Petra Björndal
email: petra.bjorndal@se.abb.com

Elina Eriksson

Henrik Artman
email: artman@kth.se

From Transactions to Relationships: Making Sense of User-Centered Perspectives in Large Technology-Intensive Companies

Keywords: User-centered design, Service design, Service development, Usability, Technology intensive companies

In this paper we analyze interviews from four technology-intensive companies, focused on service and service development. All companies have during the last two decades introduced interaction design units, and the corporations were selected due to their interest in also expanding the service share of their business. This service shift has been a top-down initiative. However in only two companies, the initiatives have led to the establishment of enterprise wide service development processes, and in the other two companies, the service development is more ad hoc. It is argued that even if interaction design has close theoretical relation to service design such combination has so far been limited. We discuss the shift from product to service view of the offerings within these companies, and relate this to user-centered perspectives. We argue there is a window of opportunity within technology-intensive and engineering focused industries to include user-centered design when formalizing service development.

Introduction

Today, technology-intensive product manufacturers go through a shift that addresses fundamental parts of their economy, when business models go from transaction based to relationship based. This transition process is called servitization and create organizational, structural as well as process challenges [START_REF] Oliva | Managing the transition from products to services[END_REF]. To some degree, the servitization process seems almost inevitable for the technology intensive product manufacturing companies, and in management literature, powerful arguments are put forward to integrate service into their core offerings along three lines, economic arguments, customer demands and competitiveness (ibid.). Taking a service perspective put a focus on how the processes are deployed and for whom, rather than focusing on the technology in itself. One might say that service has a focus centered on the experience and fluency relative the business customer. This resembles in a sense imperatives of user centered design and interaction design where the user and user experience are in focus. Put into comparison, the concurrent drive for service in part mirror how businesses adopted and incorporated the user centered design (UCD) and usability movement. The UCD and usability movement started academically as early as 1940's but it was through the extended use of computers in industry during the 1980's and forward that made companies employ usability experts. Today larger companies often have at least smaller units with UCD and interaction designers. The process of introducing UCD and usability departments in companies has been slow, in most cases bottom-up and customer demanded [START_REF] Winter | Identifying organizational barriers-a case study of usability work when developing software in the automation industry[END_REF]. This UCD shift has been playing out differently in different domains. The engineering heavy industries, well-grounded in the industrialization, have put much pride in their technology and few engineering companies have until recently been advertising their products as user friendly or with similar connotations. Instead the excellence of their technology has been focused on the product; the technology itself.

While UCD and interaction design brings focus to user needs and task decomposition relative computerization, service offerings put focus on a higher level of experience which include all forms of aspects relative the business that the industries are offering. Neither UCD nor service development ignores or diminish the technological part, but both put more emphasis on aspects which more or less presuppose that the backend of the technology is there and is (excellently) functional. It is interesting to compare such perspective shifts in general but specifically it is interesting to see if and how the two perspective shifts can be combined.

This work explores the view on service and service development among people working in-house in four global industrial companies and is based on interviews and observations. With help of the empirical material we discuss central concepts in UCD and compare it to the ongoing perspective shift in these companies.

Background

The companies within which we have done interviews, are industrial and technologyintensive. However, the focus of the technology is to solve a particular problem in a certain setting and to center technology around certain contexts implicitly include an understanding of a person that use the technology. Below we will present two different approaches which explicitly focuses on this addressed person.

Evolving User-Centered Approaches

Although human-computer interaction (HCl) is a relatively young research field it has undergone rapid changes and new sub areas have emerged in a fast pace. The perspectives within the field has evolved and is reflected in various user focused practices. HCI has it origin in the disciplines ergonomics and human factors, which are experimental approaches and treats the interaction as an isolated phenomenon. The focus is the machine performance and the unit of analysis is user actions of one person in front of a display. Human factors is criticized for isolating actions from the complex context in which they take place [START_REF] Bannon | From human factors to human actors: The role of psychology and humancomputer interaction studies in system design[END_REF]. As a result of the increase in number of computers in working life, demands for ease of use emerged as well as for practical, not so costly, methods to develop usable systems. Usability emerged as a topic and in the end of the 1980s the user-centered approach evolved as an emphasis for the designer to focus more on the user and to give users an active role [START_REF] Gould | How to design usable systems[END_REF]. Usability was defined by an international standard as "The extent to which a product can be used by specified users to achieve specified goals with effectiveness, efficiency and satisfaction in a specified context of use" [START_REF] Law | Whose Experience Do We Care About? Analysis of the Fitness of Scrum and Kanban to User Experience (UX)[END_REF]. Furthermore, the computer supported computer work (CSCW) research community grew out of the need to extend the user concept into involving groups of users as well as a multitude of computers. Further on, the technical evolution of a networked society resulted in new challenges and concerns. Earlier clear boundaries between work and leisure have become vague and the significance of the physical location has been altered. Bødker points to the need in HCI to extend the view of context to also include settings outside the physical workplace and she outlines new interests in culture, emotion and experience growing from the shift from always designing purposeful and rational solutions [START_REF] Bødker | When Second Wave HCI meets Third Wave Challenges[END_REF]. Such perspectives on HCI have been coined interaction design which have a more design oriented, in contrast to analytical, view on HCI and UCD.

Evolving Marketing Approaches

Studies of service development started as early as in the 70s marketing research [START_REF] Shostack | Breaking Free from Product Marketing[END_REF], and the evolvement of this subject has mainly been done within the marketing and management disciplines. Service marketing has a history of breaking out of marketing research, i.e. the goods marketing perspective, and has thus reinforced the differences between service and goods to justify the sub discipline.

In the 2000s new arguments was formulated on how to describe and conceptualize service. Vargo and Lusch presented their service dominant logic describing service in a value creation perspective [START_REF] Vargo | Evolving to a New Dominant Logic for Marketing[END_REF]. They are arguing for an interpretation of value as "value in use" contrarily "value in exchange". They defined business processes as service and argue to not distinguish goods and service, instead goods are means for service delivery. A central theme in their arguments is that customers are integrating knowledge and capabilities with the service provider's personnel and artifacts in a cocreation of value. This way of describing value has changed how market research characterizes customers, from passive to active co-creators, and puts an emphasis on the importance of involving customers in the development process [START_REF] Ostrom | Moving forward and making a difference: Research priorities for the science of service[END_REF]. So far, the discussion in market research has been on a conceptual level, with little result on how to put these ideas into practice [START_REF] Morelli | Designing Product/Service Systems: A Methodological Exploration[END_REF].

Where the Strands Meet

Branching out from the HCI field in the 2000s, service design became a new interdisciplinary movement with a root in design thinking [START_REF] Stickdorn | This is service design thinking: Basics, tools, cases[END_REF]. It was based primarily on two drivers; firstly the growing service sector supported by experience focused and knowledge-intensive solutions, and secondly initiatives in user-centered disciplines where people recognized the benefit of combining user-centered practices with service development and innovation. For example, Holmlid discusses how service design can help to open up the earlier sometimes impeding focus on computer mediation and the computer as a tool perspective in HCI [START_REF] Holmlid | Participative, co-operative, emancipatory: From participatory design to service design[END_REF]. The argument is that this movement can give complementing views to earlier approaches, using multiple channels and a diversity in possible ways to create user value. Wetter-Edman has researched the contribution of design practice and design theory in realizing the service dominant logic ideas [START_REF] Wetter Edman | The concept of value in design practice -an interview study[END_REF], [START_REF] Wetter Edman | Design for Service: A framework for articulating designers' contribution as interpreter of users' experience[END_REF]. She shows how user-centered methods are complementary for user involvement and co-creation and can open up new perspectives on value. She also shows that the valuable role of the designer as an interpreter and intermediator between customer and company, is lacking in marketing research approaches. The possible connection between user-centered approaches and service development points towards positive future concurrence.

Since the implementation of user-centered methods has been slow and gained relatively little impact in industrial product development, we approached service practitioners within these companies. These service practitioners do not always have an outspoken task to realize their respective organizations demand on an increased share of service. With an underlying interest in seeing where user-centered perspectives can meet service development, we aimed to investigate how these practitioners talk about service, how they perceive their role and how the servitization process has been played out within these companies.

Method

The material for this paper has been collected from four large international companies selling business to business solutions in different domains, here denoted company A, B, C and D. All four companies are global, with a history in traditional engineering fields, and they all have operations in at least Africa, America, Asia, and Europe and more than 35 000 employees each worldwide. At company A, 7 interviews were conducted, labeled 1:A to 7:A. To further broaden the picture, 5 additional interviews were done with representatives from company B, C and D, i.e. 8: B, 9:B, 10:C, 11:C, and 12:D. The sample of interviewees have been chosen in consultation with contact persons with a good knowledge of their companies view on service, and where based on two criteria, 1) perceived long experience of service delivery/development within the company and 2) some kind of responsibility in regard to this. The 12 semistructured interviews took place between April 2013 and June 2013. All interviewees had some kind of management role; concerning projects, methods and/or personnel. 9 out of 12 worked close to or in relatively close connection to customers. Two worked with technical development enabling service delivery, and one worked on a strategic level. 11 out of 12 had an engineering background, and one had training in service management. One of the persons mentioned knowledge of UCD. The interviews took around one hour each, and 14.5 hours of recorded material were transcribed verbatim. 7 of the interviews were done in Swedish and 5 in English. The original Swedish quotes were translated to English by the authors. Moreover, to gather more information, 3 on-site observations were conducted in company A. The observations were focused on delivering value to customers; two cases of remote service and onsite service delivery. Additional material was also collected from respective companies' web site.

