Hendrik Eeckhaut
email: heeckhau@elis.ugent.be

Harald Devos
email: hdevos@elis.ugent.be

Benjamin Schrauwen
email: bschrauw@elis.ugent.be

Mark Christiaens

Dirk Stroobandt

A Hardware-Friendly Wavelet Entropy Codec for Scalable Video

In the RESUME project we explore the use of reconfigurable hardware for the design of portable multimedia systems by developing a scalable wavelet-based video codec. A scalable video codec provides the ability to produce a smaller video stream with reduced frame rate, resolution or image quality starting from the original encoded video stream with almost no additional computation. This is important for portable devices that have different Quality of Service (QoS) requirements and power restrictions. Conventional video codecs do not possess this property; reduced quality is obtained through the arduous process of decoding the encoded video stream and recoding it at a lower quality. Producing such a smaller stream has therefore a very high computational cost.

In this article we present the results of our investigation into the hardware implementation of such a scalable video codec. In particular we found that the implementation of the entropy codec is a significant bottleneck. We present an alternative, hardware-friendly algorithm for entropy coding with superior data locality (both temporal and spatial), with a smaller memory footprint and superior compression while maintaining all required scalability properties.

Introduction

"Scalable video" is encoded in such a way that it allows to easily change the Quality of Service (QoS) i.e. the frame rate, resolution, color depth and image quality of the decoded video, without having to change the video stream used by the decoder (except for skipping unnecessary blocks of data without decoding) or without having to decode the whole video stream if only a part of it is required.

Such a scalable video codec has advantages for both the server (the provider of the content) and the clients. On the one hand the server scales well since it has to produce only one video stream that can be broadcast to all clients, irre-Figure 1. High-level overview of the video encoder spective of their QoS requirements. On the other hand the client can easily adapt the decoding parameters to its needs. A home cinema system can decode the stream at full quality, while a small portable client can decode the stream at low resolution and frame rate without needing the processing power of the larger clients. This way the decoder can optimize the use of the display, required processing power, required memory, . . .

The internal structure of one implementation of a scalable encoder is shown in Figure 1 and was described in [START_REF] Devos | Performance requirements for reconfigurable hardware for a scalable wavelet video decoder[END_REF][START_REF] Munteanu | Wavelet Image Coding and Multiscale Edge Detection -Algorithms and Applications[END_REF][START_REF] Munteanu | Wavelet image compression -the quadtree coding approach[END_REF][START_REF] Schelkens | Wavelet coding of volumetric medical datasets[END_REF][START_REF] Stroobandt | Reconfigurable hardware for a scalable wavelet video decoder and its performance requirements[END_REF]. It consists of the following parts: ME: "Motion Estimation" exploits the temporal redundancy in the video stream by looking for similarities between adjacent frames. To obtain temporal scalability (i.e. adjustable framerate of the video), motion is estimated in a hierarchical way as illustrated in Figure 2. This dyadic temporal decomposition enables decoding of the video stream at different bitrates. The decoder can choose up to which (temporal) level the stream is decoded. Each extra level doubles the frame rate.

An intermediate frame is predicted from its reference frames by dividing it into macroblocks and comparing each macroblock to macroblocks in the reference frames. The relative position of the macroblocks in the reference frames with respect to the intermediate frame is stored as motion vectors. The difference between the predicted and the original frame is called an "error frame".

MVEE: "Motion Vector Entropy Encoder" is responsible

for entropy encoding the motion vectors.

DWT:

The "Discrete Wavelet Transform" takes a reference or error frame and separates the low-pass and highpass components of the 2D image as illustrated in Figure 3. Each LL-subband is a low resolution version of the original frame. The inverse wavelet transform (IDWT) in the decoder can stop at an arbitrary level, resulting in resolution scalability.

WEE:

The "Wavelet Entropy Encoder" is responsible for entropy encoding the wavelet transformed frames. The frames are encoded bitplane by bitplane (from most significant to least significant), yielding progressive accuracy of the wavelet coefficients (Figure 4). The WEE itself consists of two main parts: the "Model Selector " (MS) and the "Arithmetic Encoder" (AE). The MS provides the AE with continuous guidance about what type of data is to be encoded by selecting an appropriate model for the symbol (a bit) that has to be encoded next. It exploits the correlation between neighboring coefficients in different contexts. Finally the AE performs the actual compression of the symbolstream.

P:

The "Packetizer" packs all encoded parts of the video together in one bit stream representing the compressed video.

Scalability in color depth is obtained by encoding luminance and chrominance information in three different channels in the YUV 4:2:0 format. Omitting the chrominance channels yields a grayscale version of the sequence, allocating more bits to these channels increases the color depth. Motion estimation is computed from luminance information only, but is also applied to the chrominance channels. In the other parts of the algorithm the channels are processed totally independent.

By inverting the operations of Figure 1 we obtain a scalable video decoder consisting of a Depacketizer (DP), a Motion Vector Entropy Decoder (MVED), a Wavelet Entropy Decoder (WED), an Inverse Discrete Wavelet Transform (IDWT) and Motion Compensation (MC). The wavelet entropy decoder described in [START_REF] Devos | Performance requirements for reconfigurable hardware for a scalable wavelet video decoder[END_REF][START_REF] Munteanu | Wavelet Image Coding and Multiscale Edge Detection -Algorithms and Applications[END_REF][START_REF] Munteanu | Wavelet image compression -the quadtree coding approach[END_REF][START_REF] Schelkens | Wavelet coding of volumetric medical datasets[END_REF][START_REF] Stroobandt | Reconfigurable hardware for a scalable wavelet video decoder and its performance requirements[END_REF] is our focus in this paper. Since our final goal is to achieve real-time performance we need hardware acceleration. We target an FPGA implementation to effectively support scalability.

After profiling the software implementation of this decoder (Figure 5) we came to the conclusion that the realtime performance is severely limited by the Wavelet Entropy Decoder (WED). The reason for this is that the WED encodes each frame one symbol (a bit) at a time. To get a feel for the orders of magnitude: the WED must decode approximately 30.10 6 symbols/second for a CIF video (resolution: 352 × 288) playing at a framerate of 30 Hz. We found that the algorithms described in [START_REF] Devos | Performance requirements for reconfigurable hardware for a scalable wavelet video decoder[END_REF][START_REF] Munteanu | Wavelet Image Coding and Multiscale Edge Detection -Algorithms and Applications[END_REF][START_REF] Munteanu | Wavelet image compression -the quadtree coding approach[END_REF][START_REF] Schelkens | Wavelet coding of volumetric medical datasets[END_REF][START_REF] Stroobandt | Reconfigurable hardware for a scalable wavelet video decoder and its performance requirements[END_REF] have a bad spatial and temporal locality and require data structures that are too large for an efficient hardware implementation. In this paper we present an alternative algorithm that is tailored to a hardware implementation.

A Hardware-Friendly Wavelet Entropy Decoder

We have designed a WED with the following properties in mind: dependently in the video stream. This enables us to only decode those resolution layers that are required to achieve the desired resolution.

• The algorithm should also be economical with memory. The working set should be as small as possible to avoid memory accesses to become a bottleneck.

• A high degree of parallelism is necessary if we want a really fast hardware (FPGA) implementation.

• A related issue is simplicity so as to encourage an elegant implementation.

• Finally a competitive compression rate should be achieved.

The Algorithm

We propose a new algorithm as shown in Figure 6. All subbands of the wavelet transformed channel are encoded (and decoded) totally independently. So it is possible to process all subbands of the wavelet transformed color channel of the frame in parallel. The subbands are processed bitlayer per bitlayer from top to bottom. The top is the bitplane that contains the most significant bit of the largest absolute value of all coefficients and the bottom is the bitplane containing the least significant bits. The bitlayers are processed in scanline order. This greatly benefits the memory accesses, since this is the order in which the data is stored in memory. It also enables us to stream data and use burst mode features of slower memories. All data from one subband is processed sequentially since all bits are now encoded based on information of previously encoded bits.

