III IV 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62

Nov_EDFA_Digital

A RESOURCE FOR TECHNICAL INFORMATION AND INDUSTRY DEVELOPMENTS NOVEMBER 2022 | VOLUME 24 | ISSUE 4 ELECTRONIC DEVICE FAILURE ANALYSIS edfas.org ACCURATE CALIBRATION FOR SPECTRAL PEM SECURITY ASSESSMENT OF NVM AGAINST PHYSICAL PROBING THINNING AND POLISHING HIGHLY WARPED DIE MEMORY PUF-BASED METERING OF FPGAs 4 22 12 34

A RESOURCE FOR TECHNICAL INFORMATION AND INDUSTRY DEVELOPMENTS NOVEMBER 2022 | VOLUME 24 | ISSUE 4 ELECTRONIC DEVICE FAILURE ANALYSIS edfas.org ACCURATE CALIBRATION FOR SPECTRAL PEM SECURITY ASSESSMENT OF NVM AGAINST PHYSICAL PROBING THINNING AND POLISHING HIGHLY WARPED DIE MEMORY PUF-BASED METERING OF FPGAs 4 22 12 34

edfas.org 1 ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 DEPARTMENTS Memometer: Memory PUF-based Hardware Metering Methodology for FPGAs Anvesh Perumalla and John M. Emmert A new physically unclonable function based on crosscoupled look-up tables can help detect counterfeit or illegal FPGAs. Author Guidelines Author guidelines and a sample article are available at edfas.org. Potential authors should consult the guidelines for useful information prior to manuscript preparation. 4 12 A RESOURCE FOR TECHNICAL INFORMATION AND INDUSTRY DEVELOPMENTS NOVEMBER 2022 | VOLUME 24 | ISSUE 4 edfas.org ELECTRONIC DEVICE FAILURE ANALYSIS 2 GUEST EDITORIAL Mark Tehranipoor 40 EDFAS AWARDS 40 ASM AWARDS 44 ISTFA 2022 EXHIBITORS LIST 45 CALL FOR PAPERS 46 ISTFA 2022 EXHIBITOR SHOWCASE 48 BOARD CANDIDATE PROFILES James Demarest 51 DIRECTORY OF FA PROVIDERS Rosalinda Ring 53 TRAINING CALENDAR Rosalinda Ring 55 LITERATURE REVIEW Michael R. Bruce 56 PRODUCT NEWS Ted Kolasa 58 GUEST COLUMN Keith Serrels 60 ADVERTISERS INDEX Security Assessment of Nonvolatile Memory Against Physical Probing Liton Kumar Biswas, M. Shafkat M. Khan, Leonidas Lavdas, and Navid Asadizanjani A detailed and methodical discussion about how existing and emerging memory devices can fall prey to attacks through various physical modalities. 22 For the digital edition, log in to edfas.org, click on the “News/Magazines” tab, and select “EDFA Magazine.” Accurate System Calibration and Data Extraction to Increase Significance of Spectral Photon Emission Microscopy Measurements Norbert Herfurth and Christian Boit This article presents a method for extracting precise photon emission spectrameasuredwith InGaAs detectors and describes the types of errors that can occur during calibration. 12 4 Processes for Thinning and Polishing Highly Warped Die to a Nearly Consistent Thickness: Part I Kirk A. Martin Techniques for finercontrolof remainingsiliconthickness through the correction of measuredmechanical surface profiles with multipoint thickness measurements. 34 ABOUT THE COVER See page 59 for a description of the contest images collage on the cover. 22 34

edfas.org ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 2 PURPOSE: To provide a technical condensation of information of interest to electronic device failure analysis technicians, engineers, and managers. Nicholas Antoniou Editor/PrimeNano nicholas@primenanoinc.com Mary Anne Fleming Director, Journals, Magazines & Digital Media Joanne Miller Senior Editor Victoria Burt Managing Editor Allison Freeman Production Supervisor ASSOCIATE EDITORS Navid Asadi University of Florida Guillaume Bascoul CNES France Felix Beaudoin GlobalFoundries Michael R. Bruce Consultant David L. Burgess Accelerated Analysis Jiann Min Chin Advanced Micro Devices Singapore Edward I. Cole, Jr. Sandia National Labs Rosine Coq Germanicus Universitié de Caen Normandie Szu Huat Goh Qualcomm Ted Kolasa Northrop Grumman Innovation Systems Rosalinda M. Ring Howard Hughes Research Labs LLC Tom Schamp Materials Analytical Services LLC David Su Yi-Xiang Investment Co. Paiboon Tangyunyong Sandia National Labs Martin Versen University of Applied Sciences Rosenheim, Germany FOUNDING EDITORS Edward I. Cole, Jr. Sandia National Labs Lawrence C. Wagner LWSN Consulting Inc. GRAPHIC DESIGN Jan Nejedlik, jan@designbyj.com PRESS RELEASE SUBMISSIONS magazines@asminternational.org Electronic Device Failure Analysis™ (ISSN 1537-0755) is published quarterly by ASM International®, 9639 Kinsman Road, Materials Park, OH 44073; tel: 800.336.5152; website: edfas. org. Copyright©2022by ASM International. Receive Electronic Device Failure Analysis as part of your EDFAS membership. Non-member subscription rate is $160 U.S. per year. Authorization tophotocopy items for internal or personal use, or the internal or personal use of specific clients, is granted by ASM International for libraries and other users registeredwith theCopyright ClearanceCenter (CCC) Transactional Reporting Service, provided that the base fee of $19 per article is paid directly toCCC, 222 RosewoodDrive, Danvers, MA 01923, USA. Electronic Device Failure Analysis is indexed or abstracted by Compendex, EBSCO, Gale, and ProQuest. With the involvement of numerous independent entities in themodernmicroelectronics supply chain, particularly considering the horizontal and globally distributed model, ensuring security and trustworthiness of modern system-on-chips (SOCs) has become a major challenge. At the same time, with the ever-increasing capacity and functionality of microelectronic devices, more security-critical information (secret keys, passwords, biometrics, and configuration bits) is stored in and processed by the SOCs, making themanattractive target for attackers. This issue is not unique toSOCs; the newheterogeneously integrated architectures built in 3D and 2.5Ddesign implementationwith advanced packaging technologies, such as systems-inpackage (SIP) architectures, also suffer from similar vulnerabilities. With the globalization of the design cycle and supply chain, attacks on microelectronic devices (SOCs or SIPs), have been on the rise. The academic community, industry, and government have discovered and reported numerous threats, including, but not limited to, malicious implants, counterfeiting, physical and side-channel attacks, information leakage, access control, fault injection, IP piracy, and reverse engineering. The potential sources of these threats and vulnerabilities span over different stages of the microelectronic supply chain, such as flaws in the design and integration, rogue employees (insider threat), untrusted third-parties, untrusted foundry, and malicious end users, to name a few. A number of methods have been developed to assess the design against these vulnerabilities at different stages of the design cycle during pre-silicon aswell as post-silicon stages. Example solutions include supply chain integrity (enabling end-to-endprovenance and traceability), IPprotectionandobfuscation (enabling secure key exchangewith provable security), runtimemonitoring (enablingmalicious behavior detectionduringmissionmode), and tamper detection (tampering detection including x-ray, optical, and laser). However, the emergence of the zero-trust model in the microelectronics supply chain in recent years as well as the ever-increasing complexity of microelectronic devices, the increasing trend in third-party IP reuse, and the involvement of distributed entities across the globe in the supply chain, have significantly escalated the challenges of establishing trust and assurance. Given the above-mentioned concerns, the followingmust be considered in securing future electronics supply chain: (1) Enabling EDA tools with security objectives for building security-by-construction using securitymetrics, properties, policies, enabling user-defined security assets’ definition, and automation for modeling and implementing security policies/properties at different NOVEMBER 2022 | VOLUME 24 | ISSUE 4 A RESOURCE FOR TECHNICAL INFORMATION AND INDUSTRY DEVELOPMENTS ELECTRONIC DEVICE FAILURE ANALYSIS GUEST EDITORIAL MICROELECTRONICS SUPPLY CHAIN SECURITY Mark Tehranipoor, University of Florida tehranipoor@ece.ufl.edu edfas.org Tehranipoor (continued on page 60)

