Thuy Nguyen

Christina Dindic

Wolfgang Stahl

Ha Vinh

Lam Nguyen
email: lam.nguyen@lisa.u-pec.fr

Isabelle Kleiner

4 N Nuclear quadrupole coupling and methyl internal rotation in the microwave spectrum of 2-methylpyrrole

Keywords: 2-methylpyrrole, microwave spectrum, internal rotation, nuclear hyperfine

Introduction

For many years, the phenomenon of internal rotation has been a subject of considerable interest to both chemists and physicists. Studies of potential functions, barrier heights, stability of rotational isomers, and ring conformations provide basic information for testing and improving methods to understand the effects of internal rotation. Quantum chemical calculations together with molecular jet Fourier transform microwave (MJ-FTMW) spectroscopy allow us to obtain the torsional potential with high accuracy.

Due to steric and electronic interactions, the torsional potential of methyl groups attached to an aromatic compound are often hard to predict intuitively, while results from quantum chemical calculations are still rather not sufficiently accurate. Many investigations have been carried out on such aromatic systems, especially heterocyclic five-membered rings, to determine the methyl barrier heights, i.a. 2-methylthiazole (34.9 cm -1 ) [1], 4-methylisothiazole (105.8 cm -1 ) [2], 2,5dimethylthiophene (248.0 cm -1 ) [3], 2-acetyl-5-methylfuran (369.8 cm -1 for the trans conformer and 356.5 cm -1 for the cis conformer) [4], and 2,5-dimethylfuran (439.2 cm -1 ) [5]. From those studies it is obvious that the torsional potentials of methyl groups attached to planar aromatic rings vary in a wide range in both, shape and height.

Pyrroles are nitrogen containing five-membered ring systems which possess unique organoleptic properties [6]. Some pyrroles are used as flavor additives. In the 1960s, pyrroles became known to represent a minor class of potentially significant flavor-associated compounds that occur naturally in foods. Pyrrole and the methyl substituted compound, 2-methylpyrrole (2MP), are found in volatile compounds from fried chicken [7]. Pyrrole also provides the key structural subunit for many of the most important biological molecules, such as heme and chlorophyll. Pyrrole and its derivatives exhibit wide range of biological and pharmaceutical activities, i.a. antibacterial, anti-fungal, anti-viral, anti-inflammatory, anti-cancer and antioxidant activity [8].

From a spectroscopic point of view, 2MP contains a methyl group which undergoes internal rotation and a 14 N nucleus which causes a nuclear quadrupole hyperfine structure. Within the scope of this work, a combination of quantum chemical calculations and MJ-FTMW spectroscopy was used to determine the shape of the potential function and the barrier to internal rotation. The quadrupole hyperfine structure yielded information on the electric field gradient at the site of the 14 N nucleus and consequently on the nature of its chemical bonds.

Quantum chemical calculations

To facilitate the spectral assignment, initial values of the rotational constants, the torsional potential, and the 14 N nuclear quadrupole coupling constants (NQCCs) were calculated by quantum chemical methods using the GAUSSIAN16 program package [START_REF] Frisch | Revision B.01[END_REF].

Geometry optimizations

The molecular geometry of 2MP was optimized at different levels of theory with various combinations of the MP2, B3LYP, M06-2X, and CCSD methods with different basis sets to check for the convergence and to find out the level of theory which yields rotational constants in best agreement with the experimental values. A selection of the calculations is presented in Table 1.

The predicted rotational constants are given along with the dipole moment components and the angle between the inertial principal a axis and the methyl rotor axis. For comparison, the experimental rotational constants are also shown. A full list with all calculations is given in Table pVDZ level of theory is shown in Figure 1.

<<Table 1 is approximately here>>

It should be noted that the internal rotor axis is almost parallel to the principal a axis (see also the value of the angle (i,a) in Table 1). At equilibrium, the dihedral angle α = (C3,C2,C6,H11) is 0°, i.e. the methyl group is staggered with respect to the nitrogen atom.

<< Figure 1 is approximately here >>

Torsional potential of the methyl group

To obtain the barrier height to internal rotation and the shape of the potential function, geometry optimizations at the MP2/cc-pVDZ level of theory were carried out while the dihedral angle α was varied in steps of 10°. The resulting potential curve is given in Figure S1 in the supplementary online material. The potential was parameterized by a symmetry-adapted Fourier series with the Fourier coefficients given in Table S3 in the supplementary online material.

The torsional potential of 2MP displays the typical threefold shape caused by the symmetry of the methyl group. The potential consists of a V3 value of 255.24 cm -1 with a V6 contribution of 36.16 cm -1 .

N nuclear quadrupole coupling constants (NQCCs)

In many previous studies on nitrogen containing molecules [START_REF] Kannengießer | [END_REF]11], the method of calculating 14 N NQCCs given by Bailey [12] turned out to be very reliable and was also applied in this work. At first, the molecular structure of 2MP was optimized at the MP2/cc-pVDZ level of theory. For this optimized structure, the electric field gradient tensor of the 14 N nucleus in 2MP was computed at the B3PW91/6-311+G(d,p) level of theory, as recommended for -conjugated system [13]. Using the calibration factor eQ/h = 4.599 MHz/a.u. [13], the quadrupole coupling tensor with the diagonal elements χaa = 1.331 MHz, χbb = 1.665 MHz, and χcc = -2.996 MHz, as well as the off-diagonal element χab = 0.091 MHz was obtained. Due to the symmetry of the molecule χac and χbc are zero.

Experiment

Measurements

2MP was purchased from abcr GmbH, Karlsruhe, Germany, with a stated purity of 95% and was used without further purification. A piece of pipe cleaner was soaked with the substance and inserted into a stainless steel tube placed upstream the nozzle. Helium, which was used as carrier gas, flowed over the substance at a pressure of 200-250 kPa.

All spectra were recorded using two MJ-FTMW spectrometers operating in the frequency ranges from 2.0 to 26.5 GHz [14] and from 26.5 to 40.0 GHz [15]. At first, a broadband scan was recorded from 12.0 to 14.9 GHz. The lines observed in the scan were remeasured at higher resolution. All lines show a hyperfine structure due to the nuclear quadrupole coupling of the 14 N nucleus. A typical spectrum is given in Figure 2.

<< Figure 2 is approximately here >>

Spectral assignment

At the beginning of the assignment we predicted the spectrum with the XIAM code [16] using the rotational constants, the V3 potential, and the angle between the internal rotor axis and the inertial a axis obtained by ab initio calculations at the MP2/cc-pVDZ level of theory, and neglected the quadrupole hyperfine splittings due to the 14 N nucleus. The predicted dipole moment components are |μa| = 1.07 D, |μb| = 1.79 D and |μc|= 0.00 D (see Table 1). Therefore, A species ctype transitions were not expected to be observed in the spectrum. By comparing the broadband scan and the predicted spectrum the A and E torsional components of the 211  110, 303  212, 321  312, and 421  413 transitions could be identified. The linear combinations of the rotational constants BK = A -0.5(B + C), BJ = 0.5(B + C), B-= 0.5(B -C) and the V3 potential were fitted, which enabled us to predict all other transitions with sufficient accuracy. Only one line in the scan region remained unassigned, which later turned out to be the c-type transition 110  000 of the E species, which is nominally forbidden in the semi-rigid rotor approximation.

Afterwards, all lines were remeasured at high resolution. In this step, the quadrupole coupling effect was taken into account. The values of the NQCCs obtained by quantum chemical calculations were used to predict the hyperfine patterns, which fairly matched those of the experimental spectra. Due to spin-rotation and spin-spin interactions, some transitions show additional splittings of the order of 10 kHz. In those cases, the average of the individual components was taken.

Results and discussion

Results of the fits

Two global fits of 2MP with 62 A species and 67 E species lines with a total number of 359 hyperfine components were performed using the XIAM and BELGI-Cs-hyperfine [17] codes. The measurement accuracy is about 3.0 kHz for all lines. The root-mean-square (rms) deviations are 5.6 kHz and 3.1 kHz, respectively. The fit results are given in Table 2, the frequency list is available in Table S4 of the supplementary online material. The fit with BELGI-Cs-hyperfine was carried out in the rho axis system with the parameters defined in this coordinate system are given in Table 3.