The first subband, the LL-subband of resolution layer 0, of reference frames is treated slightly differently because it contains, in contrast with all other subbands, only positive coefficients. This is a consequence of the use of the 9/7 biorthogonal filter pair in the wavelet transform. To avoid encoding the (allways positive) signs and to give this subband similar properties as the other subbands, the mean value of this LL-band is subtracted of all coefficients. Encoding this value first, gives the additional advantage of a good and compact approximation of all pixels when decoding at very low bitrates.

As can be seen from the code in Figure 6 symbols are encoded with different models (the second argument of the encode routine) depending on their context. To improve memory accesses this context is kept very small. A model contains information about the expected value of the incoming symbol and is used to encode this symbol as efficiently as possible in the Arithmetic Coder (AC).

There are four types of models:

• The data models are used to encode data such as the number of the starting bitplane and the mean value of the LL-subband.

• The sign models assist in the prediction of the signs of the wavelet coefficients.

• The significance models are used to predict the most significant bit of each wavelet coefficient. A coefficient is called significant as soon as we encounter its most significant bit. This group of models is subdivided further into two classes: the highest bitplane models and the remaining bitplane models. The selection of highest bitplane models depends on the significance of the surrounding pixels that have already been encoded (Figure 7). The selection of the remaining bitplane models is based on the significance of all sur- rounding pixels since all pixels are already encoded up till at least the previous bitplane.

• The refinement models actually consist of only one model, used to estimate the value of all refinement bits. Refinement bits are the bits following the most significant bit. These are the remaining bits we come across when processing lower bitplanes than the bitplane where the wavelet coefficient became significant. These bits have the characteristics of noise and are therefore hard to predict.

The Model Selector (see Figure 8) is responsible for selecting the models. Models are selected based on information regarding previously encoded bits. Model selection is used to exploit statistical characteristics (e.g. the fact that pixels become significant in clusters) by encoding symbols with a similar distribution using the same arithmetic coder.

For optimal compression, storing all information about previously processed data would be ideal but since this excludes an efficient hardware implementation only the most relevant information is stored. Our algorithm limits this information to the sign and the significance of each coefficient. This information can easily be organized as two bitmaps with dimensions equal to the subband's.

From these bitmaps the number of horizontal, vertical and diagonal significant (or negative) neighbors of the current coefficient are counted to determine the model for the arithmetic coder (Figure 7). In total there are 64 models: • 1 data model.

• 27 sign models: To determine the sign model in the horizontal, vertical or diagonal direction, the number of negative neighbors is subtracted from the number of positive neighbors. Non-significant neighbors are not counted. Depending on the sign of this subtraction, the sign in each direction is more likely to be positive (+), negative (-) or none of both (?). Each sign model is a combination of the result in the three directions.

• 8 highest bitlayer significance models: one for each possible combination of the significance of three already visited neighbors. (Figure 7)

• 27 remaining bitlayers significance models: one for each combination of 0, 1 or 2 significant horizontal neighbors; 0, 1 or 2 significant vertical neighbors; and 0, 1 or more significant diagonal neighbors.

• 1 refinement model.

To determine the models at the borders of the subband, the bitmaps are extended with a symmetric expansion.

Arithmetic Coder

For the arithmetic coder we opted for a modified version of the CABAC arithmetic entropy encoder used in the AVC codec [START_REF] Marpe | Context-based adaptive binary arithmetic coding in JVT/H.26L[END_REF]. This is a low-complexity adaptive, binary arithmetic coder with a probability estimation algorithm that is well suited for an efficient hardware implementation.

We made a few changes to this arithmetic coder to fit it better in our wavelet entropy encoder. Since all memories on an FPGA are 9 bit wide, we augmented the 7 bit state per model (i.e. the current estimated probability of the model) to 9 bit. This increased the accuracy for probability estimation and as a consequence the compression performance. We also perfected the transition rule table for up- dating the probability estimation, but this falls outside the scope of this paper. The fact that only a 9 bit state per model needs to be stored, means that we only require 576 bits. The cost for a large number of models is in other words very limited.

Warm up of models

Arithmetic coders perform very good if they are able to accurately estimate the probability of the incoming bitstream. This is achieved by guiding the arithmetic coder with models, that in the ideal case stand for a certain fixed probability, resulting in near optimal compression. But since we are using a high number of models, how can the arithmetic coder estimate the probability of the models that are rarely used? We tackled this problem by estimating the probabilities beforehand, by observing the real probabilities for a set of reference video sequences. By initializing each model with these precalculated values we reach the actual probability much sooner than if we initialized the model conservatively at 0.5.

Subband models

There are a lot of different types of subbands which all have distinct statistical properties. In the first place there are large differences between the LL, HL, LH and HH subbands. In addition, models will be different for subbands of different resolution layers. If we also take the difference between the color channels and the position in the temporal frame hierarchy into account, we distinguish 480 different types of subband models (for 4 resolution levels). Each type has its own private 64 arithmetic models. Since all we have to do when coding a certain subband is swap in the appropriate subband model that initializes the 64 arithmetic coder states, no real efforts were made to reduce this high number of different subband models; this cost is negligible.

Memory Use

In Section 2 we stated that the codec had to be really economical with memory since bandwidth is often a bottleneck for multimedia applications. Randomly accessing large data structures on an FPGA is not recommended since memory resources are limited and external memories might not be fast enough. Since the decoder has to be at least real time, it is very important that the working set, the data structures that are accessed very frequently, are small enough to fit in small/fast on-chip memory.

To have a better idea of memory consumption we map the data structures to the available on-chip memory blocks of the Altera Stratix and the Xilinx Virtex II Pro of Xilinx. This on-chip memory is dual-port and has a latency of 1 clock cycle. A typical Altera Stratix (EP1S25) has 224 M512 (64 × 9 bit) blocks , 138 M4K (512 × 9 bit) blocks and two MRAM (64K × 9 bit) blocks. Similarly a typical Xilinx Virtex II Pro (XC2VP30) has 136 Select-RAM (2K × 9 bit) blocks.

Implementing the above WED algorithm in a Stratix EP1S25 or Virtex XC2VP30 requires the following memory blocks.

For the AD we require:

• A lookup table for determining the next state to jump to after processing a symbol. There are 512 such states but the table is symmetric so we are dealing with a table of size 512/2.log 2 (512/2) bits = 256 bytes. This will typically fit in one M4K or one Select-RAM block.

• A lookup table containing the current state of 64 models. One such state requires 9 bits. This is very convenient since almost every FPGA has on-chip RAM that can be addressed 9 bits at a time. This will fit in one M-512 block or one Select-RAM block.

• A lookup table used to look up the new size of the range being coded (see [START_REF] Marpe | Context-based adaptive binary arithmetic coding in the H.264/AVC video compression standard[END_REF]). This lookup table consists of 256 entries (for each of the symmetrical states). Each entry contains a value for 4 quantization levels that needs 16 bits resulting in a total size of this table of 2048 bytes. Depending on the chosen FPGA component this will require 4 M4K blocks or 1 Select-RAM block.

• A small buffer to store a part of the bit stream that is being decoded will be necessary. One M4K block or one Select-RAM block should suffice.

The MS has larger, but still very modest, requirements:

• The sign bitmap for the subband under reconstruction.

For a CIF image this data structure is at most 25344 bits. To implement this we need 6 M4K blocks or 2 Select-RAM blocks. • An identical data structure is necessary for storing the significance bitmap. • We need a data structure to store the decoded image.

The WED algorithm is constructed so that it reconstructs images one bitplane at a time and in Z-order. This means we can stream out one bitplane at a time requiring only a small buffer.

In total we find that one WED will require approximately 20 M4K blocks (14.5% of the M4K blocks of an EP1S25) or 9 Select-RAM blocks (6.6% of the XC2VP30).

An alternative layout for the Stratix platform is to use M-RAM blocks together with M4K blocks. We can fit the whole significance and sign bitmaps into one M-RAM block. The remaining data structures stay in the M4K blocks. We would need two buffers for the bitmaps as they are being streamed from the M-RAM block. Assuming that we can fit the bitmaps of additional WEDs into the same M-RAM block, we would be using only 8.6% of one M-RAM block of an EP1S25 per subband decoder. The remaining 10 M4K blocks form only 7.25% of the M4K blocks.