edfas.org ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 4 EDFAAO (2022) 4:4-11 1537-0755/$19.00 ©ASM International® A GUIDE TO ACCURATE SYSTEM CALIBRATION AND DATA EXTRACTION TO INCREASE THE SIGNIFICANCE OF SPECTRAL PHOTON EMISSION MICROSCOPY MEASUREMENTS Norbert Herfurth1 and Christian Boit2 1IHP - Leibniz-Institut für innovative Mikroelektronik, Frankfurt (Oder), Germany 2Semiconductor Devices, Berlin University of Technology, Berlin, Germany herfurth@ihp-microelectronics.com INTRODUCTION Spectral analysis of photon emission signals measured in failure analysis of semiconductor devices has been discussed from time to time in several scientific publications.[1-4] The results presented by these publications have not always been fully conclusive. One reason is that no standardized calibration is available for spectral photon emission microscopy setups. This article shows that the development of a meticulous calibration procedure is an important prerequisite for the measurement and extraction of significant and meaningful spectral information from photon emission. Step-by-step instructions are given for performing a specific calibration and careful photon emission microscopy measurements. This includes the extraction of device parameters such as electron temperature from field-assisted photoemission, as well as extracting the material band gap by analyzing recombination-based emissions. Even though the calibration procedure presented here is performed on InGaAs detectors, it can easily be applied to all common photon emission detectors. Photon emission (PE) is a contactless fault isolation technique for integrated circuits (ICs) that uses the electroluminescence of active electronic devices. The intensity of this light emission is usually very faint and not easily extracted from background noise. This noise is not easily reduced as it is mainly caused by the thermal activity of the detector material itself. Therefore, dedicated cooling of the photon emission detector is always required to be able to detect the faint photon emission signals from semiconductor devices. In order to extract the spectral information from these emissions, the PE signal must be filtered for a certain wavelength or spatially spread, for example, with a prism. Both methods have the consequence that the radiant power density per detector pixel is reduced even further. This aggravates the problem of the already low signal-to-noise ratio in photon emission measurements. Therefore, it has not become common practice to isolate spectral information from PE measurements. But what information gain can be expected from a proper PE spectrum? The advantage is that device models can be associated with PE events. For example, a field-effect transistor (FET) in saturation emits a spectrum that decreases toward higher photon energy with an exponential function. From the slope of this function, the device parameter electron temperature (Te) can be derived. This parameter is correlated with the kinetic energy gained by channel electrons in the electric field.[5] This means the information that can be extracted from a single pixel of a spectrally resolved PE, e.g., from an FET, is not essential, but the number of pixels that contribute to a correct quantitative calculation of the slope is. Thus, it is more valuable to extract only a few datapoints with a high degree of confidence than to use all measured raw data from an improperly calibrated system. MOTIVATION Although the spectrum of an FET in saturation should be a pure exponential function of the photon energy, very divergent spectral distributions of photon emission obtained with an InGaAs detector have been published, often with sharply increasing or decreasing gradients at the spectral edges of the detector sensitivity or, evenmore drastically, with erratic valleys in the lower photon energy regime of InGaAs detectors.[1,6] These unrealistic results were a motivation to develop this issue in a methodically firm manner. The measurable PE intensity reduces