For comparison with the XIAM results, some parameters were converted to the principal axis system (also presented in Table 2). << Table 2 is approximately here >> With the XIAM code, the three linear combination of rotational constants, five quartic centrifugal distortion constant J, JK, K, J, K, the 14 N NQCCs aa, bb-cc, as well as the barrier to internal rotation V3, the angle (i,a) between the a axis and the internal rotor axis and two higher order terms Dpi2J, Dpi2K enabled us to reproduce the experimental spectra to a rms deviation of 5.6 kHz.

In order to treat molecules containing one methyl rotor and one nitrogen nucleus, the BELGI code has been extended to its hyperfine versions BELGI-Cs-hyperfine and BELGI-C1-hyperfine. Up to now, three molecular systems have been successfully treated by these codes, which are N-tertbutylacetamide (Cs) [17], N-ethylacetamide (C1) [START_REF] Kannengießer | [END_REF] and 3-nitrotoluene (Cs) [18]. In this work, the BELGI-Cs-hyperfine code was applied, showing its capability to handle nuclear quadrupole coupling in the presence of internal rotation.

<< Table 3 is approximately here >>

Discussion

The rotational constants from the XIAM and the BELGI-Cs-hyperfine fits are in good agreement, however, they do not agree within their standard errors. This is due to the fact that different sets of parameters were used, and that the conversion of some RAM parameters to PAM parameters is not unique and introduces some errors. It turned out that the MP2 method as well as the DFT method with the B3LYP functional in combination with Grimme's dispersion correction and Becke-Johnson damping [19] yielded a good agreement with the experimental rotational constants for most sufficiently large basis sets. Rotational constants predicted with Truhlar's M06-2X method [20] are in general further off from the experimental values. Comparison between the rotational constants obtained from XIAM with those from ab initio calculations at the MP2/cc-pVDZ level of theory shows deviations of 1.12% for A, 0.99% for B, and 1.05% for C (with respect to the experimental values). A better agreement is not expected at the level of theory in use, because the experimental constants observed in the vibrational ground state are not directly comparable with the equilibrium values obtained from the ab initio calculations. From the results given in Table S2, the values of the rotational constants predicted at our most time-consuming calculations CCSD/6-311++G(d,p) are very close to the experimental values. Similar results can be achieved using a combination of the 6-31+G(d,p) or 6-31++G(d,p) basis set with the B3LYP or MP2 method, probably due to error compensation. From our experience, the same kind of error compensation always occurs at the same level of theory. Therefore, these levels might be chosen to predict reliable rotational constants to start the spectral assignment of future investigations on related methyl substituted pyrroles.

The parameters associated with the internal rotation, the V3 potential and the angle between the principal a axis and the internal rotor axis (i,a), obtained from the XIAM and BELGI programs agree satisfactory, while the predicted V3 potential is 8.8% lower than the experimental value. This deviation is rather large, however, it is in the expected range for quantum chemical calculations at the MP2/cc-pVDZ level of theory. In contrast to the geometry parameters, the calculations of the V3 potential strongly depend on the method and basis set and a convergence is hard to achieve. Furthermore, the effects of zero point vibrations are known to influence the calculated value.

Though the calculated potential also contains contributions of V6 and higher order terms, they are assumed to be negligible in the potential function fitted with the current experimental data. With only transitions in the torsional ground state, it is impossible to test the validity of this assumption, as V6 cannot be determined.

The 14 N NQCCs obtained from the XIAM and the BELGI fits agree within the standard errors. The quantum chemical results obtained at the B3PW91/6-311+G(d,p)//MP2/cc-pVDZ level agree within 0.3% for aa and -6.9% for bb -cc (with respect to the experimental values). In the principal axis system, an experimental value for χab cannot be obtained because it is associated with the expectation value of {Pa,Pb} which is zero in the case of the A species and which cannot be determined well from the E species at rather high barriers such as 280 cm -1 . If we calculate the same quantity in RAM and back-transform it to PAM, we will not be able to acquire χab.

Particularly in case of 2MP, the off-diagonal elements of the nuclear quadrupole coupling tensor could not be fitted with BELGI-Cs-hyperfine program and therefore a back-transformation on χab was not possible. Some results obtained for 2MP are compared with those of other five-membered heterocycles in Figure 3. << Figure 3 is approximately here >> The V3 potential varies in a wide range from 34 cm -1 for 2-methylthiazole (6) [1], 106 cm -1 for 4-methylisothiazole (8) [2], 252 cm -1 for 2-methyloxazole (7) [21] to 280 cm -1 for 2MP (5).

The V3 potential is due to symmetry strictly 0 cm -1 for molecules with a C2v symmetric frame and an internal rotor of C3v symmetry. Only a small V6 term is found in the cases of toluene [22], nitromethane [23,24], and N-methylpyrrole [25]. If the frame symmetry is lowered from C2v to Cs, then a V3 contribution is observed, depending on the local asymmetry due to steric or electronic effects. In 2-methylthiazole (6) the nitrogen and sulfur atoms have similar effects on the methyl rotor and only a very low V3 potential arises. In 4-methylisothiazole (8) a similar situation also leads to a rather low barrier of 106 cm -1 . In the title compound 2MP (5) the environment of the methyl group with a NH group on one side and a carbon atom on the other side is rather asymmetric which results in a much higher barrier. We note that such intuitive interpretations should be taken with caution because in aromatic systems electronic effects are easily propagated through the π system of the ring and affect the barrier height.

The aromaticity is associated with a planar structure of the π electron system. A direct measure for planarity is the inertial defect Δc = Ic -Ia -Ib with the principal moments of inertia Ia, Ib, Ic is calculated for all compounds in Figure 3. In the case of the non-methylated systems inertial defects of 0.017, 0.074, 0.056, and 0.076 uÅ 2 are found for pyrrole (1) [26], thiazole (2) [27], oxazole (3) [28], and isothiazole (4) [29], respectively. The deviation from zero can be explained by the zero point vibrations of the rings. If one methyl group is attached to the ring, the out-ofplane hydrogen atoms of the methyl group cause an inertial defect close to 3.2 uÅ 2 . This is in agreement with the values of -3.223, -3.108, -3.127, and -3.012 uÅ 2 of 2MP ( 5), 2-methylthiazole (6), 2-methyloxazole (7), and 4-methylisothiazole (8), respectively.

In all systems given in Figure 3 the principal c axis perpendicular to the ring plane is collinear with one principal axis of the coupling tensor. Therefore, the χcc element of the 14 N quadrupole coupling tensor can be directly compared. In pyrrole (1) and 2MP ( 5), the values of χcc are very similar but have a different sign than in all other heterocycles (2-4) and (6-8). The reason is, that the two groups exhibit a very different bond situation at the nitrogen atom which causes different electric field gradients at the site of the nitrogen nucleus. The electron configuration of nitrogen is [He]2s 2 2p 3 . In all compounds of Figure 3, three sp 2 hybrid orbitals are formed, two of which are used to form the σ bonds to the neighboring atoms. One p orbital remains and becomes part of the π electron system. As shown in Figure 4, in the case of pyrrole three of five nitrogen electrons are needed in three sp 2 orbitals to form the two N-C bonds and one N-H bond (not illustrated). The other two electrons occupy the p orbital (illustrated in red) and contribute to the π electron system. Altogether, there are 6 π electrons which, according to the 4n + 2 rule, makes pyrrole an aromatic compound.

<< Figure 4 is approximately here >> In the other heterocycles, the situation is quite different. For oxazole, two sp 2 orbitals of the nitrogen atom with one electron each form the bonds to the neighboring atoms (not illustrated).

The third sp 2 orbital is occupied by an electron lone pair (illustrated in black). Only one electron remains in the p orbital (illustrated in red) contributing to the π electron system. It should be noted that in this group of molecules a sulfur or an oxygen atom is needed to donate two electrons for their p orbital to fulfill the condition for an aromatic compound (6 electrons in the π system).

Similar considerations apply also to thiazole and isothiazole.

In the case of pyrrole, the effect of methylation on χcc is small. Despite the well-known +I effect [30] of methyl groups, only a small change in the field gradient tensor is observed. The values of χcc of pyrrole (1) and 2MP (5) are -2.704 and -2.846 MHz, respectively. Similar small effects are observed upon methylation of thiazole (4), oxazole (6), and isothiazole (8).

