the simulator with our model permits to calculate the photocurrent generation of an NMOS transistor in triple-well for every point of the mesh. Our models were tuned thanks to electrical measurements, in order to take into account laser condition and body biasing variations. With this method, current cartographies of the 10 x 1 µm NMOS inside the 6 x 30 µm triple-well is proposed. Figure 11, 12 and 13 depicts the photocurrents generated on Nwell, Pwell and source for a laser power = 133.25 mW. A very good correlation between measurements and electrical simulation is obtained.

VI. CONCLUSION

This paper compares the triple-well structure to a classical Psubstrate-only structure of an NMOS transistor. It reveals the activation change of the bipolar transistors and describes accurate electrical models of a triple-well NMOS structure in 90 nm CMOS technology that takes into account body biasing techniques using pulsed-laser stimulation. This model combines all various photoelectrical phenomena revealed by measurements during the PLS. The effectiveness of our approach has demonstrated a very good correlation between measurements and our model. In failure analysis, this 3D proposed simulation technique may serve as a reference to detect defaults by comparison with a device under pulsed-laser stimulation. Future works will consist in characterizing and modeling PMOS transistors and an inverter in triple-well.

Figure 1 .

 1 Figure 1. DUT structure with parasitics bipolars representation

Figure 2 .Figure 3 .

 23 Figure 2. Electrical modeling of a PN junction under pulsed laser embedded in a sub circuit called Subck_Iph

Figure 4 .

 4 Figure 4. Psubstrate, drain and source current of an NMOS in Psubstrate

Figure 6 .Figure 5 .Figure 7 .

 657 Figure 6. Comparison of experimental and simulation results on Drain and Source current of an NMOS transistor in Psubstrate under PLS

  depicts the RBB and FBB impact on the Pwell and source current for a laser power = 93.275 mW. The photocurrents on DeepNwell/Pwell = 221 µA in FBB condition and -98 µA in RBB condition. As we expected, the FBB condition is a contribution of bipolar activation and the RBB condition limits this impact. The NMOS drain and source current behaviors follow this tendency. The photocurrents measured on the NMOS source electrode = -4 µA in FBB condition and -17 µA in RBB condition for a laser power = 93.275 mW. V. CURRENT CARTOGRAPHIES Based on our electrical model which takes into account the spatial parameters, 3D electrical post-layout SPICE simulation is now possible to draw. Current cartographies are based on

Figure 8 .

 8 Figure 8. Electrical model of a NMOS transistor in Triple-well under PLS

Figure 12 .Figure 13 .

 1213 Figure 12. Current cartographies of the Pwell electrode of an NMOS transistor in Triple-well for a laser power = 133.25 mW. Measurement (a) and electrical simulation (b)


N Borrel A-B

C Champeix

E Kussener

W Rahajandraibe

M Lisart

A Sarafianos

J-M Dutertre

Influence of triple-well technology on laser fault injection and laser sensor efficiency

Keywords: Laser, fault injection, triple-well, body biasing, countermeasure I

This study is driven by the need to understand the influence of a Deep-Nwell implant on the sensitivity of integrated circuits to laser-induced fault injections. CMOS technologies can be either dual-well or triple-well. Triple-well technology has several advantages compared to dual-well technology in terms of electrical performances. Single-event responses have been widely studied in dual-well whereas SEE (single event effects) in triplewell is not well understood. This paper presents a comparative analysis of soft error rate and countermeasures sensors with for these two techniques in 40 nm and 90 nm CMOS technology. First, laser fault injection on registers were investigated, showing that triple-well technology is more vulnerable. Similarly, we studied the efficiency of Bulk Built-In Current Sensors (BBICS) in detecting laser induced fault injection attempts for both techniques. This sensor was found less effective in triple-well. Finally, a new BBICS compliant with body-biasing adjustments is proposed in order to improve its detection efficiency.