Results

In Figure 9, the average PSNR for decoding 289 frames from the mobile sequence (CIF, 30 frames/s, full resolution) is plotted for both the QTL approach of [START_REF] Munteanu | Wavelet image compression -the quadtree coding approach[END_REF][START_REF] Schelkens | Wavelet coding of volumetric medical datasets[END_REF] and the new WED. The PSNR of each frame is calculated as follows. If Y i,j , U i,j and V i,j and Y i,j , U i,j and V i,j are resp. the luminance and the two chrominance channels of the original and reconstructed frame of h × w pixels, then the PSNR is defined as follows:

10 log 10 255 2 3 2 hw (Y -Y ) 2 + (U -U ) 2 + (V -V ) 2
(1) Both approaches used the same motion estimation and wavelet transform results, only the entropy encoding and bitrate allocation algorithm were different. Figure 9 clearly illustrates that the new WEE is very competitive with QTL, which is considered state of the art [START_REF] Munteanu | Wavelet Image Coding and Multiscale Edge Detection -Algorithms and Applications[END_REF].

Conclusions

We presented a balanced algorithm for scalable wavelet entropy coding with superior data locality, both temporal and spatial, a small memory footprint, streaming capability, a high degree of parallelism and excellent compression.

Figure 2 .

 2 Figure 2. Framerate scalability. Motion estimation processes one Group of Pictures (GOP) consisting of 16 consecutive frames. The arrows illustrate which frames are used as a first approximation of the intermediate frames at lower compositional levels. R 1 is the reference frame of this GOP, R 2 is the reference frame of the next GOP and the H i are the intermediate frames.

Figure 3 .

 3 Figure 3. Resolution scalability. Numbers in subscript reflect the resolution layers.

•

  In the first place a WED should support the scalability of the codec; this is both resolution and quality scalability. As mentioned in the Introduction, quality scalability is obtained by encoding the wavelet image bitplane by bitplane. Resolution scalability requires that data from the different resolution layers is encoded in-

Figure 4 .

 4 Figure 4. Quality scalability: decoding more bitplanes gives a more accurate wavelet transformed frame.

Figure 5 .

 5 Figure 5. Execution times for decoding three reference sequences (9.6s each) of the three major parts of the video codec. From bottom to top: Wavelet Entropy Decoding (WED), Inverse Discrete Wavelet Transform (IDWT) and Motion Compensation (MC)

Figure 6 .

 6 Figure 6. Entropy encoding of one wavelet encoded frame.

Figure 7 .

 7 Figure 7. Illustration of the use of the bitmaps: neighborhood of the top bitplane (left) and of the remaining bitplanes (right). 'C' is the current bit.

Figure 8 .

 8 Figure 8. The model selector selects a model based on information of neighbors, stored in sign-and significance bitmaps. Once the model is determined, the arithmetic encoder encodes the bit with the selected model.

Figure 9 .

 9 Figure 9. Average PSNR of QTL and WEE.

Proceedings of the Design, Automation and Test in Europe Conference and Exhibition (DATE'05) 1530-1591/05 $ 20.00 IEEE

Proceedings of the Design, Automation and Test in Europe Conference and Exhibition (DATE'05)

Acknowledgements

This research is supported by I.W.T. grant 020174, F.W.O. grant G.0021.03 and by GOA project 12.51B.02 of Ghent University. Harald Devos is supported by the fund for scientific research Flanders (F.W.O.).


Kris Tiri
email: tiri@ee.ucla.edu

Ingrid Verbauwhede
email: ingrid@ee.ucla.edu

A VLSI Design Flow for Secure Side-Channel Attack Resistant ICs

This paper presents a digital VLSI design flow to create secure, side-channel attack (SCA) resistant integrated circuits. The design flow starts from a normal design in a hardware description language such as VHDL or Verilog and provides a direct path to a SCA resistant layout. Instead of a full custom layout or an iterative design process with extensive simulations, a few key modifications are incorporated in a regular synchronous CMOS standard cell design flow. We discuss the basis for side-channel attack resistance and adjust the library databases and constraints files of the synthesis and place & route procedures accordingly. Experimental results show that a DPA attack on a regular single ended CMOS standard cell implementation of a module of the DES algorithm discloses the secret key after 200 measurements. The same attack on a secure version still does not disclose the secret key after more than 2000 measurements.

Introduction

The integrated circuit (IC) emerges more and more as the main vulnerability of a security application. Due to physical and electrical effects, it broadcasts information that is related to the secret key. In recent years, several attacks have been reported that use information from socalled 'side-channels' to find the secret key. These sidechannel attacks do not tamper the security IC. They are non-invasive and observe the device under normal operation mode. The attacks analyze information ranging from time delay [START_REF] Kocher | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF] and power consumption [START_REF] Kocher | Differential Power Analysis[END_REF] to electromagnetic radiation [START_REF] Quisquater | ElectroMagnetic Analysis (EMA): Measures and Counter-measures for Smard Cards, E-smart'01[END_REF] and often apply statistical techniques. In general, SCAs do not require expensive equipment and are rather quick to set up. SCAs are a real threat for any device of which the security IC is easily observable such as smart cards and embedded devices.

At first, SCAs have been fought with ad hoc countermeasures. For instance, the addition of random power consuming operations obscured the data dependent variations in the power consumption. Yet over time, the attacks have evolved and become more and more effective. Subsequently, countermeasures have been conceived at the different abstraction levels of the security application. It _______________ This work was supported in part by NSF grant CCR-0098361.

started at the algorithmic level. A fine illustration is masking [START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF]. This technique prevents intermediate variables to depend on an easily accessible subset of the secret key. Only recently, dedicated hardware techniques have been presented [START_REF] Tiri | Securing Encryption Algorithms against DPA at the Logic Level: Next Generation Smart Card Technology[END_REF], [START_REF] Fournier | Security Evaluation of Asynchronous Circuits[END_REF]. Instead of concealing or decorrelating the side-channel information, these techniques try not to create any side channel information. Goal of these countermeasures is to make the power consumption of the logic gates independent of the data values or the Hamming distances between data values. To our knowledge, this publication is the first to present a comprehensive top-down automated synchronous VLSI design flow that pursues a constant power dissipation of the security IC.

A major advantage of our proposed technique is that it is independent of the cryptographic algorithm or arithmetic implemented and that there is no need to train the VLSI designer to become a security expert or vice versa. When the power dissipation of the smallest building block is a constant and independent of the signal activity, no information is leaked through the power supply regardless of the implementation and consequently irrespective of the experience of the digital designer. Such a technique is an essential component of a secure digital design flow.

A secure digital design flow is an automated design flow that creates a secure integrated circuit or system-onchip. The design flow starts from the design specifications and results in a secure side-channel attack resistant layout through the subsequent steps of synthesis and place & route. Major smart card vendors and service providers have recently identified such a design flow as an important open issue related to the general security of cryptographic applications [START_REF] Renaudin | High Security Smartcards[END_REF].

In this paper, we will transform a regular synchronous digital design flow into a secure digital design flow. The modifications and additions are inserted in the backend of the regular automated design flow and have been implemented in a "push-button" approach. They only have a minimal influence on the design flow and a negligible overhead in design time. The additional steps required only a total of 6 minutes of extra CPU time for a 39K gates prototype IC implementing a high-throughput AES, controller and fingerprint processor.

The remainder of this paper is organized as follows. In section 2, we present the secure digital design flow. We first discuss two components: (1) a logic style with constant power consumption and (2) a place & route technique, which controls the parasitic effects on the interconnect wires. Next, the remaining components, which complete the design flow, are presented. Section 3 compares the secure digital design flow with a regular digital design flow. A module of the DES algorithm is implemented. Area and power numbers are given and the results of a Differential Power Analysis are provided. While section 2 and 3 focus on power attacks, section 4 will deal with the other side-channel attacks. Finally a conclusion will be formulated.

