Gimer Cervera

Michel Barbeau
email: barbeau@scs.carleton.ca

Joaquin Garcia Alfaro

Evangelos Kranakis
email: kranakis@scs.carleton.ca

Joaquin Garcia-Alfaro
email: joaquin.garcia-alfaro@acm.org

Mitigation of flooding disruption attacks in hierarchical OLSR networks

Keywords: HOLSR, security, flooding mechanisms, MPR

come   L'archive ouverte pluridisciplinaire

I. Introduction

The Hierarchical Optimized Link State Routing (HOLSR) [START_REF] Villasenor-Gonzalez | HOLSR: A hierarchical proactive routing mechanism for mobile ad hoc networks[END_REF] is a proactive routing protocol designed to improve scalability of heterogeneous Mobile Ad-Hoc Networks (MANETs). HOLSR organizes the network in logical levels and distributes the nodes in clusters. In every cluster, it implements the mechanisms and algorithms of the original OLSR [START_REF] Clausen | Optimized link state routing protocol (OLSR)[END_REF] to generate and to distribute control traffic information. Nevertheless, HOLSR was designed without security concerns and both inherits and add new security threats. In HOLSR, every node must be able to acquire an accurate topology map to preserve the connectivity in the network. Then, each node has two main tasks to perform: (a) to generate control traffic information or (b) to relay that information on behalf of other nodes. Thus, information contained in Hello and Topology Control (TC) messages are used to calculate optimal routes from any given node to any destination within each cluster. Additionally, Hierarchical Topology Control (HTC) messages are implemented to advertise membership information from a cluster to other nodes in higher levels. The core optimization of the protocol is the selection of Multipoint Relays (MPRs) as a flooding mechanism for distributing TC and HTC messages to all levels of the hierarchical architecture. In HOLSR, topology map acquisition [START_REF] Herberg | Security Issues in the Optimized Link State Routing Protocol version 2 (OLSRv2)[END_REF] is the ability of any given node to acquire a complete view of the network connectivity (i.e., routing tables) according to their topological level in the network. A node with an incomplete topological map is unable of calculating routing paths and forwarding data. In this context, a malicious node is defined as a node that interrupts the flooding of control traffic information or does not obey the rules of the protocol to maintain the hierarchical architecture. Topology map acquisition is affected by a malicious node that performs a flooding disruption attack to interrupt the propagation of control information. This attack can be performed by a misbehaving node that reports either a false identity (i.e., identity spoofing) or a false link (i.e., link spoofing) to perturb the proper selection of the MPRs. Furthermore, a malicious node might not relay properly control traffic information on behalf other nodes. Thus, the nodes in the network will not be able of constructing a complete map of other nodes attached to its cluster or in lower hierarchical levels. Notice that in some cases flooding disruption attacks can be performed even in a secured HOLSR network (e.g., a node does not forward control traffic information to save energy). Additionally, if an attack is detected, it is necessary to implement an efficient mechanism to advertise other nodes in the network. In this document, we analyze flooding disruption attacks that affect the topology map acquisition process in HOLSR networks. Additionally, we present preventive mechanisms to mitigate the effect of this kind of attacks.

In this paper, we explain the effect of the flooding disruption attacks in HOLSR networks, however other hierarchical approaches based on the OLSR protocol that implement the MPR mechanism to flood control information at both inter-cluster and intra-cluster levels, are also affected by the attacks that we describe in Section IV, for instance: cluster OLSR (C-OLSR) [START_REF] Ros | Cluster-based OLSR extensions to reduce control overhead in mobile ad hoc networks[END_REF] proposed by Ros et al., a tree-based logical topology [START_REF] Baccelli | OLSR trees: A simple clustering mechanism for OLSR. Challenges in Ad Hoc Networking[END_REF] to provide hierarchical routing presented by Baccelli, the Multi-level OLSR Routing using the Host and Network Association (HNA) messages Extension (MORHE) [START_REF] Voorhaen | MORHE: A transparent multi-level routing scheme for ad hoc networks[END_REF] presented by Voorhean et al., a hierarchical approach which also uses HNA messages for both inter-cluster and intra-cluster communication [START_REF] Arce | Performance evaluation of video streaming over ad hoc networks using flat and hierarchical routing protocols[END_REF] by Arce et al. and a clustering mechanism to manage and to distribute cryptographic keys in an OLSR network [START_REF] Hajami | An enhanced algorithm for MANET clustering based on multi hops and network density[END_REF] proposed by Hajami et al.

Organization of the paper -Section II reviews the OLSR protocol. HOLSR is described in Section III. Section IV describes the flooding disruption attacks in HOLSR networks. Section V presents a set of strategies to mitigate the attacks. Experiments and results are presented in Section VI. Finally, conclusions are presented in Section VII.

II. Optimized Link State Routing protocol

This section presents an overview of the original OLSR protocol. OLSR is a proactive routing protocol designed exclusively for MANETs. The core of the protocol is the selection, by every node, of Multipoint Relay (MPR) sets among their one-hop symmetric neighbors as a mechanism to flood the network with partial link-state information. This technique minimizes the number of traffic control messages flooded in the network, reduces the size of the messages and allows to construct optimal routes to every destination in the network. The link-state information is constructed by every node and involves periodically sending Hello and TC messages. The OLSR protocol is hop-by-hop routing, i.e., each routing table lists, for every reachable destination, the address of the next node along the path to that destination. Every node learns about its one and two-hop neighbors by periodically generating and receiving Hello messages. Hello messages are not retransmitted further. The MPR set is selected so that every two-hop neighbor is reachable through, at least, one MPR. Every node reports the nodes it has selected as MPRs in its Hello Messages. With this information, the nodes build their MPR selector set, i.e., the set of nodes that have se-

III. Hierarchical OLSR

MANETs are by nature formed by heterogeneous devices and nodes that can join the network without following a predictable pattern. Furthermore, scalability is a problem in MANETS. Scalability can be defined as the capacity of the network to adjust or to maintain its performance even if the number of nodes in the network increases [START_REF] Villasenor-Gonzalez | HOLSR: A hierarchical proactive routing mechanism for mobile ad hoc networks[END_REF]. OLSR is a flat routing protocol and the performance of the protocol tends to degrade when the number of nodes increases due to a higher number of topology control messages propagated through the network. The MPR mechanism is local and therefore very scalable. However, the diffusion by all the nodes in the network of all the link-state information is less scalable. For instance, in [START_REF] Palma | Inside-out olsr scalability analysis[END_REF] Palma et. al., show that OLSR have good results in terms of scalability in networks with up to 70 nodes, preferably with a moderate node speed and where the number of traffic flows is also moderate. However, OLSR's performance decreases in large heterogeneous ad hoc networks. Additionally, OLSR does not differentiate the capabilities of its member nodes and, in consequence, does not exploit nodes with higher capabilities. Thus, HOLSR is an approach designed to improve the scalability of OLSR protocol in large-scale heterogeneous networks. The main improvements are a reduction in the amount of topology control traffic and efficient use of high capacity nodes. HOLSR organizes the network in hierarchical clusters. This architecture allows to reduce the routing computational cost, i.e., in case a link is broken only nodes inside the same cluster have to recalculate their routing table while nodes in different clusters are not affected. In HOLSR, nodes are organized according to their capacities. The HOLSR network architecture is illustrated in Fig. 1. At level 1, we have lowcapability nodes and one interface represented by circles. Nodes at the topology level 2 are equipped with up to two wireless interfaces, designated by squares. Nodes at level 2 employ one interface to communicate with nodes at level 1. Nodes at level 3, designated by triangles, represent high-capacity nodes with up to three wireless interfaces to communicate with nodes at every level. Thus, in Fig. 1, node F3 represents node F's interface at level 3. The only restriction for nodes at levels 2 and 3 is that they have at least one interface to communicate with nodes at levels 2 or 3, respectively. For instance, in Fig. 1 node F has two interfaces and can communicate with nodes at levels 2 and 3. Node A has also two interfaces and establishes communication with nodes at levels 1 and 2. Node D can just communicate with nodes at level 2. In the example, the notation used to name the clusters reflects the level of the cluster and the cluster head, e.g., C1.A means that the cluster is at level 1 and the cluster head is node A. HOLSR allows formation of multiple clusters and, unlike OLSR, HOLSR nodes can exchange Hello and TC messages exclusively within each cluster. This constraint reduces the amount of traffic information broadcast to the entire ad hoc network.

