Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/22—Detection or location of defective computer hardware by testing during standby operation or during idle time, e.g. start-up testing
  • G06F11/24—Marginal checking or other specified testing methods not covered by G06F11/26, e.g. race tests
• • G—PHYSICS
  • G01—MEASURING; TESTING
  • G01R—MEASURING ELECTRIC VARIABLES; MEASURING MAGNETIC VARIABLES
  • G01R31/00—Arrangements for testing electric properties; Arrangements for locating electric faults; Arrangements for electrical testing characterised by what is being tested not provided for elsewhere
  • G01R31/28—Testing of electronic circuits, e.g. by signal tracer
  • G01R31/2832—Specific tests of electronic circuits not provided for elsewhere
  • G01R31/2836—Fault-finding or characterising
  • G01R31/2849—Environmental or reliability testing, e.g. burn-in or validation tests
• • G—PHYSICS
  • G01—MEASURING; TESTING
  • G01R—MEASURING ELECTRIC VARIABLES; MEASURING MAGNETIC VARIABLES
  • G01R31/00—Arrangements for testing electric properties; Arrangements for locating electric faults; Arrangements for electrical testing characterised by what is being tested not provided for elsewhere
  • G01R31/28—Testing of electronic circuits, e.g. by signal tracer
  • G01R31/302—Contactless testing
• • G—PHYSICS
  • G01—MEASURING; TESTING
  • G01R—MEASURING ELECTRIC VARIABLES; MEASURING MAGNETIC VARIABLES
  • G01R31/00—Arrangements for testing electric properties; Arrangements for locating electric faults; Arrangements for electrical testing characterised by what is being tested not provided for elsewhere
  • G01R31/28—Testing of electronic circuits, e.g. by signal tracer
  • G01R31/302—Contactless testing
  • G01R31/305—Contactless testing using electron beams
• • G—PHYSICS
  • G01—MEASURING; TESTING
  • G01R—MEASURING ELECTRIC VARIABLES; MEASURING MAGNETIC VARIABLES
  • G01R31/00—Arrangements for testing electric properties; Arrangements for locating electric faults; Arrangements for electrical testing characterised by what is being tested not provided for elsewhere
  • G01R31/28—Testing of electronic circuits, e.g. by signal tracer
  • G01R31/302—Contactless testing
  • G01R31/308—Contactless testing using non-ionising electromagnetic radiation, e.g. optical radiation
  • G01R31/311—Contactless testing using non-ionising electromagnetic radiation, e.g. optical radiation of integrated circuits