Secure Digital Design Flow

The secure digital design flow is depicted in Fig. 1. Someone familiar with a regular synchronous CMOS standard cell based digital design flow recognizes the subsequent steps in an IC design: logic design, logic synthesis and place & route. The creative part is the description of the circuit in a high level design language such as Verilog or VHDL, indicated by the "logic design" task. Nothing changes to this task. One can notice 2 additional steps: "cell substitution" and "interconnect decomposition". These operations have been inserted in the backend of the flow and do not interfere with the creative part of a design. Before we discuss each step, we first elaborate on 2 important components, which are necessary to understand the flow. We will start with a logic style with constant power consumption. The idea is to have exactly 1 switching event per clock cycle during which a constant amount of charge is used. A 100% switching factor can only be achieved through a dual rail logic, which has a true and a false output. Consequently, the load capacitance at the 2 outputs must be matched to assure that the load capacitance is independent of the switching event. This is achieved through a special place & route approach, which we will discuss secondly.

Wave Dynamic Differential Logic

The cornerstone of a secure digital design flow is a logic style with constant power consumption. The power consumption of traditional standard cells and logic is dependent on the signal activity. It depends on both the sig-nal values and the signal transitions, i.e. the Hamming distance between consecutive data values. This is the fundamental reason that information can leak through the power supply and power attacks are possible. To address this problem several logic families have been introduced: asynchronous logic [START_REF] Fournier | Security Evaluation of Asynchronous Circuits[END_REF], Sense Amplifier Based Logic [START_REF] Tiri | Dynamic and Differential CMOS Logic with Signal Independent Power Consumption to Withstand Differential Power Analysis on Smart Cards[END_REF] and Wave Dynamic Differential Logic [START_REF] Tiri | Logic Level Design Methodology for a Secure DPA Resistant ASIC or FPGA Implementation[END_REF]. They all employ some form of dynamic differential logic, sometimes also referred to as dual rail with precharge logic. In this logic, every signal transition is represented with a switching event, in which the logic gate charges a capacitance, even when the input signals remain constant.

The major disadvantage of the asynchronous approach [START_REF] Fournier | Security Evaluation of Asynchronous Circuits[END_REF] is that it is extremely difficult. The methodology and tools for the design of large asynchronous logic circuits substantially lags behind that of synchronous circuits. Compared to EDA support for synchronous designs, which is very mature, there is still a shortage of CAD tools to support asynchronous circuit designs.

Sense Amplifier Based Logic (SABL) [START_REF] Tiri | Dynamic and Differential CMOS Logic with Signal Independent Power Consumption to Withstand Differential Power Analysis on Smart Cards[END_REF] has been conceived to thwart Differential Power Analysis (DPA). It uses advanced circuit techniques to guarantee that the load capacitance has a constant value. SABL completely controls the portion of the load capacitance that is due to the logic gate. The intrinsic capacitances at the differential inand output signals are symmetric and additionally it discharges and charges the sum of all the internal node capacitances. A major disadvantage is the non-recurrent engineering costs of a custom designed cell library development. SABL also suffers from a large clock load, as is common to all clocked dynamic logic styles.

Wave Dynamic Differential Logic (WDDL) [START_REF] Tiri | Logic Level Design Methodology for a Secure DPA Resistant ASIC or FPGA Implementation[END_REF] is implemented with static complementary CMOS logic, which is the default logic style used in standard cell libraries. Static CMOS standard cells are combined to form secure compound standard cells, which have a reduced power signature. Instead of pre-charging with a clock signal as is the case for SABL, in WDDL a pre-discharge wave travels through the circuit. In the precharge phase, the inputs to the WDDL gate are set at 0. This puts the output of the gate at 0 and the precharge wave travels over to the next gate of the combinatorial logic. By way of example, Fig. 2 shows the WDDL AOI32 gate and the original static CMOS gate. Our WDDL library contains 128 cells.

WDDL has many advantages. It can be readily implemented from an existing standard cell library. The design flow is fully supported with accurate EDA library files that come directly from the vendor. WDDL also results in a dynamic and differential logic with only a small load capacitance on the precharge control signal and with the high noise margins of static CMOS. Furthermore, since the gates do not precharge in parallel, it also benefits from a low supply current derivative di/dt and peak supply current. As a result, the supply bounce, often a critical problem for signal integrity, is lowered. Building WDDL logic at the logic level will reduce but not eliminate side channel attacks. At the transistor level, the implementation of the WDDL logic also needs to be balanced. It is essential in order to achieve constant power consumption that a fixed amount of charge is used per transition. A standard cell must always charge ideally the same load capacitance. Since a differential logic gate has 2 outputs, of which only 1 switches per event, the load capacitances at the 2 outputs must be matched. The load capacitance consists of the intrinsic in-and output capacitances of the cells and the interconnect capacitances between cells. Additional capacitances can be incorporated inside the compound gates to balance the intrinsic capacitances. Or even custom designed WDDL gates can be made. Yet with shrinking channel-length of the transistors, the share of the interconnect capacitance in the total load capacitance increases and the interconnect capacitances will become the dominant capacitance [START_REF]International Technology Roadmap for Semiconductors[END_REF]. Hence, the issue of matching the interconnect capacitances of the signal wires is crucial for the countermeasures to succeed. This is achieved through a special place & route approach.

Multiple Differential Pair Routing

The best strategy to achieve matched interconnect capacitances is to route the output signals with routes that are at all times in parallel and on the same layers. Then independent of the placement, the two routes have the same parasitic effects [START_REF] Tiri | Place and Route for Secure Standard Cell Design[END_REF].

The parasitic effects of the interconnects are caused by the resistance of the wires and by the capacitance to the substrate and to wires in upper and lower metal layers. Aside from process variations, these effects are equal for both nets. The resistance is the same since both interconnects have the same length. The capacitances are made the same by the proposed differential routing since in general the length of the differential route is orders of magnitude larger then the distance between the 2 differential routes and one can therefore argue that both nets travel in the same environment.

The pair of interconnects however, need not only to be routed with the same capacitance but also with control over cross-talk. Cross-talk is the phenomenon of noise induced on one wire by a signal switching on a parallel wire. This has an effect on the power consumption. Crosstalk effects are caused by the capacitance to adjacent wires in the same metal layer. Shielding the differential routes on either side with a power or ground line eliminates the cross-talk. Alternatively increasing the distance between the different differential pairs reduces the effect. The tradeoff is an increase in silicon area.

Differential pair routing has been available through gridless routers. But their goal is to route a few critical signals, such as the clock or general reset signal. They are not built for crypto applications where all signals need a differential route and thus router performance and completion rate degrade rapidly with increasing number of differential pairs. These tools are unable to route 20K+ differential pairs as an encryption algorithm requires. Highcapacity gridded routers on the other hand have no or only limited capability to route differential pairs and often avoid running wires in parallel to prevent cross-talk effects.

We have recently presented a way to work around tool limitations [START_REF] Tiri | Place and Route for Secure Standard Cell Design[END_REF]. The technique is built on top of a commercial place & route tool and forces the tool to route the two output signals at all times in adjacent tracks. In the technique, each differential output pair is abstracted as one single "fat" wire. The differential design is routed with the fat wire and at the end the fat wire is decomposed into the differential wire.

Automated Design Flow

We will now describe the secure digital design flow. Please recall that the design flow is depicted in Fig. 1.

In the logic design phase, the design specifications (design specs) are translated into a behavioral model (behavior.v). This is the creative phase in the IC design.

Logic synthesis is the process of mapping the behavioral model (behavior.v) into logic gates of the library file (lib.v). It generates a gate level description of the desired circuit (rtl.v). The constraints file (script) contains area and timing optimization directives. It also limits the type of gates used during synthesis. The gates available for synthesis depend on the WDDL cells that have been assembled. The library file is the original static CMOS standard cell library file.

The cell substitution procedure modifies the gate level description. A script, e.g. in PERL or in Awk, transforms the gate level netlist (rtl.v). Two files are generated: a fat gate level netlist (fat.v), which will be used to route the design, and a differential gate level netlist, which will be used in the verification tasks. The differential netlist is obtained by replacing each gate by its WDDL counterpart. The inverters are also removed; the inversions are implemented by switching the nets. The fat netlist is equivalent to the differential netlist except that the differential signals have been abstracted as one single signal. This procedure is not present in a regular design flow. The run time overhead is negligible. The parser required a little less then 4 minutes to generate both files for a prototype IC containing 39000 gates on a SunFire v100 (550MHz., 2GB RAM).