Conclusion

The methyl torsional fine structure and the quadrupole hyperfine structure in the rotational spectrum of 2MP could be fully resolved using two molecular jet Fourier transform microwave spectrometers operating in the frequency range from 2 to 40 GHz. All observed transitions were analyzed and fitted with the programs XIAM and BELGI-Cs-hyperfine, whereby the BELGI-Cshyperfine code enabled us to reproduce the whole data set close to measurement accuracy. The spectroscopic work was supplemented by quantum chemical calculations.

The methyl group undergoes internal rotation with a V3 hindering potential of 279.7183(26) cm -1 .

The quadrupole coupling constants of the 14 N nucleus were determined with very high accuracy.

Calculations of the electric field gradient tensor with Bailey's method yielded nuclear coupling constants in good agreement with the experimental values.

Disclosure statement

No potential conflict of interest was reported by the authors. a All parameters refer to the rho axis system and cannot be directly compared to those referring to the principal axis system. Pa, Pb, Pc are the components of the overall rotation angular momentum, P is the angular momentum conjugate to the internal rotation angle . {u,v} is the anti-commutator uv + vu. The product of the parameter and operator from a given row yields the term actually used in the vibration-rotation-torsion Hamiltonian, except for 𝐹, 𝜌 and A which occur in the Hamiltonian in the form 𝐹(𝑃 𝛼 -𝜌𝑃 𝑎 ) 2 + 𝐴𝑃 𝑎 2 , where F = ħ 2 /2rIα.

Statistical uncertainties are shown as one standard uncertainty in the last digits. b Fixed to the value obtained from XIAM fit. c Root-mean-square deviation of the fit. d Number of A and E species transitions as well as hyperfine components. The nuclear quadrupole coupling constants are defined in the way that they are by a factor of two greater compared to their definitions in the XIAM program.

Figure 1 .

 1 Figure 1. The molecular geometry of 2MP optimized at the MP2/cc-pVDZ level of theory. The atom numbering and the a and b inertial principal axis of inertia are given. The hydrogen atom H13 is located behind H12.

Figure 2 .

 2 Figure 2. A high resolution spectrum of the 414  303 A species transition of 2MP. The Doppler doublets are marked by brackets. The quantum numbers F'  F are given at the respective hyperfine component. For this spectrum, 153 free induction decays were co-added prior to Fourier transformation.

Figure 3 .

 3 Figure 3. Comparison of the V3 potential, the inertial defect Δc, and the 14 N coupling constant χcc of 2MP with those of other five-membered heterocycles. (1) Pyrrole, (2) Thiazole, (3) Oxazole, (4) isothiazole, (5) 2-methylpyrrole, (6) 2-methylthiazole, (7) 2-methyloxazole, (8) 4methylisothiazole.

Figure 4 .

 4 Figure 4. The π electron system in pyrrole and oxazole.

Table 1 .

 1 The rotational constants (in MHz), the angle between the inertial principal a axis and the internal rotor axis i (in degree), and the dipole moment components (in Debye) obtained by optimizations of the molecular geometry of 2MP at various levels of theory.

		A	B	C	(i,a) |µa| |µb|	|µc|
	MP2/6-311+G(d,p)	8536.0 3417.4 2478.4 2.82	1.16 1.72 0.00
	MP2/6-311++G(d,p)	8533.9 3419.1 2479.1 2.80	1.16 1.71 0.00
	B3LYP-D3/6-311+G(d,p) 8594.5 3427.0 2488.1 2.87	1.09 1.67 0.00
	B3LYP-D3/6-311++G(d,p) 8595.3 3427.0 2488.1 2.86	1.09 1.66 0.00
	MP2/cc-pVDZ	8462.7 3398.5 2462.7 2.75	1.07 1.79 0.00
	MP2/cc-pVTZ	8607.6 3446.9 2499.5 2.77	1.08 1.73 0.00
	B3LYP-D3/ cc-pVDZ	8535.3 3415.7 2477.7 2.80	1.03 1.79 0.00
	B3LYP-D3/ cc-pVTZ	8639.7 3444.5 2500.9 2.84	1.02 1.69 0.00
	CCSD/6-311++G(d,p)	8549.4 3413.6 2477.6 2.93	1.13 1.69 0.00
	Experimental	8559.0 3432.5 2488.9 2.00

Table 2 .

 2 Molecular parameters of 2MP in the inertial principal axis system obtained from fits with XIAM and BELGI-Cs-hyperfine.

	Par. a	Unit	Fit XIAM	Fit BELGI b	ab initio c
	A	MHz	8558.954(44)	8569.751(34)	8462.7
	B	MHz	3432.5127(87	3432.832(38)	3398.5
	C	MHz	) 2488.8717(87	2489.1935(69)	2462.7
	J	kHz	) 0.2354(19)	0.2391 (11)	0.2236
	JK	kHz	1.397(10)		1.4044
	K	kHz	0.790(30)		0.5694
	J	kHz	0.06467(77)		0.0618
	K	kHz	0.401(18)		0.4222
	Fo	GHz	158 d		158.061
	F	GHz	167.0422 e	167.0422 f
	V3	cm -1	279.7183(26)	278.9946(13)	255.24
	𝜌		0.0541 e 0.0536021(93)
	Dpi2J	kHz	13.12(92)	)
	Dpi2K	MHz	1.1163(44)
	aa	MHz	1.3345(20)	1.3342(11)	1.331
	bb-cc	MHz	4.3599(36)	1.3342(11)?? 4.3600(33)	4.661
	(i,a)	°	2.002(46)	4.3600(33) 2.050(24)	2.75
	(i,b)	°	87.998(46)	87.950(24)	87.25
	(i,c)	°	90.0 g	90.0 g	90
	rms h	kHz	5.6	3.1
	NA/NE/Nq i		62/67/359	62/67/359

a All parameters refer to the inertial principal axis system. Statistical uncertainties are given as one standard uncertainty in the last digit. Watson's A reduction and I r representation were used. b Obtained by transformation from the rho axis system to the principal axis system. c Calculated at the MP2/cc-pVDZ level. d Fixed to the calculated value. e Derived parameter. f Fixed to the value of Fit XIAM. g Fixed due to symmetry. h Root-mean-square deviation of the fit. i Number of A and E species transitions as well as number of the hyperfine components.

Table 3 .

 3 Spectroscopic constants of 2MP in the rho axis system obtained using the program BELGI-Cs-hyperfine.

	Par. a	Unit	Value	Operator
	A	MHz	8568.696(23)	Pa 2
	B	MHz	3433.887(29)	Pb 2
	C	MHz	2489.1935(69)	Pc 2
	Dab	MHz	73.64(87)	{Pa,Pb}
	ΔJ	kHz	0.2391 (11)	-P 4
	ΔK	kHz	0.736(17)	-Pa 4
	ΔJK	kHz	1.3174 (56)	-P 2 Pa 2
	δJ	kHz	0.06585(43)	-2P 2 (Pa 2 -Pc 2 )
	δK	kHz	1.000(10)	-{Pa 2 ,(Pa 2 -Pc 2 )}
	χaa	MHz	2.6683(22)
	χbb	MHz	3.0258(22)
	V3	cm -1	278.9946(13)	(1/2)(1-cos 3)
	ρ	unitless	0.0536021(93)	PaP
	F	cm -1	5.57193 b	(P-ρPa) 2
	Fv	MHz	-0.920(61)	(1-cos 3)P 2
	rms c	kHz	3.1
	NA/NE/Nq d		62/67/359

Acknowledgement

I.K., H.V.L.N., and T.N. thank the DIM Qi2 for supporting the organization of the Journées de Spectroscopie Moléculaire (JSM) in Créteil where T.N. presented a poster with the results. C.D. thanks the DIM Qi2 for supporting her trip to the JSM.

Funding T. N. thanks the Doctoral School of Environmental Science of Île-de-France (DS 129) for a Ph.D grant. Simulations were performed with computing resources granted by RWTH Aachen University under project rwth0369. W.S. thanks the Université Paris-Est for an invited researcher grant which enabled him to work at the Université Paris-Est Créteil. This work was supported by the Agence Nationale de la Recherche ANR (project ID ANR-18-CE29-0011).