The transcribed material was collected in Atlas.ti, a common qualitative data analysis software. Furthermore the data analysis were made primarily by the first author, using techniques from grounded theory, specifically inspired by the constructivist grounded theory approach described by Charmaz [START_REF] Charmaz | Constructing Grounded Theory: A Practical Guide Through Qualitative Analysis[END_REF]. During the initial coding the transcribed material was worked through in detail, followed by a more focused coding phase were some key issues was followed up and further explored. These key issues formed emerging themes that were in an iterative process, revisited and refined, together with the field material and information from the web sites.

Results and Analysis

In this section we will both recount what status service development have in these four companies and contrast service development with user-centered design and usability through some key concepts.

Service Status in the Studied Companies

The companies studied for this paper are all mainly technology-intensive organizations with a prevailing engineering culture and have all a long tradition of developing and selling products, where providing spare parts for the products have been their main service business. In line with this prevailing engineering attitude, the format and the specifications of the products produced becomes noticeably important. This is reflected in the organizational structure where different parts of the organizations are dealing with specific product families. When service packages are created, our interviewees explained that these are often seen as separate components added on to the products. In the same vein, service departments have been added as isolated entities into the existing organization. Budgets, tools, and resources often follow these organizational boundaries, which contribute to silo thinking and complicate collaboration between different departments. Frequently, you find several pieces of equipment from the same producing company at one customer site, but with limited coordination between the departments delivering these products or service. Our interviewees explain that there is a tension between adding service components onto existing products, and by so reinforce the silos, and the wish to solve the customer's problem regardless whether it is a motor or a robot that stopped the production for the customer. This is similar to what Winter et al. have observed, where the organizational set up created conflicts of interest between departments, and giving cause to breakdowns in communication [START_REF] Winter | Identifying organizational barriers-a case study of usability work when developing software in the automation industry[END_REF]. Hence, there are budding service initiatives within the studied companies, but their organizational belonging is still under construction.

Top Down Incentives for Service

Within all the studied companies, the top management have emphasized the importance of increasing the percentages of revenues coming from service which is manifested e.g. in strategies and policies. Hence, these companies are compelling examples of the current servitization process as exemplified by the following quote from company C: "As times goes on, the greater scope service will get, I'm quite sure [...] it is more and more important you have value-added service. There is probably a stated goal [...] we should have a certain proportion of service. We will be more service oriented as a company" [10:C] However, these top down encouraged initiatives does not necessarily mean there is a widespread knowledge about service and service development within the companies we have studied. Hence there is a frustration among people working with service, they are encouraged, or even prompted to develop service revenue, but they seem to be lacking clear goals on what this would be as in the following quote: "The closest they [

the middle management] has come to service may be that they have purchased a TV subscription as a service, they have poor understanding of what service is all about, so now when they get this directive from the top management, 'now, work with service', of course, they do not know what to do" [11:C]

Not only is there a lack of knowledge, our interviewees also express a concern that support for those supposed to implement the service initiatives are also largely lacking: "they expect the most and put the least in the service organization" [7:A].

Service in these organizations could be more than something on top of their products, it could include also the knowledge base of what and how the products may provide value in specific contexts. Still as the quotes above indicate this has not yet become a central position of their business -possibly a consequence of a firm grounding in a product focused mindset. The top-management initiatives have not been that thoroughly grounded in the practices of the organization and their employees which may hinder the servitization process.

Service Development

All of the studied companies had standardized and clear product development processes, but only two of the organizations had at the time for the interviews defined the processes for service development. Some of the interviewees from companies with defined service development processes, describes that it is difficult to diffuse the process: "the difficulty that I've seen anyway, is how we roll out the stuff and get this to work practically out there" [10:C] Worth noting is that despite there being defined processes in two of the companies, most services in all four organizations were actually developed ad-hoc. As a consequence of this, service is developed in different ways in different parts of the organization, and the resulting solutions are often not coordinated. There are initiatives to mitigate this problem and to create company-wide offerings out of these ad hoc solutions, as explained in this quote: "the service is created out there, sold and delivered a couple of times before it is washed off a little before it is introduced into the global portfolio" [8:B] Reports of the ad-hoc development process are mixed, mentioning both positive as well as negative aspects. There is a pride in the solutions that have been made, but at the same time people feel out of control and without any overview, as exemplified in the following quote: "there is a mentality to fix things, an entrepreneurship,

and this has created very good stuff, what is worse then is that you might not know what you have done, and what opportunities are available" [1:A]

At this point in time it is difficult to elaborate on the role of a service process in these companies since they are in two cases nonexistent and in the other two cases not widely spread. What can be deduced though is that the interviewees express a wish to have a more structured way of working.

Use of the Concept Service

The word service, is not well-defined and agreed upon in these organizations. Even if the interviewees worked with service in their daily work, they had difficulties explaining the concept. This was common in all companies, the interviewees expressed a confusion about what other people working in the same organization meant by service, as indicated by these two quotes:

"it is all context dependent,

of course, talking internal [A] how I see it, it [service] is very wide and very unclear" [6:A], "the service concept is so unclear [...] it means that there are lots of people who develop this who does not understand it is service they develop" [12:D]

Also the very different categories of service can complicate the communication, especially since maintenance and spare parts are viewed by many as being equal to service in this context. As of today service in these companies can cover for example; agreements, training, spare parts, software, maintenance, consulting, analyzes and financing. This complicate things as this interviewee explains: "if you talk to people, they will mix all those things together [...] if you talk to some people, they talk about the services needed to get the system going, a bunch of people see services to operate [x], so it is a confusing picture to people" [9:B] From the interviews, it is clear that the term service must be defined and grounded in the organization, in order for the service development to work satisfactorily.

4.5

The Customer in Focus Traditionally, service in these companies has meant maintenance and spare parts tightly coupled to particular products but the perspective oriented towards more product transcended knowledge has begun to gain some support. The former is firmly based on a technological orientation, where the product has a central role, while the latter case is focusing more on what the customer wants to be done, more or less independent of what products might be used. These two views have different implications as the former will focus on one form of equipment while the latter will focus on how different equipment can be combined and integrated in order to fulfill a certain objective. Our interviewees talk about their offerings in terms of a whole, with a cer-tain goal to make the clients work process work smoothly and it is this system that delivers the value for the receiver: "We handle both our own products that can be installed there and our competitors, we handle maintenance of automation products, systems, electrical equipment, mechanical equipment and everything else, so we take total responsibility for the maintenance. For a production site [...] we have a common goal together with the client" [4:A] This perspective puts the customer in the center, and this is a strength the interviewees point to, the tradition of long term relationships to the customers. Previously this has been due to the long life time, sometimes decades, of the equipment they are selling. However, the use of the term customer by the interviewees can be problematic to interpret as a customer is not necessarily the same person as a user [START_REF] Law | Whose Experience Do We Care About? Analysis of the Fitness of Scrum and Kanban to User Experience (UX)[END_REF]. The ISO definition of a user is "a person who interacts with the product" [START_REF]International Standard, ISO 9241-11 Guidance on Usability[END_REF], and a customer "organization or person that receives a product or service" [START_REF]2008 Systems and software engineering -Software life cycle processes[END_REF]. In the transcribed material the term customer is used much more frequently compared to user (512 times, vs. 12 times).

Although some interviewees seems to employ customer and user as synonyms, "We have a large group of customers that is not a homogeneous group, to truly understand the essence of what they need to achieve, and for us to be able to find something that fits quite a few, not all, but many" [6:C] Others show awareness of this problem "First, there are different types of customers, we start with that, one of the most important things is to actually understanding who the customer is, as the concept of customer is very very difficult, so we have even begun to talk about customers and end users, as two different" [12:D] Consequently, a shift towards services seem to put the customer, and perhaps the user, more readily in mind in the developers of services. Since the users are the main focus within an HCI perspective this is an interesting correspondence between service and UCD.

Service over Time

An important aspect shared between HCI and service development is that the value of the result is created over time. In contrast to a product perspective where the product is finite and defined at the very moment of construction, both a HCI and service perspective presuppose a user who becomes acquainted with the system and becomes more skilled over time. Both HCI and service perspectives values long relations and the learning process which the users or customers provides. When it comes to services, this long relationship also involves a continuous development as in this quote: "One of the challenges for us is to find other service opportunities that enables us to have a more continuous contact with the customer, so we can have that ongoing relationship, and [remote ] services are very good, very good area that makes sure we have a more continuous contact with those who actually use the services, first we get to know our customers better, they can tell you continuously what are the problems, it becomes a more natural contact with them because they understand, well they can actually help me with something" [12:D] It even seems like the service perspective, at least from our interviewees point of view, naturally includes a life-cycle awareness: "you need a life-cycle view, you can not only have development because then you miss the big maintenance an end of life part of service" [8:B] This would imply that at least for these interviewees, a within the HCI field sought after perspective of longevity comes naturally when working with services and service development.