In the place & route step, the fat gate level netlist (fat.v) is placed and routed. The place & route tool requires a fat gate library database (fat_lib.lef). The library database contains cell macros and routing rules. Information from the original library files is used in procedures such as clock routing and timing driven placement. The resulting design file (fat.def) specifies the location of the cells in the core and of the interconnect wires.

The fat to differential routing transformation consists of two separate procedures: (1) a duplication and translation of the fat wires; and (2) a width reduction.

The interconnect decomposition procedure accomplishes the duplication and translation. This procedure edits the fat design file (fat.def). In a design file, wire segments are represented by lines between 2 points. The parser duplicates and translates the coordinates of the points. This is the second procedure not present in a regular design flow. It has a negligible timing overhead. The parser required 2 minutes to generate the differential design file (diff.def) for our 39K gate IC.

The width reduction is accomplished by updating the library database with the differential library database during the stream out of the design. In this step, the differential design file (diff.def) and the differential library database (diff_lib.lef), which contains the normal wire definition and the differential gate macros, are combined in the place & route tool to generate the layout (layout).

A WDDL gate is composed of gates that are supported by the vendor library. The standard verifications, executed in each stage, accurately verify functionality, delay and area in function of the original gates. Two extra measures validate the inserted cell substitution and interconnect decomposition procedures. A logic equivalence checker, such as Formality [12] or Verplex LEC [13] verifies the equivalence between the fat gate level netlist and the original netlist. Importing the differential gate level netlist during the stream out procedure verifies the equivalence between differential gate level netlist and the differential placed and routed design file.

Design Example

A test circuit is implemented through the secure digital design flow and through a regular digital design flow using ordinary static CMOS standard cells. The block diagram of the test circuit is depicted in Fig. 4. This circuit has been presented as a sufficient subset of the DES algorithm on which a Differential Power Analysis can be mounted [START_REF] Tiri | Securing Encryption Algorithms against DPA at the Logic Level: Next Generation Smart Card Technology[END_REF]. The algorithm has been reduced to this setup such that the instantaneous supply current transient can be simulated with the transistor level simulator Hspice.

Fig. 5 shows the resulting layouts. The secure implementation and the reference implementation require 12880µm 2 and 3782µm 2 respectively. The WDDL compound gates have been derived from the 0.18µm, 1.8V static CMOS standard cell library that has been used in the regular design flow. The single ended gate level netlist has been obtained through DesignAnalyzer [12]. Place & route have been done in Silicon Ensemble [13] with an aspect ratio of 1 and a fill factor of 80%. The language Awk is used in the parser to generate the fat and differential netlists. The spice netlists, which include the layout parasitics, have been extracted in Virtuoso [13]. In total, 2000 input vectors have been consecutively encrypted with a random input at the plaintext P L and P R , and with a fixed secret key K, equal to 46. The clock frequency of the circuit is chosen at 125MHz, and 800 'measurement' samples are made per clock cycle.

The clock and input signals are driven by cascaded inverters to provide realistic data and clock signals. The power consumption of the additional input circuitry is excluded from the measurements. The mean energy consumption is 27.1pJ and 4.6pJ for the secure implementa- tion and the reference implementation respectively. The normalized energy deviation, which specifies the absolute range of the variation on the energy consumption per encryption, is 6.6% and 60%. The normalized standard deviation is 0.9% and 12%. Fig. 6 shows the result from the DPA on the transient SPICE simulation on the extracted netlists, including all parasitic capacitances. Note that in a DPA, the supply current measurements are divided over 2 sets by means of a selection function and a guess on the secret key. The correct secret key is found with the aid of the differential traces. A differential trace is the difference between the typical supply currents of the two sets. The difference will approach zero for a wrong key guess, but has noticeable peaks if the correct secret key has been predicted.

The resistance against DPA is quantified with the MTD, the number of measurements to disclosure. Fig. 6 (left) shows that for the reference design 250 measurements are sufficient to disclose the secret key. The secure digital design flow on the other hand has been effective in reducing the peaks of the differential trace of the correct secret key: the peak-to-peak value of the secret key is conforming with the peak-to-peak value of the other key guesses. The Differential Power Analysis does not reveal the secret key. Fig. 6 (right) shows the peak-to-peak value of the differential traces of the secret key guesses for 2000 measurements. The secret key clearly stands out for the reference implementation.

Perfect security does not exist. Despite the fact that for instance noise and measurement errors will reinforce the level of security, increasing the number of samples may expose the secret key of the secure design. The more powerful an attacker is, the better his results may be. On the other hand, the more one is willing to invest, the higher the security will be. Shielded lines or a larger pitch, balanced intrinsic capacitances or custom designed cells, etc. will improve the security. With the introduction of the secure digital design flow, the problem has been reduced to a problem of parasitic effects.

Secure Digital Design Flow and other SCAs

A secure digital design flow must create a system that is secure against the collection of known practical sidechannel attacks. In the preceding sections, we have dealt with power attacks. We will now discuss how the design flow creates a system that thwarts timing attacks, Electromagnetic Analysis and Differential Fault Analysis.

Timing Attacks

Timing attacks are a class of cryptanalysis that takes advantage of timing information [START_REF] Kocher | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF]. For instance, the arrival time of the ciphertext may be determined by operations that depend on the secret key. Making the power consumption uniform does not remove the threat of a timing attack. Conditional branching with unequal lengths for example can still be seen. Therefore, a careful design that at all times has a worst case running time is still necessary.

Power measurements can nevertheless provide substantial timing information in spite of this conventional design practice. They expose idle cycles, which have been inserted to hide conditional branches with unequal lengths. If the state of the circuit does not change, the gates of a regular design will not switch and do not dissipate any power. This is not the case for a system that employs a logic style with a 100% switching factor, as is done in the secure digital design flow. When desired, idle cycles can be inserted. Every gate has a switching event in every cycle, whether or not useful data is processed or in other words whether or not idle cycles have been inserted.

Electromagnetic Analysis

The flow of electric charges produces an electromagnetic field. Electromagnetic Analysis (EMA) is the equivalent of a power attack but instead uses the electromagnetic fields generated by the (dis)charging gates as the side channel information [START_REF] Quisquater | ElectroMagnetic Analysis (EMA): Measures and Counter-measures for Smard Cards, E-smart'01[END_REF]. There are differences. A power attack has only access to the global power consumption. An EMA however, can do measurements that are confined to a small area of the security IC. On the other hand, a power attack can be mounted rather quickly with off-theshelf devices, whereas an EMA requires an advanced measurement setup.

The electromagnetic fields are generated by the electric charge that flows through the power lines and either of the 2 differential output wires. Since ideally the same amount of charge is used, the only option to differentiate between different switching events is to detect which of the 2 differential output wires the charge flows through.

The differential output wires have been routed at a distance of about 1µm apart with the special place & route approach, while their length is 10 to several 100µm. The measurement probe on the other hand is positioned at a few millimeters from the device [START_REF] Quisquater | ElectroMagnetic Analysis (EMA): Measures and Counter-measures for Smard Cards, E-smart'01[END_REF]. The resulting measurement setup is depicted in Fig. 7. The measurement probe must distinguish between electromagnetic fields generated between two antennas for which the distance in between (1µm) is orders of magnitude smaller then their length (10-100µm), while the distance between the probe and the antennas (1-10mm) is another multiple order of magnitude larger. Furthermore, many cells switch simultaneously and thus large numbers of antennas are broadcasting at the same time and in the same area. In the available literature [START_REF] Quisquater | ElectroMagnetic Analysis (EMA): Measures and Counter-measures for Smard Cards, E-smart'01[END_REF], [START_REF] Gandolfi | Electromagnetic Analysis: Concrete Results[END_REF], [START_REF] Agrawal | The EM Side-Channel(s)[END_REF], a measurement setup with this kind of accuracy has not been demonstrated.

Differential Fault Analysis

In Differential Fault Analysis (DFA), the attacker tries to force an error in the internal state of the circuit, and subsequently exploit weaknesses of the algorithm under malfunctioning. The main countermeasure against DFA is fault detection. The idea is to monitor if one has tried to corrupt the computation, and in such an event to shut down the processor and delete any valuable information as soon as possible.