edfas.org 5 ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 drastically at the edges of the spectral sensitivity of an InGaAs detector.[7] This means that even tiny inaccuracies in the evaluation of measured spectral information near the outer limits of the spectral sensitivitywill have amajor impact on the extracted spectral distribution. Evidence for exponential behavior of the full spectral range (for an FET in saturation) is given because the three PE detectors typically used overlap in their respective spectral sensitivity range. These are silicon (Si), indium gallium arsenide (InGaAs), and mercury cadmium telluride (MCT) detectors. PE with a Si detector is often used when themeasurement ismade from the front side of the device under test (DUT). Corresponding spectra showing exponential spectral curves of an FET in saturation over the full spectral range of a Si-CCD have been published.[2,8] The spectral range of a Si detector overlaps with the lower wavelength limits of an InGaAs detector. A similar exponential spectral behavior from an FET in saturation was measured with an MCT detector and published in Reference 4. The lower wavelength limits of anMCT detector overlaps with the spectral sensitivity on an InGaAs detector. Figure 1 illustrates why the overlap of spectral sensitivities for all three detectors serves to explain why the calibration of the outlined InGaAs system is still incomplete. The sensitization for a meticulous system calibration of a spectral photon emission microscopy (SPEM) system, as presented here, is the key to increase the number of trustworthy data points that contribute to a precise determination of Te. This precise calibration pays off even more when device properties like the band gap are to be determined from themaxima of a Gauss shaped PE spectra.[9] Erratic calibration might shift the maximum to an erroneous bandgap estimation. SETUP SPEM setups are usually realized as an extension of “normal” PE tools. Generally, there are twoways to realize such an extension. It is possible to insert different bandpass filters and combine the different measurements to one spectrum. A more convenient method is to insert a prism into the optical path and measure the whole spectrum at once. A schematic drawing of a PE setup that is extended with a prism is shown in Fig. 2. SYSTEM CALIBRATION This section gives a detailed step-by-step description for a meticulous calibration procedure of a SPEM system. The process is appliable to all available PE detectors. However, here the focus is on calibration for a systemwith an InGaAs detector as these systems arewidely used in the failure analysis community. CALIBRATION CONCEPT This calibration concept is based on the principle of substitution. As described in the “Setup” section, an SPEM system consists of many different optical components. Some of themare very well optically characterized but some of them are not. It turned out that bringing together the optical characteristics of all components is a complicated task as they are not naturally provided by Fig. 1 Spectral photon emission distribution of a FET in saturationmeasuredwithanMCTdetector,[4] a Si-CCD detector[2] and a not-properly calibrated InGaAs detector. Fig. 2 Schematic drawing of a PEM setup with movable prism to upgrade the setup with SPEM functionality.

edfas.org ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 6 the tool supplier, or they must be characterized individually. A more convenient way is to see the SPEM system as a whole and determine a wavelength dependent system transformation factor Csys(λ). A thorough determination of Csys(λ) is the key enabler to increase the trustworthiness of SPEM results. THE REFERENCE LIGHT SOURCE A meticulous calibration of a SPEM setup requires a light source with a known spectrum. This light source is used to generate a reference spectrumthat canbe used for calibrating the SPEM systemwith a substitution method. The light source chosen must feature a continuous spectrum with spectral components in the infrared regime (for InGaAs detectors). A couple of commercially available light sources offer an enclosed spectral distribution. However,most likely, theseout of thebox solutionswill not fit into the SPEM measurement setup. Furthermore, as it was shown inReference 10, the aging of the reference light source influences the outcome of the calibration significantly. Thus, it is crucial to have a calibrated spectrometer available, which allows for regular checking of the emitted spectra of the reference light source. Amore convenient solution for a reference light source is offered by typical thermionic emission-based lamps. These lamps emit a continuous spectrum including light in the infrared (IR) region. For example, the broadband infrared tungsten bulb HEP3965 is a suitable candidate that offers a small form factor and an adjustable emission spectrum by controlling the power consumption. However, the characterization of the emitted spectrum under given boundary conditions needs to be performed. Finding a suitable and certified spectral calibration system can be tricky but often photovoltaic labs have these systems available. Finally, a pinhole is required to simulate a point shaped light source. Depending on the objectives that need to be calibrated, 1 to 10 µmpinholes had proven to be suitable. Having a point-shaped light source is essential for SPEM measurements as pointed out later. To be flexible enough during the SPEM system calibration and to not oversaturate the SPEM detector, it is suggested to measure the spectra of the reference light source for various power supplies. Voltages of 1.3 up to 3 V are a good reference. Last but not least, it is suggested that the lamp shouldbe initially operated for several hours to address the burn-in effect and for each measurement the lamp must be fully warmed to be stabilized. As a last step to finalize the reference light source setup, it is necessary to calculate a fitting function for the measured spectra. This is crucial as most likely the data points of the spectral measurement tool will not map to the ones from a typical SPEM set up. DISPERSION CHARACTERISTIC AND SPATIAL DISPLACEMENT When the SPEM measurement is performed with the helpof a prism, a point-shaped light source is transformed into a line area as shown in Fig. 3. The XY coordinate of a point-shaped emission is defined as the origin, and the resulting spectral coordinates are noted in relation to this origin. However, the assumption of a point-shaped emission is a theoretical construct. A spatially extended emission is of greater practical relevance. In this case, the coordinates of the maximum intensity of the emission must be noted and defined as the origin. It must be noted that the spatial extent of the photon emission is an irrevocable boundary condition of real SPEMmeasurements, which always leads to a deviation from the theoretical model and thus to inaccuracies in the spectrumextraction. To minimize the spatial extent of the photon emission, a lower magnification can be chosen if the associated Fig. 3 Schematic shows how a prism is used in a photon emission microscope to analyze an emission signal spectrally. A local XY point source information (left) is spread into a spectral λ-y information (right).[11]