INTRODUCTION

The first faults called SEEs have been notified in the 1960s when it was found that radioactive particles were causing errors in electronic circuits [START_REF] Binder | Satellite anomalies from galactic cosmic rays[END_REF], [START_REF] May | Alpha-Particle-Induced Soft Errors in Dynamic[END_REF]. The aerospace industry directly affected by this issue began research on the physical effects of these particles in silicon. In this context, the use of pulsed-lasers was introduced to emulate SEEs at the experimenter's bench [START_REF] Habing | The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits[END_REF]. Laser-fault injection and radiative particles have indeed similar effects on system on chip. However, pulsed-laser may also be used to induced faults (as a result of SEEs) into the computations of security-dedicated ICs for the purpose of retrieving the secret data they may contain [START_REF] Skorobogatov | Optical fault induction attacks[END_REF], [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF]. BBICS [START_REF] Neto | Using Built-In Bulk Current to detect Soft Errors[END_REF] were introduced to monitor the unusual currents induced in the bulk of integrated circuits (ICs) by ionizing particle hits.

A. Laser-induced Single Event Effects in Integrated Circuits

When an ionic particle or a laser beam passes through silicon it generates electron-hole pairs along its path. These electrical charges generally recombine without any significant effect on the IC computations. However the electric field found in reverse-biased PN junctions may separate the electron-hole pairs, inducing a parasitic transient current. This transient current may in turn disturb the voltage of the IC's internal nodes leading to computational errors. This pulsed laser phenomenon may appear provided that its photons energy is bigger than the silicon bandgap (electron-hole pairs are then induced by photoelectric effect [START_REF] Buchner | Pulsed-Laser Testing for Single-Event Effects Investigations[END_REF]). This effect is called 'photocurrent' [START_REF] Sarafianos | Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology[END_REF]. The way how a transient photocurrent is turned into a SEE is illustrated in Fig. 1 for the inverter case when its input is at low logical level.

In this configuration, the SEE sensitive area is the drain of the NMOS transistor (shaded in pink), which is in OFF state. A laser-induced photocurrent, depicted by a current source in Fig. 1, may be injected there through the reverse-biased PN junction between the N-type drain of the NMOS (biased at VDD) and the P-type substrate (grounded). As a result of the latter, the inverter output voltage may drop from '1' to '0' provided that the injected photocurrent is higher than the PMOS transistor saturation current. Note that a similar phenomenon may also take place when the inverter input is at a high logical state (in this instance the laser-sensitive place is the drain of the OFF PMOS): the photocurrent then flows from VDD through the biasing contact (or tap) of the Nwell (i.e. the PMOS bulk) to ground. This voltage transient, also known as SET (Single Event Transient), may thus propagate through the circuit logic, creating errors. Furthermore, if a SET is induced directly in a memory element, as a latch, the stored data may be flipped, characterizing the so-called SEU (Single Event Upset;; i.e. a bit set from '0' to '1' or a bit reset from '1' to '0').

B. Triple-well isolation

The use of a triple-well layer is used to electrically isolate the Pwell in order to reduce the electronic noise and cross talk from the substrate. It may also be used to adjust power consumption and speed of the transistors by modifying the threshold voltage using well bias. Typically, devices are regularly distributed along cell array in dual-well (also called in bulk technology): Nwell and Psubstrate rows (Fig. 2a). In triple-well, a Deep-Nwell implant (DeepNwell) is used to isolate the substrate of the NMOS transistors from the Psubstrate of the chip, hence creating Pwells. The biasing of the DeepNwell at VDD (generally) is provided through the Nwell. Such as, Psubstrate potential and Pwell may be at different voltage potential (but generally grounded). In triplewell, cells are places in Nwell and Pwell array (Fig. 2b).