Discussion

This paper has elaborated on results from interviews with people working with service at four global technology-intensive companies. The interviews showed that the increased focus on service is an initiative from top management, but also that new ways of thinking is to implement. This is due to, on one hand, that the product oriented view reinforces a silos structure of the organization, while services to some degree need to transcend several departments, and on the other hand, service as a concept has so far been ill-defined and can connote different things. Note that both size of the company and the market probably is of importance for servitization and this analysis do not claim to inform the situation for smaller companies. Furthermore, the large range of service types and the rapid technical development leads to the introduction of new types of services, e.g. software-supported services, and it also increase the confusion. What is referred to as service or product depends on your perspective, or viewpoint [START_REF] Norman | Living with complexity[END_REF], often related to what view the company want to market. One consequence of the concept confusion is that it makes service difficult to relate to during service development [START_REF] Menor | New service development: areas for exploitation and exploration[END_REF]. It is important that everybody involved in development has a similar idea of the service and it is likewise interpreted by all [START_REF] Clark | Exploiting the service concept for service design and development[END_REF]. Rexfelt et al. found in an industrial context that a non-agreed upon definition about service turned it into a concept with no real meaning for the participants taking part in the studied service development project [START_REF] Rexfelt | A proposal for a structured approach for cross-company teamwork: a case study of involving the customer in service innovation[END_REF]. There were negative consequences for development of new service in this case.

Analytically we have scrutinized how service as a contemporary perspective is related to UCD and usability. We can see many similarities such as a focus on the client's needs and goals, as well as how the value of the result is created over time. However the focus on the client or customer can differ somewhat between service and UCD, since UCD as a systems development process is focusing on the actual user of a computer system. In contrast, service perspectives fluctuate between different roles with responsibility for certain processes within the recipient organization, as well as the actual user of a system or several systems. To complicate things even more, these systems might not originate from the delivering organization. Consequently, the service organization of a supplier company must then also have knowledge of the client organization and how they can be integrated in with the supplied products and services. This kind of value creation on a higher hierarchical level for the organization as a whole is lacking in definitions of usability [START_REF] Law | Whose Experience Do We Care About? Analysis of the Fitness of Scrum and Kanban to User Experience (UX)[END_REF], where the goal is met as long as the end-user is satisfied. Taking a service perspective on the other hand, thus makes one not only focus on the actual product, but also the value and enablement of the product for the client. A service perspective in the organization may impose more focus on the value of the reliability of the product than on the constitution of the product. Service thus is value-sensitive rather than product sensitive, interestingly such perspective have also been advocated within the UCD community [START_REF] Friedman | Value sensitive design: Theory and methods[END_REF].

The move towards an increased number of service solutions puts a focus on the experience of the receiver. In turn, this places new requirements on the delivering organization, which has to act in harmony and give the impression of acting as one entity towards the beneficiary. To make this possible, the people involved, their tools and policies, as well as their tasks needs to be understood and related to each other as a larger system. Development of solutions adapted to this reality, calls for a multi-level approach taking tasks, tools as well as organizational aspects into account.

In the interviews, we have noted an understanding of key concepts important for UCD, among people working with service. At the same time, there are economic incentives for upper management in these companies to invest in service. We argue that this is an opportunity to build on already established practices for user-centered design applied within these organizations for service development, a development currently done to a large extend by engineers. The access to professionals with UCD competence is limited today in these types of companies, and will be during a foreseeable future. Hence, a pre-understanding of these concepts will possibly facilitate introduction of a new way to approach service development building on experiences and learnings from the UCD tradition.

When shifting the focus from the product and hence the transaction, to service, there is also a shift to the relationships. Consequently, we see the opportunity for the usability community to take advantage of an increased attention on shared interests. Following this shift in perspective, we feel the hope for an increased perceived significance of what is considered foundations of UCD.

6

Acknowledgments

We would like to thank those we have been in contact with within these companies. We would also thank the anonymous reviewers for their input.


Judith Molka-Danielsen
email: j.molka-danielsen@himolde.no

Mikhail Fominykh
email: mikhail.fominykh@himolde.no

David Swapp
email: d.swapp@ucl.ac.uk

Anthony Steed
email: a.steed@ucl.ac.uk

Designing a Demonstrator Virtual Learning Environment to Teach the Threshold Concept of Space Syntax: Seeing from the User's Perspective

Keywords: virtual learning environments, space syntax, threshold concepts, systems design, experiential learning, virtual worlds

Space syntax is an important knowledge domain and focus of study for students of Architecture. It centers on the understanding of spaces, tectonics and volumes for the informed design of buildings or outdoor spaces. Space syntax is considered to be a threshold concept in Architecture, in that understanding and interpreting this knowledge domain is something that the learner needs to acquire in order to progress as a professional in this field. The concept of "line of sight" is a specific example of a concept in the space syntax domain. This research investigates a case of systems design of an immersive virtual learning environment to support teaching a concept of space syntax to students of Architecture. Such environments can engage, immerse and guide learners in ways not yet undertaken and may find application in workplace learning. This research explores the systems design requirements through a demonstrator that is tested by a small pilot group. One case scenario to teach the concept of "line of sight" was selected for the target design. Based on the expert feedback we designed a learning module demonstrated at the University College London CAVE-hybrid facility. The demonstrator was trialed in 16 timed trials. Several conclusions for workplace learning on the systems design choices are drawn.

Introduction

Information Systems (IS) designers have often made analogies between the design of information systems and the design of buildings, saying that IS design is like building design in that, "Architecture, design, construction, furnishings, inhabitants, and location all play major roles in shaping the overall experience" [START_REF] Morville | Information Architecture for the World Wide Web[END_REF]. It is not surprising then that "consideration of the end users first person perspective" would be an important approach to teaching of concepts in Architecture. And we as systems designers of Virtual Learning Environments (VLE) would seek to discover and include these requirements in the design of VLE learning module for students of Architecture. In this paper, we describe our approach of systems design of a VLE demonstrator. We report on the trials of the demonstrator and discuss the implications that such tools support reflective learning approaches [START_REF]Reflection: Turning Experience into Learning[END_REF] and can be suitable for students at different stages of their careers. This paper explores: What are the systems design requirements for VLEs to support learning of the threshold concept of "line of sight" in the knowledge domain of space syntax?

The remaining paper is presented as follows. In the next section, we clarify meaning of threshold concepts and the role of virtual technologies in practical experiential learning, and we present prior research in these domains. In Section 3, we give a description of our methodology for this project describing the systems design approach for the demonstrator. In Section 4, we describe our trials and observations. Section 5 discusses implications for VLE design. Section 6 gives concluding remarks.

2

Literature Review

Virtual Reality Technologies

In recent years, virtual reality (VR) technologies have been applied in teaching and learning. The main motivations for their use have been that VLE based on VR technologies are engaging as media [START_REF] Windschitl | When does immersion in a virtual environment help students construct understanding[END_REF] and that use of 3D media facilitates comprehension by means of situating learning materials in a context and exploiting the natural capabilities of humans to interact in 3D space [START_REF] Roussou | The virtual playground: an educational virtual reality environment for evaluating interactivity and conceptual learning[END_REF]. In particular they investigated user interaction in immersive VR environments and found that the use of virtual content successfully changed the users' conceptual understanding of the content [START_REF] Roussou | The virtual playground: an educational virtual reality environment for evaluating interactivity and conceptual learning[END_REF]. A key characteristic that motivates the use of VR in training is that participants behave in a way that is similar to their behavior in comparably similar real situations [START_REF] Sanchez-Vives | From presence to consciousness through virtual reality[END_REF][START_REF] Slater | Place Illusion and Plausibility Can Lead to Realistic Behaviour in Immersive Virtual Environments[END_REF]. These studies distinguish immersive VR from desktop VR proving that in the immersive VR the participant acts, to a great extent, as they would in the real physical world. In desktop VR, this level of immersion is limited by the form and structure of the interface. General studies of the capabilities of immersive VR systems on comprehension have shown that these systems are preferred for tasks that are exploratory and interactive [START_REF] Demiralp | CAVE and fishtank virtual-reality displays: a qualitative and quantitative comparison[END_REF][START_REF] Prabhat | A Comparative Study of Desktop, Fishtank, and Cave Systems for the Exploration of Volume Rendered Confocal Data Sets[END_REF][START_REF] Swindells | Comparing CAVE, wall, and desktop displays for navigation and wayfinding in complex 3D models[END_REF]. One study identifies that for constrained tasks that features of immersive VR are contributing to performance differences [START_REF] Ragan | Studying the Effects of Stereo, Head Tracking, and Field of Regard on a Small-Scale Spatial Judgment Task[END_REF]. However, these studies are limited in that they have not provided requirements analysis that can predict tasks for which immersive VR environments are superior over desktop approaches.