edfas.org 7 ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 objective lens is still sensitive enough todetect the photon emission. However, for the calibration process, it is necessary to find an appropriate pinhole that limits the spatial extend of the reference light source emission. Having noted the XY coordinates of the photon emission origin, the prism can be moved into the optical path to spectrally distribute the PE. By inserting narrow band pass filters into the filter slide, XY coordinates for the band pass filter wavelength used can be extracted by noting the maximumof themeasuredemission. TheseXY coordinates are noted in relative distance to the previously defined origin of the photon emission, resulting in an extractable shift for each band pass filtermeasured. Figure 4 shows an example dispersion characteristic in terms of pixel shift in the X-direction. Adata interpolation function is required to extract thewavelength for every pixel within the sensitivity range of the detector. Mechanical spatial displacements in the X-direction are addressedby characterizing the dispersion properties of the system. Observing a non-constant displacement in the Y-direction is most likely caused by a prism that is not correctly inserted into the system. In this case, it is recommended to reinstall the prism with a correct alignment. Observing a constant displacement in Y-direction can be easily compensated by the data extraction algorithm, this will be shown later. EXTRACTING Draw (λ) Even though the angular error of the prism is minimized during prism adjustment, it is recommended to not extract only one X-line array for the raw spectral data. Extracting the median of the predetermined center line as well as a symmetrical number of lines above and below the center line compensates for mechanical tolerances that may occur during the movement of the prism, remaining angular errors and photon emissions with a spatial extend. For example, one line below and one line above the center line. Especiallywithhighermagnification lenses, the spatial extent of the photon emission increases in a way that the assumptionof apoint-shapedemission source ismoreand more violated. This problemcan be partially addressed by choosing a pinholewith a smaller diameter or by reducing the spectral intensity by limiting the supply voltage of the reference light source. Overall, magnifications of 50x or even 100x have been found to show a significant spatial expansion of the photon emissions spot. As spatial expansion of the photon emission source results in a widening of spectral data in Y-direction as well as a superposition of spectral information in X-direction, this initial situation should be avoided if possible. However, a spatial extent in Y-direction must be taken into account by calculating the median for Draw(λ) from an increased number of X-lines, for example five. MEASURING Csys(λ) Having the dispersion characteristics, the spatial displacement, as well as the raw data of the spectral distribution of the reference light source available are the basics for determining the wavelength dependent system transformation factor Csys(λ). Therefore, the reference light source is measured in the SPEM system under the same electrical conditions as measured during the characterization of the reference light source. First, the emission is measured without the prism in order to determine the origin coordinates. Next, the prism is moved into the optical path tomeasure the corresponding spectra. The raw spectral data, which are then measured by the SPEM system, represent a transformed version of the reference spectrum. Components that contribute to the data transformation are the lens objective (Cobj), the tube lens (Ctube), and the prism (Cprism). In the presence of a reference spectrum, the transformations of the various components can be combined to form the system transformation factor, Csys. The system transformation factor Csys can be calculated by dividing the reference data (Dref) by the measured raw data (Draw): Draw(λ) · Csys(λ) = Dref(λ) Eq 1 Due to the nonlinearity of the dispersion characteristics, thewavelength resolutionper pixel ranges from3.5 to 15 nm. Now the previous work of extracting a fitting function for the spectral distribution of the reference light source as well as the functional description of the dispersion characteristics pay off. An accurate wavelength can be calculated for each pixel within the spectral line array. Afterward, the intensity of the reference light source can be calculated for these specific wavelengths associated to the pixels. This proceduremust be performed for every Fig. 4 Exemplarydispersioncharacteristicof aSPEMsystem.

edfas.org ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 8 objective lens to be used for spectral measurements. Figure 5 shows an example set of correction factors for a 5x, 20x, as well as a 50x lens. The 50x lens is a dedicated lens for backside analysis. SPECTRAL MEASUREMENTS AND CORRECT DATA EXTRACTION After the complete dataset of Csys(λ) is known for all available objective lenses, calibration of the SPEM system is formally finished. Now spectral measurements can be performed for devices under tests (DUTs). For this purpose, the raw spectral data, Draw(λ), from the DUT must be extracted according to the procedure previously described. Subsequently, the wavelength-dependent spectral intensity, Ispec(λ), of the analyzed spectrum is calculated by multiplying the extracted raw data by the system transformation factor: Draw(λ) · Csys(λ) = Ispec(λ) Eq 2 Several obstaclesmay occur during the extractionof the correct raw data. Typical sources of error include: • the extraction of pure noise data, which is then transformed by Csys(λ) and later interpreted as spectral information. • choice of an objective lens with high magnification, so that the PE source is spatially expanded significantly • mechanical tolerances of the prismmovement system are not taken into account • absorption in the back side bulk silicon when performing measurements from the back side are not considered EXTRACTING THE RAW SPECTRAL DATA OF A DUT A spectral measurement always requires measuring the non-spectrally distributedphoton emission in order to determine the reference coordinates. If the XY coordinates of the photon emission origin are available in combination with the dispersion characteristics as well the prism Y-offset, the extraction of the spectral lines to be considered as raw data can be performed semiautomatically. An example semiautomatic Microsoft Excel implementation for the extraction of correct raw data as well as the implementationof the following data processing steps are publicly provided by the authors and can be downloaded under Reference 12. The CVS data of the PE spot and the PE spectra are imported into this file. The tab “spectrum” allows to easily enter the origin coordinates as well as the number of spectral lines that should be considered. RAW DATA PROCESSING The data processing steps presented here are included in the provided “spectral extraction file” of Reference 12, more specifically in the tab “DataProcessing.” Noise level. An easily missed source of error is the noise ground floor. If the noise floor is not truncated, the system transformation factors will be applied to the noise data, regardless of whether true spectral information is present. Thismeans that, theoretically, a spectrumcan be extracted from any measurement. In the worst case, the measured data is only noise. This case is shown in Fig. 6. The spectrum shown was extracted directly from the raw data without cutting off the noise floor. The measured noise is equally distributed over the 2D detector, but due to the highly nonlinear Csys(λ), the transformeddata exhibit a characteristic shape. Fig. 5 Wavelength dependent system transformation fac- tor Csys(λ); values are normalized to a wavelength of 1300 nm. Fig. 6 Extracted spectral data from a noise measurement with 0% noise floor filter applied.