A. Cluster Formation

The topology control information between clusters is exchanged via specialized HOLSR nodes designed as cluster heads. The selection of cluster heads and classification of nodes according to their capabilities are defined at the startup of the HOLSR process. A cluster is formed by a group of mobile nodes -at the same hierarchical levelthat have selected a common cluster head. Nodes can move from one cluster to another and associate with the nearest cluster head. Any node participating in multiple topology levels automatically becomes the cluster head of the lower-level cluster. In HOLSR, a cluster head declares its status and invites other nodes to join in by periodically sending out Cluster ID Announcement (CID) messages.

These messages are transmitted in the same packet with Hello messages using a message grouping technique. This technique is implemented to reduce the number of packet transmissions. A CID message contains two fields: cluster head that represents the interface address of the originator of the message, and distance which is the distance in hops to the cluster head generating the message. Every time the cluster head generates a CID message, it initializes the field distance to zero. The receiver node joins the cluster head and sends a new CID message. The new CID message increases the value of the distance by one unit. This mechanism allows to invite other nodes to join the same cluster. The cluster formation process is described in more detail in [START_REF] Villasenor-Gonzalez | HOLSR: A hierarchical proactive routing mechanism for mobile ad hoc networks[END_REF].

B. Cluster Head Message Exchange

The hierarchical architecture must support the exchange of topology control information between clusters without introducing additional overhead. Thus, Hierarchical TC (HTC) messages are generated by the cluster head and used to transmit the membership information of a cluster to higher level nodes. HTC forwarding is enabled by the MPRs and restricted within a cluster. Nodes at the highest topology level have full knowledge of all nodes in the network and their routing tables are as large as they would be in an OLSR network. However, in lower levels, the size of the routing table of every node is restricted to the size of the cluster and it is smaller than in OLSR. For instance, in Fig. 1 the cluster head A generates an HTC message for the interface A2 (level 2) announcing that nodes 1, 2 and A1 are members of its cluster at level 1. The message is relayed to all nodes at the same level. Then, node B generates an HTC message for the interface B3 (level 3) advertising that nodes 1, 2, 3, 4, 5, 7, 8, A1, B1, C1 (at level 1) and A2, B2, C2, D2 (at level 2) are members of its cluster.

C. Topology Control Propagation

Nodes in each cluster at different levels select their MPRs to flood control traffic information. Control messages are generated and propagated exclusively within each cluster, unless a node is located in the overlapping zone of several clusters. For example, in Fig. 1 node 2 is within the border of cluster C1.A and may accept a TC or HTC message from node 3 located in cluster C1.B. However, node 2 retains the information without retransmitting it to its cluster. Thus, except for the border nodes, knowledge of nodes about the cluster is restricted to the cluster itself. Data transfer between nodes in the same cluster is achieved directly via the information in the routing tables. However,when transmitting data to destinations outside the local scope of a cluster, the cluster heads are always used act a gateway mechanism by member nodes at lower hierarchal levels. A different strategy might be used, when transmitting data between border nodes in different clusters at the same level, the cluster head is not used as a gateway to relay the information, and nearby nodes in different clusters at the same topology level can communicate directly without having to follow the strict clustering hierarchy. Therefor, HOLSR offers two main advantages (a) the traffic control messages reflecting local movement are restricted to each cluster (thus, reducing the routing table computation overhead), and (b) an efficient use of high-capacity nodes without overloading them.

IV. Flooding Disruption Attacks in HOLSR

The flooding mechanism for control traffic information in an HOLSR network is based on the correct selection of the MPRs. Control traffic messages (i.e., TC and HTC messages) are forwarded exclusively by the MPRs. An attacker seeking to interrupt the control traffic flooding can either (a) manipulate the information about the one and two-hop neighbors of a given node to cause the MPR selection to fail, or (b) misbehave during the generation and forwarding processes. Thus, a node will receive incomplete information about other nodes in its cluster or in lower level clusters. The attack has a cross layer impact if the affected node is a cluster head with an interface to an upper level. In this case, nodes in the upper level will fail to compute a route to nodes in lower levels of the network. For instance, consider in Fig. 1 that node E2 selects node H2 as its MPR, nonetheless H2 misbehaves and does not retransmit any control traffic message. In consequence, node F2 and nodes in cluster C3.B will not be aware of nodes within cluster C1.E. Fig. 2 summarizes flooding disruption attacks in an HOLSR network and the mechanisms used to perform them. In the sequel, we present these attacks more in detail.

A. Identity Spoofing

The identity spoofing attack [START_REF] Herberg | Security Issues in the Optimized Link State Routing Protocol version 2 (OLSRv2)[END_REF] is performed by a malicious node pretending to be a different node in the network. The goal of the attack is to report false information about nodes one or two-hops away in order to maliciously affect the MPR selection process. Figure 3(a) illustrates an example where node x spoofs the identity of node d and broadcasts hello message advertising a valid link with node c. Then, node a will receive Hello messages from node x indicating that node d has links with nodes c and f. In this case, node a selects incorrectly node d as the only element in its MPR set. In consequence, node c is unreachable through the MPR set and will never receive TC or HTC messages. Figure 3(b) presents an example where the attacker affects the MPR selection of a node at distance two hops. The malicious node x spoofs the identity of node c, i.e., nodes f and e will generate Hello messages advertising node c as a one-hop neighbor. From the point of view of node a nodes b, e, f and d have node c as a onehop neighbor. As a result of the attack, node a can select incorrectly nodes f or e as a MPR. In this case, nodes b and d will not forward control traffic information to node c because they are not included in the MPR set.

B. Link Spoofing

The link spoofing attack [START_REF] Herberg | Security Issues in the Optimized Link State Routing Protocol version 2 (OLSRv2)[END_REF] is performed by a malicious node that reports an inexistent link to other nodes in the network. The objective of the attacker is to manipulate the information about the nodes one or two hops away and be selected as part of the MPR set. Once the malicious node has been selected as an MPR, it neither generates nor forwards control traffic information. The flooding disruption attack due to link spoofing is illustrated in Fig. 4(a). In this example, node x spoofs links to nodes e and c. Node x sends Hello messages and looks like the best option to be selected as an MPR for node a. Node a receives the Hello messages from node x and computes incorrectly its MPR set by selecting node x as the only element to reach nodes e and c. Thus, all routing information will not reach nodes two hops away from node a. A variant of the attack can be performed by reporting a link to an inexistent node.