Definitions

• the present invention relates to a method of testing a software application. It is usable in the field of electronic cards regardless of the application implemented by such cards.
• the target electronic maps are mainly those that are subject to external energy interactions.
• software application is meant digital or analog processing of input data to produce output data.
• the input data may be measurements from a measuring device or electrical states of such an organ, whether or not carried by the card.
• the output data are either data of the same type as the input data, but corrected or transformed, either attributes of these data, or actuator commands driven by the electronic card.
• An electronic card is distinguished from an electronic component in that it may comprise a set of electronic components used for the logistics of maintaining a main component carried by the card in service.
• An electronic card essentially comprises a connector or connection device allowing the card to be connected inside a device.
• transient faults a transient current created by an ionization causes either a transient current that propagates in the circuit, or a switchover of one or more electrical states (in the case of a memory or a register). In the latter case the effect is called a transient because, if the contents of the memory or the register is rewritten, the error disappears;
• the architecture of the equipment or system may offer some protection.
• Embedded applications therefore have a certain tolerance to faults that must be quantified. This quantification is not accessible today.
• a number of methods and techniques at the hardware, operating system and application software level protect an embedded application against transient and permanent faults. They are called mitigation techniques. More specifically, the invention relates to a method for evaluating and validating fault tolerance of applications and mitigation techniques vis-à- transient effects and permanent effects that affect logical and analog electronic components.
• An electronic component may consist, inter alia, of a user memory part, of a memory part necessary for its configuration, of logical resources making it possible to carry out the operations, of resources necessary for the communication between the different logical blocks and of resources needed to communicate this component with its environment.
• a parasitic current can propagate in a series of logic gates, and attenuate then disappear without being memorized by a register.
• the problem of the designer is to quantify this tolerance in order to apply a fair level of mitigation.
• the error correction codes can be used to detect and correct one or more errors.
• the most complex error correction codes can detect and correct multiple simultaneous errors.
• Other mitigation techniques are the periodic rewriting of data or the periodic verification of data that may be corrupted and followed by the rewrite of this data if an error is detected.
• redundancy methods usually triplication
• voting system allows, in the event that an error occurs in one of the duplicated resources, to prevent the error has a consequence on the function performed by the component or the card.
• mitigations can be implemented at the level of the operating system, at the level of the application software, at the level of the architecture of the electronic equipment, and at the higher level of the global system architecture.
• the component is mounted on a user card and is executing its application.
• the laser radiation is focused within the component at the areas that exhibit sensitivity to charge injection.
• the card is integrated or not in a device and / or a system.
• the injection of faults makes it possible to quantify, directly or after analysis, the tolerance to transient and permanent faults of the application, and / or to validate the mitigation techniques implemented to protect the application vis-à-vis these same faults.
• the repetitiveness over time of the aggressions carried out by the laser and the short duration of these excitations make it possible to characterize in a realistic way the reaction of the component, while the application is running.
• the subject of the invention is therefore a method for testing a software application implemented using an integrated circuit electronic component in which
• the sensitivity of the application to the faults induced by the energetic particles in the component in a test installation is measured that it is in operation and that it operates the application
• the electronic component is put into operational service and, because of this commissioning, the component is synchronized by a clock signal and has an application cycle time
• a functional state of service being different from a static state of service in that the component performs, in functional service, an application function, other than an internal logistics function implemented in a static state of service, the electronic component thus switched on is excited by means of pulses of pulsed laser radiation produced by the test installation,
• the component receives time-varying input signals during this test on its inputs, and produces output signals that vary over time in correspondence with its outputs, and measures a malfunction of the application operated by the electronic component put into service corresponding to this excitation,
• the integrated circuit component is mounted on an electronic card capable of operating the application,
• the electronic card capable of the application is placed in the test installation,
• the excitation pulses are triggered by an asynchronous or synchronous signal of this clock signal of the cycle of the application.
• the laser radiation is focused at different depths in the component, and the duration of the pulses is limited to a duration less than or equal to one nanosecond
• FIG. 2 A timing diagram showing the component clock signals, laser pulse dates of the invention and the application cycle times implemented;
• FIG. 3 For an area of interest according to the invention, a critical energy reading for which interactions are critical, as a function of a depth of focus, and a choice of excitation energy.