edfas.org 9 ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 This simplified example illustrates the need for appropriate noise floor determination as well as cutting off the noise data before applying the system transformation factor. The measured noise is caused either by parasitic light reaching the detector or by the thermal activities of the detector itself. However, both mechanisms result in the generation of countable events on the detector. These events generate the noise floor even during spectral photon emission measurements. As shown in Fig. 6 the application of the spatially related system transformation factor Csys(λ) to a noise signal itself produces an unevenly distributed spectrum. Therefore, it is essential to cut off the noise floor from themeasured raw data before applying Csys(λ). To do so, we have chosen to truncate the raw data at a threshold (TH) that is calculated by the median of the noise floor (NFmedian) plus a variable percentage of NFmedian: TH = NFmedian + NFmedian · ζ | ζε[0;1] Eq 3 Figure 7 shows a spectrum measured from a FET in saturation with a varying noise cut off threshold value ζ of 0 to 4%. Correction of bulk silicon absorption. The system transformation factor Csys(λ) compensates for the properties of the SPEMsystemitself. However, if the photon emission has to pass bulk silicon before reaching the optical parts of the SPEM system, the absorption that occurs within the bulk silicon is not addressed by the system transformation factor Csys(λ). The absorption characteristics of siliconhighly dependon thewavelength considered as well as the doping concentration of the silicon.[13] For substrate doping concentrations well below 1016 cm-3, an absorption coefficient α(λ) as given in References 14 and 15 can be assumed. It must be kept in mind that these values do not reflect the doping concentration. However, photon emission detectors like an InGaAs or a MCT detector are sensitive in the spectral range where the absorption characteristics of silicon are strongly affected by the doping concentration. Therefore, the choice of the correct absorption coefficient data set is important to compensate for absorption within the bulk silicon. More accurate data sets can be extracted from commercial software such as TCAD. Once a suitable dataset is selected, thewavelengthdependent intensity loss due to bulk absorption can be compensated using the Beer-Lambert law:[16,17] I(z,λ) = I0(λ) · e-a(λ)z Eq 4 Whereas I(z,λ) are from the PE detector measured raw data Iraw(z,λ), α(λ) is wavelength dependent absorption coefficient, and z is the thickness of the bulk silicon. A fewsimple transformation steps give thewavelength dependent intensity of the photon emission I0(λ): I0(λ) = Iraw(z,λ) · ea(l)z Eq 5 In Reference 12 the tab “Correction of absorption” shows an exemplary implementation for the correction of the bulk silicon absorption. Applying lens-specific system transformation factor. The correct raw data was extracted, taking into account the noise levels as well as the absorption within the bulk silicon. Now the nonlinear signal transformation due to the optical system can be addressed by applying the system transformation factor Csys(λ). Equation 2 can be used directly to give the correct spectral data Ispec(λ): Ispec(λ) = I0(λ) · Csys(λ) Eq 6 Normalizing (optional). The absolute intensity of the measured spectra cannot be easily compared to each other. If several measurements are to be compared to each other, it is recommended to normalize the extracted spectra to a predefined wavelength. This should be done automatically with a predefined wavelength as implemented in Reference 12 in the tab “DataProcessing.” Smoothing (optional). Even though the noise floor has been removed as described previously, noise is an additive phenomenon. This means that when measuring low intensity spectra, the noise may still be at least partially in the order of magnitude of the signal itself. An additional smoothing algorithm, for example moving average, can be implemented. Fig. 7 Spectral photon emission data from a FET in saturation with different threshold values chosen to determine the noise floor.

edfas.org ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 10 PARAMETER EXTRACTION Following the previously mentioned steps will lead to a spectral photon emission result that can be trusted and from which accurate device or emission parameters can be derived. Electron temperature Te. Spectral distribution of a photon emission caused by acceleration and scattering of electronswithin an electrical field canbe approximatedby the Maxwell-Boltzmann distribution.[3] Thus, the spectral distribution follows the formula: Ispec(Eph) = I0 · e-Eph/kT Eq 7 where Eph is the considered photon energy or wavelength respectively, k is the Boltzmann constant, and T is the temperature, in this case it can be considered as electron temperature Te. A few transformations of Eq 7 lead to Te in relation to the slope, m, of the logarithmic plotted PE intensity. Whereas m can be graphically determined:[11] Te = -1/(km) Eq 8 Band gap. A Gaussian-shaped spectral distribution indicates that a band-band recombination process causes the photon emission. Such a shape couldbe used to determine the band gap of the analyzed material.[9] CONCLUSION A method for extracting precise photon emission spectra measured with InGaAs detectors was long overdue. It is nowavailable and is presented in this article. Basedonmeticulous SPEMsystemcalibration, thoroughly performed SPEM measurement and data handling, confidence in SPEM measurement results can be drastically increased. As the provided substitution-based step-bystep guide for calibrating a SPEM system combines the optical properties of the whole system into a single factor Csys, this method can easily deal with uncertainties for optical properties of individual system components. The provided step-by-step spectral data extraction guide shows that accurate handling of incorporated noise as well as handling the wavelength dependent bulk absorption can significantly influence the quality of the extracted spectral data. For accurate correction of the bulk absorption, thedoping concentrationof the substrate should be considered in more detail. This article discusses different types of errors that can occur during the calibration of a SPEM system and the subsequent data extraction, and their consequences for spectral evaluation. The most obvious impact of these errors can be identified in the spectral distribution. A non-exponential relationship between photon emission intensity and photon energy emanating from a FET in saturation is a proof of incomplete SPEM system calibration. Insufficient noise floor intermittency leads to a steep increase in the slope in the extracted spectra, due to the large systemtransformation factors Csys resulting fromthe decreasing detector sensitivity. With the system in good shape, it is possible to extract trustworthy spectral data from a SPEM measurement. A quantitative and trustworthy evaluation of the spectral data allows the extraction of the electron temperature (Te) as described in Reference 18 or the extraction of effective band-gap energy.[9] However, due to mechanical tolerances and aging components such as the light source or the detector, it is recommended to repeat the presented calibration procedure at regular intervals. This could be part of a system’s regular preventive maintenance schedule. REFERENCES 1. J. Phang, et al.: “A Review of Near Infrared Photon Emission Microscopy and Spectroscopy,” Proc. Int. Symp. Phys. Failure Anal. Integr. Circuits, 2005, p. 275–281. 2. A. Glowacki, C. Boit, P. Perdu, and Y. Iwaki: “Backside Spectroscopic Photon Emission Microscopy using Intensified Silicon CCD,” Microelectron. Reliab., 2014, Vol. 54, 9-10, p. 2105–2108, doi: 10.1016/j.microrel.2014.07.132. 3. I. Vogt, T. Nakamura, B. Motamedi, and C. Boit: “Device Characterization of 16/14 nm FinFETs for Reliability Assessment with Infrared Emission Spectra,” Microelectron. Reliab., 2018, 88-90, p. 11–15, doi: 10.1016/j.microrel.2018.07.012. 4. U. Kindereit, et al.: “Near-infrared Photon Emission Spectroscopy of a 45 nm SOI Ring Oscillator,” IEEE Int. Reliab. Phys. Symp. Proc., 2D.2.1-2D.2.7. 5. A. Toriumi, M. Yoshimi, M. Iwase, and K. Taniguchi: “Experimental Determinationof Hot-carrier EnergyDistribution andMinority Carrier Generation Mechanism due to Hot-carrier Effects,” IEEE Int. Electron Devices Meet., 1985, p. 56–59. 6. D.L. Barton, et al.: “Infrared Light Emission from Semiconductor Devices,” 1996, https://www.osti.gov/servlets/purl/390573. 7. S. Tan, et al.: “Detectivity Optimization of InGaAs Photon Emission Microscope Systems,” Proc. Int. Symp. Phys. Failure Anal. Integr. Circuits, 112006, p. 315–319. 8. C. Boit, “Fundamentals of Photon Emission (PEM) in Silicon— Electroluminescence for Analysis of Electronic Circuit and Device Functionality,” Microelectronics Failure Analysis: Desk Reference, 2004, p. 356–368. 9. A. Beyreuther, et al.: “Contactless Parametric Characterization of Bandgap Engineering in p-type FinFETs using Spectral Photon Emission,” Microelectron. Reliab., 2019, Vol. 92, p. 143-148, doi: 10.1016/j.microrel.2018.11.008. 10. N. Herfurth and C. Boit: “Meticulous System Calibration as a Key for Extracting Correct Photon Emission Spectra,” Proc. Int. Symp. Phys. Failure Anal. Integr. Circuits, 2021, p. 1–5. 11. A. Glowacki, C. Boit, P. Perdu, and Y. Yokoyama: “Electron Temperature - The Parameter to be Extracted fromBackside Spectral Photon Emission,” IEEE Int. Reliab. Phys. Symp. Proc., 2013, p. 14-18, 5B.6.1-5B.6.7.