Jean-Max Dutertre
email: dutertre@emse.fr

Alexandre Menu
email: alexandre.menu@emse.fr

Olivier Potin
email: olivier.potin@emse.fr

Jean-Baptiste Rigaud
email: rigaud@emse.fr

Jean-Luc Danger
email: jean-luc.danger@telecom-paris.fr

Experimental Analysis of the Electromagnetic Instruction Skip Fault Model and Consequences for Software Countermeasures ⋆

Keywords:

A C T

Microcontrollers storing valuable data or using security functions are vulnerable to fault injection attacks. Among the various types of faults, instruction skips induced at runtime proved to be effective against identification routines or encryption algorithms. Until recently, most research works assessed a fault model that consists in a single instruction skip, i.e. the ability to prevent one chosen instruction in a program from being executed. We question this fault model for EM fault injection on experimental basis and report the possibility to induce several consecutive instructions skips. Such an extended fault model proved to be effective against a duplication-based software countermeasure as our experiments revealed.

Introduction

Hardware attacks take advantage of the physical implementation of an electronic device to overcome its security features. To this purpose, either passive side channel techniques or active fault injection techniques can be used. The former is out of the scope of this article. Fault injection techniques aims to force the device out of its specification by altering its environmental conditions [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF] (e.g. its voltage, temperature, frequency, etc.). An attacker that successfully induces an erroneous behavior refers to it as an injected fault. These faults can then be used as an attack primitive to extract a cryptographic key [START_REF] Boneh | On the importance of checking cryptographic protocols for faults[END_REF] or provide an unauthorized access to some of the target functionalities [START_REF] Dureuil | FISSC: A fault injection and simulation secure collection[END_REF]. The set of properties of a fault induced by an electromagnetic (EM) perturbation (or by any other fault injection means) is referred to as a fault model (FM). It is often linked to a given attack scheme and expressed as an ability to meet requirements in terms of synchronization with the target activity and extension of the induced fault (e.g. the FM of the well-known Piret fault attack (FA) [START_REF] Piret | A differential fault attack technique against SPN structures, with application to the AES and Khazad[END_REF] requires to fault one byte of the AES algorithm calculations before its last MixColumn transformation).

Among fault injection (FI) techniques, laser FI and EM fault injection (EMFI) achieve the best performances [START_REF] Dutertre | Laser fault injection at the CMOS 28 nm technology node: an analysis of the fault model[END_REF][START_REF] Buchner | Pulsed-laser testing for single-event effects investigations[END_REF][START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of AES[END_REF]. Laser is probably the most expensive FI means, however it makes it possible to inject faults with high accuracy even at advanced technology nodes [START_REF] Dutertre | Laser fault injection at the CMOS 28 nm technology node: an analysis of the fault model[END_REF]. It is accurate both in terms of timing (faults may be injected with laser pulses as short as a few picoseconds [START_REF] Lacruche | Laser fault injection into SRAM cells: Picosecond versus nanosecond pulses[END_REF]) and in terms of location (its effect is mainly limited to the logic gates located within its spot size which may be as low as a few micrometers [START_REF] Buchner | Pulsed-laser testing for single-event effects investigations[END_REF]). EMFI on the other hand does not require a direct access to the die, the clock, or the power supply of the target, while enabling an attacker to fault micro-architectural features [START_REF] Rivière | High precision fault attacks on the instruction cache of ARMv7-M architectures[END_REF]. As an operational setup can be build for less than a thousand dollars [START_REF] Cui | BADFET: Defeating modern secure boot using second-order pulsed electromagnetic fault injection[END_REF], EMFI is often considered a good compromise between price and locality.

In this work, we report our analysis of the EM-induced instruction skip FM. This FM relates to how a given instruction of a microcontroller program may be skipped (i.e. not executed) at runtime. Several works already described this FM and assessed the possibility of EM-induced single instruction skips [START_REF] Beckers | Characterization of EM faults on ATmega328P[END_REF][START_REF] Moro | Electromagnetic fault injection: Towards a fault model on a 32bit microcontroller[END_REF][START_REF] Moro | Formal verification of a software countermeasure against instruction skip attacks[END_REF][START_REF] Moro | Experimental evaluation of two software countermeasures against fault attacks[END_REF]. The assessment of FMs on experimental grounds is of high interest regarding how FIs countermeasures (CMs) are designed and tailored. As a matter of example, the authors of [START_REF] Moro | Experimental evaluation of two software countermeasures against fault attacks[END_REF] discussed two CMs based on instruction redundancy designed on the assumption that an attacker is only able to induce single instruction skips. Would this assumption be proved wrong, their CMs would be vulnerable.

Our experiments extend further this FM by reporting the feasibility of inducing several successive instruction skips by EM perturbation.

Our contributions are as follows:

• We achieve to skip, with a perfect reproducibility, several consecutive fetch operation with a single EM perturbation, controling both the timing and the number of the affected instructions,

• We highlight the influence on the observed fault model of the width of the voltage pulse inducing the EM perturbation,

• We demonstrate practical applications on an 8-bit microcontroller, bypassing several software CM. We were indeed able to defeat an instruction duplication-based CM (similar to that described in [START_REF] Moro | Experimental evaluation of two software countermeasures against fault attacks[END_REF]).

This article is organized as follows. Section 2 discusses the state-of-the-art of instruction skips and introduces the aim of our work. Our experimental setup and settings are described in section 3. Section 4 reports the obtained results. Section 5 describes how the observed extended FM is able to defeat a software countermeasure based on instruction duplication. Then, the obtained FM is discussed in section 6. The last section concludes the paper.

The EM-induced instruction skip fault model

Our first research objective was to reproduce EM-induced instruction skips on a microcontroller and to study the main characteristics of its FM: accuracy (i.e. ability to choose the skipped instruction), extent (i.e. number of skipped instructions), success rate, etc. Our aim was also to assess if the multiple instructions skip fault model was achievable on a simple target (one that has no cache or complex pipeline) or whether it relies only on specific micro-architectural features. This question is of interest, as CMs based on a too narrow FM may reveal vulnerabilities at test time.

Fault model definition

A fault model refers indisctintly either to the abstract properties of a fault or to the main properties of a FA scheme. These are often expressed in terms of extension (e.g. bit, byte, nibble) and synchronization with the execution of the program. However, a fault and a FA scheme are most conveniently described at two different level of abstraction, i.e. the physical layer and the logical layer. The authors of [START_REF] Dutertre | Laser fault injection at the CMOS 28 nm technology node: an analysis of the fault model[END_REF] follow the former approach and describe laser-induced bitset and bit-reset faults at the transistor and gate level. However, this approach is extremely difficult and time consuming if the attacker has a limited insight on the device internals. The authors of [START_REF] Piret | A differential fault attack technique against SPN structures, with application to the AES and Khazad[END_REF] follow the latter approach and describe a mono-byte FM to corrupt the AES algorithm calculations before its last MixColumn transformation. However, this approach faces practical limitations in understanding the underlying fault mechanism because of the complex interaction between the physical and the logical layer of an electronic device.

In our approach, we considered the instruction set architecture (ISA) which is a natural interface between the physical and the logical layer. Previous works highlighted that the characterization of FM at the level of the ISA covers a wide range of practical faults [START_REF] Moro | Experimental evaluation of two software countermeasures against fault attacks[END_REF][START_REF] Balasch | An in-depth and black-box characterization of the effects of clock glitches on 8-bit MCUs, in: Fault Diagnosis and Tolerance in Cryptography[END_REF]. In this article, we followed this approach and analyzed the behavior of a microcontroller target at the ISA level in order to assess and study EM-induced instruction skips.

Instruction skip fault model

An instruction skip is a fault that results in skipping, meaning not executing, one instruction of a program at runtime. There is to date very few explanations of how an instruction skip is induced at gate level, with the notable exception of [START_REF] Balasch | An in-depth and black-box characterization of the effects of clock glitches on 8-bit MCUs, in: Fault Diagnosis and Tolerance in Cryptography[END_REF]. It describes how progressively increasing the stress applied by a clock glitch to a microcontroller induces an increasing number of bit-reset faults into the opcode of an instruction. It results in (1) instruction modification at low stress or (2) in turning the instruction into an actual no operation instruction (nop) at high stress.

An instruction modification has the same effect as an instruction skip if the modified instruction has no effect on the context of the program. While this modification are the most frequent in practice [START_REF] Cojocar | Instruction duplication: Leaky and not too fault-tolerant![END_REF], we focused our experiments toward achieving instruction skips by turning the target instructions into nop instructions.