• FIG. 1 shows a device that can be used to implement the method of the invention.
• the object of the invention is to measure the effects of energy interactions in an electronic component 1.
• the electronic component 1 thus comprises, in a known manner, and presented upside down, a semiconductor crystal 2 in which are carried out various implantations: caissons and zones implanted by impurities.
• Connections typically metallic, such as 3 open on a connection interface 4 of the electronic component 1.
• the semiconductor plate 2 may be surmounted by a protection 5, for example a metallization.
• the protection 5 is located on a face of the crystal 2 opposite to the one where the connections 3 are made.
• this component 1 is mounted on an electronic card 6 of printed circuit, monolayer or multilayer.
• the card 6 may be an actual card for using the component 1.
• the card 6 comprises in this respect other components such as 7 and 8, of the 9-pin type of connection crossing the card 6, or of the ball type solders such as for surface mounted components.
• the component 1 is itself of the surface-mounted component type, with solder balls connected to the metallizations 3, but this is not an obligation.
• the card 6 has components 7 and 8 useful for its operation.
• these components are of the quartz clock type, transmission filters, decoupling components, switches or switches, or even microcontrollers.
• the component 1 may be for example a microprocessor, with or without integrated associated memory or a programmable logic component (FPGA).
• the card 6 has a connector 11. In the invention, this card is used connector 11 to connect the card 6 to the test apparatus.
• the connector 11 is connected in the card to tracks such as 12 leading to the components 1, 7 and 8.
• the tracks 12 can be distributed in the thickness 13 of the card for a multilayer type electronic card.
• a test apparatus is used. With this apparatus, the component 1 is excited by means of a laser source 14.
• This laser source 14 emits radiation 15 which attacks the electronic component 1.
• the component 1 is subjected to this aggression by its base 5.
• the protection 5 is open (in particular by chemical or mechanical process) in a window 16 through which the radiation of the laser 14 can penetrate.
• the electronic component 1 is connected via its interface 11 to a power supply and control device 17.
• the device 17 comprises, in a schematic manner, a microprocessor 18 connected by a bus 19 of controls, addresses and data to a program memory 20, to a data memory 21, to the interface 11, to the laser source 14 and to a system 32 for attenuating the laser energy.
• the device 17 further comprises, schematically represented, a comparator 22 receiving on the one hand on a setpoint input 23 an expected electrical quantity and on a measurement input 24 of the electrical signals of the application taken by the interface 11 while the component 1 undergoes the interactions and excitations of the laser 14. This part of the device makes it possible to identify the operating defects of the application.
• the size 23 may be that produced by another card identical to the card 6, synchronized with the latter, but which is not subject to aggression.
• the device 17 also comprises a comparator receiving on the one hand on a setpoint input an electrical quantity of the expected component and on a measurement input of the electrical signals taken by the interface 11 in the component 1, whereas the latter undergoes the interactions and excitations of the laser 14. This optional part of the device makes it possible to identify the faults of the component 1.
• a first comparator optional, which measures the failure of the component and a second comparator which makes it possible to measure a corresponding failure of the application.
• the first comparator may for example include a program for, after an attack, read a memory cell or a register and check the contents, while this memory cell or register are not requested by the application.
• the second comparator measures output signals from the application to check if they are consistent.
• the comparators may be replaced by a subroutine 25 for measuring the coherence of the signal received from the application and / or the electronic component 1 with an expected signal.
• the operation of the measurement can be static: it tests in this case only potential values and currents available on the pads of the interface 11. It is essentially dynamic.
• the microprocessor 18 further comprises a clock that gathers certain operations whose progress must undergo a known history, and it is measured whether this history is reproduced in an expected manner or if it has anomalies.
• the program memory 20 comprises a program 26 for controlling the laser source 14, its XYZ displacements, its power and its tripping times.
• the memory 20 preferably comprises a program 27 for controlling the operation of the card 6.
• the card 6 realizes the application for which it is designed: processing the input data received on its connections 3, possibly from of the bus 19, and production of output data substantially applied to the bus 19 or to the other components 7 and 8 of the card 6.
• the two programs 26 and 27 can take place simultaneously, sequentially or asynchronously.
• Program 26 may take into account program phases 27 to opportunistically initiate excitations at selected times.
• FIG. 2 shows a first temporal diagram 33 meshing with the pulses of a timing clock of component 1.
• This clock can be carried by card 1 or connected to bus 19.
• its pulses are managed, at least taken into account, by the program 26.
• a second timing diagram 34 shows the temporal distribution of the laser pulses, short durations, as issued at times 36 to 42 calibrated or not with respect to a particular signal of the clock.
• third time diagram 43 shows phases 44 to 46 of actions of component 1. These action phases correspond to actions, complex operations, selection, calculation, reformatting, transmission, verification or other carried out by the component 1 in the context of the application implemented with the card 16.