In Search for Pedagogical Approaches

Modern pedagogic approaches have emphasized the importance of real life experience, such as in the workplace, for transforming learning objectives into knowledge that can be applied in practice. At the same time, workplace experience needs to be converted into knowledge to enable deeper learning. The information relevant for a master level of performance (aka 'theory'), traditionally, is separated from the immediate experience of competent action (aka 'practice') [START_REF] Fominykh | An Overview of Capturing Live Experience with Virtual and Augmented Reality[END_REF]. In the past, this conversion has been supervised by skilled experts or teachers using shared experience and direct instruction. Various media, such as textbooks or instructional films, have been used as information containers. However, with recent technical advances in virtual and augmented reality, new opportunities arise for training that do not rely on strict separation of knowledge from its application. Knowledge appears in many forms. Tangible knowledge may be stored as written instructions or in databases. Intangible knowledge appears as activity, practice, relation between participants, and in their shared experience. The former type of knowledge is known as explicit and the latter as tacit [START_REF] Polanyi | The Tacit Dimension[END_REF] [START_REF] Lam | Tacit Knowledge, Organizational Learning and Societal Institutions: An Integrated Framework[END_REF].

Tacit knowledge can be converted to explicit knowledge through narrativesin addition to iterative training that aim to create embodied experience through activity [START_REF] Jang | Embodied Cognition and Virtual Reality in Learning to Visualize Anatomy[END_REF]. Immersive VR as well as augmented reality provides an embodied dimension that makes users interact in the same way they do in a real context. [START_REF] Mennecke | An Examination of a Theory of Embodied Social Presence in Virtual Worlds[END_REF][START_REF] Mennecke | Embodied Social Presence Theory[END_REF] Approaches, such as experiential learning [START_REF] Kolb | Experiential Learning[END_REF] and problem-based learning [START_REF] Gijselaers | Connecting problem based practices with educational theory[END_REF], have been applied in classrooms and have been intended for acquiring workplace skills. While having correct objectives, these approaches often fall short of supports for the transformative process necessary for the learner to capture core concepts within the targeted discipline.

Threshold Concepts

The core concepts referred to here are identified as threshold concepts. Erik Meyer and Ray Land state, "A threshold concept can be considered as akin to a portal, opening up a new and previously inaccessible way of thinking about something. It represents a transformed way of understanding, interpreting, or viewing something without which the learner cannot progress" [START_REF] Meyer | Threshold Concepts and Troublesome Knowledge: Linkages to Ways of Thinking and Practicing within the Disciplines[END_REF].

These necessary knowledge components represent transitions in understanding [START_REF] Meyer | Threshold concepts and troublesome knowledge: linkages to ways of thinking and practicing[END_REF]. While struggling with a new way of perceiving the practices of a discipline, the learner is in a state of liminality before finally grasping the concept and passing the threshold [START_REF] Meyer | Threshold concepts and troublesome knowledge: issues of liminality[END_REF].

Threshold concepts among other qualities are difficult to perceive and comprehend for the newcomers in a community of practice. Experts differ from the newcomers not only by the level of their skills, but by deeper understanding of the discipline, the profession, and, in other words, of the threshold concepts. Such understanding is often connected to tacit knowledge [START_REF] Kolb | Experiential Learning[END_REF]. Access to such knowledge is therefore important and necessary for a professional to achieve the level of expert in a discipline. Land and Meyer state further that threshold concepts are central "core" concepts within a discipline that are essential in the acquisition of creative thinking, learning and communication of understanding within a discipline [START_REF] Meyer | Threshold Concepts and Troublesome Knowledge: Linkages to Ways of Thinking and Practicing within the Disciplines[END_REF][START_REF] Meyer | Threshold concepts and troublesome knowledge (2): Epistemological considerations and a conceptual framework for teaching and learning[END_REF][START_REF] Meyer | Threshold concepts and troublesome knowledge (4): Issues of variation and variability[END_REF][START_REF] Perkins | The constructivist classroom -the many faces of constructivism[END_REF].

There is a documented lack of support for threshold experiences in higher education [START_REF] Perkins | Threshold Experience. 3rd Biennial Threshold Concepts Symposium[END_REF]. However, we have recently explored teaching threshold concepts with the support of VR technologies [START_REF] Fominykh | Repositories of Community Memory as Visualized Activities in 3D Virtual Worlds[END_REF] and identified conceptual requirements for systems design [START_REF] Molka-Danielsen | Teaching Threshold Concepts in Virtual Reality: Exploring the Conceptual Requirements for Systems Design[END_REF]. This study extends the research of [START_REF] Molka-Danielsen | Teaching Threshold Concepts in Virtual Reality: Exploring the Conceptual Requirements for Systems Design[END_REF] in that it designs and pilot tests a demonstrator of a VLE that aims to support an exploratory and interactive learning task for Architecture students. The demonstrator is designed with use of immersive VR technologies that are described in the next section.

Methodology

This research applies the general steps of Design Science Research (DSR) as an approach to design the demonstrator artifact that is a learning module implemented in a VLE. We selected DSR as recent studies for developing user innovation in virtual world's shows that DSR can be used as problem solving process to develop IS artifacts [START_REF] Vaishnavi | Design research in information systems[END_REF][START_REF] Spence | The Researcher's Toolbox[END_REF][START_REF] Hevner | Design Science in Information Systems Research[END_REF]. Through a cyclical process of design of the learning module, a better understanding of the users experience and design requirements are obtained. The general steps of DSR are: problem awareness, suggestion, development, evaluation and conclusion. At each stage of development, evaluation and conclusion, knowledge is gained and fed back into problem awareness, thus influencing suggestions for further improvements. The DSR approach was useful in that it allowed us the designers of the VLE, to study how a trial group learned. We conducted the following steps:

1. Problem Awareness: Through interviews with experts in the selected field of learning, Architecture, we recognize difficulties with traditional learning methods. 2. Suggestion: The knowledge gained from the interviews and designers knowledge of VLE technologies influence the initial development of the learning module. 3. Development: The learning modules are implemented using two software implementations to allow control for the influence of the software interfaces on the trials. 4. Evaluation: The demonstrators are evaluated by general users in timed trials.

Conclusion:

The designers draw conclusions based on the observation of the trials. 6. Cycle-2: Further cycles are suggested with use of several trial groups of Architecture students at different points in their progression of study.

Problem Awareness and Suggestion

In September 2013, the researchers conducted interviews with Architecture experts Dr. Sean Hanna (SH, Space and Adaptive Architectures, UCL) and Dr. Sam Griffiths (SG, Urban Morphology and Theory, UCL). The information from these interviews was used to inform the learning module that would be implemented in the VLE. Some of the statements of the interviews are summarized as follows:

 SH: "Space syntax" is a long threshold concept. This is a very broad theme, and the knowledge domain for a master's level program. SH says that students that have mastered the concepts of space syntax make different assessments and decisions as applied to architectural designs. This has been tested in students' responses to school assignments and even in master's thesis.  SH: Issues such as "lines of sight", "where people are likely to move, gather around objects, meet others", are related to understanding of space syntax.  SH: The way that students think about "spaces, tectonics, and volumes" is part of a long threshold in Architecture. Students that know about design space syntax are more likely to use those concepts in design decisions.  SG: Points out that there are some students who you can see that "get it" and that these are distinguishable from those who may struggle with the tools and models. While understanding the tools and models, these can give very delineated responses to questions. However, the questions are sometimes complex and do not have simple responses.  SG: Most of the tools and visual presentations of their work are done in 2D. The work presented in 2D only is a challenge for students with little work experience to transform that view in a classroom exercise into an integrated analysis of the space syntax. The use of 3D tools in itself offers another perspective that can be helpful in learning.

We concluded at this stage to develop a module that would function in a Cave Automatic Virtual Environment (CAVE), as described in the next section. The aim is that a simulation in the CAVE that provides a real-time feedback would help in the student's integrated analysis.

Development Components of the Immersive 3D VLE

The platform applied in this research made use of CAVE, an immersive projection technology [START_REF] Cruz-Neira | The CAVE: audio visual experience automatic virtual environment[END_REF]. A CAVE is typically a cube-shaped display that the user stands inside. The CAVE surrounds the user, thus excluding other distractions and allowing the participant to move about un-constrained by the need to face a specific desktop display. The wide field of view allows natural peripheral observation and gaze control. More specifically, this research was conducted as part of a visiting scholar research project (see acknowledgements) in cooperation with the Virtual Environments and Computer Group (VECG) of the CS Dept. at University College London. The project applied VECG group computers and immersive visualization facilities. The VECG group of the Department of Computer Science (UCL-CS) has excellent visualization facilities including a four-sided CAVE-hybrid driven by a PC cluster (four client nodes with GeForce Quadro 5600 graphics), a six-camera Vicon motion-tracking system, an eight camera Optitrak system, an Intersense wireless tracking system, head-mounted VR and augmented reality displays, a GRAB haptic interface and various other tracking systems and input devices including bio-signal amplifiers. This research applied two virtual world technologies that are normally accessed through desktop interfaces. However, the learning modules were instantiated (brought up) in the CAVE. These virtual world technologies were vAcademia™ (vA), a VLE software that was created especially for educational purposes [START_REF] Morozov | vAcademia -Educational Virtual World with 3D Recording[END_REF], and Second Life™ (SL) a general purpose virtual world software that has been widely adopted also for non-educational purposes. The implications for this study were that the researchers had access to more server side hooks for vA when bringing up simulations in the CAVE. With use of two virtual world technologies we also control for some behavior differences that can be due to perspectives afforded by the different interfaces.