A dynamic and differential logic style, such as WDDL, employs redundant encoding. This means that a state is actually represented by 2 bits instead of 1 bit, as is the case in a normal single ended logic, such as static CMOS logic. With redundant encoding error detection is possible. For instance, in a glitch attack, the clock frequency is temporarily increased with the intention to force a state-bit or a selected conditional branch by not giving enough time for all calculations to complete. If at the rising clock edge an input signal to a register is differential it means that it has correctly evaluated. On the other hand if both inputs remain at zero, the clock frequency has been increased and the circuit should be put in the alarm state. Of course, it is sufficient to monitor the critical path of the system. In other DFAs, electromagnetic radiation, such as light or radio waves, is used to flip a state-bit. Here a similar approach can be worked out, except that the detection is not restricted to 1 register.

Conclusions

We have presented a secure digital design flow. The design flow provides an accessible means to fabricate a security IC that is SCA resistant regardless of the implementation details. It relies on a logic style that has constant power consumption and a place & route approach that controls the parasitic effects. The design flow is completely supported by mainstream EDA tools and depending on the required level of security several options are available to strengthen the security. Experimental results have demonstrated that the design flow results in a DPA resistant layout and we have argued the effective obstruction of a collection of know practical SCAs.

Fig. 1 .

 1 Fig. 1. Main tasks of secure digital design flow.

Fig. 2 .

 2 Fig. 2. AOI32: static CMOS (left); and WDDL (right).

Fig. 3

 3 demonstrates the place & route approach. The figure shows a placed & routed design consisting of 6 gates. At the left, the result is shown of the fat routing. At the right, the result after decomposition is shown. Two normal wires replace each fat wire.

Fig. 3 .

 3 Fig. 3. Fat design (left); and differential design (right).

Fig. 4 .Fig. 5 .

 45 Fig. 4. Design example: DPA on a module of DES [5].

Fig. 6 .

 6 Fig. 6. Measurements to disclosure (top); peak-to-peak of differential traces at 2000 measurements (bottom).

Fig. 7 .

 7 Fig. 7. Measurement setup (not drawn to scale).

Proceedings of the Design, Automation and Test in Europe Conference and Exhibition (DATE'05) 1530-1591/05 $ 20.00 IEEE

Proceedings of the Design, Automation and Test in Europe Conference and Exhibition (DATE'05)


MD Aurore Bussat

MD Maia Proisy

MD Bertrand Bruneau

MD Guillaume Bouzillé

MD Céline Chappé

MD, PhD Laurent Riffaud

Edema of the optic tract in patients with tumors of the sellar region: clinical and visual implications in the pediatric population

Keywords: optic tracts, edema, sellar region, brain tumor, pediatric, MRI, surgical technique

 but it has since been described in other types of tumors and almost exclusively in adults.

Few studies have assessed the clinical significance of ABBREVIATIONS BCVA = best-corrected visual acuity; EOT = edema of the optic tract; MR = magnetic resonance.

R e v i s e d

m a n u s c r i t p t 2 EOT in parasellar tumors. Some reports have found this edema to be correlated with visual impairment, [START_REF] Baggenstos | Progressive peritumoral edema defining the optic fibers and resulting in reversible visual loss[END_REF][START_REF] Pamir | Outcome determinants of pterional surgery for tuberculum sellae meningiomas[END_REF][START_REF] Saeki | Oedema along the optic tracts due to pituitary metastasis[END_REF][START_REF] Wang | Surgical management and evaluation of prognostic factors influencing postoperative visual outcome of suprasellar meningiomas[END_REF] but others have not confirmed this negative influence. [START_REF] Nagahata | Edema along the optic tract: a useful MR finding for the diagnosis of craniopharyngiomas[END_REF][START_REF] Saeki | MR imaging study of edema-like change along the optic tract in patients with pituitary region tumors[END_REF] To date, the consequence of EOT has never been evaluated specifically in the pediatric population. Here, we discuss a series of 26 children who presented with a tumor of the sellar region to analyze both distinctive clinical and radiological features associated with the development of EOT and the specific influence of this edema on visual function. The aim of the study was to clarify whether the presence of such an edema represents a factor of visual impairment in tumors of the sellar region, which could influence our routine practice and treatment strategies.

Methods

We retrospectively reviewed collected data from patients younger than 18 years who were underwent surgery for a tumor of the sellar region at our institution between January 2005 and January 2016. Data were collected on patient characteristics, ophthalmological evaluations, and neuroimaging findings. The surgeries were performed by a senior pediatric neurosurgeon (L.R.), and tumor type was confirmed by histological analysis in all cases. Surgical strategies were tailored to each patient: biopsy when a malignant tumor was suspected, or as complete a resection of the tumor as possible in the other cases, which was guided by what the surgeon considered prudent at the time.

The patients with intrasellar tumors that were located a distance from the visual pathways were excluded: microadenoma, intrasellar Rathke's cleft cyst, inflammation or infectious lesion of the pituitary gland, and orbital tumor. Primary optic nerve and chiasm tumors, such as optic nerve gliomas, were excluded because they represent intrinsic tumors of the optic pathways and edema could not be differentiated from local tumoral infiltration. Cases of neurofibromatosis type 1 were also excluded because of the presence of unidentified bright objects in the basal ganglia of patients with this disorder, which could generate false positives.

Patient Characteristics

Of 49 children who were initially identified, 23 were excluded: 2 patients died soon after surgery, 8 patients had optic nerve glioma, 1 patient had ganglioglioma and early and profound loss of vision, 7 patients had microadenoma, 1 patient had nonspecific pituitary inflammation, 1 patient had pituitary abscess, 2 patients had intrasellar Rathke's cleft cyst, and 1 patient did not have an initial MR image available. Finally, 26 patients comprised our patient cohort.

Two opposing groups were then defined according to the presence or absence of EOT on MR images.

Symptoms at presentation were analyzed and compared between groups: presence or absence of the signs of intracranial hypertension and the signs of endocrine deficiency and hypothalamic syndrome. The type of surgical procedure (total or partial resection or biopsy), adjuvant treatment (chemotherapy or radiotherapy), and presence or absence of recurrence were also examined. None of the patients were treated with glucocorticosteroids because their use is not a routine therapeutic strategy for tumors of the sellar region at our institution, regardless of the radiological and ophthalmological conditions.

Ophthalmological Examination

Ophthalmological examinations were conducted by senior ophthalmologists either before or after treatment of the tumor. Practitioners were not aware of the presence or absence of EOT; this aspect was later studied retrospectively.

Best-corrected visual acuity (BCVA) for both eyes was evaluated before treatment, 3-6 months after treatment, and at the last follow-up (1-6 years later). Visual acuity was measured by using a Monoyer chart, Snellen chart, or Pigassou symbols chart that had been converted to decimals. Only distant vision was taken into account. Visual field deficiencies were described according to the side and type of deficit (hemianopia, quadrantanopia, diffuse loss of sensibility, enlarged blind spot, or normal). Data were collected separately for each eye and were graded into 3 groups (see the paragraph below about visual field deficiencies). The presence or absence of papilledema and optic disc pallor detected by fundus examination was also recorded. No patient had previously known strabismus or amblyopia.

To evaluate and compare visual function impairment, we converted ophthalmological data to a global visual function score (Table 1). This score ranged from 10 (normal visual acuity and visual field in both eyes) to 0 (both eyes had severe to total vision loss and severe visual field impairment). The global visual function score took into account asymmetrical visual deficiency in terms of visual loss (interocular difference in BCVA ≥ 0.1) and any visual field deficiency as follows: 0, both eyes involved; 1, one eye; 2, neither. The visual acuity score was defined according to the International Classification of Diseases, 10th Revision (code H54; http://apps.who.int/classifications/apps/icd/ icd10online2003/fr-icd.htm?gh53.htm+): 21 0, severe to total vision loss (no light perception to BCVA ≤ 0.1); 1, moderate vision loss (BCVA ≥ 0.12 to < 0.3); 2, mild vision loss (BCVA ≥ 0.3 to ≤ 0.7); 3, normal vision (BCVA ≥ 0.8).