Several works studied the EM-induced instruction skip FM. Most of them assessed single instruction skips, in the same 8-bit microcontroller as the one studied in this work [START_REF] Beckers | Characterization of EM faults on ATmega328P[END_REF], or in a 32-bit microcontroller [START_REF] Moro | Experimental evaluation of two software countermeasures against fault attacks[END_REF].

Several works also studied the laser-induced instruction skip FM. In [START_REF] Breier | Laser profiling for the back-side fault attacks: With a practical laser skip instruction attack on AES[END_REF], the authors obtained single instruction skips with high accuracy and high success rate. Still on the same target, [START_REF] Kumar | An in-depth and black-box characterization of the effects of laser pulses on ATmega328P[END_REF] reports single instruction skips based on resetting one or two bits of the targeted instruction opcode. The authors of [START_REF] Trichina | Multi fault laser attacks on protected CRT-RSA, in: Fault Diagnosis and Tolerance in Cryptography[END_REF] induced single instruction skips on a more complex 32-bit cortex-M3 microcontroller. They were able to inject two single instruction skips distant from 58 ms to defeat a protected CRT-RSA algorithm.

While the instruction skip FM alone does not encompass the complexity of practical faults [START_REF] Cojocar | Instruction duplication: Leaky and not too fault-tolerant![END_REF], skipping multiple instructions was, until recently, a theoretical consideration.

Multiple instructions skip fault model

The state-of-the-art in laser-induced instruction skip reports that the number of successive instructions that could be skipped was not limited in the same 8-bit microcontroller as the one studied in this work [START_REF] Dutertre | Experimental analysis of the laser-induced instruction skip fault model[END_REF]. Moreover, the injection can be syncronized with the program execution and the duration of the laser pulse is linearly correlated with the number of consecutive instructions which are skipped. This is a strong FM as entire sections of code can be selectively erased by an attacker. To the best of our knowledge, the only works reporting several successive instructions skips with other injection techniques are [START_REF] Rivière | High precision fault attacks on the instruction cache of ARMv7-M architectures[END_REF], [START_REF] Yuce | Software fault resistance is futile: Effective single-glitch attacks[END_REF] and [START_REF] Elmohr | Embedded Systems Security: On EM Fault Injection on RISC-V and BR/TBR PUF Design on FPGA[END_REF][START_REF] Elmohr | Em fault injection on arm and risc-v[END_REF]. The authors of [START_REF] Rivière | High precision fault attacks on the instruction cache of ARMv7-M architectures[END_REF] assessed four successive EM-induced skips of instructions stored in the instruction cache of an ARMv7 microcontroller. The authors of [START_REF] Yuce | Software fault resistance is futile: Effective single-glitch attacks[END_REF] succeeded in faulting instructions stored in the pipeline of a FPGA implementation of the LEON7 core with a clock glitch. More recently, [START_REF] Elmohr | Embedded Systems Security: On EM Fault Injection on RISC-V and BR/TBR PUF Design on FPGA[END_REF][START_REF] Elmohr | Em fault injection on arm and risc-v[END_REF] reports EM-induced skips of up to six consecutive instructions with a low success rate in a modern RISC-V microcontroller. However, they did not provide an understanding of the micro-architectural effects.

Based on previous experiments and taking into account the state-of-the-art we described, we focused our experiments toward achieving instruction skips by turning the targeted instructions into nop instructions. Our experiments were carried out with the same 8-bit microcontroller studied by [START_REF] Balasch | An in-depth and black-box characterization of the effects of clock glitches on 8-bit MCUs, in: Fault Diagnosis and Tolerance in Cryptography[END_REF][START_REF] Beckers | Characterization of EM faults on ATmega328P[END_REF][START_REF] Breier | Laser profiling for the back-side fault attacks: With a practical laser skip instruction attack on AES[END_REF][START_REF] Kumar | An in-depth and black-box characterization of the effects of laser pulses on ATmega328P[END_REF], so that our results can be easily compared. Moreover, this microcontroller has a very simple 2-stage pipelined architecture and no caches, which is easy to analyse in the absence of unwanted architectural effects. The results of this research should give a better insight on the instruction skip FM when induced through EMFI and also provide a comparison basis with laser injection.

Experimental settings

EM injection bench

The EM pulse injection setup we used is similar to the one described in [START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of AES[END_REF], it consists in the following elements:

• a voltage pulse generator,

• an injection probe,

• a XYZ positioning table ,   • an oscilloscope,

• a target (described in subsection 3.2),

• a control PC interfacing the different elements of the bench and running the test series.

The EM disturbance that induces a fault is generated thanks to the voltage pulse generator: it delivers a square voltage pulse with a transition time of 2 ns (for the first edge of the pulse, the second edge has a transition time of 5 ns), a maximum amplitude of ±400 V, and a width in the 6 -100 ns range. The voltage pulse edges are converted into current variations in a coil wrapped arround the tip of a handcrafted injection probe. The coil is made of six turns of copper wire around a ferrite core which diameter is ∼ 500 m. The swift current variation induces an EM perturbation at the root cause of the injected faults. A trigger signal generated by the device under test synchronizes the voltage pulse with the operations of the microcontroller target (the corresponding jitter was measured below 0.5 ns). Listing 1: Test code -Instruction skip analysis.

Test chip

We chose a simple target for the purpose of being able to analyse easily its responses to fault injection: an 8-bit nonsecure ATmega328P microcontroller designed in the CMOS 0.35 old technology. It has 2 kB RAM, 32 kB Flash and 1 kB EEPROM memories; a Harvard architecture with a 2stage fetch-execute pipeline. It runs at 16 MHz and has 32 general purpose registers (registers r16 to r25 were used during our experiments). Figure 1 gives a front view of the test chip with its Flash, RAM and EEPROM memories highlighted in red. The laser sensitive area that makes it possible to induce an instruction skip is highlighted by a small deep blue star (slightly outside the Flash memory at its left), it is in the order of a few micrometers [START_REF] Dutertre | Experimental analysis of the laser-induced instruction skip fault model[END_REF]. The EM sensitive area, which is convenient for inducing instruction skips, is larger (see experimental results in section 4), it is in the order of a hundred of micrometers. It is located in the bottom-right part of the Flash memory and highlighted by a greater deep blue star in Figure 1. As the strength of the magnetic field generated by the coil strongly decreases with the distance from the injection probe, it was placed close to the target's silicon die (∼1 mm). To this end, the package of the target device was open on its top by chemical etching.

Test codes

We studied the effect of EM-induced faults on dedicated test codes mostly written in assembly langage (see Listing 1). Our intent was to induce and analyze instruction skips by examining their effect.

For each test series, we used two trigger signals, both produced by the test chip (as denoted in Listing 1), for synchronization purposes:

• a synchronization trigger signal to accommodate for the latency of our EM injection setup (about ∼ 300 ns),

• a core trigger signal to synchronize the actual EM perturbation (thanks to an image of the transmitted perturbation, see Fig. 2 as an example) with the part of the assembly code of interest. Listing 1 provides a description of the test code we used to tune our settings in order to induce instruction skips. The core part of the test code (delimited by the core trigger signal: lines 5 and 16 in Listing 1) is a series of ten ld rX,Z+ instructions. Each one corresponds to a load in a destination register rX of a byte value stored in RAM memory at address Z with a post increment of Z. Prior to that, the ten destination registers, r16 to r25, are initialized at 0x55 and an array of ten byte values 0x39 to 0x30 are stored in RAM with Z storing the address of its first element. Registers r16 to r25 are read back after the synchronization trigger has been cleared. The two top signals in Figure 2 are the synchronization and core triggers, the bottom blue signal is an approximated image of the EM perturbation (obtained by wrapping the wire end of a coaxial line around the wire conducting the voltage pulse to the injection probe). The top part of Table 1 displays the values read back from r16 to r25 for a fault-free execution.

As an example, the right column of the test code core part in listing 1 (lines 6 to 15) displays the effect of an EM perturbation turning the ld instruction of line 9 into a nop instruction. The effect of such an EM-induced instruction skip is highlighted in the bottom part of table 1: the initialization value 0x55 is read back from r19 (in red), and because an increment of address Z is missing, all the values read back from r20 to r25 are shifted (in black).