Demonstrator Design

In the next phase of the project, we developed a learning module that is based on a prior design of Kalff et al. [START_REF] Kalff | Turning the Shelves: Empirical findings and Space Syntax analyses of two virtual supermarket variations[END_REF]. The demonstrator activity is shopping for items in a food store. In our scenario, the participant is to look for and identify three items on the shelves in a food store. Our model has eight shelves. There are two perspectives of the shelves and in the VLE models and both perspectives are replicated in SL and vA. That is we have made two separate builds for each perspective. The perspectives are with shelves pointing towards the participant ("plus" or A) and with shelves pointing away from the participant ("minus", B).

The 2D overhead view of the VLE scene is depicted below (Fig. 1, left). A person would stand at point A or B. In general, the perspective of B should result in faster times for participants to locate and identify items in the food store. This would be a typical "line of sight" exercise for a new student in Architecture. For a participant to look at the 2D representation above, it can be difficult to visualize which perspective is more effective. With the help of a 3D representation, the "better" design could be more easily identified. Applying the 3D representation would be seeing from the end user's perspective, that is, the shopper's perspective. A more experienced Architecture student might be given more delineated tasks. For example, they might be asked to determine the best angle of the shelves. This was not asked in these trials.

Trials and Observations

We conducted trials of the learning module with five volunteer participants, using a Think-aloud protocol [START_REF] Lewis | Task-Centered User Interface Design: A Practical Introduction[END_REF] to gather data. Participants were asked to talk about what they were doing while active in the trials. The trials were video recorded to not interfere with the participants while they completed their tasks. All had prior experience with virtual reality environments. They gave verbal consent for use of video recording of their trials. We first showed them a 2D diagram of a food store (Fig. 1,right) and asked which perspective would be their preferred starting point (A or B). Although everyone did choose B, most of the responders were hesitant and unsure. We then had the participants try out the module in SL (Fig. 2) and in vA (Fig. 3). All five participants trialed the module in vA and three of them in SL (Table 1). We used the 'identification times' as an objective metric of their effort for location of three items in the food store. In all trials, the 'identification' time values were smaller for perspective B, even when the items sought after were made different across trials. This trend was consistent across both VLE platforms.

As an affective measure of participants' feelings of the learning experience we asked after the trials if they had any comments about the two perspectives. All responded that it was immediately obvious that B was "easier" or "better" that "I can see everything in B, but in the other (A) my view is blocked". Some noted that it was also a more pleasant shopping experience with B, as it was so hard to move around in the VLE and with B they did not have to move the avatar so much. Many commented that in real life grocery stores, that store owners want you to walk around, and maybe wanted customers to not find items so quickly. Some participants of the exercise noted that items were easier to see/identify in vA than in SL. We attribute this to the fact that first person perspective functioned in the vA trials, giving a better view. And, only third person perspective functioned in SL in the CAVE. However, some commented that it was easier to move around in SL. In both VLEs, the participants controlled the movement of the avatar using a keyboard. The model in vA had shelves inside a four-walled store; while alternatively, the model in SL had shelves on an open plane. So the reason for some longer identification times in vA may have been the presence of the walls, as sometimes the users' camera view was obstructed when standing too close to the walls. While the number of trials is too few to make performance comparisons of the two VLEs, future designs could be created in open spaces to avoid confusions caused by misaligned camera views.

Table 1. Trial Times according to VLE and Perspective

Implications for VLE Systems Design

This study gives evidence that VLEs hold potential to support of learning of threshold concepts through experiential learning approach. A demonstrator of one threshold learning scenario was implemented and trialed in the CAVE using two VLE platforms. The primary implications of this research are summarized in Table 2.

Table 2. Implications for VLE systems design

Implications

 Learning with your virtual bodythe VLE supported the learning of threshold concepts through the interaction of the learner (through their avatar) with the 3D virtual environment. In brief, walking around in the store in the demonstrator had the feel of walking around a store in real life.  First person view perspectivewas one of the features that was most important in the ability to read items on the shelves and to move naturally around. This was not apparent to an outside observer that views 2D video recordings of movement in the virtual environments. But, it was reported as important by those participating in the trials.  The students were informed by their experience in the trials that enabled them to "see from the user's perspective"however, that perspective will depend on who is the user. The trial participants realized during the trials that a customer in a food store will want to find items quickly, while a shop manager will want the customer to spend more time in the shop.  Learning takes place after becoming familiar with the technical interface and moving around in the VLEwhen the users became more familiar with the VLE interface controls, they were able to focus on the cognitive task. The comments then focused more on which architectural perspective was better, rather than on the VLE interface. A pre-task interaction session is recommended for all learning modules.

We conclude that several VLE design factors were important and can contribute to better workplace learning environments that support experiential reflective learning. These are:

1. First person view is important for achieving realistic lines of vision/sight (Fig. 3). The use of third person view in SL places the user above the scene (Fig. 2). In addition, as one user pointed out, it is harder to get closer (next to) the shelves in third person view, and so it is more difficult to see and identify the items. 2. Choices of interface tools are important. Several commented a joystick would have enabled easier movement as opposed to the application of keyboard for movement. The choice of "easier movement" would represent more accurately the real life ease of walking around in a food store. 3. The food items on the shelves in the store models were placed with no specific logic next to each other. For example, refrigerated items (e.g., orange juice) could be on shelf next to dry storage items (e.g., toothpaste). In addition, the color of the shelves were green, indicating dry storage space, and this did not make sense to one participant that was looking for orange juice in a cold refrigeration unit that should be white. Obliviously, the placement of items in the model is not how the items would be located in stores in real life. In brief, during trials the participants could not rely on internalized experience models of normal layouts of food stores.

While done purposely for this exercise, course designers and VLE designers might consider multiple layouts when testing learning outcomes. 4. The model of the scene and avatar in the 3D (e.g. CAVE environment) should be built to a 1:1 scale as they would be in real life. That is if the participant is using first person view, the size of the objects should be on a 1:1 scale with the size of the avatar. For example, the shelf height should be designed as in real life, on average about 2-2.5 meters for a 1.6-2 meter tall person. The reason for doing this is, if a shelf height of a three meters is used, the top of the shelf could not be viewed in first person view mode, unless the avatar would take a step away from the object. This was at least what our participants experienced in the CAVE. Alternatively, the issue of scale is not as important for a PC desktop interface. That is because when using a PC desktop interface the user often uses a third person view to find items. As such, the scales of objects (items and shelves) are often made larger in respect to the avatar than they would be in real life, to take advantage that the objects in the desktop module would fill more screen space.

Regarding the four above, it is clear that VLE design choices had implications for how the participant saw the environment and solved problems.

Concluding Remarks

In summary, this paper explored the systems design requirements for the design of VLE for teaching an architectural threshold concept of "line of sight" within the knowledge domain of space syntax. Our research used a DSR approach to design a demonstrator that contributes to a proof-of-concept, that VLE can be applied to support learning of a threshold concept. This was demonstrated in two different VLEs. We described the implementation and analysis of a demonstrator of a threshold learning scenario in the CAVE and assessed the system elements that would support that environment. We identified some basic factors about the software and hardware components that need to be considered in VLE design to be more supportive of a workplace learning environment. Last, we created a testing environment that can be replicated, modified and applied in future research projects.

For further DSR cycles of the VLE design, we recommend testing of the modules with Architect students at various stages of their career including those with workplace experience. Educators could also change tasks and apply different assessment methods. Future changes to this design should explore the question: can the VLE be a learning aid for those who already "get it". That is, more experienced professionals may already comprehend the threshold concept, but may struggle with it in different contexts.

Finally, we think the DSR approach may be applied to the design of other VLE scenarios for workplace training and for teaching threshold concepts in other knowledge domains. For example, possible scenarios could include re-training for new equipment or settings in industry, continuous training in medicine, and threat detection in emergency management. In such a case, VLEs can be used as tools for vocational training. Creating more learning scenarios and trialing these with expanded target groups is a natural next step.

Fig. 1 .

 1 Fig. 1. The Learning Scenario in a VLE (left) and a 2D layout of a food store (right)

Fig. 2 .Fig. 3 .

 23 Fig. 2. Trials in SL: Plus perspective -A point (left) and Minus perspective -B point (right)



  Orange Juice, Tooth paste, Milk  Pasta, Tooth paste, Olives  Tomatoes, Tomato sauce,

Acknowledgements

The research leading to these results has received funding from the European Commission's Research Infrastructure Actiongrant agreement VISIONAIR 262044under FP7/2007-2013. The author wishes to thank Mikhail Morozov, Maksim Tsukanov and Andrey Smorkalov from the support team of vAcademia at Volga State University of Technology, RU, for their contribution of the development of the VLEs.


