EM-FI Transient Probe

Introduction

With increasingly challenging chip packages and sophisticated light-sensitive sensors to prevent optical laser faults Riscure presents a new testing vector for fault injection scenarios. The EM-FI Transient Probe induces fast, high power, EM pulses on a user-defined location of the chip. EM-FI testing allows bypassing traditional countermeasures and provides the next step in high-end security tests.

Key features

Does not require de-packaging the chip.

Adjustable high power pulses.

Fast and predictable response to trigger.

EM glitches are not detected by light sensors meshes.

Different coils included to generate different EM fields over a chip.

Fits Riscure EM Probe Station and Diode Laser Station for automated scanning.

Flips value of logic cells on target device.

Optional camera for precise and careful probe positioning.

Lower chance of permanent chip damage compared to laser glitching.

Fast and short pulses configurable from software. Fast and predictable response to trigger. Fits Riscure EM Probe Station and Diode Laser Station for automated scanning.

How to use EM-FI Transient Probe

The EM-FI Transient probe offers a powerful addition to the fault injection setup. The easy setup and testing make it a relatively easy and time-saving way of performing localized faults on modern chips. The EM-FI transient probe offers a fast and predictable pulse that meets the demands of international testing laboratories and manufacturers. The set of probes, XY table and camera offer a complete and powerful setup that can be controlled and parameterized flexibly through the Inspector FI software. The software allows automation of testing scenarios and easy reporting for further analysis and refinements of the scenario. Like all other hardware components Riscure offers the EM-FI Transient Probe to be used in stand-alone or custom environments as well integrated with your own hardware and software.

Inspector integration

The VC Glitcher controls the timing and power settings of the probe EM pulse, and performs triggering, synchronous power measurements for card communication. For embedded devices Inspector support a multitude of devices and protocols to generate an environment suitable for your testing setup. A current probe or power probe is recommended for power monitoring of the embedded device. The stage and camera connect to the Inspector FI software for navigation and automated surface scanning. The solution can further be extended with icWaves to trigger faults and to prevent a device from breaking down after an EM attack.

Technical specifications

Maximum voltage over coil: 450 V (+/-10%)
Maximum internal current: 64A
EM pulse power control: 5 – 100%
Pulse width at digital glitch input for full power: 50 ns
Max switching frequency with constant power: 1 MHz
Operating temperature: 0-70°C

1.5mm tip / 4mm tip characteristics:

Propagation delay (as time difference from 10% of digital glitch to 10% of current monitor): 50ns (+/-10%) / 51ns (+/-10%)
Propagation delay (as time difference from 10% of digital glitch r to 10% of EM pulse T4-T1): 40ns (+/-10%) / 42ns (+/-10%)
Max current through coil of probe tip: 56 A (+/-10%) / 48 A (+/-10%)
Max voltage at current monitor: –1.4 V (+/-10%) / -1.2 V (+/-10%)
Pulse width of the waveform at Current Monitor: 17ns (+/-10%) / 20ns (+/-10%)

Contact us
Bartek Gedrojc 大虎
Sales and Business Development Director Tools