C. Invalid MPR Set

In this attack, a malicious node disrupts the flooding of topology control information by misbehaving during the MPR selection process. Figure 5(a) illustrates the attack. Node x wants to be selected as the only MPR of node a. Then, it spoofs a link to node g and generates Hello messages announcing node g as a one-hop neighbor and its only MPR. From the perspective of node a, nodes c and g can be reached through node x. Then, node x is the best candidate to be selected as an MPR for node a. Thus, node x receives and forwards TC or HTC messages from node a. However, those messages never reach node d because any one-hop neighbor of node x retransmits the messages. This attack exploits the source dependent requirement in OLSR to forward control traffic information. In this case, for nodes a, b, c and e, node x is not included in their selector table and they will never forward any message from node x.

D. Incorrect Relaying

A misbehaving node can disrupt the integrity of the network by either incorrectly generating or relaying control traffic information on behalf of other nodes. Consider x in Figure 5(a) as a misbehaving node. Node x wants to be selected as the only MPR of node a. Then, it spoofs a link to node g and generates Hello messages announcing node g as a one-hop neighbor. From the perspective of node a, nodes c and g can be reached through node x. Thus, node x is selected by node a as its only MPR and might perform the following incorrect behaviors: Selfish behavior. The attack is performed by a node that misbehaves and neither generates nor forwards TC or HTC messages. To increase the effectiveness of the attack, the malicious node might establish false links to other nodes in the network and force its one-hop neighbors to select it as their MPR. Fig. 5(a) illustrates an example where node x has been selected by node a as an MPR but it does not relay control traffic on behalf of other nodes. In consequence, node d will not receive control traffic information from node a. Notice that in an HOLSR network, the attacker can choose not to forward any particular message, i.e., TC , HTC, MID or HNA messages. Slanderer behavior. The list of addresses reported in each TC message can be partial (e.g., due to message size limitations). Thus, a misbehaving node can always generate TC messages without reporting all nodes in its selector table claiming that the size of the messages is not enough to include all nodes in its selector table. As a result, if node x generates TC messages without including node a, node d will not be able to compute a path to node a. Hop Limit attack. A malicious node x can drastically decrease the hop limit (TTL value) when forwarding a TC or HTC message, e.g., setting the hop limit equal to zero. This will reduce the scope of retransmitting the message. The attack can be performed by a malicious node that has not been selected as an MPR. For instance, in Figure 5(b), a control message is forwarded by node a and received by both nodes x and b. Previously node b was selected by node a as its MPR. However node x forwards the message without any delay or jitter such that its retransmission arrives before that the valid message from b. Before forwarding, it reduces the hop limit of the message. The affected node, node c, will process the message and mark it as already received, ignoring future valid copies from b. Thus, the message with a very low hop limit will not reach the whole network.

V. Countermeasures

In an HOLSR network, the MPR selection reduces at minimum the overhead generated by control traffic messages, if every node selects its MPR set with the following conditions: (i) the MPR set is kept at minimum, (ii) an MPR retransmits control traffic messages if and only if the sender node is included in its selector table, and (iii) only partial link state information is transmitted, i.e., an MPR reports only links with its selector nodes. Nevertheless, we can loosen up the previous restriction in order to offer a higher level of security while maintaining a tradeoff between security and performance. In the following subsections, we describe a set of strategies to reduce the effect of flooding disruption attacks. The strategies that we describe are based on the selection of MPRs with additional coverage, generation of TC messages with redundant link state information and a non source-dependent forwarding mechanism.

A. MPRs with Additional Coverage

Additional coverage in the selection of the MPRs is defined in [START_REF] Clausen | Optimized link state routing protocol (OLSR)[END_REF], as the ability of a node to select redundant MPRs. The selection of MPRs must be as small as possible to reduce the overhead generated by flooding the network with TC messages. Nevertheless, additional coverage allows a node to advertise its presence to more nodes in the network. In this manner, extra coverage helps to maintain the integrity of the network in spite of the presence of malicious nodes during the execution of HOLSR. The selection of MPRs with extra coverage is defined in the RFC3626 [START_REF] Clausen | Optimized link state routing protocol (OLSR)[END_REF], we named this approach a k-Covered-MPR set. However, the overhead generated by the excessive number of TC and HTC messages reduces the performance of the network. This problem is addressed with an improved k-Robust-MPR selection presented in [START_REF] Cervera | Mitigation of topology control attacks in OLSR networks[END_REF], which balances security and traffic overhead. Figure 6 presents examples of the resulting MPR selection strategies with or without additional coverage.

1) RFC3626's MPR Coverage Parameter:

The RFC3626 [START_REF] Clausen | Optimized link state routing protocol (OLSR)[END_REF] defines the MPR Coverage parameter to specify by how many one-hop nodes any two-hop neighbors must be covered. If MPR Coverage is equal to one, then the overhead is kept at minimum and the function is equivalent to the MPR selection without additional coverage specified in [START_REF] Clausen | Optimized link state routing protocol (OLSR)[END_REF], Section 8.3.1. If MPR Coverage is equal to k, a node selects its MPR set such as any two-hop neighbor is covered by k one-hop neighbors, whenever possible. A poorly covered node, is a node in the two-hop neighborhood that cannot be covered by at least k nodes in the one-hop neighborhood. The MPR Coverage parameter is local to every node in the network. Nodes with different values of MPR Coverage may operate in a same network. The MPR selection with additional coverage using the MPR Coverage parameter is explained in more detail in [START_REF] Cervera | Mitigation of topology control attacks in OLSR networks[END_REF], [START_REF] Clausen | Optimized link state routing protocol (OLSR)[END_REF]. Figure 6 2) k-Robust-MPR Selection: A k-Robust-MPR selection [START_REF] Cervera | Mitigation of topology control attacks in OLSR networks[END_REF] computes an MPR set that is composed of, at most, k + 1 disjoint groups, i.e., every two-hop node is covered, if possible, by k + 1 disjoint groups of one-hop neighbors. Assume the following notation:

• d(n, u): number of hops between nodes n and u.

• N 1 (n) := {n 1 : d(n, n 1 ) ≤ 1}. • N ≤2 (n) := {n 2 : d(n, n 2 ) ≤ 2}. • N 2 (n) := N ≤2 (n) \ N 1 (n).
• M : M is an MPR set for node n if and only if M ⊆ N 1 (n) such that for every node

n 2 ∈ N 2 (n), N 1 (n 2 ) ∩ M = ∅.
The k-Robust-MPR selection algorithm works as follows:

1) First, we obtain a subset M i such that M i is subset of N 1 (n) and covers all the nodes in N 2 (n). 2) We repeat the process until it is not possible to find a new disjoint subset M i that covers all the nodes in N 2 (n) or we have found a maximum of k + 1 disjoint subsets. 3) The MPR set is formed by the union, if it is possible, of k disjoint subsets M i .

The resulting MPR set has two main properties: (a) in a k-Robust-MPR set it is possible to discard a maximum of k MPR sets, and the remaining set it is still a valid MPR set, and (b) if we can only find k +1 disjoint MPR sets, such that k +1 is less or equal than a value of k, we obtain a valid k -robust-MPR set. Figure 6(b) shows a k-Robust-MPR selection with a value of k equal to one. For instance, node i can select either {g} or {f, j} as valid disjoint MPR sets, then node i can compute a 1-Robust-MPR set formed by {g, f, j}. Then, if node g misbehaves, node i can discard it and the subset {f ,j} remains as a valid MPR set.