Maxime Lecomte
email: lecomte.maxime@cea.fr

Jacques J A Fournier
email: jacques.fournier@cea.fr

Philippe Maurine
email: philippe.maurine@lirmm.fr

Extraction of intrinsic structure for Hardware Trojan detection

In this paper we present a novel solution to address the problem of potential malicious circuitry on FPGA. This method is based on an a technique of structure extraction which consider the infection of an all lot. This structure is related to the design (place and route, power grid. . . ) of the integrated circuits which composes the lot. In case of additional circuitry this design will be modify and the extracted structure will be affected. After developing the extraction techniques we present a methodology to insert detection of hardware trojan and counterfeit in different IC manufacturing steps. At last an application example using 30 FPGA boards validate our extraction method. Finally, statistical tools are then applied on the experimental results to distinguish a genuine lot from an infected one and confirm the potential of detection the extracted structure.

Introduction

Due to the recent trend of outsourcing integrated circuit (IC) manufacturing and design, structural integrity verification of ICs has become a hot topic. From the specification step to that of packaging, and especially during the design step, a circuit can be corrupted by a malicious adversary. This malicious alteration of the IC structure is called a Hardware Trojan (HT) insertion and its effects can range from performance degradation (e.g. denial of service) up to more sophisticated functionalities (memory dumping etc) [START_REF] Tehranipoor | A survey of hardware trojan taxonomy and detection[END_REF]. Similarly with the multiplication of foundries and IC vendors, counterfeits are spreading rapidly, ranging from simple copies to a complete replacement of an given IC by one of lower quality.

A HT is composed of two parts: the trigger and the payload. The trigger is the mechanism that scans some signals within the IC until a specific condition is met. When this condition is met, the payload is activated. The trigger can either be generated externally (external signals or physicals condition) or internally (a special internal state, data, etc). Moreover the trigger can either be combinational (result of a logical operation) or sequential (related to a succession of states). The payload is the 'malicious' effect of the HT. It can either be explicit where of signals are directly added, removed or deactivated. It can also be implicit where the effect cannot be directly observed like, for example, adding side-channel information in the power consumption. The detection of a HT before its activation is a difficult task and it still remains a challenging problem even after its activation when the payload is implicit.

The probability of triggering a HT during functional tests is low and testing is an expensive approach to that end. Moreover, inspecting the circuit through reverse engineering is an expensive process in terms of cost and time and can be destructive. This solution can therefore be applied to only few devices, even though latest imaging based methods have proven to offer a simpler and faster alternatives [START_REF] Courbon | A high efficiency hardware trojan detection technique based on fast sem imaging[END_REF].

Several non destructive methods for HT detection have been recently proposed. The first proposed approaches analyze, using statistical techniques, the overall consumption of an IC to detect the impact of the HT. For example, in [START_REF] Agrawal | Trojan detection using ic fingerprinting[END_REF], a detection technique based on the Karhunen-Loève theorem is proposed in order to detect the power consumption of the HT within process variations and noise. However, this paper only reports validations obtained by simulations, omitting things like the measurement noise. Moreover, the technique may not scale to complex Systems on Chip (SoC).

Hence, in order to enhance the detection capabilities, techniques have been proposed in [START_REF] Li | At-speed delay characterization for ic authentication and trojan horse detection[END_REF] to analyze locally the propagation delays of logical paths with embedded monitors. However, once again, only simulation results are provided. Another method has been proposed in [START_REF] Abramovici | Integrated circuit security: New threats and solutions[END_REF] to integrate a hardware system allowing to monitor important nets of ICs. However, little information is given in this paper about the efficiency of the proposed technique. In parallel to this approach, a test solution was also proposed in [START_REF] Chakraborty | Mero: A statistical approach for hardware trojan detection[END_REF] in order to trigger easily a HT or at least to increase their electrical activity.

In [START_REF] Narasimhan | Multiple-parameter side-channel analysis: A non-invasive hardware trojan detection approach[END_REF], a first attempt to suppress process variations from the HT detection problem has been proposed based on the strong correlation between the maximum operating frequency of ICs, F max , and their dynamic power consumption. This approach however faces the difficult problem of measuring F max on SoCs [START_REF] Bowman | Dynamic variation monitor for measuring the impact of voltage droops on microprocessor clock frequency[END_REF][START_REF] Rebaud | Timing slack monitoring under process and environmental variations: Application to a DSP performance optimization[END_REF].

Then in 2011, the use of Ring Oscillators (RO) has been proposed to detect HTs. For example, in [START_REF] Lamech | An experimental analysis of power and delay signal-to-noise requirements for detecting trojans and methods for achieving the required detection sensitivities. Information Forensics and Security[END_REF] the authors propose an analysis of RO sensitivity to the presence of HT but conclude that it seems difficult to detect really small HT. In parallel [START_REF] Zhang | Ron: An on-chip ring oscillator network for hardware trojan detection[END_REF] proposes the use of an array of RO, used in conjunction with a Principal Component Analysis (PCA) [START_REF] Degroot | Probability and Statistics[END_REF], to distinguish infected ICs from genuine ones. This proposal has been experimentally validated on an FPGA using a Digital Sampling Oscilloscope (DSO) (thus off-chip) to measure the oscillating frequency of ROs. This idea has then be applied to design an ASIC in 2012 [START_REF] Ferraiuolo | Experimental analysis of a ring oscillator network for hardware trojan detection in a 90nm ASIC[END_REF] where the initial results were only partly validated. This is may due to the use of an embedded 8-bit counter as RO, which reduces the accuracy of the measured frequencies.

Later in 2013, the authors in [START_REF] Cao | Cluster-based distributed active current timer for hardware trojan detection[END_REF] propose to cluster, during the design step, the power grid in several voltage islands embedding each a dedicated sensor to enhance the detection capability. However, no experimental results are given in this paper, neither on the improvements obtained nor on the cost in terms of Silicon area. In 2014, [START_REF] Soll | Em-based detection of hardware trojans on fpgas[END_REF] describes a method based on the use of near field electromagnetic cartography. Yet, the authors conclude that it seems difficult to detect all the HT. However, in [START_REF] Balasch | Electromagnetic circuit fingerprints for hardware trojan detection[END_REF], a more efficient technique is used to interpret the EM traces. As a result, authors conclude it is possible to detect really small HTs but with a special care to control the temperature during measurements. Finally, in [START_REF] Ngo Xuan | Method taking into account process dispersions to detect hardware trojan horse by side-channel[END_REF] the authors analyze EM emanations from FPGAs and succeeds to differentiate a genuine population from an infected one.

Based on those results, the on-chip monitoring solutions seem relevant in term of efficiency since the obtained detections rates are higher than for off-chip methods. Furthermore, these solutions seem industrially viable since the cost of the equipments, dedicated to the data acquisition, is reduced as the tests can easily be done in parallel. For those reasons, the work presented here is based on on-chip methods.

In this paper, we consider that the infection of a single device is not realistic based on the current life cycle of ICs (mainly linked to production and distribution constraints). That why the HT detection methodology proposed in this paper does not aim at establishing if an IC is infected but aims at checking the integrity of a whole production lot. Moreover, this approach also allows to determine if a given IC is a counterfeit (apart from the case of a really high quality copy). The principle of the proposed methodology is to detect, thanks to a embedded sensor network, an alteration in the design's structure induced by the presence of a HT, or by a modification in its place and route or in its floor-plan. These alterations modify the IC power distribution and in particular the static voltage drops [START_REF] Liu | Floorplan and power/ground network co-synthesis for fast design convergence[END_REF] in the glue logic and hence that in the sensor array. This method is based on a novel variation model of the performance of CMOS structures in real designs (not in test chips dedicated to the fine measurement of the intra and inter die variations), model which is introduced and validated in this paper.

The paper is organized as follows. First, section 2 describes the threats to IC integrity and specifies which ones are covered in this paper. Then section 3 introduces the proposed variation model and defines the basic principle of our detection methods. Section 4 details the HT and counterfeited detection methodology and section 5 describes the experimental results which validate the proposed approach and the proposed variation model on a set of 30 FPGAs. Finally, the wide range of perspectives generated by our approach is discussed, as a conclusion, in section 6.

Design center

Manufacturing Usage

Trojan Insertion

IP vendors

Trojan Insertion

Trojan Insertion

(1) (2)
(3) (4) First, this section recalls briefly the main threats to IC integrity. Second, the HT and counterfeit detection method is described specifying which threats it covers.

Threats to IC integrity

Fig. 1 summarizes the different steps, from design to exploitation, for manufacturing an IC and the associated threats. The first vulnerabilities are at the design stage. A corrupted piece of hardware IP can be introduced into the product (Threat (1) in Fig. 1) or a compromised employee from the design center can introduce a HT into the HDL description (Threat (2) in Fig. 1). It is difficult to protect against such threats, but some solutions based on ad-hoc design and verification methods have been proposed [START_REF] Chakraborty | Security against hardware trojan attacks using key-based design obfuscation[END_REF][START_REF] Mohammad | A trustdriven placement approach: A new perspective on design for hardware trust[END_REF][START_REF] Kan | Bisa: Built-in self-authentication for preventing hardware trojan insertion[END_REF].