Experimental results

Finding the Points-of-Interest

EMFI has a local effect [START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of AES[END_REF][START_REF] Zussa | Efficiency of a glitch detector against electromagnetic fault injection[END_REF] that may be classified in between the strongly local effect of laser FI [START_REF] Dutertre | Experimental analysis of the laser-induced instruction skip fault model[END_REF] and the global effect of other FI means (such as clock and power glitches). As a result, the position of the injection probe w.r.t. the target has a significant effect on the FI process: a fault may be injected or not, different FMs may be obtained [START_REF] Beckers | Characterization of EM faults on ATmega328P[END_REF][START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of AES[END_REF][START_REF] Moro | Electromagnetic fault injection: Towards a fault model on a 32bit microcontroller[END_REF]. Our research objective was to induce instruction skips similar to that described in [START_REF] Dutertre | Experimental analysis of the laser-induced instruction skip fault model[END_REF] for laser FI. This implied to test a large amount of settings: injection probe location, synchronization with the test code, and voltage pulse parameters. Because this search space has several dimensions, this process could be very time consuming, especially regarding the XY position of the injection probe (we refer the reader to [START_REF] Menu | Precise spatio-temporal electromagnetic fault injections on data transfers[END_REF] for an illustration of the probe location effect; for the other parameters, previous work helped us to converge in a matter of a few hours). It took approximately a week to find the right settings allowing to induce an instruction skip (the injection probe location is shown in Figure 1).

Figure 2 exemplifies the kind of instruction skip that can be observed. It displays the trigger signals of the test code (two top waveforms) and an image of the EM perturbation (third waveform). The trigger signals are both drawn for a fault-free execution (in red, denoted as 'normal operation') and for an EM-injection that induces an instruction skip of the ld instruction into register r19 (in blue). Because execution of a ld instruction takes two clock periods contrary to that of a nop instruction which takes one clock period, each consecutive instructions skip shall correspond to a reduction of the test code execution time of one clock period. This phenomenon is displayed in Figure 2. The test code execution time is shortened as well as the duration of the trigger signals: the faulted execution triggers in blue last one clock period less than the fault free execution. This experiment was performed with a voltage pulse amplitude set to -200 V and a width of 100 ns (the values read back from the registers were actually those mentioned in the bottom part of Table 1). For these settings a 100 % success rate 1 was achieved (calculated from 1,000 tests).

It assessed the ability of EMFI to induce an instruction skip in a running microcontroller. These settings (in particular the injection probe location) served as a basis for the experiments we carried out to analyze further the EM instruction skip FM (as reported in the following subsections).

EM-induced instruction skip, test of accuracy

In terms of accuracy, we tested whether the single instruction skip fault model was still valid while targeting the ld instruction of the other test registers. Our aim was to assess an attacker ability to target an arbitrary instruction in a program. To do so, we sweeped the time delay between the EM-perturbation and the synchronization trigger signal to span the whole test code. Figure 3 reports the obtained results. It displays the skipped registers (positions 1 to 10 correspond to registers r19 to r25) as a function of the delay. It reveals that an attacker is able to inject EM-induced single instruction skips into a running microcontroller with high timing accuracy. For each instruction, we were indeed able to find an injection timing leading to a 100 % success rate (calculated for 100 experiments for each).

EM-induced multiple instructions skip

Some experimental results (not reported here) suggested that several consecutive instructions may be skipped simultaneously. In order to verify this assumption, we again carried out our experiments with a voltage pulse amplitude increased to -250 V. The corresponding results are displayed in Figure 4. It shows that this increase makes it possible to skip two consecutive instructions with a still high timing accuracy (i.e. the ability to choose the two instructions that are skipped). As an illustration (denoted in blue in Figure 4), the two successive load instructions into r19 and r20 are skipped for a trigger to shot delay of 980 ns. A further increase of the voltage pulse amplitude to -400 V did not change the number of skips (similar results were obtained using positive voltage pulses). Through further testing, we discovered that tuning the width of the voltage pulse (from 10 ns to 100 ns) had an effect on the number of achievable successive skips. The use of different values of the voltage pulse width led to different number of skips as reported in Figure 5. For the same settings (location, voltage amplitude, and delay) but different pulse widths, up to four successive instructions skips were obtained (for a width between 20 ns and 35 ns). The tuning of the width also made it possible to choose precisely the number of skips: 2, 3 or 4. With other settings (location and voltage amplitude), we ascertained the ability to increase to six the number of successive instructions skipped. This ability to skip up to six instructions in a row strengthens the threat associated to the EMFI fault model. It is acknowledged in section 5 which describes how an instruction duplicationbased software countermeasure may be defeated.

r19 & r20

EM-induced multiple but separate instruction skips

Voltage pulse generators generally have a repetition rate in the kHz range2 . Hence, there will be a latency in the microsecond range between two instruction skips, which is a long time at the scale of a microcontroller program. It may be used for designing a software countermeasure based on the assumption that an attacker would not be able to skip two instructions that are placed sufficiently close in a program (i.e. their execution times being in a time interval smaller than one microsecond) but not too close in order to avoid the risk of multiple instructions skip as described in subsection 4.3. It is a potential limitation of the EMFI potency (contrarily to laser FI that do not suffer from this limitation [START_REF] Dutertre | Experimental analysis of the laser-induced instruction skip fault model[END_REF]).

However, some voltage pulse generators have a double pulse generation capability: they are able to output two voltage pulses with a latency in the nanosecond range. It is the case for our voltage pulse generator which is able to output r19 r22

Figure 6: EM-induced instruction skips: inducing two separate instruction skips using two voltage pulses, ld instructions into r19 and r22 were skipped (from top to bottom, synchronization trigger, core trigger, and approximated images of the EM perturbations). a second voltage pulse with a minimal delay of 150 ns after the first one. The characteristics of the second voltage pulse (duration and voltage amplitude, see subsection 3.1) can be set independently from that of the first pulse. It makes it possible to skip two separate instructions, with a low latency, by exposing a target to two close EM perturbations.

We carried out these tests on the test code given in Listing 1. Both voltage pulses had the same duration and voltage amplitude settings: 10 ns and 150 V respectively. The first EM perturbation aimed at the ld r17, Z+ instruction (line 7 of Listing 1) which was successfully skipped. The second EM perturbation was outputted with a delay (measured from the onset of the first perturbation) varying between 150 ns (its minimal achievable value) and 1,000 ns with a time increment of 5 ns (the duration of a ld instruction). Table 2 reports timing delays that made it possible to skip the ld rx, Z+ instructions (line 9 to 15 of Listing 1) into registers r19 to r25 with a 100 % success rate. These delays are spaced out by a 125 ns time interval which is logically equal to the 125 ns execution time of a ld instruction (two clock periods).

The first EM perturbation induced a skip of the ld r17, Z+ instruction; due to the minimal 150 ns delay between the two voltage pulses it was not possible to skip the following ld r18, Z+ instruction. However, the next following instruction (a ld into r19) was successfully skipped for a 225 ns delay. These results underline that EMFI is able to target simultaneously separate but close instructions. Figure 6 is an illustration of this property for a time delay of 600 ns between the two EM perturbations: the ld instructions into registers r19 and r22 were skipped. In addition, because both voltage pulses (at the root cause of the EM perturbations) can be set independently with their full duration and amplitude parameter ranges, it is possible to induce two series of several successive instruction skips (as reported in subsection 4.3) while not disturbing the instructions executed in between. This provides a potential attacker with a lot of flexibility.

PIN bypass with EM perturbation

In order to improve our assessment of the threat raised by EM-induced instruction skips, we targeted a 4-digit PIN verification algorithm (denoted verifyPIN hereafter, and described in [START_REF] Dureuil | FISSC: A fault injection and simulation secure collection[END_REF]). It is protected against brute force attacks (i.e. attacks that consist in testing all existing PIN codes) thanks to a PIN trial counter (denoted by g_ptc hereafter). The value of this counter is tested before calling the PIN verification routine: byteArrayCompare (this code routine is in charge of comparing the user PIN to a reference PIN). g_ptc is decremented and memorized before each verification. It is initialized at 3 (and restored to this value after a successful identification). If g_ptc reaches zero, a conditional if statement denies the entry into the byteArrayCompare routine. As a result, the verification systematically fails. A part of the (simplified) pseudo-code of this algorithm is shown in Listing 2, where BOOL_TRUE and BOOL_FALSE are respectively the true and false boolean values, and g_auth a variable indicating the user status (g_auth set to BOOL_TRUE indicates that the user has been successfully authenticated). The g_auth and g_ptc variables are updated if the verification routine byteArrayCompare succeeds. This routine takes two arguments: g_userPin and g_cardPin (the addresses of the user pin and of the secret pin respectively). [11] describes several instruction skip attacks that may result in a successful PIN bypass: most of them targeting one or a few successive code instructions. We chose to implement that which consists in skipping the verification of the trial counter (line 4 in Listing 2), allowing us to perform a bruteforce attack on the four digits of the secret PIN code.