edfas.org 1 1 ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 12. N. Herfurth: Extractionof photon emission spectra, Available: https:// docs.google.com/spreadsheets/d/1-g2oMWFn5OB8ME6LACUttBj1gRBlCINT/edit?usp=sharing&ouid=112348371872980361591&rtp of=true&sd=true. 13. R. Soref and B. Bennett: “Electrooptical Effects in Silicon,” IEEE J. Quantum Electron., 1987, Vol. 23, No. 1, p. 123–129, doi: 10.1109/ JQE.1987.1073206. 14. Refractive index library, Available: https://www.pvlighthouse.com. au/refractive-index-library. 15. M.A. Green: “Self-consistent Optical Parameters of Intrinsic Silicon at 300K including Temperature Coefficients,” Solar Energy Materials and Solar Cells, 2008, Vol. 92, No. 11, p. 1305-1310, doi: 10.1016/j. solmat.2008.06.009. 16. M. Fox: Optical properties of solids, 2nd ed. New York: Oxford University Press, 2010. 17. Beer–Lambert law: Available: https://en.wikipedia.org/wiki/ Beer%E2%80%93Lambert_law. 18. A. Toriumi, et al.: “A Study of Photon Emission from n-channel MOSFET’s,” IEEE Trans. Electron Devices, 1987, Vol. 34, No. 7, p. 15011508, doi: 10.1109/T-ED.1987.23112. ABOUT THE AUTHORS Norbert Herfurth received his M.Sc. in electrical engineering (microelectronics) in 2013 and his Dr.-Ing. in semiconductor failure analysis from TU Berlin in 2020. From 2013 to 2019, he conducted research and worked in the field of failure analysis for semiconductor devices at TU Berlin’s Department of Semiconductor Devices. Since 2020, he has worked at IHP Frankfurt (Oder) in the Technology department as a post-doc and project coordinator in the area of hardware security and open-source activities. Christian Boit retired in 2018 as chair of the Semiconductor Devices Department at Technische Universitaet Berlin, Germany. His research focuses on IC failure analysis (FA) and contactless fault isolation (CFI). In recent years, he was also investigating hardware security risks introduced by CFI. Boit started at Siemens Semiconductors in 1986 and from 1990 to 1993 participated in the IBM/Siemens DRAM project. Later, he was director of FA at Infineon Technologies until taking the university position in 2002. Boit is an active supporter of the FA community. He was co-founder and member of the board of directors of EDFAS, served in many conference committees, and was general chair of major electronic device FA conferences ISTFA 2002 and ESREF 2014. NOTEWORTHY NEWS IEDM 2022 The 68th International Electron Devices Meeting (IEDM) will take place December 3-7 at the Hilton San Francisco Union Square. IEDM is a leading forum for reporting breakthroughs in the technology, design, manufacturing, physics, and modeling of semiconductors and other electronic devices. Topics of interest include circuit and device interactions; characterization, reliability, and yield; compound semiconductor and high-speed devices; memory technology; modeling and simulation; nano device technology; optoelectronics, displays, and imagers; power devices, process and manufacturing technology, and sensors, MEMS, and BioMEMS. IEDM is sponsored by the IEEE Electron Devices Society. For more information, visit ieee-iedm.org and watch for any updates to the meeting plan.