Since the first SEEs, semiconductor industry searches to improve architecture and process technology against soft error. The use of triple-well has been widely studied against SER in radiation evaluation. In 1984, Momose et al. [START_REF] Momose | A P-Type buried layer for protection against soft errors in high density CMOS static RAMs[END_REF] showed that the use of a Deep P-type implant in an N substrate of a RAM memory is an excellent protection against SEE. It decreases the soft error rate (SER) susceptibility by a factor of 10 +03 . Then between 1985 and 1993, similar studies [START_REF] Minami | A new soft-errorimmune static memory cell having a vertical driver MOSFET with a buried source for the ground potential[END_REF] and with Deep N-type implant in a P substrate [START_REF] Fu | Alpha-Particle-Induced Charge Collection Measurements 'and the Effectiveness of a Novel p-Well Protection Barrier on VLSI Memories[END_REF] and [START_REF] Burnett | Soft-Error-Rate Improvement in Advanced BiCMOS SRAMs[END_REF] also showed significant reduction factors of SER between 100 and 10 +03 . Afterward, studies of more recent technology nodes showed less conclusive results. [START_REF] Noda | An Ultrahigh-Density High-Speed Loadless Four-Transistor SRAM Macro with Twisted Bitline Architecture and Triple-Well Shield[END_REF] and [START_REF] Roche | Impacts of front-end and middle-end process modifications on terrestrial soft error rate[END_REF] found gains of 40% on 0.18μm and 0.15μm for SRAM with triple-well. Then [START_REF] Cannon | SRAM SER in 90,130 and 180 nm Bulk and SOI Technologies[END_REF], [START_REF] Chatterjee | Single-Event Charge Collection and Upset in 40-nm Dual-and Triple-Well Bulk CMOS SRAMs[END_REF], [START_REF] Chatterjee | Effects of charge confinement and angular strikes in 40 nm dual-and triple-well bulk CMOS SRAMs[END_REF] proved that the more technologies become thin (180 nm, 130 nm, 90 nm, 65 nm and 40 nm), the more the SER becomes important. And [START_REF] Gasiot | Multiple Cell Upsets as the Key Contribution to the Total SER of 65 nm CMOS SRAMs and Its Dependence on Well Engineering[END_REF] shows that the triple-well may even have a negative impact on SER.

This paper is organized as follows: Section II describes comparative experiments of laser fault injection in dual-well and triple-well technology in 40 nm technologies. In section III, the principles underlying BBICS and its architecture are described. A comparison for both in dual-well and triple-well has been experimentally drawn. Its weaknesses on the basis of measurements, revealed during the testing, are discussed. In section IV, we propose BBICS architectural modification to obtain an improved detection capability. A new design well suited for triple-well CMOS is introduced. Then, section V draws a conclusion

II. FAULT INJECTIONS COMPARISON

Fault injection were performed with a pulsed-laser at 1064 nm wavelength, a laser spot diameter of 1 μm and a wide range of laser pulse duration from short nanosecond to long microsecond. The laser beam was centered on flip-flops in dual-well and triple-well structures through their backside. Our test structures were designed in 40 nm CMOS STMicroelectronics technology for both techniques (dual and triple-well). The targeted flip-flop design and layout were similar. All the datas in this paper were normalized with a single percentage factor (instead of power in watts) for effective presentation and due to confidentiality constraints. These laser settings are not consistent with the emulation of an ionizing particle strike. However, we were more interested in comparing the magnitude of laser power needed for a fault injection than in precisely emulating an SEE.

Multiples faults were recorded during the experiments on the test structures. In figure 3 are compared the minimum laser power needed for a fault injection on the structure with and without triple-well.

These data show that the minimum laser power needed for an SEE on a FF in triple-well are around 2 times lower than in dual-well. This trend and order of magnitude for the slight decrease are in agreement with the other works published in the literature [START_REF] Gasiot | Multiple Cell Upsets as the Key Contribution to the Total SER of 65 nm CMOS SRAMs and Its Dependence on Well Engineering[END_REF]. Nowadays, for a 40 nm CMOS technology, the use of a triple-well has a negative impact regarding SEE generation with a laser.

III. SENSOR BBICS COMPARISON

A fecund idea of countermeasure was the monitoring of the currents that happen with SEEs [START_REF] Gill | An Efficient BICS Design for SEUs Detection and Correction in Semiconductor Memories[END_REF], [START_REF] Vargas | Seu-tolerant sram design based on current monitoring[END_REF]. Bulk Built-In Current Sensors (BBICS) were developed to detect the transient bulk currents induced in the bulk of integrated circuits when hit by ionizing particles or pulsed laser [START_REF] Neto | Using Built-In Bulk Current to detect Soft Errors[END_REF], [START_REF] Neto | Tbulk-BICS : A Built-In Current Sensor Robust to Process and Temperature Variations for SET Detection[END_REF], [START_REF] Zhang | A New Bulk Built-In Current Sensing Circuit for Single-Event Transient Detection[END_REF]. Among various BBICS architecture proposals, only few were, to date, experimentally tested [START_REF] Zhang | A New Bulk Built-In Current Sensing Circuit for Single-Event Transient Detection[END_REF], [START_REF] Champeix | Experimental Validation of a Bulk Built-In Current Sensor Detecting Laser-Induced Currents[END_REF]. A simulationbased evaluation of a BBICS used to monitor a triple-well architecture was done by [START_REF] Dutertre | Improving the ability of Bulk Built-In Current Sensors to detect Single Event Effects by using triple-well CMOS[END_REF]. Their conclusion was to recommend the use of triple-well to obtain an optimal use of BBICS.