B. Redundant Information

In contrast to other classic link state protocols, such as the OSPF [START_REF] Moy | Open Shortest Path First (OSPF) version 2, RFC2328[END_REF], in an HOLSR network only partial link state information is diffused. Periodically, an MPR generates TC messages reporting only nodes in its selector table to calculate optimal routes to every destination. However, the advertised link set of a node may include links to neighbor nodes which are not in the MPR selector set of the node. The minimal set of links that any MPR must advertise in its TC messages are the links to its MPR selectors. Nevertheless, the advertised link set may include links to the whole neighbor set of the node. The diffused link-state information can be tunned through the TC Redundancy parameter defined in the RFC3626 [START_REF] Clausen | Optimized link state routing protocol (OLSR)[END_REF], Section 15. The parameter TC Redundancy is local to every node and determines the amount of information that should be included in the TC messages. If the TC Redundancy parameter is equal to zero, then the advertised link set of the MPR is limited to its MPR selector set. If the TC Redundancy parameter is equal to one, then the MPR will advertise its MPRs and its MPR selector set. Finally, if the parameter is equal to two, then the MPR will report all its one-hop neighbors. For instance, in Fig. 6(b) node a selects node {b} as its only MPR. However, suppose node c misbehaves and reports a false link to node d and a phantom node x, node a can not select disjoint MPR sets and will select node c as its only MPR set. If node c does not generate or forward control traffic, then node a will remain isolated. Notice that node b is selected by node d as its MPR, then it reports in its TC messages node d as its only selector node. If node b sets its TC Redundancy parameter equal to three, then it will report all its one-hope neighbors, including node a. As a result, the size of the TC message will increase but this strategy might be used to prevent flooding disruption attacks.

C. Non-Source Dependent Mechanism

In an HOLSR network, an MPR retransmit a control traffic message (TC or HTC message) following a Source Dependent (SD) strategy, i.e., an MPR forwards a control traffic message if and only if the sender of the message is included in its selector table. This mechanism allows to minimize the number of retransmissions and overhead generated by excessive TC messages in the network. In [START_REF] Macker | Evaluation of distributed cover set algorithms in mobile ad hoc network for simplified multicast forwarding[END_REF], Macker et al. analyze the overhead generated by a nonsource dependent MPR (NSD-MPR) mechanism to support simplified multicast IP routing in MANETs. Nonetheless, this approach can be used to enforce security in an HOLSR network. In order to avoid an excessive overhead, the mechanism can be useful to retransmit exclusively HTC messages according the following algorithm for a given node n:

• If node n receives an HTC message and node n's selector table is not empty then process and forward the message. Otherwise, just process the message.

• If node n receives a TC message and node n's selector table is not empty and the sender of the message is included in node n's selector table then process and forward the message. Otherwise, just process the message. For instance, in Fig. 6(b) consider node a as a cluster head and can not select disjoint MPR sets. Suppose, node c misbehaves and reports a false link to node d and a false link to a phantom node x. Then, node a is forced to select node c as its only MPR. Node c generates TC messages and announces node a as it selector node but it does not retransmit HTC messages generated by node a.

In consequence, all nodes reported by node a in its HTC messages will not be advertised by other nodes in its cluster and in upper levels. However, if node b is selected by node d as its MPR and it follows a non-source dependent strategy to retransmit HTC messages, node a's messages will be retransmitted by node b even if node a is not included in its selector node.

VI. Experiments

We conducted simulations to assess the effectiveness of our proposed countermeasures against flooding disruption attacks in HOLSR networks. We count the number of nodes in a HOLSR network that are able to build complete routing tables under the presence of one to four malicious nodes. We obtain as performance ratio, the percentage of nodes with complete routing tables over the number of messages generated during the simulation. We conducted our experiments using the NS-3 simulator [START_REF] Henderson | Software package retrieved from[END_REF], version 3.9. We modified the original OLSR code developed by Ros and Carneiro to implement the hierarchical approach (i.e., HOLSR) and the countermeasures described in Section V. The malicious nodes are selected among the MPRs, they do not collude to perform an attack, no data traffic is generated and all the scenarios are static. We test our proposed countermeasures in HOLSR networks with three levels and two hundred nodes in each case: 175 nodes with one interface and a transmission range of 100 m, 20 nodes with up to two interfaces and a transmission range of 200 m, and five nodes with up to three interfaces and a transmission range of 500 m. The nodes with just one interface at the first level, are placed following an uniform distribution. We assume that the administrator of the network can decide the best criteria to distribute the cluster heads. Figure 7 depicts the average number of nodes with complete routing tables and 95% confidence intervals. It shows how our strategies offer additional protection to mitigate the effect of selfish nodes in contrast with the selection of MPRs without additional coverage. Notice that the k-robust-MPR function mitigates the effect of misbehaving nodes with a better performance than the k-covered-MPR and NSD-MPR approach (cf. Figure 7(b)). Similar results are expected for the other two cases described in Section IV-D.

VII. Conclusion

In this paper, we presented a taxonomy of flooding disruption attacks that affect the topology map acquisition in HOLSR networks. These kind of attacks affect either the MPR selection process or the flooding of control traffic information for inter-cluster or intra-cluster communication. Additionally, we present a set of strategies to mitigate the effect of this kind of attacks. According to our experiments, it is possible to mitigate the effect of flooding disruption attacks by selecting the MPR sets with additional coverage or generating control traffic with redundant information.

Figure 2 .

 2 Figure 2. Taxonomy of flooding disruption attacks in HOLSR.

  Node x spoofs d and reports an incorrect link between nodes c and d. One-hop address duplication. Node x spoofs c and affects node a's MPR selection. Twohop address duplication.

Figure 3 .

 3 Figure 3. Flooding disruption due to identity spoofing attacks.

Figure 4 .

 4 Figure 4. Flooding disruption due to link spoofing attacks.

  Node x never selects a valid MPR set.

  Node x modifies and forwards incorrectly TC and HTC messages.

Figure 5 .

 5 Figure 5. Flooding disruption due to protocol disobedience.

  (a) shows a k-Covered-MPR selection with a value of k equal to two.

  k-Covered-MPR selection k equal to two. k-Robust-MPR selection k equal to one.

Figure 6 .

 6 Figure 6. MPR selection in an HOLSR cluster with additional coverage.

  (a) Percentage of nodes with complete routing tables. , k=1 k-robust-MPR, k=1 k-covered-MPR, k=2 (b) Performance ratio.

Figure 7 .

 7 Figure 7. Comparison of functions NSD-MPR, k-covered-MPR, and k-robust-MPR under the presence of selfish nodes.

Example of a hierarchical architec- ture with heterogeneous nodes.

						K3
	Level 3
		B3					F3
						I3
				Cluster C3.B
							Cluster C2.F
	Level 2	Cluster C2.B		H2		F2
	A2	D2	B2	C2		E2	G2
		Cluster C1.B	Cluster C1.H		Cluster C1.G
			B1	4	H1		10	G1
	Level 1	3		5		6	9	11
		A1
		1	2	C1	7	8	E1	12
	Cluster C1.A							13
				Cluster C1.C			Cluster C1.E
	Figure 1. lected a given node as an MPR. TC messages are generated
	exclusively by the MPRs. A node that has an empty MPR
	selector set does not send or retransmit any TC message.
	The originator of TC message advertises itself as the last
	hop to reach all nodes included in its selector table. This in-
	formation allows each node to construct and to maintain its
	topology table [8]. Additionally, OLSR implements HNA
	and Multiple Interface Declaration (MID) messages. HNA
	messages are used to inject external routing information
	into an OLSR network and to provide connectivity to nodes
	with non-OLSR interfaces. MID messages are used to
	declare the presence of multiple interfaces on a node. HNA
	and MID are optional and exclusively retransmitted by the
	MPRs. Therefore, the selection of the MPRs and the link-
	state advertisement mechanism are critical vulnerability
	targets.