edfas.org ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 12 MEMOMETER: MEMORY PUF-BASED HARDWARE METERING METHODOLOGY FOR FPGAs Anvesh Perumalla and John M. Emmert Department of Electrical and Computer Engineering, University of Cincinnati, Ohio john.emmert@uc.edu EDFAAO (2022) 4:12-21 1537-0755/$19.00 ©ASM International® INTRODUCTION Security, assurance, and trust (SA&T) within the integrated circuit (IC) supply chain are of crucial importance to the government and the commercial sector. As the semiconductor business has shifted toward a horizontal (“fabless”) model, there is an increasing need to protect against counterfeiting, cloning, overbuilding, and intellectual property (IP) theft andpiracy. TheU.S. Department of Commerce defined a counterfeit electronic part as: 1) an unauthorized copy, 2) does not conform to original component manufacturer (OCM) design, model, and/ or performance standards, 3) is not produced by OCM or is produced by unauthorized contractors, 4) an offspecification, defective, or used OCM product sold as “new” or working, or 5) has incorrect or false markings and/or documentation.[1] A recent 2020 report by the Semiconductor Industry Association (SIA) states that the “United States today nowonly accounts for 12.5%of total installed semiconductor manufacturing, with more than 80% of production now happening in Asia.”[2] This SIA report also shows that state-of-the-art 7-nmand below IC production is happening almost exclusively outside of the United States. This creates an opportunity for untrusted agents and entities to counterfeit and overproduce ICs and place them in the supply chain. This article describes the memometer, a hardware metering technique, which addresses the supply chain integrity of field-programmable gate arrays (FPGAs). Currently, FPGAs pervade most of the semiconductor ecosystem due to their faster prototyping and time-tomarket capabilities when compared to traditional application-specific integrated circuits (ASICs). In the last three decades, the FPGA logic capacity has grown 10,000x and processing speed has grown 100x, and at the same time, the FPGA cost and energy consumption per unit function have reduced over 1000x.[3] As FPGAs have become the predominant choice of circuit realization, SA&T of these Fig. 1 An ecosystem affected by untrusted FPGAs.

edfas.org 13 ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 devices have become a major concern. Figure 1 exemplifies how counterfeit or illegal FPGAs within the supply chain can end up undetected in our computing systems. Amemometer is suggested to overcome this problem. The memometer is a low-overhead, inexpensive, adaptable hardware metering (fingerprinting) methodology leveraging memory physically unclonable functions (PUFs). Historically, memory PUFs have not been applied to contemporary FPGAs becausemost of themcomewith manufacturingmemorypreset startupvalues. Theauthors have overcome this issue by inventing a newmemory PUF using cross-coupled look-up tables (LUTs) that imitate the SRAM PUF behavior, thus providing unique start-up values (SUVs) used for fingerprinting each FPGA. These fingerprints are further used in identification and authentication throughout the supply chain. HARDWARE METERING Hardware metering helps in identifying authorship of an IC or intellectual property (IP) after fabrication by uniquely locking/tagging each IC that is manufactured under the samemask.[4] Hardwaremetering is further classified as passive and active metering.[4] Passive metering is used to tag each IC with an unclonable unique identifier. This identifier is further used in recognizing genuine ICs from the overbuilt/counterfeit ICs. Whereas in active metering, in addition to tracking passively, it can also help with enabling/disabling IC functionality and controlling/ preventing the ICs from further infiltrating the supply chain.[4] This passive metering methodology can be used to create unique unclonable fingerprints and use them to interrogate ICs within the supply chain. The authors are also leveraging themethodology to activelymeter, which is briefly described later. PHYSICALLY UNCLONABLE FUNCTIONS Identification and authentication are critical to secure any electronic system. Em- bedding a unique key can only help identify an IC, but in order to authenticate, a secret key must be embedded onto the IC itself.[5] These secret keys are either stored in nonvolatile memory (NVM) or battery-backed external volatile memory. Bothmethods not only add additional overhead but are also extremely vulnerable to attackers. A simple side-channel attack[6] can reveal a lot about the IC and allow for the secret key to be stolen, which can be further used in creating clones of those ICs. To overcome this issue, a new authentication mechanism—physically unclonable functions (PUFs)—was invented. PUFs are extremely hard-to-forge, unique to every IC ever manufactured, non-programmed, and low-overhead.[5,7] The basic idea behind a PUF is that each IC exhibits a unique process variation characteristic profile that can be leveraged to create unclonable fingerprints. Even when two ICs are functionally same, the underlying microscopic process variation characteristics are slightly different. When a challenge (input) Ci is applied to a section of an IC, the underlying unique process variation profile in that section exhibits a unique response (output) RCi. [7] Uniqueness and reproducibility are the two metrics used toanalyze thequalityof PUF fingerprints. Uniqueness ismeasured using inter-chip hamming distance (HD), and reliability or reproducibility is measured using intra-chip HD.[8] Inter-chip HD is the average HD measured between the responses when the same challenge is applied to two different ICs. Ideally, it should be 50%, which means half of the bits from these two fingerprints must be different. This measurement can also be used to analyze two fingerprints obtained from different sections of the same IC. Intra-chipHD is the average HDmeasured between the responseswhen the same challenge is applied at different times. Ideally, this should be 0%, which means that each fingerprint must be reproducible or repeatable over time. Anexampleof this illustration is shown inFig. 2. Aprogramming file (*.bit) is used as a challenge, applied on different FPGAs, and the response fingerprints are recorded. These responses are used to analyze the uniqueness of these fingerprints. Similarly, a challenge is applied to the same FPGAmultiple different times and the responses are used to investigate the repeatability measure of a given fingerprint. Fig. 2 (a) Uniqueness (inter-chipHD), (b) repeatability/reproducibility (intrachip HD) of PUF challenge-response pairs. (a) (b)