Our experimental evaluations are dedicated to compare and validate the efficiency of the sensor of a BBICS architecture, designed to simultaneously monitor PMOS and NMOS transistors in dual-well and triple-well structures, under Photoelectric Laser Stimulation (PLS). The obtained results are the first silicon experimental proof of the efficiency of BBICS in triple-well and the mitigated results compared with the dual-well BBICS. Furthermore our investigations will give information of the sensitivity detection.

A. BBICS principles

Bulk currents induced during normal operation of an IC are in the µA range, whereas particles or laser-pulsed induce bulk currents are above by two orders of magnitude for the generation of SEEs [START_REF] Neto | Using Built-In Bulk Current to detect Soft Errors[END_REF]. BBICSs are designed to take advantage of this property: they monitor bulk currents, hence they are able to detect unusual currents and, consequently, the advent of SEEs [START_REF] Dutertre | Sensitivity tuning of a bulk built-in current sensor for optimal transient-fault detection[END_REF], [START_REF] Simionovski | Simulation Evaluation of an Implemented Set of Complementary Bulk Built-In Current Sensors With Dynamic Storage Cell[END_REF].

Fig. 4 depicts the insertion of BBICS between the bulks of the MOS transistors and their biasing voltages. The BBICS used pBBICS to monitor PMOS bulk transistors (i.e. the Nwell), and nBBICS to monitor NMOS bulk transistors (i.e. the Psubstrate in dual-well and the Pwell in triple-well structure).

Hence, as illustrated, any transient photocurrent necessarily flows through the BBICS. The purpose of the BBICS is then to raise a warning flag indicating that the circuit function may be affected. Note that the BBICS has also to provide the biasing of the transistor's bulk.

B. BBICS architecture

Fig. 5 depicts the architecture of the BBICS we designed and used for practical validation with a laser in [START_REF] Champeix | Experimental Validation of a Bulk Built-In Current Sensor Detecting Laser-Induced Currents[END_REF]. Its main feature is its ability to simultaneously monitor NMOS and PMOS transistors. Two cross-coupled inverters are used to store the content of a warning flag: OUT node. OUT goes to high level to indicate the detection of any unusual bulk current, and stays low in monitoring mode. The INNWELL and INPWELL nodes are the respective BBICS connections to the biasing contacts of the PMOS and NMOS bulks. Transistors MP1 and MN1 are used to bias the INNWELL and INPWELL nodes, respectively at VDD and ground. In this way they ensure the proper biasing of the corresponding bulks. These transistors are always in ON state. The purpose of transistors MP2 and MN2, whose drains are connected to nodes OUTB and OUTA, is to raise the alarm flag in case of the advent of a SEE according to the process explained hereafter. Fig. 5 also highlights (in violet) when a bulk current is induced by the laser, OUTA and OUTB change their stable state in the latch, so consequently, the output of the sensor (OUT) is at '1'. The sensitive latch detects small variations of their inputs and memorizes a state if there was a transient bulk current. It needs to be reset at every acquisition.

C. Experimental measurements

For the purpose of analyzing the weakness of the BBICS, we performed a set of experiments on a test chip we designed in 90nm CMOS STMicroelectronics technology. Note that the technology node differs from the fault injection evaluation presented in part II. But the tendency stays the same in 40 nm (simulation have been done in the next part). Manufacturing silicon BBICSs in 40 nm are in progress. Sensor detection measurements will be evaluated soon.