Acknowledgment The authors graciously acknowledge the financial support received from the following organizations: Natural Sciences and Engineering Research Council of Canada (NSERC), Mathematics of Information Technology and Complex Systems (MITACS), Institut Telecom, Spanish Ministry of Science and Innovation (grants TSI2007-65406-C03-03 E-AEGIS and CONSOLIDER-INGENIO CSD2007-00004 ARES), National Council of Science and Technology (CONACYT), and Ministry of Education of Mexico (SEP, Program for Academic Improvement).


Pascal Alix

Laurence May

Jean-Pierre Bigot

Loss of containment: Experimental validation of initially subcooled two phase critical flow models


Xiaohui Tang
email: tang@dice.ucl.ac.be

Nicolas Reckinger

Vincent Bayot

Christophe Krzeminski

Emmanuel Dubois

Alexandre Villaret

Daniel-Camille Bensahel

Fabrication and Room-Temperature Single-Charging Behavior of Self-Aligned Single-Dot Memory Devices

Keywords: nanotechnology, single-electron memory, Coulomb blockade effect, self-aligned floating gate, arsenic-assisted etching and oxidation effects

Self-aligned single-dot memory devices and arrays were fabricated based on arsenic-assisted etching and oxidation effects. The resulting device has a floating gate of about 5-10 nm, presenting single-electron memory operation at room temperature.

In order to realize the final single-electron memory circuit, this paper investigates process repeatability, device uniformity in single-dot memory arrays, device scalability, and process transferability to an industrial application.

Introduction

Single-electron memories [i] are the ultimate device for low power operation.

In single-electron memories, a nanometer-scale floating gate is charged/discharged by a few (ideally one) electrons based on energy quantization and Coulomb blockade effect [ii]. Two main approaches, single-dot and multiple-dot devices, have been proposed to fabricate these devices since the first single-electron memory was reported in 1993 [iii].

In multiple-dot devices [iv]- [11], randomly deposited nanocrystals store individual electrons. A large number of dots implies that these devices are intrinsically not single-electron devices, but each dot stores only one or a few electrons depending on its size. Multiple-dot devices present the advantage of being more immune to spurious discharging as electrons are distributed among isolated dots. However, the randomness of nanocrystal deposition induces device characteristic fluctuations.

Single-dot devices are composed of a narrow channel MOSFET with a single nano-floating gate embedded in the gate dielectric. The key technological issue is to fabricate this nano-floating gate and to align it with the channel in a controlled manner. To our knowledge, contrary to multiple-dot memories, there are only a few papers related to Si single-dot single-electron memory devices [12]-[17], probably because of the difficulty of their realization. In the race for the ultimate memory device, single-dot memory devices have the advantages of nanometer dimension, stable performance and easy analysis over multiple-dot memories [1].

In most cases [12]- [START_REF] Park | A nano-structure memory with silicon on insulator edge channel and a nano dot[END_REF], very high-resolution lithography tool is required to define the floating gate and the channel. By making use of arsenic-assisted etching and oxidation effects, we have developed the fabrication process of a single-dot memory device [17]. It can be realized by current optical lithography tools, moreover, the floating gate is self-aligned with the channel. To realize the final single-electron memory circuit, we investigate here process repeatability, device uniformity in singledot memory arrays, device scalability, and finally process transferability to an industrial production line. We also characterize miniaturized single-electron memory devices.

Device process

A. Fabrication

A detailed process can be found in [17]. The layout of the processed memory device is shown in the inset of Fig. 1.a. Wider source and drain regions are connected by a narrow-wide-narrow channel. The memory devices and arrays were fabricated on As-doped SOI wafer with a silicon overlay of 200 nm (at doping energy of 110 keV).

The silicon overlay, covered by silicon nitride, is defined by a hybrid lithography (UV+e-beam) and reactive ion etching (RIE). Fig. 1.a shows a SEM cross-section of a device center after etching, which has a diabolo-like shape. Like all the crosssectional SEM pictures in this study, contrast is enhanced by a quick HF dip that removes a bit of the silicon oxide surrounding Si parts. The arsenic-assisted etching effect leads to the fastest lateral etching rate of silicon where the arsenic is at its peak concentration (see the trench in Fig. 1.a). After wet oxidation, a tunnel oxide is formed in the trench region shown in Fig. 1.b. The tunnel oxide separates the top silicon dot from the bottom triangular wire. The dot and the triangular wire are used as the floating gate and the channel of the memory device, respectively. The floating gate is restricted to the central region since the top silicon dot is completely oxidized in the narrow regions of the channel (also called constrictions, see Fig. 3.b). In source and drain regions, the width of the silicon mesa is large enough to avoid the formation of the tunnel oxide at the location of arsenic peak concentration. Thus, the floating gate is separated from the channel in a single oxidation step. This results in a selfaligned structure.

B. Repeatability

To move the present process from laboratory concept to industrial application, it is necessary to assess the process repeatability. Therefore, we performed three experiments under the same conditions. Fig. 2 demonstrates a SEM image of the device center in the third experiment. Fig. 1.b was taken from the device in the second experiment. The first experimental result has been published in [17]. In these images, the same structure can be seen, indicating that this process is highly repeatable.

C. Uniformity

For the feasibility of a memory circuit, uniformity across the array is a more relevant parameter than the memory device size itself. Device uniformity is shown in Fig. 3.a and Fig. 3.b. In this experiment, different arrays were fabricated together with memory devices. Fig. 3.a exhibits the cross-section of the central part of the device for one array. It is worth noting that in the third line from left hand, the floating gate is nearly invisible. This comes from the limitations of our contrasting method (HF dip) which sometimes causes the removal of the very small silicon dot. However, this has no effect on real devices. Fig. 3.b illustrates the constriction region. As expected, only a triangular channel is formed since the silicon dot is completely consumed. It is found that the channel size is very uniform across each array. Fig. 4 gives some typical geometrical parameters (i.e. the channel base width, the channel height and the tunnel oxide thickness) for 8 devices chosen randomly from a large number of devices. We cannot provide precise data for the silicon dot because the dot size is too small to be extracted accurately from SEM pictures.

However, the equivalent diameter of the floating gate is estimated to be about 20 nm.

In order to meet the requirements for room-temperature single-electron operation, the floating gate must be scaled down below 10 nm [18].

D. Scalability

In the present process, the size of the floating gate depends on arsenic doping dose and energy, the thickness of the silicon overlay, as well as oxidation conditions.

The device scalability is first investigated by simulation and then confirmed by experiments. The optimal scaling rule tells us that device miniaturization should be done by reducing silicon overlay thickness and implantation energy in the same ratio.

By thinning the silicon overlay from 200 nm to 100 nm and decreasing the arsenic implantation energy from 110 keV to 55 keV, we fabricated 70 miniaturized devices.

They present single-electron memory operation at room temperature. Hereafter, the device we discuss about refers to the miniaturized device.

The most critical step in this process is the wet oxidation since it governs the creation of the silicon dot on top of the channel. Oxidation is simulated by a commercial simulator (ISE DIOS) [19]. Fig. 5 gives the simulation result and Fig. 6 shows a SEM image of the top view for one of the 70 fabricated devices before polysilicon gate deposition. The floating gate, which can barely be observed through the gate oxide, has a diameter around 10 nm with a pretty large uncertainty given the weak contrast between silicon and oxide. Even if the real dot size cannot be determined, the room-temperature single-electron behavior (see section 3) will confirm that this size is smaller than 10 nm. This dimension approaches to the limitation of the present process. To further reduce the size of the floating gate, a longer oxidation time will be needed. This would result in a significant increase in the tunnel oxide thickness, thereby, programming/erasing speed of the memory device would be decreased. Finally, Fig. 7 demonstrates a fabricated device with a control gate of 150 nm.