• a cycle time 47 of the application can thus be defined as the one during which one or more processing phases are executed.
• the dates 36 to 42 are chosen, or at least distributed, with respect to these cycles of the application, which are different from a cycle 48 of the clock 33. What is important is that these pulses 35 are distributed during the cycle 47, and not as long as they are placed at a given time with respect to the start 49 or the end 50 of any pulse of the clock 33.
• the hole formed by the window 16 may be smaller than the extent of the slab 2 of the component 1.
• the trace of the impact of the radiation on the surface of the component 1 is of course less than the hole 16, otherwise the scanning in X and Y of window 16 would be useless.
• areas of interest are identified in the component 1 in the sense that these areas are the harmful interaction seats for the operation of the component 1 and / or the application.
• the object of the invention is to know if the component will be in any place of its structure the seat of a harmful interaction.
• a depth 31 shown here is located under the interface 2-5.
• the refractive index of crystal 2 different from the index of refraction of the air. This is not shown in FIG. 1 where the focused radiation has rectilinear rays 34.
• the energy interactions of the radiation are measured on the component 1. The principle of this measurement is as follows .
• the laser source 14 is placed opposite an area of interest, for a given first focus, for example on the interface 2-5, is adjusted by commands transmitted to the attenuator 32, to the Using the microprocessor 18 and the bus 19, the attenuation level of the laser energy and control, using the microprocessor 18 and the bus 19, the source 14 to perform a laser pulse. Decreasing the attenuation level of the attenuator 32 causes the laser energy to grow. This growth has the result that the laser power deposited in the component 1 increases. In practice, this administration of energy excitations is drawn
• the pulse must be very short, for example of the order of a hundred or so picoseconds, and therefore in any case of duration less than or equal to one nanosecond.
• the power change can be made step by step. From the experimental point of view, we start from the highest value of laser energy (power) and decrease it until we reach the critical value (but the opposite is possible: from the value of energy the weaker and increase it gradually). For each pulse, at the end of the pulse, the coherence of the signals read in the component 1 and at the level of the application is measured with respect to the expected signals. If this coherence is good, the attenuation is reduced. At a given moment, a critical power is obtained for which, for the first time, the electronic response of the application or component 1 is no longer that expected. We note the value of this critical power.
• the focus of the laser source is changed, for example by moving the lens 29 towards the component 1 (or possibly using a lens with variable focal length), so that the focus 30 penetrates farther into the crystal 2.
• the growth operation is repeated (one can also proceed by decay) and a new critical power value is obtained.
• the laser beam is incident on the back side, on the substrate side of the component 1. As the laser beam does not penetrate the metallizations, the back-side irradiation is preferable to reveal all the sensitive areas. Mounting on the electronic card 6 is therefore fully compatible with the method, as it allows the opening of the window 16.
• the critical energy corresponds, for a given pulse duration, to a critical power. If the curve of the critical energy, also called threshold energy, is plotted as a function of the depth of focus in the configuration of FIG. 1, it will have the appearance shown in FIG. 3. It is the exploitation of this curve (search for the minimum) that provides the depth of the collection sensitive area. Indeed, the critical zone is that where it takes the least laser power 14 to disrupt the operation of the component 1.
• the focus of the laser beam is adjusted to identify the focus for which the component has a maximum sensitivity to a laser pulse.
• This maximum sensitivity is achieved when the laser energy required to cause the failure is minimal.
• This operation is performed for a position of interest but can also be systematically repeated on all positions of the laser map or possibly for randomly selected positions. For example, Fig. 3, for a given XY position, it was measured that a minimum energy 51 was required at a depth 52 to cause a failure. At any other depth, a laser energy higher than the energy 51 is required.
• the minimum of the experimental curve characterizing the evolution of the threshold energy as a function of the depth of focus corresponds to the depth at which it is buried the sensitive area.
• the laser beam is displaced relative to the component, in known or random manner, over all or part of the surface of the latter, over all or part of its depth, during all or part of the phases 44 to 46.
• a laser shot is made, synchronized or not with respect to a signal 33 and a check is made on the test system to see if one or more failures (faults within the component or malfunctions of the application) have occurred.
• the energy of the laser photon must be greater than the potential barrier at the forbidden band of the semiconductor.
• the wavelength of the laser is smaller than 1.1 micrometer.
• a pulsed and focused laser makes it possible to ionize locally and transiently the semiconductor constituting electronic components, inducing transient or permanent faults in the component operating the application.
• the laser must have a wavelength allowing the generation of charges (by linear or non-linear absorption mechanism) in the constituent material of the component.
• the nonlinear absorption mechanism corresponds to a multi-photon excitation. Several photons are simultaneously absorbed by the semiconductor material. The energy sum of these photons is sufficient to trigger the fault.