Our test structure in 90 nm, is the same as used for our results presented in [START_REF] Champeix | Experimental Validation of a Bulk Built-In Current Sensor Detecting Laser-Induced Currents[END_REF]. We focused our study on two same areas of a purely combinational logic block, in dual-well and triple-well technologies, monitored by a single BBICS. These measurements were carried out by the same infrared laser source used in section II, for a laser power = 100% (minimum power fault threshold in dual-well) and for a wide range of laser pulse duration from short ns to long µs.

To understand the different detection maps reported in Fig. 6, description of how the blocks are distributed in the layout is important. The 45 µm x 13 µm monitored area (also called target) is 14 µm far from the BBICS in order to avoid any perturbation during acquisitions. This target is a combinatorial gates area whose bulks are biased by the BBICS. Two version of this gates area have been designed in dual-well and triplewell technologies in order to have a comparative sensitive detection area. The BBICS, is always designed in dual-well. The laser detection maps will cover both the monitored area and the BBICS (80 µm x 60 µm with a step size of 1 µm).

A first detection (or sensitivity) maps at 100% laser power, is shown on Fig. 6a. The target sensitive area is almost fully covered in triple-well. Our measurements were caring out, first in triple-well in order to have the laser power needed to have a full coverage. Firstly, it is the proof of the effectiveness of a laser sensor in triple-well technology. Unfortunately, for this coverage, the laser power is 2 times higher than the power requested for a SEE in a flip-flop (cf part II).

Then, a second detection maps in dual-well (Fig. 6b) was built experimentally to have a comparative detection trend from the previous detection maps. The sensitive area in dual well is 6.4 times bigger than in triple-well. This result is contradictory with [START_REF] Dutertre | Improving the ability of Bulk Built-In Current Sensors to detect Single Event Effects by using triple-well CMOS[END_REF]. Our hypothesis is that the current generated on the wells in triple-well are less important than in dual-well.

A detection area is also present in the BBICS itself. It is not due to the photocurrent in the BBICS taps but to an SEU in the core latch of the BBICS itself.

The architecture of this single BBICS demonstrated that the detection is very effective in dual-well technology but not enough in triple-well. So the design need to consider those aspects to perfectly tune the BBICS detection threshold. It can be tuned by changing the W/L ratio of MN1 and MP1 transistors. The more resistive these transistors are, the more effective the detection at low photocurrent is. Unfortunately, after the design the sensor coverage can't be adjusted.

IV. THE USE OF BODY-BIASING FOR THE SENSOR

Based on these results, we developed a new BBICS architecture well suited for the monitoring of triple-well CMOS logic and with the goal to adjust the BBICS coverage.

With technology scaling down, performance and power consumption play an increasingly important role in logic design. The body biasing technique presented in [START_REF] Liu | Trading Speed for Low Power by Choice of Supply and Threshold Voltages[END_REF] and [START_REF] Keshavarzi | Technology scaling behavior of optimum reverse body bias for standby leakage power reduction in CMOS IC's[END_REF] is one well-known solution to adjust consumption and performance. This low power technique uses threshold voltage scaling by reverse or forward body bias. In 40 nm CMOS technology, the power supply is 1.2 V and the body biasing range is +/-400 mV applied on both NMOS and PMOS bulks (i.e. applied on the N and P wells). Body-biasing technique can only be obviously used for the triple-well CMOS. The Psubstrate potential is always grounded, DeepNwell = 0. This biasing tuning will have the impact to help the BBICS detection. Thus, in RBB condition the potential are inversed and then the impact will disadvantage the BBICS detection. Based on this assumption, we designed a BBICS compliant with body-biasing adjustments (see Fig. 7). MP1 and MN1 ensure the proper biasing of the corresponding bulk.

Then, the source potential instead of being directly connected to VDD and GND, they are connected on adjustable voltage source in green and orange on Fig. 7.