All visual fields were monocular, either automated or manual, and visual field deficiencies were converted into the following scores: 0, severe visual impairment, including the total loss of the visual field of 1 eye, homonymous lateral hemianopia, bitemporal hemianopia, or hemianopia plus any deficiency in the other eye; 1, mild visual impairment, including diffuse loss of sensibility, enlargement of the blind spot, and quadrantanopia in 1 or both eyes; and 2, no visual field deficiency.

We compared visual acuity, visual field results, and global scores in both groups before and after treatment. Two patients in the edema group did not undergo initial visual acuity and visual field evaluations because of an emergency, and 5 patients in the group without edema were not given initial visual field evaluations because of their young age.

Neuroimaging Findings

All patients underwent pre-and postoperative MRI, including T1-and T2-weighted imaging. MR images were reviewed by 2 pediatric radiologists (M.P. and B.B.). EOT was defined by a high-intensity signal along the optic tract on the axial and/or coronal planes on T2-weighted imaging and without any enhancement on T1-weighted imaging after contrast injection (Figs. 123). If present, EOT was classified into 3 categories: symmetrical, right predominance, or left predominance. Intensity was classified as slight, mild, or severe. Additional imaging findings were evaluated: tumor size (3 dimensions), tumor location (sellar, suprasellar, or both), presence of tumor cyst and hydrocephalus, presence of dilated Virchow-Robin spaces, and compression of the optic tracts. Upward or forward displacement of the optic chiasm and the type of mass effect on this structure, i.e., at a distance from the lesion, close contact, stretched and laminated, or invaded, were also studied.

Statistical Analysis

The Mann-Whitney U-test, Fisher exact test, and Pearson chi-square test were used for statistical comparisons of the 2 groups using R statistical software (version 3.3.3), and p < 0.05 was considered to be statistically significant.

Results

Patient Characteristics

Twenty-six patients were included in the study: 17 patients with craniopharyngioma, 3 patients with pilocytic astrocytoma, 2 patients with ganglioglioma, 2 patients with germ cell tumor, 1 patient with macroprolactinoma, and 1 patient with Rathke's cleft cyst (Table 2). There were 11 children in the group with edema and 15 children in the group without edema. None of the following criteria were

Ophthalmological Examination

The results of the ophthalmological examinations of the 2 groups are presented in Table 3.

The median global visual function scores were not statistically significantly different between the groups either at presentation or at final evaluation. Although nonsignificant, improvement of the median global visual function score was higher in the group without edema when compared with the group with edema (8.5 vs 7). After treatment, the median global score in the group with edema improved in 56% of patients, remained stable in 11% of patients, and became worse in 33% of patients. In the second group, the median global score improved in 40% of patients, remained stable in 50% of patients, and became worse in 10% of patients.

For the visual acuity score, no statistical differences were observed between the 2 groups either at presentation or after treatment. The distributions of the degree of visual acuity deficiency and evolution of the scores before and after treatment were identical in the 2 groups.

Visual field score at presentation demonstrated some statistical differences between the 2 groups: the visual Although not significant, the number of patients with optic disc pallor was higher in the group without edema, both at diagnosis and at final examination. More than half of the patients in this group (57%) exhibited optic disc pallor at fundus examination after treatment.

Neuroimaging Data

The neuroimaging findings are summarized in Table 2. Ten patients in each group had compression of the optic tracts, which represented 91% of the patients with edema and 67% of the patients without edema (p = 0.19). All patients without edema but only 9 of 11 (82%) patients in the group with edema had intratumoral cysts (p = 0.17). No statistical difference was observed between the 2 groups in terms of the mass effect on the optic chiasm or tumor size, regardless of which axis was measured, nor was the incidence of hydrocephalus at diagnosis different between the groups: approximately one-third of the patients had hydrocephalus in each group. Dilated Virchow-Robin spaces were rarely observed in either group.

Postoperative MRI demonstrated that EOT disappeared in all patients, except for 2 patients: a patient with a pilocytic astrocytoma still had EOT after biopsy, as did a second patient with ganglioglioma who underwent subtotal resection. In the latter case, edema disappeared after surgery and appeared again at recurrence.

Discussion

Although first described as craniopharyngioma, [START_REF] Higashi | Moustache" appearance in craniopharyngiomas: unique magnetic resonance imaging and computed tomographic findings of perifocal edema[END_REF] EOT was later reported in the adult population and in association with other types of tumors, such as pituitary metastasis, pituitary adenoma, meningioma, Rathke cleft's cyst, and germ cell tumor. [START_REF] Asaeda | MR imaging study of edema along the optic tract in patient with Rathke's cleft cyst[END_REF][START_REF] Saeki | Oedema along the optic tracts due to pituitary metastasis[END_REF][START_REF] Shizukuishi | Granular cell tumor of the neurohypophysis with optic tract edema[END_REF][START_REF] Sklar | Optic tract edema in a meningioma of the tuberculum sellae[END_REF][START_REF] Takahashi | A case of metastatic suprasellar tumor with edema along the optic pathway[END_REF][START_REF] Wang | Surgical management and evaluation of prognostic factors influencing postoperative visual outcome of suprasellar meningiomas[END_REF] No risk factor has yet been demonstrated. In a series of 49 adults and children who were treated for parasellar tumors, Hirunpat et al. [START_REF] Hirunpat | Optic tract edema: a highly specific magnetic resonance imaging finding for the diagnosis of craniopharyngiomas[END_REF] found 7 EOTs exclusively in patients with craniopharyngioma and concluded that this type of edema shows good sensitivity and specificity for the diagnosis of craniopharyngioma. In our study, as in others, [START_REF] Saeki | Oedema along the optic tracts due to pituitary metastasis[END_REF][START_REF] Siemons | Optic tract edema sign and craniopharyngiomas[END_REF] EOT was most often related to craniopharyngioma but not exclusively so.

The mechanism of EOT remains controversial. According to Nagahata et al., [START_REF] Nagahata | Edema along the optic tract: a useful MR finding for the diagnosis of craniopharyngiomas[END_REF] it may correspond to an inflammatory reaction of the brain tissue to the presence of the neoplasm (cytotoxic edema). Kawamura et al. [START_REF] Kawamura | Peritumoral brain edema associated with pediatric brain tumors: characteristics of peritumoral edema in developing brain[END_REF] asserted that it was caused by the leakage of serum from the newly formed blood vessels in a tumor lacking the normal bloodbrain barrier (vasogenic edema). Kearney et al. [START_REF] Kearney | Craniopharyngioma and the moustache sign[END_REF] suggested that it could result from the leakage of the fluid content in the cystic areas of the tumor. In meningioma in adults, the roles of oligemia, altered metabolism surrounding the tumor, vascular endothelial growth factor, macrophages, and leukotrienes have been mentioned. [START_REF] Sklar | Optic tract edema in a meningioma of the tuberculum sellae[END_REF] More recently, Saeki et al. [START_REF] Saeki | Histologic characteristics of normal perivascular spaces along the optic tract: new pathogenetic mechanism for edema in tumors in the pituitary region[END_REF][START_REF] Saeki | MR imaging study of edema-like change along the optic tract in patients with pituitary region tumors[END_REF] showed in 3 patients that EOT may be related to distended, large Virchow-Robin spaces. However, in our study, the dilation of the Virchow-Robin spaces was R e v i s e d m a n u s c r i t p t present in only 3 of the patients with edema, which does not support this hypothesis. Moreover, we observed this aspect in a child without edema.