E. Transferability

The key steps of the present process, such as implantation, lithography, etching and oxidation, have also been tested in an industrial fabrication line of ST Microelectronics. Fig. 8 gives the SEM cross-section of a device center realized by current optical lithography tools. A floating gate of about 5 nm over the triangular channel can be seen clearly. Although further improvements are needed to optimize dot size and the tunnel oxide thickness, the present process is compatible with CMOS technology and can be considered as a potential option in the forthcoming technological nodes.

Electrical characterization

The condition to observe Coulomb blockade effect is k B T < q 2 /C  . For real device applications, the charging energy q 2 /C  should exceed the thermal energy k B T at least by a factor of three [18]. Here C  is the total capacitance of the floating gate.

A first simple model for the floating gate is a silicon conducting sphere which has a self-capacitance of C  = 2 ox d (d is the diameter of the floating gate and  ox is the permittivity of oxide). For the presence of Coulomb blockade effect at room temperature, the diameter of the floating gate must be less than 8.5 nm from k B T = 0.3q 2 /C  . This is consistent with the observed size of the dot (about 5-10 nm) from Fig. 6 and Fig. 8. Fig. 9 shows the I d -V g curve of a typical device at room temperature. The I d -V g characteristics are that of a typical P-channel MOSFET (As-doped). Several jumps (see arrows) in the current, corresponding to single charge (hole) injection into the floating gate, can be seen in the figure . To further support single-charge injection, the time evolution of the drain current is carried out. In this measurement, a positive voltage of 5 V is first applied to the control gate for returning holes to the channel and obtaining an empty floating gate. Then a constant voltage of -5.58 V is set and held on during the measurement. Fig. 10 demonstrates a typical I d -t characteristics. When one hole is injected into the floating gate, an abrupt reduction of drain current is observed. The quantization of the current steps, of ΔI d  0.94 nA, confirms that they stem from single hole injection in the nano-floating gate.

From the I d -t measurements, we found that the hole injection is stochastic. By repeating the same measurement more than 100 times, we calculated the mean injection time τ of the first hole to be 0.7 s at a gate voltage of -5.58 V, which is much smaller than Yano's value (12.9 s) at a gate voltage of 12 V [20]. It is possible to model hole injection process by a simple Poisson process. To calculate the probability of the first hole injection in the floating gate (P 1 ), we simply use P 1 (t) = 1 -P 0 (t), where P 0 (t) is the probability for an empty floating gate at t time (P 0 (t) = exp(t/τ)). The Poisson law (the solid line) and the results extracted from the experiment For an SOI standard transistor, which has a gate length of 1 µm, the threshold voltage is determined as the gate voltage at I d = 100 nA/µm and V d = 50 mV [21]. Taking into account the specificities of our device structure, we set the threshold voltage as the gate voltage at I d = 1 nA and V d = 10 mV. When the floating gate is empty, the threshold voltage is -4.95 V, while when the first hole is injected into the floating gate, the threshold voltage becomes -5.05 V. For small |V g |, the threshold voltage shift is found to be approximately equal to n * ΔV n , where n is the number of injected hole and |ΔV n |  0.1 V (for n = 1,2,3). The threshold voltage shift is basically proportional to the number of holes injected, which is in qualitative agreement with the theoretical calculation result in [22]. This may be explained by the special hole distribution in the triangular channel surrounded by an -gate. In this device, the holes of the initial inversion layer induced by the gate voltage occur mainly at the tip of the triangular channel. Hence, the channel holes experience the same screening for every hole injected in the floating gate. However, for large |V g |, the proportional relation (n * ΔV n ) is untenable. As seen in the figure, the fourth voltage shift |ΔV 4 | is larger than 0.1V. This issue is under investigation.

The hysteretic behavior of the device at room temperature is shown in Fig. 13. When V g is swept from -3V to -7V, five I d shifts are observed, while two back shifts are observed when V g sweep is reversed. Hysteresis has been observed on almost all devices, while the reference device without silicon dot does not exhibit any hysteresis. This indicates that holes are injected into the floating gate rather than into possible traps of the gate oxide. Finally, it is worth noting that the threshold voltage shift and the hole charging voltage are varying a little from one device to another. To reach reproducibility of electrical characteristics, the layout of the device should be transferred perfectly to the silicon overlay by using a good lithography tool, which was not possible with our lithography tool. The relatively short retention time, compared to our results on the 20 nm-dot devices [17], is probably due to (1) a poor quality of tunnel oxide, because wet oxidation at low temperature (800°C) was used to form the tunnel oxide; (2) a high arsenic doping concentration inducing stress, point-defects and dislocations. However, the tunnel oxide property can be improved by increasing oxidation temperature and adjusted by tuning oxidation time.

Conclusion

Self-aligned single-dot memory devices and arrays with a floating gate of about 5-10 nm have been fabricated. The quantized threshold voltage shift and the hysteresis characteristics imply that room-temperature single-hole memory operation is achieved. Process repeatability and size uniformity across each array indicate that this process can be used to realize memory circuits. The present process is compatible with CMOS technology and several key steps have been tested in an industrial fabrication line. with the same width as the constrictions of the device. In both cases, the device structure is uniformly repeated. Fig. 4: Typical geometrical parameters for 8 devices realized in different regions of one wafer. The data show small variations from one device to another due to the limit of lithography system.

Captions

(

  the star symbols) are shown in Fig. 11. As we can see in the figure, the experimental data are in good agreement with this approximation before 1 s, while the data fitting becomes poor after 1 s since we have neglected the probabilities for the second, third, … hole injection in the calculation. This indicates that the other hole injection except for the first hole should be taken into account after 1 s. The I d -t is also measured at different gate voltages. The extracted values of drain current steps (a bunch of current values) as a function of gate voltage are shown in Fig. 12. Note that it is impossible to extract all current values at some gate voltages due to fast injection. The solid lines, plotted by linking the current values from each hole injection status, represent the |I d |-V g curves with zero, one, two, three … holes in the floating gate, respectively.

Fig. 1 :

 1 Fig. 1: SEM cross-section of a device centre: (a) after etching, the trench is observed where the As peak concentration is located; (b) after oxidation, the trench is completely consumed, forming the tunnel oxide.

Fig. 2 :

 2 Fig. 2: SEM cross-section of a device centre after oxidation. The floating gate and the channel are clearly separated by the tunnel oxide.

Fig. 3 :

 3 Fig. 3: SEM cross-sections of lines within an array: (a) with the same width as the device centre and (b)

Fig. 5 :

 5 Fig. 5: Simulated cross-section for one device with a silicon overlay of 100 nm.

Fig. 6 :

 6 Fig. 6: SEM top view of a device before polysilicon gate deposition. The floating gate can be seen through the gate oxide in the centre of the memory device. The dot size is approximately equal to 10 nm.

Fig. 7 :

 7 Fig. 7: SEM top view of a fabricated memory device, the control gate has a length of 150 nm.

Fig. 8 :

 8 Fig. 8: SEM cross-section of a device centre processed by ST Microelectronics. The floating gate size is about 5 nm.

Fig. 9 :

 9 Fig. 9: I d -V g characteristics (solid line) of a typical device at room temperature. The arrows represent one, two, three … holes injected into the floating gate.

Fig. 10 :

 10 Fig. 10: Time evolution of drain current for a constant gate voltage of -5.58V. The different steps in I dt are an evidence for single hole injection in the floating gate.

Fig. 11 :

 11 Fig. 11: First hole injection probability, accounted by a simple Poisson process. A mean injection time of 0.7 s, obtained from more than 100 I d -t measurements, is used in the calculation. The solid line shows the calculation result and the star symbols represent data extracted from the experiment.