The second vulnerable stage is the manufacturing (Threat (3) in Fig. 1). For example, filler cells can be substituted by logic gates, inducing a denial of service or more complex functionalities, or a fuse can be disabled etc. A last threat is that of counterfeits. It consists in selling second hand products, lower quality devices or functional copies directly onto the market causing financial losses (Threat (4) in Fig. 1). Some can even be almost perfect copies which are difficult to detect.

Features of infected circuits or counterfeits

Many methods have been proposed to detect HTs. Among them, a large majority aims at detecting the parasitic electrical activity (additional power consumption) generated by the HT's trigger. However, this parasitic electrical activity is not the only measurable trace left by the HTs. Another one is the alteration of the inner structure of the IC. For example, the HT insertion modifies the local and global capacitance and resistance of the power and ground nets. This modification induces a different current flow in the IC, and thus a different static or dynamic voltage distribution (static or dynamic voltages drops).

In the same way, counterfeits are characterized by a more (functional copies) or less (almost exact hardware copy) different physical structures, and therefore by a different repartition of the voltage across the IC's surface.

Principle of HT and counterfeit detection

Our detection method is based upon a simple principle: a fingerprinting of the supply voltage on the surface of IC at rest (i.e. just powered on with the clock active). In order to do this, a network of sensors is uniformly spread over the whole IC surface to get a cartography of the inner supply voltage. Any sensor sensitive to the supply voltage, V dd, can be used. In the experiments reported in section 5, Ring Oscillators (RO) are used. Given that the frequency f of a RO is sensitive to the local V dd value, the distribution of measured values for f above the IC surface, in the absence of any process variation (P), is a direct picture of the V dd distribution. Hence in our approach, we have to get rid of the effect of intra-die and inter-die process variations. With this approach, we shall be able to mitigate risks linked the introduction of HTs at the manufacturing stage.

Process variation model and performance variation model of CMOS structures

Given p, an inherent parameter of the IC fabrication technology, the impact of the manufacturing process variations, the so called process variations, are generally described as follows:

p = p + ∆p inter + ∆p intra (1)
with p being the mean (or typical) value of the parameter on a whole lot of a production, ∆p inter ∼ N (0, σ 2 inter ) the effect of the inter-die variations assumed normal and ∆p intra ∼ N (0, σ 2 intra ) the impact of variations within a die, i.e. the intra-die process variations also assumed normal.

This process variation model is well known and widely adopted to simulate the effect of process variations on the parameter p of an IC (a transistor, a resistance, a pn junction, etc). However, the extraction of the standard deviation values σ intra and σ intra is generally performed on dedicated ICs (regular arrays of MOS transistors [START_REF] Keshavarzi | Measurements and modeling of intrinsic fluctuations in mosfet threshold voltage[END_REF] or SRAM cells [START_REF] Bhavnagarwala | Fluctuation limits amp; scaling opportunities for cmos sram cells[END_REF]) which are quite uniform relative to their physical structures and under controlled voltage and temperature. This process variation model does not take into account the impact of the IC's physical structure (power supply routing, local transistor density, etc) on the CMOS gate performance or on that of an embedded sensor which, of course, depends on all process variations through equation [START_REF] Abramovici | Integrated circuit security: New threats and solutions[END_REF]. Hence for our case, we shall use the following variation model for the output value T (x i , y i ) of a sensor i located at (x i , y i ) on the IC's surface:

T (x i , y i ) = T + ∆T inter + ∆T intra + ∆T (x i , y i ) (2)
where ∆T (x, y) is a deterministic value which depends of the sensor's position over the IC, and which models the impact of the IC's structure on the performance of the sensor. To ease the reading, T (x i , y i ) and ∆T (x i , y i ) shall be noted T i and ∆T i respectively, showing that the variation model considered in this paper is a spatial model.

Fingerprinting the IC's structure

Considering the model given by equation ( 2), fingerprinting the structure of a design featuring a network of q sensors regularly spread on its surface is relatively simple for a same manufacturing lot of ICs. The q values of ∆T i are calculated by averaging the impact of the process variations on m lot devices of the same lot:

∆T i = 1 m lot • m lot j=1 T j i -T = 1 m lot • m lot j=1 ∆T j i ( 3
)
σ ∆Ti = 1 m lot • m lot j=1 (∆T j i -∆T i ) 2 (4)
where:

T = 1 m lot • q • m lot j=1 q i=1 T j i (5)
T j i is the measurement of the output of the sensor i of the device j ∈ {1, . . . , m lot } of the considered lot.

With these notations, the vector S Design = [s Design ] can be defined as follows:

S Design = [ ∆T 1 , . . . , ∆T q , σ ∆T1 , . . . , σ ∆Tq ] (6)
S Design represents the fingerprint of the physical structure of an IC called 'Design' and is by construction independent of the process variations. This fingerprint is the base of the HT and counterfeit detection methods proposed in section 4.

Detection Methodology

The starting point of our methodology is the addition of a network of sensors sensitive to the supply voltage. Those sensors are placed so as to cover most of the IC's surface. The granularity, i.e. the distance between two sensors, is chosen by the IC designer depending on the trade-off between detection capability and cost.

When the first run or the test run (which are less likely to be infected) is received, the integrity of some devices is verified to qualify the whole lot. This could be done by applying reverse engineering methods or by using optical based methods [START_REF] Stellari | Functional block extraction for hardware security detection using time-integrated and time-resolved emission measurements[END_REF]. Once the first production lot is qualified, the signature (see eq. ( 6)) of the design is calculated using equations ( 3) and ( 4). This fingerprint constitutes the reference fingerprint for the considered design.

The designer will then usually order other runs ("production runs") from the same foundry or from another one which offers the same technology node. Once those new production lots are received, their corresponding fingerprints are calculated and are 'compared' with the reference one in order to verify that the newly received lots have not been corrupted. Ageing techniques could be applied to this reference lot to derive fingerprints of the design at different ages.

In the same way, at some (later) point in time, the designer can have 'field returns' which could contain counterfeits. With the reference fingerprint, the origin of these devices can be verified without application of expensive, complex and destructive methods. In order to do that, the designer extracts the fingerprint of the suspected device and compares it with the reference fingerprint to finally get a probability that the device is a genuine one. If the probability is too low, complementary analyses (like reverse engineering) can be applied.

The above procedures require the comparison of the reference fingerprint with that of a new production lot in order to detect the eventual presence of an HT (case 1). The procedures also require the comparison of the reference fingerprint S REF with the fingerprint of a single device in order to detect counterfeits (case 2).

Case 1:HT detection

When the integrity of a new lot of devices has to be checked, the first step is to calculate its fingerprint S NewRun . Since this signature shall be, in practice, calculated using a high number of devices (> 100), the estimate of means can be considered as reliable. It is therefore possible to apply distinguishers or a statistical tools working on the means, like the Difference of Means (DoM) or the T-test (and more precisely the Welch's test). This implies using the ∆T i s of the signatures (eq. ( 6)) and to analyze the values

∆S i = S Ref i -S N ewRun i (7)
for i = {1, . . . , q}, or that of

T Stat i = S Ref i -S N ewRun i (s Ref q+i ) 2 m lot - (s N ewRun q+i ) 2 m lot . ( 8
)
It is also possible to use other statical tools such as the Kolmogrow-Smirnov test (KS) to determine if the distributions for all j ∈ {1, . . . , m lot } of (T j i -T) for the reference lot and for the new one are drawn from the same distribution law, i.e. if the devices embed the same design or not.

With the same idea of comparing centered populations of (T j i -T), clustering solutions can be used such as the k-means (with k = 2) or using simply the median. To do this, the populations (T j i -T) of the reference lot and of the new lot are merged within the same set. Then, the k-means is applied on the resulting population (or the median is calculated) so that to split it into two clusters. Finally, the number of devices in each cluster coming from the reference lot and from the new one are counted. If the tested ICs are genuine, the two resulting clusters have the same number of elements from the reference lot and that of the new lot. More precisely, if the cardinals of the reference lot and that of the new lot are equal, 50% of the devices from the reference lot and 50% of the devices from the new lot have to constitute each cluster. If this is not the case, the new lot can be considered as different from the reference one.

Case 2: counterfeit detection

The case of the suspected 'field return' is more difficult to treat as the fingerprint as described so far for HT detection cannot be calculated on one single device: we only have the T Suspected i of the considered device. In this case, we first "recenter" all the values using the value TSuspected of the suspected IC (i.e. calculate T Suspected i -TSuspected ) and then calculate the probabilities that each T Suspected i values comes from the normal distribution:

N (0, (s Suspected q+i ) 2 ) = N (0, σ 2 ∆Ti ) ( 9
)
σ ∆Ti is indeed the standard deviation of the sensor i, value estimated with the ICs from the reference lot. The probabilities for all sensors are then combined (and more precisely a multi-normal distribution is defined with all σ ∆Ti ) to obtain the probability that the considered device is a genuine one.