Figure 7 displays the trigger signals highlighting the execution of the verifyPIN algorithm in red, and of the byteArray -Compare routine in blue. When g_ptc equals zero (Figure 7.a), the access to the byteArrayCompare routine is denied (the corresponding trigger stays low). picted in purple) that forces the entry into the byteArrayCompare routine: the PIN code entered by the attacker is checked against the reference PIN despite the exhaustion of the PIN counter. We were able to find settings that achieve a 100% success rate and then to brute force the verifyPIN algorithm.

Test of the extended EM fault model on a duplication-based software countermeasure

The extended EMFI fault model we ascertained in section 4 questions the relevance of countermeasures based on the assumption that EMFI attacks are limited to single instruction skips. This section describes the software countermeasure using instruction redundancy we used to harden a PIN code verification algorithm against EMFI. It also reports its efficiency when tested against multiple instructions skip EMFI.

Instruction duplication-based software countermeasure

Moro et al. [START_REF] Moro | Formal verification of a software countermeasure against instruction skip attacks[END_REF][START_REF] Moro | Experimental evaluation of two software countermeasures against fault attacks[END_REF] introduced a software countermeasure against EMFI based on the assumption that an attacker can only induce a single instruction skip. It consists in duplicating the sensitive instructions of a program. Applying a software countermeasure to a program requires that its functionality remains identical when it is under attack and when it runs undisturbed. This requirement is fulfilled when duplicating idempotent instructions (i.e. instructions that can be executed several times without changing the result obtained by its first execution). Comparison and branch instructions are idempotent and can be duplicated easily, which is of interest to hardened the execution flow of a program against fault injection attacks. The hardening of a non-idempotent instruction requires to substitute an equivalent idempotent instruction or (if possible) to rewrite part of the code with idempotent instructions [START_REF] Moro | Formal verification of a software countermeasure against instruction skip attacks[END_REF][START_REF] Moro | Experimental evaluation of two software countermeasures against fault attacks[END_REF]. This software countermeasure comes at a price, it involves an overhead both in execution time and in code size that are more than doubled.

Instruction duplication provides an effective hardening against the single instruction skip fault model: the code functionality is left unchanged by any single instruction skip be-cause its duplicated twin is still executed. As mentioned previously, it is well suited for hardening the conditional branches of a program (e.g. as the PIN code trial counter test bypassed through EMFI reported in figure 7). We applied this countermeasure methodology to our PIN verification algorithm and tested its efficiency against the extended EMFI fault model we reported in section 4.

PIN verification algorithm hardened against single instruction skip attacks

Listing 3 provides the assembler language version of the PIN code verification algorithm (denoted verifyPINasm()); several instructions were omitted for concision (they are marked by left-aligned comments, while tabulated comments refer to the following block of instructions). This verifyPINasm() routine is the basis we used to write a duplication-based hardened code: verifyPINhardened(). For the sake of concision, we provide in Listing 4 three subparts of this code corresponding to three attack paths an attacker may use. Hereafter, we refer to these attack paths by: 1. Attack 1: the brute force attack reported in subsection 4.5, it consist in skipping the conditional branch instruction brge label_end_verifyPINasm of line 9 in Listing 3. 2. Attack 2: forcing authentication with an incorrect PIN code by skipping the brne .+6 instruction of line 24 in Listing 3. As a result, authentication is granted to the attacker (ldi r16, 0xAA) despite a negative comparison of the user entered PIN against the reference PIN. 3. Attack 3: implementing a brute force attack by skipping the sts (g_ptc), r20 instruction of line 31 in Listing 3 which is in charge of storing the decremented PIN trial counter after an incorrect PIN code has been tested.

The first hardened code part (lines 3 to 6 of Listing 4) consists in duplicating the test of g_ptc (stored in registers r20 and r21) and the corresponding branch instructions (taken when g_ptc equals zero). It provides a countermeasure against a brute force attack (attack 1) due to the single skip of any of these instructions. The second hardened code part (lines 10 to 13 of Listing 4) provides a hardening against attack 2 by duplicating the test of the diff variable (r17) and the associated branch instructions.

The third hardened code part (lines 16 and 17 of Listing 4) consists in a simple duplication of the store instruction of g_ptc, this is a countermeasure against attack 3. This third countermeasure uses two identical duplicated instructions that are adjacent. It is immune to a single instruction skip, however it is ineffective against a double instruction skip similar to those we report in subsection 4.3. The two other countermeasures combines an interleaving of the different duplicated instructions. This provides the same protection against a single instruction skip and also provides immunity against double instruction skips. A successful attack would require to skip three successive instructions (e.g. those of lines 4 to 6 in Listing 4) which may be considered more difficult to achieve than a double instruction skip.

Attacking an instruction duplication-based software CM, experimental results

The extended EMFI fault model, that makes it possible to skip several successive instructions, was then experimentally tested against our duplication-based hardened PIN verification algorithm. We used the same EMFI test bench (de- With a voltage pulse width of 100 ns and a 100 V amplitude (well suited for inducing single instruction skips), we were able to implement attacks 1, 2, and 3, with a 100 % success rate on the unprotected verifyPINasm() code (for delays set respectively to 1210 ns, 4270 ns, and 4530 ns). Using the same voltage pulse width and amplitude, we were unable to succeed in implementing the same three attacks on the hardened verifyPINhardened() code. This proves the efficiency of instruction duplication against single instruction skips. However, by using pulse settings producing multiple skips, we were able to carry out the attacks successfully as reported in the following subsections.

Implementing attack 1 with multiple instructions skip

The voltage pulse width and amplitude were set to 20 ns and 200 V to induce a multiple instructions skip with a single EM perturbation. During our experiments, we were able to force repeatedly the entry into the PIN comparison loop of verifyPINhardened() despite a g_ptc counter equal to zero. However, we were unable to find an EMFI settings that would assure a 100 % repetition rate (it was rather in the 40-60 % success rate depending on the test series and settings). Nonetheless, such a 100 % success rate was achieved when considering a set of several tests performed with a delay varying between 1450 ns and 1510 ns with a time step of 10 ns. This is a suitable strategy to perform a brute force attack (it involves more tests but still guarantees the success of the first attack).

Implementing attack 2 and 3 with multiple instruction skips

Attack 2 and 3 proved even more difficult to succeed in. Despite the fact that we were indeed several times successful in performing these attacks (for delays in the 4650-4710 ns and 4840-4970 ns ranges respectively), we were unable to find settings associated to a significant success rate. We also found no significant difference in the success rates of attacks 2 and 3 despite the fact that involved respectively the skip of 3 and 2 successive instructions.

Considering attacks 2 and 3 that both require that the PIN trial counter is not exhausted (we regularly reset g_ptc to 3 during our experiments for convenience purposes), the implementation of both attacks shall be considered unsuccessful. On the other hand, the countermeasure shall be considered broken (regarding attack 2 and 3) because several attacks were successful (in addition, progress in EMFI settings may provide a significant success rate in the future).

Discussion

EM-induced instruction skip fault model

The experimental results reported in sections 4 and 5 demonstrate that a very high accuracy is achievable with EMinduced instruction skips: we were able to choose and skip a single instruction of a test sequence with a 100 % success rate. Moreover, we were able to increase its extent to skip six successive instructions which adds to its strengh (unlike [START_REF] Rivière | High precision fault attacks on the instruction cache of ARMv7-M architectures[END_REF][START_REF] Yuce | Software fault resistance is futile: Effective single-glitch attacks[END_REF], the ability to skip consecutive instructions was not linked to the micro-architecture of the target). From an attacker perspective, this attack does not require any insight on the underlying micro-architecture, which makes it easily reproducible. This FM has been successfully applied to brute force a PIN verification algorithm. We demonstrate on a 8bit microcrontroller that several consecutive fetch operations can be skipped with a single EM pulse, extending the current FMs.