Fig. 12 :

 12 Fig. 12: Extracted values of drain current steps as a function of gate voltage at room temperature. The solid lines represent the |I d |-V g curve with zero, one, two, three and four holes in the floating gate, respectively.

Fig. 13 :

 13 Fig. 13: Hysteresis characteristics of a device at room temperature at V d = -10 mV. Many I d shifts can be seen when the gate voltage is swept forth and back.

Fig. 1

 1 Fig. 1.a : Xiaohui Tang et al.

Fig. 1

 1 Fig. 1.b : Xiaohui Tang et al.

Fig. 2 :

 2 Fig. 2 : Xiaohui Tang et al.

Fig. 3

 3 Fig. 3.b : Xiaohui Tang et al.

Fig. 4 :

 4 Fig. 4 : Xiaohui Tang et al.

Fig. 5 :

 5 Fig. 5 : Xiaohui Tang et al.

Fig. 6 :

 6 Fig. 6 : Xiaohui Tang et al.

Fig. 7 :

 7 Fig. 7 : Xiaohui Tang et al.

Fig. 8 :

 8 Fig. 8 : Xiaohui Tang et al.

Fig. 9 :

 9 Fig. 9 : Xiaohui Tang et al.

Fig. 10 :

 10 Fig. 10 : Xiaohui Tang et al.

Fig. 11 :

 11 Fig. 11 : Xiaohui Tang et al.

Fig. 12 :

 12 Fig. 12 : Xiaohui Tang et al.

Fig. 13 : Xiaohui Tang et al.

ACKNOWLEDGMENTS

The authors would like to acknowledge A. Crahay, D. Spote, B. Katschmarskyj, P. Loumaye, C. Renaux, N. Mahieu and M. Zitout for their help in the device fabrication.


Slim Hrigua
email: slim.hrigua@satie.ens-cachan.fr

Cyrille Gautier

Bertrand Revol

François Costa

Using of VHDL-AMS to model power semiconductors for EMI simulation

Keywords: VHDL-AMS models, EMI constraint, Power components simulations. NOMENCLATURE region area [m 2 ]. ε drain overlaps depletion capacitance [F]. Coxd: Gate-drain overlap oxide capacitance [F]. Coxs: Exceeding oxide capacity [F]. Cm: Source metallization capacity [F]. Ibss: Steady-state base current [A]. Icss: Steady-state collector current [A]. Iccer : Collector-emitter redistribution current [A]. Iceb: Emitter-base capacitor current [A]. W: Quasi-neutral base width [m]. q: Electronic charge [C]. A: Device active area [m 2 ]. µ eff : Effective mobility [m 2

The design of static power converters makes intervene an important number of variables as well as several different kinds of constraints. The goal of this work consists in introducing the EMI constraint at the time of the power electronic circuit's design while leading an accurate analysis of the conducted sources of perturbations. The developed models aim to improve the realism of the power components simulation in the goal to optimize the design while dealing with EMI constraints.

I. INTRODUCTION

The consideration of the aspects linked to the EMI when simulating the power electronic system requires the modeling of the whole system in its real environment. Indeed, modeling must take into account on one hand the internal coupling between the different elements of the system (parasitic elements of the components, wirings and links impedances) and on the other hand, the coupling between the system and its vicinity (conducted and radiated coupling modes).

However, a particular effort must be provided to propose models for the semiconductor components enabling an accurate simulation of the switchings since they represents the main sources of high di/dt and dv/dt leading to perturbations in the converters. The used models must be valid in a large frequency range, in order to get a realistic spectral representation of the currents and voltages.

Actually, this survey aims to introduce the EMC constraint at the circuit conception time. In fact, a sensitivity study on the design parameters would permit to identify those acting directly on the radiated and conduced emissions in order to intervene at the virtual prototyping stage to insure that the EMC aspect is respected.

In this work, we propose a first version of the dynamic IGBT model in VHDL-AMS. The IGBT referenced IRGPC40UD is chosen to establish the model. It

2/6

integrates an N-channel IGBT chip as well as a fast recovery anti-parallel diode. The complete model will be implemented in a DC-DC converter circuit and used subsequently to lead a parameters sensitivity analysis of the model by observing the evolution of the conduced EMI at the LISN (Line Impedance Stabilization Network).

II. LUMPED-CHARGE DIODE MODEL IN VHDL-AMS

The lumped-charge LC modeling technique represents a systematic approach for the development of power semiconductor models of which we find several applications in the literature [12][13]. We referred for this work to the Laurizen-Ma diode model [START_REF] Ma | Modeling of Power Diodes with the Lumped-Charge Technique[END_REF]. This model, based on a physical approach, is developed to replace the SPICE standard model in order to have a better representation of the inverse recovery effect.

Figure 1: The LC nodes distribution in a 1-D P+N-N+ diode structure [START_REF] Ma | Modeling of Power Diodes with the Lumped-Charge Technique[END_REF] Thanks to this technique, the basic semiconductor equations are simplified while using this node arrangement (Figure 1). These relations are transformed in lumped-charge equations for every region. With regard to the VHDL-AMS diode model, we leaned on the described models in [START_REF] Lauritzen | Compact Models for Power Semiconductor Devices[END_REF] used on SABER simulator.

The test circuit presented in figure 2 is used to analyze the diode model. According to the literature [START_REF] Ben Salah | A Novel Approach to Extract Accurate Design Parameters of PiN Diode[END_REF], the method consists in analyzing the inverse transient characteristic of the diode from a null forward current.

Figure 2: Simulation circuit of the inverse recovery from a null initial current

In spite of resistance R1 influences on the value of the maximal inverse voltage VRM (Figure 3), it doesn't affect its variation. On the other hand, the current slope (Figure 4) depends essentially of the applied inverse tension and of the inductance L1 permitting to impose the current gradient.

In the absence of initial current, the diode behaves like a non-linear capacitance. The internal diode capacitance discharges through the resistance and the inductance of the circuit generates an oscillation.

III. IGBT MODELING

In spite of the recent efforts toward an IGBT behavioral modeling to avoid the physical models complexity, the understanding of the internal mechanisms proves to be even indispensable to really define the model relevance.

In fact, the Hefner model is classified among the first models that takes into account the important physical modeling effects. It is the basis of several behavioral models, notably those elaborated for Spice [1][2].

This first complete model with charge control [START_REF] Pittet | Modélisation physique d'un transistor de puissance IGBT -Traînée en tension à l'enclenchement[END_REF] shows excellent results in literature. These results were the subject of the simulations described in document [START_REF] Hefner | An Investigation of the Drive Circuit Requirements for the Power Insulated Gate Bipolar Transistor (IGBT)[END_REF]. To describe the injection operation done at the level of the large PNP transistor base, the theory of ambipolar diffusion [START_REF] Gatard | Analyse des phénomènes physiques dans les diodes p-i-n : Contribution à la modélisation électrothermique pour les applications de puissance RF et hyperfréquences[END_REF] is used instead of conventional quasi-static approach to describe the transient behavior and the transportation of electrons and holes [START_REF] Hefner | An Experimentally Verified IGBT Model Implemented in the Saber Circuit Simulator[END_REF]. For these IGBT modeling works, we lean upon the Hefner model [START_REF] Hefner | An Experimentally Verified IGBT Model Implemented in the Saber Circuit Simulator[END_REF] and on the VHDL-AMS modeling works in literature [START_REF] Ibrahim | Contribution au développement de modèles pour l'électronique de puissance en VHDL-AMS[END_REF].