edfas.org ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 14 MEMORY PUFS Memory components (such as SRAMs and D-FFs) are essential elements in electronic systems. Memory based PUFs use these basic elements to create fingerprints. When a cross-coupledmemory structure ismanufactured for minimum size, as shown in Fig. 3, the relative drive strength and doping levels are usually balanced. When these devices are powered on, before programming any value, the metastability property of balanced memory elements leads to random start-up values.[9-11] Instability within these cross-coupled components is due to several technological and non-technological parameters, such as probabilistic geometry of transistors, inexact threshold voltages, or channel length modulation.[12] Because of these varying parametric values, some memory cells always power on to a specific state, whether logic “1” or logic “0;” that is, 100%of the time these cells are powered on to the same logic value. However, other cells fluctuate between logic “0” or logic “1” for each power cycle. A fingerprint is created by estimating themost likely power-up state of each memory cell SUV.[10] MEMORY PUFS FOR CONTEMPORARY FPGAS One major disadvantage of applying memory PUFs to contemporary FPGAs is that many newer FPGA families come withmemory preset. In other words, as soon as the FPGA is powered on, the memory elements within in the FPGA are preset to either logic “1” or logic “0” by default. This makes memory PUFs impractical. One notable effort to overcome this particular problem was the invention of the butterfly PUF (BPUF).[13] The BPUF emulates SRAM behavior at power-up. The BPUF uses built-in FFs configured as cross-coupled latches to emulate memory PUFs, as shown in Fig. 4a. The preset (PRE) signal sets the output of a latch high, and the clear (CLR) signal sets the output low. The BPUF operation starts when the excite signal— connected to the PRE of one latch and CLR of another latch—is set to high for a few clock cycles and brought to low. The BPUF will settle to either logic “0” or logic “1” at the output. The output SUVs are based on the intrinsic characteristics of the FPGA. A key challenge with this implementation is that the quality of SUVs will purely depend on the symmetric construction of the BPUF cell. As shown in Fig. 4a, the red and green routing paths must be routed identically. In other words, the delay difference between the signals should be equal down to picoseconds. Unlike ASICs, FPGA routing paths arenot easilyaccessible to thedesigner. Even though FFs are readily available on almost all FPGAs, the symmet- ric construction of a BPUF makes it challenging to imple- ment for different FPGA architectures. A similar research study concluded that a BPUF is not an ideal candidate for anFPGA.[14] This has led to the inventionof thememometer PUF,which is amuchsimpler implementationof emulating SRAMstart-upbehaviorusingLUTs.Table1shows themajor differences between the BPUF and the memometer PUF. MEMOMETER The memometer PUF is implemented by mapping cross-coupled NAND gates to cross-coupled LUTs, as Fig. 3 Common cross-coupled memory structures: SRAM and D-FF. Fig. 4 PUFs for contemporary FPGAs that imitate SRAM PUF. (a) (b)

edfas.org 15 ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 24 NO . 4 shown in Fig. 4b. One of the challenges of this design is balancing feedback path delays. If the feedback routing paths are not matched, then thememory element produ- ces known values instead of random values. In previous works, “implementing a cross-couple element using combinational logic on an FPGA was not straight forward due to inability to create combinational loops;”[13] however, the authors have been successful implementing crosscoupled combinational elements using FPGA LUTs and balancing the feedbackpathdelays. Memory PUF research shows that 64 bits are enough to differentiate between all existing ICs (264 unique signatures).[10] To demonstrate the approach, the authors programmed 64 of these memometer PUF elements on ten Xilinx Artix-7 FPGAs. The same programming (*.bit) filewas used to programall ten FPGAs, and each FPGA gave a unique 64-bit memory signature. Figure 5 shows the probability analysis for fingerprint bits powering up to logic “1” values, where each row corresponds to a unique 64-bit fingerprint from a different FPGA. Figure 6 shows the probability distribution of the inter-chip and intra-chip HD of these 64-bit fingerprints for ten power cycles on all ten FPGAs. The x-axis represents the percentage of PUF output bits that are different from one FPGA to another for inter-chip HD, and PUF output bits that are changing over time for the intra-chip HD. An average inter-chip HD of 49.7% (vs. an ideal HD of 50%) and intra-chip HD of 0.88% (vs. an ideal HD of 0%) was achieved. These values demonstrate fingerprint uniqueness and reproducibility. JOURNEY TOWARD A STRONGER PUF PUFs are generally categorized as weak or strong.[7] A weak PUF contains a limited number of challengeresponse (Ci RCi)pairs,whereasastrongPUFcontainsa large number.[15] Both SRAM and butterfly PUFs are categorized as intrinsicweakPUFs[15] due to their fixednumber of (C iRCi) pairs—most cases typically have one challenge at powerup. Weak PUFs are mainly used in cryptographic systems where a secret key is derived from the PUF response with the help of error-correction codes. On the other hand, a strong PUF not only contains many (Ci RCi) pairs, but also makes it difficult for an adversary to predict the next response.[16] The approach of creating a large number of (Ci RCi) pairs is similar to a reflective PUF or optical PUF. [7] For example, reflective PUFs are used in identifying missiles: a light scattering particle is sprayed onto themissile and an inspector records the images of this particle by illuminating it at different angles. Each angle of incidence gives a unique response, which is recorded and stored in a secure database. For authentication, a random angle Table 1 Butterfly PUF compared to memometer PUF Butterfly PUF Memometer PUF Uses cross-coupled latches Uses cross-coupled LUTs Complex implementation and routing Simple implementation and routing Difficult to balance feedback path delays Easy to balance feedback path delays Requires three sets of paths to be symmetric for ideal SUVs Path 1: Global clock to clock pin (clock skew) Path 2: Excite signal to CLR/PRE Path 3: Feedback path delay (latch 1 output Q -> latch 2 input D) Requires only one path to be balanced Feedback path delay (LUT 1 output F -> LUT 2 input A) Requires external signal to settle into an unstable state for startup behavior Does not require any external signals for start-up behavior One challenge-response pair Hundreds of challenge-response pairs Fig. 5 The probability analysis of a 64-bit memory signature powering up to 1 on ten FPGAs.

RkJQdWJsaXNoZXIy MTMyMzg5NA==