Experimental results

The HT detection methodology has been experimentally tested on a set of 30 FPGA boards featuring a Xilinx Spartan3E-1600. 15 boards have been used as genuine ICs and 15 have been used in order to emulate an infected lot or counterfeited devices. Validation of our methodology using FPGAs is a first step before entering the long and costly process of designing an ASIC.

Experimental protocol

On each Spartan-3E-1600 FPGA, a 128-bit-key AES, an RS232 communication block and a Finite State Machine (FSM) have been placed and routed. An array of 60 ROs has been added to the design. Each RO is coupled with a clock divider by two so as to be able to observe and measure precisely the 60 frequencies on an IO pad through a multiplexer. The area overhead incurred by the addition of our on-chip detection hardware is about 3.2% of the FPGA resources. The frequency measurements are performed with an oscilloscope from Lecroy featuring a 4GHz bandwidth and a 40GS/s sampling rate.

In order to obtain accurate measurements (accuracy of ±0.025ps), each frequency estimation is done by measuring the duration equivalent to 100 periods and by repeating this experiment 100 times to obtain a mean value of the period of each RO: T j i . During these measurements, the IC is kept inactive, i.e. just powered on and with the clock running. The time spent to measure the 60 values T j i on a board is lower than 30min which is short enough to consider the temperature as constant in a laboratory environment. In order to guarantee a good stability of the supply voltage, the FPGA is powered by a stabilized dc supply source with an accuracy of 0.05%.

To emulate the effect of a HT, a 64-bit LFSR is used. It occupies an area of 48 slices which represents 0.32% of the FPGA's surface (see the rightmost picture of Fig. 2). Note that the AES alone is mapped onto 1778 slices. The LFSR is clocked at 50M Hz by taking the clock input of a D Flip-Flop of the AES. This HT can therefore be considered as a sequential HT.

To emulate counterfeits, several constrained place and route steps of the design are performed. Fig. 2 gives 3 different floorplans of the same HDL code (three leftmost pictures). One of them (Design 1) is considered as the original / genuine design, the two others as counterfeits. Before evaluating the relevance of the proposed methodology and thus the relevance of the proposed variation model of CMOS structures, the impact of the inter and intra-die variations have been estimated on the 30 FPGA boards. Fig. 3(a) gives the histogram of the periods (T j i ) for the 60 ROs on ten boards, i.e. ten different devices. One can observe that the mean period for each device varies from 13.5ns to 14.5ns. The impact of inter-die variations is therefore of the order of several hundreds ps. Hence, using data from 30 boards, we estimate that the inter-die impact, can be modelled by the following normal distribution N (0, σ 2 inter ) with σ 2 inter = 460ps. Fig. 3(b) shows the histograms for the measured periods (centred for each board) for the 60 ROs values and this for the same ten boards. On can observe that the intra-die variations have an impact of the order of a hundred ps. Based on those assumptions, the intra-die variations can be considered to follow a zeromean normal distribution and can be modeled by N (0, σ 2 intra ) with σ intra = 130ps.

Validation of our variation model and Counterfeit detection

In section 3, we introduced a variation model for the performance of CMOS structures and for that of sensors. This model is novel as it introduces a deter-𝑺 𝑫𝒆𝒔𝒊𝒈𝒏 𝟏 (𝒑𝒔) ministic term which expresses the impact of the design structure on the sensor and particularly the impact of the power distribution. This novel model being the base of the proposed detection method, we start by evaluating its relevance.

In order to do that, the frequency of the 60 ROs from the 3 leftmost designs shown in Fig. 2 have been measured on 15 boards. Then, the first half of their fingerprints S Design (i.e the ∆T i s) have been compared. Fig. 4(a) shows S Design1 (dark curve) and the unique fingerprints (dotted curves) for each of the 15 devices used to compute S Design1 . Fig. 4(b) shows the three fingerprints obtained from the three designs. One can observe they are significantly different despite the use of the same 15 boards. One can also observe that the designs 2 and 3 have significantly different fingerprints (which are in turn different from that of design 1) even though the two floorplans are relatively similar. Note that in Fig. 6(a) (dotted curve), we see that the signatures corresponding to the same design obtained from two different lots of 15 FPGA are the same.

For these designs 2 and 3, the sensors 30 to 45, located in the neighborhood or in the AES (see Fig. 2), are characterized by high s i = ∆T i values. For the design 1, the AES is around sensors 1 to 10 (see Fig. At this point, we see that our variation model of CMOS structures is valid and allows to distinguish different floorplans of a same HDL code. To show that our method can determine whether a suspected IC is a counterfeit (compared to a reference lot), we shall refer to Fig. 5 which shows the complete fingerprint (calculated from 15 samples) of the design 1 (dark curve), i.e. the values of ∆T i ± σ ∆Ti , and the fingerprint of a suspected device (dotted line). In this case, there are visually no doubt that the considered device is a counterfeit. For example, the ROs 30, 39 and 40 are out of the ±3 • σ ∆Ti measured on the reference lot. It is the same for the ROs 1 and 44.

HT detection

The detection method of an infected lot is similar to that of a counterfeit lot, although the alteration of the physical structure is expected to be significantly smaller and localized. Fig. 6 shows the results obtained by applying the DoM (upper picture) and the T-test (lower picture) in order to verify the integrity of the 15 infected and 15 genuine ICs with the 15 reference ICs. 30 boards are used. To emulate the infection (the presence of a sequential HT), a 64-bit LFSR (48 slices) has been added to the design 1. Both the DoM and the T-test allow to detect an anomaly located around RO 33 which is effectively close to the LFSR. Moreover, the DoM stays low between the reference and the genuine lots. In this case, the absolute T-values (| T Stat i |) does not exceed, 1.22 for i ∈ {1, . . . , 60}. Genuine lots are therefore recognized as uninfected lots. Similar results have been obtained with the k-means (Fig. 8) and the median (Fig. 7). These results validate the proposed detection methodology and above all the proposed variation model of the performance of a CMOS structure in a real design which strongly depends on the power distribution in advanced CMOS technologies.

Conclusion and perspectives

This paper introduces an efficient and practical approach for detecting Hardware Trojans in ICs and counterfeits based on a new variation model for the performance of CMOS structures. This model gets rid of the process variation issues usually met when doing HT detection in practice. The model is actually built from measurements made on 'real circuits' and not designs usually dedicated to the monitoring of process variations, the latter being much more uniform and regular in terms of physical structure and content. This approach is based on the assumption that IC infection is more likely to be done on a lot level than on individual isolated ICs.

A reference signature is first derived from a trusted lot (which could correspond in practice to a first run usually done for characterisation purposes). Then the same signatures will be calculated on subsequent (suspected) lots and compared with the reference one, using the different statistical methods described in this paper. For counterfeit detection, we propose a way of calculating this IC fingerprint and comparing it with the reference signature. The model and the methods have been successfully experimented on a set of 30 FPGA boards as an initial validation strategy.

The next steps will be to implement the on-chip sensor structures on an ASIC design and validate the method on large set of ICs. Moreover, other factors like the size of the HT, the density of sensors to used or the positioning of those sensors shall be investigated.

Figure 1 :

 1 Figure 1: Mains threats to IC integrity 2 Threats and characteristics of infected devices and counterfeits

1 ,

 1 . . . , s Design 2q

FSMFigure 2 :

 2 Figure 2: From left to right: 3 implementations of the same HDL-code without any HT. The rightmost picture is an infected (LFSR) version of Design 1.

Figure 3 :

 3 Figure 3: Impact of inter-die (a) and intra-die (b) variations

Figure 4 :

 4 Figure 4: (a) S Design1 in blue and the 15 specific fingerprints associated to the the 15 boards used to compute S Design1 (b) Fingerprints of the three designs reported Fig. 2

  4(b)). This reinforces the hypothesis that the floorplan influences the sensors by modifying locally the 𝑺 𝑫𝒆𝒔𝒊𝒈𝒏 𝟏 (𝒑𝒔)

Figure 5 :

 5 Figure 5: S Design1 and signature of a counterfeit distribution of supply voltage even when the IC does not compute anything.At this point, we see that our variation model of CMOS structures is valid and allows to distinguish different floorplans of a same HDL code. To show that our method can determine whether a suspected IC is a counterfeit (compared to a reference lot), we shall refer to Fig.5which shows the complete fingerprint (calculated from 15 samples) of the design 1 (dark curve), i.e. the values of ∆T i ± σ ∆Ti , and the fingerprint of a suspected device (dotted line). In this case, there are visually no doubt that the considered device is a counterfeit. For example, the ROs 30, 39 and 40 are out of the ±3 • σ ∆Ti measured on the reference lot. It is the same for the ROs 1 and 44.

Figure 6 :

 6 Figure 6: Difference between the fingerprints of 15 infected and 15 genuine devices with the signature of the 15 reference devices, (a) DoM, (b) T-test

Figure 7 :

 7 Figure 7: Percentage of a cluster (made by median) that come form the reference lot

Figure 8 :

 8 Figure 8: Percentage of a cluster (made by kmeans) that come form the reference lot