3/6

III.1.ELECTRICAL MODEL OF THE IGBT IN VHDL-AMS

The IGBT and the VDMOSFET structures are quite identical; the main difference is that the IGBT substratum is of P+ type. In fact, these two components have the same grid structure, the source contact (for the IGBT is called cathode or emitter) is done as much on the N+ area as on the P zone. This zone has two doping levels (high doped at the volume level and low doped at the canal level) in order to guarantee a reasonable threshold voltage and a low resistivity to avoid the booting of the parasitic bipolar N+PN- [START_REF] Lefranc | Etude, conception et réalisation de circuits de commande d'IGBT de forte puissance[END_REF].

Nevertheless, the physical functioning of the IGBT is closer to the bipolar transistor functioning then the VDMOSFET. Indeed, the presence of the P+ substratum permits the injection of minority carriers (holes) in the N-layer, this generates a modulation of its conductivity and induced to the reduction of its conduction resistance.

III.2.VDMOSFET CHARACTERISTICS

Figure [START_REF] Gatard | Analyse des phénomènes physiques dans les diodes p-i-n : Contribution à la modélisation électrothermique pour les applications de puissance RF et hyperfréquences[END_REF] shows the VDMOSFET capacitive elements. The Cgd capacitance is equal to the oxide capacitance Coxd at the level of the grid-drain overlap for Vds ≤ Vgs -V , for except that for Vds ≥ Vgs -V , the silicon that is below the grid becomes depletive and the Cgd capacitance will be constituted by a serial recombination of the Coxd capacitance and the depletion capacitance Cgdj at the level of the grid-drain overlap.

Figure 5: VDMOSFET capacitive elements

The sum of the oxide capacitance Coxs at the level of the grid-source overlap and the source metallization capacitance Cm forms the grid-source capacitance Cgs.

The depletion capacitance of the drain-source junction Cds is given by:

= × (1)

III.3.THE BIPOLAR TRANSISTOR CHARACTERISTICS

Contrary to the conventional bipolar transistor, the base length is not anymore too small in relation to the diffusion length of its minority carriers. Thus, the transistor is separated to a collector/anode-base junction, a base-emitter/cathode junction and a resistive base Rb [START_REF] Pittet | Modélisation physique d'un transistor de puissance IGBT -Traînée en tension à l'enclenchement[END_REF]. This resistance is imposed like a critical element that must essentially takes into account the current lines focusing mechanism and the base conductivity modulation [START_REF] Linder | On DC Modeling of the Base Resistance in Bipolar Transistor[END_REF]. It is expressed by the following equation:

= × × × (2)
The Ic current crossing the collector/anode-base junction corresponds to the sum of two currents. The recombination capacity Ccer is an important element that describes the recombination effect when IGBT current is cut off.

Indeed, the decrease rate of the tail current correspond to the evacuation by recombination of the majority carriers stocked in the N-base [10][11]. Contrary to the Iccer current that browses this capacitance, the representation of the stationary current Icss doesn't depend on the variations of the base-emitter/cathode potential.

On the other hand, the base-emitter/cathode junction is represented as a current source Ibss set in parallel with the Iceb current. These currents symbolize the evacuation of the transistor charge.

The equivalent diagram used for the IGBT modeling in VHDL-AMS is detailed on figure 6.

IV. SIMULATION CIRCUIT TOPOLOGY: BUCK CONVERTER

The IRG4PC40UD diode has the features of a power diode (600V,15A) and it is designed for bridge configuration. The major advantage of this diode is its speed and its weak losses. The IGBT and the diode modeling can be achieved in an independent way since they represent two detached components in the same package [START_REF]IRG4PC40UD: Insulated Gate Bipolar Transistor with Ultrafast Soft Recovery Diode[END_REF] and it allows us to use the already defined models of the IGBT and the diode.

The parameters identification proceeds of two main stages [START_REF] Ibrahim | Contribution au développement de modèles pour l'électronique de puissance en VHDL-AMS[END_REF]:

The extraction of the initial parameters: it is based, on one hand, on the manufacturer technical files (Datasheet) and the analytic equations and on the other hand on static or dynamic measurements.

The adjustment of the parameters by an optimization approach permitting to minimize the differences between the experimentations and simulations.

At the first phase of work, we use the manufacturer's technical files as a basis [16][17] to define the model parameters.

The different simulations of this model are achieved on the Portunus® software. In order to evaluate the dynamic behavior of the model, we used a DC-DC converter circuit presented in figure 7. The switching cell is constituted of an IRG4PC40UD IGBT model (commanded by the control supply E1 (grid tension included between 0V and 15V for switching frequency of 40 KHz), a freewheeling diode model identical to that used in the IRG4PC40UD. The circuit also integrates a 500V supply E2, a grid resistance Rg of 100 Ω, a load that is constituted by a resistance Rch of 100 Ω and an inductance Lch of 1mH as well as the circuit parasitic elements. These values have been estimated on a real prototype.

A LISN circuit has been inserted between the supply and the converter in order to calculate the conduced EMI generated by the circuit in both common and differential modes.

V. SEMICONDUCTORS SWITCHING AND CONDUCTED EMI SIMULATION

The IGBT switching off (Figure 8) follows the same process that of the MOS. The current decreases suddenly since the MOS opens up and the major part of the current is cut. When the Vac voltage reaches the supply voltages, the free wheel diode in unblocked. On the other hand, a tail current persists until the complete recombination. This current is due to the excess in carriers that are not evacuated from the base of the PNP transistor.

5/6

The IGBT switching on (Figure 9) is practically identical to a MOS. Actually, when the grid voltage reaches the threshold voltage, the current increases in the IGBT. We notice that the increase of the IGBT current is made with the same slope that in the free wheel diode that continues to conduct as far as reaching the maximal current IRM.

VI. CONCLUSION AND PERSPECTIVES

The EMI analysis of the power electronics at the conception stage and at the time of the virtual prototyping requires the use of accurate models for the semiconductor components. These models require an important number of parameters whose exact knowledge often requires experimental measurements and optimization procedures.

The behavior in changing and steady state varies considerably according to the type of used semiconductor switch. As a fact, the circuit simulation type seems to be an indispensable stage facing a general characterization by means of measurements as the field cartography. This method allows defining the elements that mainly contribute to the resonances but requires exact models for the calculation of the electromagnetic perturbations. Once the correct modeling is achieved, studying the distribution of the cables and the components in the chopper block is essential to evaluate the influence of the parasitic elements on the efficiency of the supplementary circuit (of filtering, of commutation help…) in order to lead a complete EMC analysis.

At this phase, we studied a VHDL-AMS primitive model of the IGBT on the Portunus® software. This work is the result of a deepened survey of the physics and the internal structure of the semiconductors. On the other hand, the implementation of the models in a chopper circuit allows us to simulate the conduced EMI generated by the circuit. Further study will combines these two aspects in order to find more precise relations between the physical models parameter and the conduced EMI. The validations of the proposed model in relation to experimental measurements are necessary this stage. This first phase of modeling must be applied also to passive devices and to connectors that contribute inevitably to the electromagnetic signature of power devices.

Figure 3 :Figure 4 :

 34 Figure 3: The voltage behavior at the reverse recovery instance

Figure 6 :

 6 Figure 6: Equivalent circuit model of the IGBT

Figure 7 :

 7 Figure 7: Switching circuit

Figure 8 :

 8 Figure 8: IGBT switching off and free wheel phase

Figure 9 :

 9 Figure 9: IGBT switching on and the inverse recovery phase

VII. ACKNOWLEDGMENTS

This work has been supported by the O2M project.