For the purpose of analyzing the BBICS coverage, we performed a set of experiments on stand-alone structures to measure the currents involved in SEE generation. These measurements were carried out on NMOS and PMOS transistors for both dual-well and triple-well [START_REF] Borrel | Characterization and simulation of a body biased structure in triple-well technology under pulsed photoelectric laser[END_REF], [START_REF] Borrel | Electrical model of an NMOS body biased structure in triple-well technology under photoelectric laser stimulation[END_REF] and [START_REF] Borrel | Electrical model of a PMOS body biased structure in triple-well technology under pulsed photoelectric laser stimulation[END_REF]. Based on these measurements, we created SPICE simulation models which make it possible to simulate the photocurrent generated on the test structure. The first three columns show the body-biasing condition and the voltage potential of the Nwell and Pwell. The fourth and fifth columns are some currents extract values of the photocurrent generated on the wells. The photocurrent generated on Nwell is around 50% higher than in Pwell. This is because one part of this current flows to Psubstrate. And this current is not monitored by the BBICS structures. And the last column is the minimum laser power needed for BBICS detection (also called detection threshold).

As we expected, the FBB condition contributes to help BBICS detection and the RBB condition limits this impact. In FBB condition, the Pwell/DeepNwell junction is less reversed biased (0.8 -0.4 = 0.4 V) than in RBB condition (1.6 + 0.4 = 2 V). It is well known that the more the PN junction is reverse biased, the more the photocurrent is generated. Thus, in RBB condition the photocurrent on DeepNwell is 309 µA and only 23.7 µA in FBB. This current generation should be limiting the BBICS detection in FBB. However, the threshold voltage Vth of the transistor MP2 and MN2, decrease in FBB condition than in RBB. In addition, FBB changes the gate potential of MP2 and MN2. Then, it drastically helps the sensor detection by reaching the voltage gates of MP2 and MN2 to the ON state.

Therefore, in maximal FBB condition, the minimal laser power needed for a BBICS detection is 15.32%. Compare to, the previous results, this laser power is now too weak to induce a SEE in flip-flops. Thus, the use of FBB on BBICS compliant with body-biasing in triple-well structure appears to solve the weakness for detecting a SEE.

V. CONCLUSION

This paper compares the triple-well structure to a classical dual-well. Test results for laser fault injection show that triplewell flip-flops cells are more vulnerable compared to dualwell. Additionally, triple-well BBICS countermeasures are less sensitive than in dual-well. Our experiments revealed an unexpected weakness in using triple-well contrary to the work simulated by [START_REF] Dutertre | Improving the ability of Bulk Built-In Current Sensors to detect Single Event Effects by using triple-well CMOS[END_REF]. Then, we proposed a new BBICS compliant with body-biasing adjustments. This solution shows the effective impact on detection and can easily used as an adjustment of the sensor threshold, in order to improve its detection efficiency.

Figure 1 .

 1 Figure 1. Laser-sensitive area of an inverter with its input at low level..

Figure 2 .

 2 Figure 2. Cross section view of CMOS gates (a) without triple-well and (b)with triple-well.

Figure 3 .

 3 Figure 3. Comparative study of the laser sensitivity threshold of a flip-flop in dual-well and triple-well.

Figure 4 .

 4 Figure 4. Principle of SEE detection by a combinated n & p BBICS

  Figure 6. BBICS laser cartographies in (a) triple-well and (b) dual-well, for a laser power = 100%.

Figure 7 .

 7 Figure 7. BBICS architecture compliant with body-biasing variation.

  Fig. 8 reports the signals of interest during a laser shot: the transient currents generated on Nwell, the voltage of INPWELL (NMOS bulk's voltage) and INNWELL (PMOS bulk's voltage) and the flag signal OUT. The next step was to obtain the detection threshold (i.e. the transient current magnitude sufficient to trigger an alarm) of the new BBICS with body-biasing well adjustments. The transient current magnitude was progressively increased (the pulse timings were left unchanged) until reaching the magnitude sufficient to trigger the alarm. We ran simulations for different FBB & RBB variations. The obtained results are given in table 1.

TABLE I .

 I EFFECT OF BODY-BIASING ON BBICS DETECTION

			THRESHOLD
	Body-	DeepNwell	Pwell	DeepNwell	Pwell	Laser
	biasing	potential	potential	Current	current	power
		(V)	(V)	(µA)	(µA)	(%)
	RBB	1.6 1.4	-0.4 -0.2	309 231.5	204 152.8	199.74 149.64
	No	1.2	0	154.7	102.1	100
	FBB	1 0.8	0.2 0.4	82.9 23.7	54.7 15.64	53.59 15.32

Figure 8. Electrical BBICS simulation whithout body-biasing.