This fault model shares similarities with laser-induced instruction skips in terms of accuracy and repeatability under the same synchronization requirements. However, the number of consecutive instructions which can be skipped is limited with the EM injection technique, whereas an arbitrary number of instruction can be blinded with laser injection [START_REF] Dutertre | Experimental analysis of the laser-induced instruction skip fault model[END_REF]. This difference might be understood as a difference in the nature of the stress induced by laser and EM injection techniques. The former can be precisely tuned with the laser power and pulse duration, whereas the latter only occurs during the rising edge of the EM pulse. While software CMs against EM-injection may take advantage of this temporal limitation, the number of consecutive instructions which can be skipped might be higher than the number assessed in this article.

Finally, we underline the importance of synchronization of the EM injection with the target code to achieve the high success rate we report. We also refer the reader to [START_REF] Dutertre | Experimental analysis of the laser-induced instruction skip fault model[END_REF] for a discussion on how synchronization may be obtained.

Discussion of the EM-induced fault injection mechanism

Several physical mechanisms have been proposed to describe the faults induced by an EM pulse [START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of AES[END_REF][START_REF] Moro | Formal verification of a software countermeasure against instruction skip attacks[END_REF][START_REF] Ordas | Electromagnetic fault injection: the curse of flip-flops[END_REF]. The authors of [START_REF] Dehbaoui | Electromagnetic transient faults injection on a hardware and a software implementations of AES[END_REF] and [START_REF] Moro | Formal verification of a software countermeasure against instruction skip attacks[END_REF] highlighted the similarities between EM induced faults in an IC and faults that were obtained with the violation of timing constraints. A model of the glitch induced by an EM pulse on a power-ground network was later proposed in [START_REF] Dumont | Electromagnetic fault injection: how faults occur[END_REF]. The authors of [START_REF] Ordas | Electromagnetic fault injection: the curse of flip-flops[END_REF] suggested that glitching the set and reset circuitry corrupts the operation of Dflip-flop memory cells, thus explaining the specificity of the timing of EM injections. In the same time, the authors of [START_REF] Ghodrati | Inducing local timing fault through EM injec-tion[END_REF] measured and analyzed the effets of an EM pulse on the clock circuitry of a FPGA. The diversity of suggested hypothesis reflects the complexity of the analysis of EM physical effects.

In this article, we observed a non-linear correlation between the width of the EM pulse and the number of skipped instructions. This result shares some similarities with [START_REF] Zussa | Analysis of the fault injection mechanism related to negative and positive power supply glitches using an on-chip voltmeter[END_REF], where damped oscillation were obtained by glitching a FPGA power supply with a voltage pulse. The authors observed constructive and destructive interferences for various duration of the pulse. Moreover, positive and negative polarities of the voltage pulse were shown to have the same effects, as this is the case with our experiments. These elements support the hypothesis that we observed violation of timing constraints in our experiments (similarly to the timing constraint violations observed in [START_REF] Zussa | Analysis of the fault injection mechanism related to negative and positive power supply glitches using an on-chip voltmeter[END_REF]). In addition [START_REF] Elmohr | Em fault injection on arm and risc-v[END_REF] reports that EMFI sensitivity is higher at lower supply voltage or higher frequency of the target, which increases the propagation delays of its digital gates (a result we also observed on other targets). This is consistent with a fault injection mechanism related to timing constraint violations [START_REF] Zussa | Analysis of the fault injection mechanism related to negative and positive power supply glitches using an on-chip voltmeter[END_REF].

Conclusion

This research work assesses on experimental basis an extended fault model for EM-induced instruction skips. The main characteristics of this fault model are:

• its accuracy, or ability to choose the skipped instruction with a 100 % success rate provided that a precise synchronization is obtained,

• its extension, or ability to skip up to six successive instructions (without the help of any micro-architectural effect),

• its flexibility, with the ability to skip several separate instructions in a small time interval (using a voltage pulse generator able to output two close voltages pulses).

We also highlighted the influence of the width of the voltage pulse, which has been underestimated until now, in the properties of EM-induced faults.

Simply put, EMFI may offer an attacker the ability to erase a small part (or two small parts) made of several instructions of a microcontroller firmware at runtime. This extended capability was ascertained successfully against a software countermeasure based on instructions duplication.

Though, this EM fault model is not as threatening as the laser FM that offers the ability to erase several chosen parts of arbitrary length of a running program [START_REF] Dutertre | Experimental analysis of the laser-induced instruction skip fault model[END_REF]. It nonetheless extends the threat model that shall be considered when securing microcontrollers against FAs as EMFI is more common and affordable than laser FI.

Figure 1 :

 1 Figure 1: Frontside view of the ATmega328P test chip -Flash, RAM and EEPROM memories highlighted in red; fault sensitive areas for laser and EM injection highlighted resp. by a small and a greater deep blue stars.

1 # 2 # 3 # 16 # Clear core trigger 17 nop # 700 ns 18 # Clear synchronization trigger 19 #

 12316171819 Store 0x39 to 0x30 in RAM at address Z Initialize r16 to r25 at 0x55 read back r16 to r25

Figure 2 :

 2 Figure 2: EM-induced single instruction skip: effect on execution time, trigger waveforms modification due to EM injection (from top to bottom, synchronization trigger, core trigger, and approximated image of the EM perturbation).

Figure 3 :

 3 Figure 3: EM-induced single instruction skip: ability to choose the skipped instruction -Faulted registers as a function of EM injection time (ns) for a -200 V voltage amplitude and 100 ns pulse width.

Figure 4 :

 4 Figure 4: EM-induced instruction skip: ability to skip two consecutive instructions -Faulted registers as a function of EM injection time (ns) (-250 V voltage amplitude and 100 ns pulse width).

  Voltage pulse width [ns]

Figure 5 :

 5 Figure 5: EM-induced instruction skip: effect of the voltage pulse width -Number of EM-induced instruction skips as a function of the voltage pulse width (ns).

1 BOOL 9 }

 19 Listing 2: C code of the verifyPIN algorithm.

Figure 7 .

 7 b reports a successful EMFI attack (an image of the EM perturbation is de-EM-forced entry into the byteArrayCompare routine.

Figure 7 :

 7 Figure 7: Illustration of a PIN brute force bypass through EM-induced instruction skips.

Listing 3 :

 3 verifyPINasm() routine.

2 # 3 cp 8 # 9 #

 2389 test of g_ptc, hardening against attack 1 Test diff, if FALSE do not branch and set STATUS at TRUE

15 # 16 stsListing 4 :

 15164 Store g_ptc, hardening against attack 3 Subparts of the verifyPINhardened() routine using a countermeasure based on instruction duplication[START_REF] Moro | Formal verification of a software countermeasure against instruction skip attacks[END_REF]. scribed in subsection 3.1) but a different voltage generator. It has a tunable pulse duration range of 10-200 ns and a maximum voltage amplitude of ±200 V.

Table 1

 1 Registers

	Register	16	17	18	19	20	21	22	23	24	25
	Fault free 0x39 0x38 0x37 0x36 0x35 0x34 0x33 0x32 0x31 0x30
	Register	16	17	18	19	20	21	22	23	24	25
	Faulted	0x39 0x38 0x37 0x55 0x36 0x35 0x34 0x33 0x32 0x31

r16 to r25 read back values, for a fault free execution (top) and for an instruction skip (bottom).

Table 2

 2 Skip of two instructions: delay (in ns) between the two EM perturbations and reference of the second skipped instruction expressed as the load instruction destination register (r19 to r25).

	Delay [ns]	225 350 475 600 725 850 975
	Register #	19	20	21	22	23	24	25

it is calculated, for a given settings, as the ratio of the number of instruction skips to the number of experiments.

Our pulse generator has a 2 kHz repetition rate, other generators from established manufacturers may be slightly faster with repetition rates of 20 kHz[START_REF] Länger | IC EM pulse injection langer pulse[END_REF] or 1 MHz[START_REF] Riscure | EM-FI transient probe[END_REF].

Acknowledgment

This research has been partially supported by the European Commission under H2020 SPARTA (Grant Ag. 830892).

⋆ This research has been partially supported by the European Commission under H2020 SPARTA (Grant Agreement 830892).