The presence of EOT was not correlated with tumor size in our series as previously observed by others. [START_REF] Hirunpat | Optic tract edema: a highly specific magnetic resonance imaging finding for the diagnosis of craniopharyngiomas[END_REF][START_REF] Nagahata | Edema along the optic tract: a useful MR finding for the diagnosis of craniopharyngiomas[END_REF][START_REF] Saeki | MR imaging study of edema-like change along the optic tract in patients with pituitary region tumors[END_REF] This result may suggest the role of other factors, like the rate of tumor growth or a certain degree of histopathological aggressiveness, in both adults and children. This hypothesis is illustrated by the adult patients with pituitary metastasis: patients had visual impairment both when the tumor grew and when EOT appeared. [START_REF] Saeki | Oedema along the optic tracts due to pituitary metastasis[END_REF] In craniopharyngioma, despite its benign histology, the role of aggressive behavior rather than size in some of these tumors is supported by observations: the duration of clinical symptoms in the pediatric population is not related to visual impairment and tumor size. [START_REF] Hoffmann | History before diagnosis in childhood craniopharyngioma: associations with initial presentation and long-term prognosis[END_REF] The results of our study demonstrated that the visual field was significantly more damaged at diagnosis in the patients with edema when compared with the patients without edema: only 1 normal visual field was observed in the EOT group versus 6 in the group without edema. Interestingly, visual fields improved twice as much after treatment in the group with edema. Therefore, we suppose that EOT may result in significant impairment of vision and specifically alteration of the visual field, which could improve to a certain degree after treatment of the tumor. We also observed that the incidence of papilledema and optic disc pallor did not differ between the 2 groups. This result also argues against the role of tumor size and intracranial hypertension in the occurrence of edema. It also suggests the role of the local aggressiveness of the tumor toward neural tissue. The number of patients with papilledema in both groups was much lower than that in case series of other pediatric cerebral tumors and craniopharyngioma. [START_REF] Alswaina | Ophthalmic features of outpatient children diagnosed with intracranial space-occupying lesions by ophthalmologists[END_REF][START_REF] Drimtzias | The ophthalmic natural history of paediatric craniopharyngioma: a long-term review[END_REF][START_REF] Lee | Papilledema in children with hydrocephalus: incidence and associated factors[END_REF] Finally, and in accordance with these previous reports, the incidence of optic atrophy after treatment was higher than at diagnosis. This study has some limitations. It is a retrospective study of nonstandardized ophthalmological examinations by multiple practitioners. The general condition of the children as a result of the tumors may have compromised the accuracy of the visual acuity and field measurements, and the study concerned a limited number of patients. However, this is the largest series reported so far, and the population is quite homogeneous because we excluded intrinsic tumors of the visual pathways. Furthermore, we suggest a global score of visual function that includes the visual acuity of both eyes, visual field results, and number of eyes impaired. This type of simple global score was previously proposed as a way to evaluate the ophthalmological history of pediatric patients with craniopharyngioma. [START_REF] Drimtzias | The ophthalmic natural history of paediatric craniopharyngioma: a long-term review[END_REF] It has the advantage of allowing easy comparison of pre-and postoperative examinations of each patient and between groups. Other data, like visual evoked potential, color and contrast vision, and retinal nerve fiber layer thickness as determined by optical coherence tomography, may also be used in the future to better understand this edema. However, complete standardized ophthalmological examination of children remains a challenge in the context of emergency.

Because we do not routinely use glucocorticosteroids in this type of situation, their potential beneficial influence on the evolution of EOT and visual function remains undefined. The role of surgery and its extent also represent an undetermined bias when evaluating the exact role of EOT on visual outcome in patients with these tumors, even in the context of a single-institution study and homogeneous surgical strategy.

Conclusions

Our study confirms that EOT in the context of a tumor of the sellar region in children is not necessarily associated with a less-favorable visual prognosis. It was not possible to distinguish specific factors that are responsible for the appearance of such edema because the cohort of patients was insufficiently small. R e v i s e d m a n u s c r i t p t

R e v i s e d m a n u s c r i t p t 3

 3

FIG. 1 .

 1 FIG. 1. Case 1. A 10-year-old girl with a germ cell tumor at diagnosis. A-C: Axial FLAIR MR images showing a bilateral hyperintense signal along the optic tracts (arrows) that produces the moustache sign. D: Coronal T2-weighted MR image showing a symmetric hyperintense signal of the optic tracts (arrows).

FIG. 2 .

 2 FIG. 2. Case 2. A 9-year-old boy with large retrochiasmatic craniopharyngioma at diagnosis. A: Axial T2-weighted MR image. The arrow indicates the optic tract. B: Axial FLAIR MR image. The arrow indicates the optic tract. C: Coronal T2-weighted MR image showing a hyperintense signal along the right optic tract (arrow).

  s c r i t p t statistically different between the 2 groups: age, sex, clinical symptoms at presentation, treatment, type of tumor, recurrence.

FIG. 3 .

 3 FIG. 3. Case 3. A 9-year-old girl with large cystic craniopharyngioma at diagnosis. A: Sagittal T2-weighted MR image showing forward displacement of the optic chiasm (arrowhead). B: Axial T2-weighted MR image showing a bilateral asymmetrical hyperintense signal along the optic tracts and predominantly on the right side (arrows). The arrowhead indicates the optic chiasm.

TABLE 1 . Global visual function score*

 1

	Visual acuity score †
	0	Severe to total vision loss: no light perception to
		BCVA ≤ 0.1
	1	Moderate vision loss: BCVA ≥ 0.12 to < 0.3
	2	Mild vision loss: BCVA ≥ 0.3 to ≤ 0.7
	3	Normal vision: BCVA ≥ 0.8
	Visual field score
	0	Severe visual field deficiency: total loss of the
		visual field of 1 eye, homonymous lateral
		hemianopia, bitemporal hemianopia, & hemi-
		anopia plus any deficiency in the other eye
	1	Mild to moderate visual field deficiency: diffuse
		loss of sensibility, enlargement of the blind
		spot, & quadrantanopia in 1 or both eyes
	2	Normal
	Laterality
	0	Both eyes involved
	1	1 eye involved
	2	Normal

* The global visual function score consists of the sum of total visual acuity score in both eyes, visual field score, and laterality score (range 0-10).

† The total visual acuity is scored in both eyes (range 0-6).

TABLE 2 . Patient characteristics and neuroimaging findings

 2

			Group w/o	p
	Characteristic	Group w/ Edema	Edema	Value
	No. of patients	11	15
	Sex			>0.99
	Male	3 (27)	5 (33)
	Female	8 (73)	10 (67)
	Age at presentation, yrs	10 (8-11.5)	7 (6-9.5)	0.13
	Intracranial hypertension	5 (45)	9 (60)	0.46
	Signs of endocrine	5 (45)	9 (60)	0.46
	deficiency
	Type of endocrine			0.49
	deficiency
	Diabetes insipidus	1 (9)	2 (13)
	Growth retardation	4 (36)	4 (27)
	Both	0	3 (20)
	Hypothalamic syndrome	4 (36)	4 (27)	0.68
	Compression of optic	10 (91)	10 (67)	0.19
	tracts
	Position of optic chiasma			0.18
	Displaced upward	6 (55)	3 (20)
	Displaced forward	0	3 (20)
	Mass effect on optic			0.48
	chiasma
	At a distance	1 (9)	0
	Close contact	2 (18)	4 (27)
	Stretched	5 (45)	4 (27)
	Invaded	3 (27)	7 (47)
	Tumor size, mm
	Axial transverse
	direction
				0.56
	Frontal height	36 (29.25-40)	35 (24-44.5)	0.66
	Localization			0.37
	Suprasellar	2 (18)	1 (7)
	Supra-& intrasellar	6 (55)	11 (73)
	Supra-, retro-, &	0	2 (13)
	intrasellar
	3rd ventricle	1 (9)	0
	Other	2 (18)	1 (7)
	Dilated Virchow-Robin	3 (27)	1 (7)	0.28
	spaces
	Intratumoral cysts	9 (82)	15 (100)	0.17
	Hydrocephalus	3 (27)	5 (33)	>0.99
	Tumor type			0.87
	Craniopharyngioma	6 (55)	11 (73)
	Pituitary adenoma	0	1 (7)
	Pilocytic astrocytoma	2 (18)	1 (7)
	Ganglioglioma	1 (9)	1 (7)
	Germinoma	1 (9)	1 (7)
	Rathke's cleft cyst	1 (9)	0
			CONTINUED ON PAGE 5 »

22.5 (20.25-26.5) 27 (18.5-38.5) 0.39 Axial anteroposterior direction 22.5 (20.25-27.75) 25 (17.5-39)

Acknowledgments

We thank Mrs. Deirdre McKeown for her help with writing the English-language version of this study.

Disclosures

The authors report no conflict of interest concerning the materials or methods used in this study or the findings specified in this paper.

Author Contributions

Correspondence

Laurent Riffaud: Pontchaillou University Hospital, Rennes, France. laurent.riffaud@chu-rennes.fr.