• the advantage of this last mechanism is to allow a better spatial resolution, in depth in the component and in the plane of this component. A more precise location of the multi-photon impact makes it possible to characterize more precisely the operation of the application with respect to the aggressions.
• the wavelength of the laser must be less than 1.1 ⁇ m.
• the laser is preferably used in mono pulse or synchronized with respect to a signal the component or application under test.
• An optics system is used to focus the laser radiation at the active areas of the component.
• there exists on the optical path of the laser beam a system for modifying the energy of the laser. This system has an interface that allows its control from a computer.
• All elements can be controlled to allow the automation of the test.
• the positions and times of the laser shots can be chosen randomly to reproduce the impact of particles of the natural environment or not, or on the contrary carefully adjusted to locate the spatial and temporal positions by faulting the component and causing a defect operation of the application. Similarly in each position the laser energy can be adjusted and the same position is tested again until there is no more measured fault and / or malfunction of the observed application, which allows you to map the sensitivity of the component and the application associated with it. .
• This procedure can be performed for the component and application for which no mitigation technique has been applied as well as for the component and application for which a mitigation technique has been applied. The comparison of the two measures proves the effect of the mitigation. If the application made by the component has a malfunction, the mitigation is implemented and started again. This procedure can be performed on an isolated component in a card 6 and on which an application is embedded, or on a component 1 included in a card 6, itself included in its real environment.
• Table 1 below shows the various verification and measurement operations that can be started according to the present method.
• the symbol O means yes, the symbol N means no.
• Table 1 below shows the various verification and measurement operations that can be started according to the present method.
• the symbol O means yes, the symbol N means no.
• Situation D Obtain spatial mapping of component-level failures - spatial and temporal mapping of application-level failures, identification of spatial and temporal locations responsible for application failures - Identification of spatial locations responsible for failures in the application component, comprehensive observation of the failure modes spatially, and temporally exhaustive observation of application failure modes, dynamic cross section measurement of the component (number of laser firing failures), as well as measurement of the dynamic cross section of the application (number of laser firing failures)
• Situation E Obtaining the spatial and temporal mapping of component-spatial deficiencies of application failures Identification of spatial and temporal locations responsible for component failures, identification of spatial locations responsible for application failures, observation comprehensive spatial failure modes, and temporal statistical observation, dynamic component cross section measurement (laser firing failure count), as well as dynamic cross section measurement of the application (number of laser firing failures)
• Situation F Obtaining spatial mapping of component and application failures Identification of spatial locations responsible for component and application failures, comprehensive observation of the failure modes spatially, and temporal statistical observation, section measurement component dynamic efficiency (number of laser firing failures), as well as measurement of the dynamic cross section of the application (number of laser firing failures)
• Situation G Fault mapping of the component and component application, identification of temporal locations responsible for component and application failures, temporally exhaustive observation of failure modes, and spatially statistical observation, dynamic cross section measurement of the component (number of laser firing failures), as well as measured by the dynamic cross section of the application (number of laser firing failures)
• Situation K Accumulation of failures in the component, multiple errors are not identified, measure the number of component failures required to cause application failure, depending on the timing of the firing versus the application cycle , measurement of the static cross section of the component (total number of failures compared to the total number of laser shots) and measurement of the static cross section of the application (total number of failures compared to the total number of laser shots)
• Situation L Accumulation of failures in the component, multiple errors are not identified, static cross section measurement of the application (total number of failures compared to the total number of laser shots)

Landscapes

• Engineering & Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Computer Hardware Design (AREA)
• Quality & Reliability (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Testing Or Measuring Of Semiconductors Or The Like (AREA)
• Tests Of Electronic Circuits (AREA)
• Test And Diagnosis Of Digital Computers (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=39156269

Family Applications (1)

Country Status (8)

Families Citing this family (7)

Family Cites Families (9)

• 2007
  • 2007-07-23 FR FR0756687A patent/FR2919402B1/fr not_active Expired - Fee Related
• 2008
  • 2008-06-26 CA CA2693991A patent/CA2693991C/fr not_active Expired - Fee Related
  • 2008-06-26 JP JP2010517457A patent/JP5721430B2/ja not_active Expired - Fee Related
  • 2008-06-26 WO PCT/FR2008/051166 patent/WO2009013419A1/fr not_active Ceased
  • 2008-06-26 US US12/669,867 patent/US9213614B2/en not_active Expired - Fee Related
  • 2008-06-26 CN CN200880104398A patent/CN101784991A/zh active Pending
  • 2008-06-26 BR BRPI0814646-2A2A patent/BRPI0814646A2/pt not_active Application Discontinuation
  • 2008-06-26 EP EP08806095A patent/EP2181390A1/de not_active Withdrawn

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events