Vulnerability of PC-Systems to EMP / UWB Threats

Transcription

1 Vulnerability of PC-Systems to EMP / UWB Threats Dipl.-Ing. Michael Camp University of Hanover Institute for Electrical Engineering and Measurment Science

2 Contents Goal of the Investigation General Measurement Setup Definitions Personal Computer Test Setup Measurement Results Destruction Effects on Chiplevel Summary

3 Goal of the Investigation Measurement of the susceptibility of microelectronic systems to EMP and UWB field threats Analysis of the failure effects in consideration of different pulse parameters (amplitude, rise time, energy content,...) Determination of the influence of the technology (TTL, CMOS), circuit parameters (clock rates, cable length,...), complexity, operation and program states on the failure effects

4 E H 100 % 90 % ( t ) General Measurement Setup H E( t) = E0 ( e e α t β t ) 50 % Waveguide 1 10 % t r t fwhm t / s Pulse rise time pulse length UWB t r = 100 ps t fwhm = 2.5 ns EMP t r = 7.5 ns t fwhm = 180 ns Waveguide 2

5 Definitions - Parameters of BFR and DFR BFR: Breakdown Failure Rate BFR = No. of Breakdowns No. of Pulses 1 0,95 Breakdown Bandwidth BB BFR Destruction Bandwidth DB DFR DFR: Destruction Failure Rate DFR = No. of Destructions No. of Pulses 0,05 0 Breakdown Threshold BT Destruction Threshold DT Amplitude

6 Personal Computer Test Setup Device Under Test IDE FDD Northbridge Cache RAM Processor Battery BIOS Southbridge ISA-Slots PCI-Slots Power connector Interfaces I/O-Control. Keyb.-BIOS

7 Personal Computer Test Setup PC-Architecture (AT) ISA-Bus I/Ologic Wait- State ISA-Slots Multiplexer Controllogic Databuffer Addressbuffer Addressbuffer Local Bus Clock RAM Controlbus CPU DMA Addressbuffer PIT Addressbus Coprocessor CMOS Databuffer ROM Interruptcontroller Keyboardcontroller Databus

8 Personal Computer Test Setup Testprogram START CPU-Test Address register initialization CPU-Test Timer-0- initialization CPU-Test Counter register initialization CPU-Test Timer-1- initialization CPU-Test Side register initialization CPU-Test Timer-2- initialization CPU-Test DMA-Routine PIT-Routine

9 Personal Computer Test Setup Devices Under Test AT-Systems ATX-Systems Processor (Intel) Clock Rate [MHz] Structure Size [µm] Number of Trans DX SX DX DX2 66 P I P I PI MMX P II P III P III >1,5 1,5 1,5 1,0 1,0 0,6 0,6 0,6 0,35 0,28 0,25 0, ,2e6 1,2e6 1,2e6 3,3e6 3,3e6 4,5e6 7,5e6 9,5e6 28,1e6 - Additional voltage required for ATX-Systems ( 3.3 V for Processors ) - Different changing factors: Clock Rate, Structure Size, Number of Transistors,...

10 Personal Computer Test Setup ISA Bus Monitor Card Data lines Controlling lines Address lines ISA bus connector Program performs different incremental bit patterns during subroutines ISA bus available at all investigated systems Direct access to: - Data bus - Address bus - Control bus Orientation of testsystems with minimum E- and H-coupling into the monitor card

11 Personal Computer Test Setup Basic Configuration a) Mainboard Monitor b) c) Processor Keyboard RAM Mouse Power Supply Hard Disk Drive ISA Monitor Card Floppy Disk Drive Basic Configuration PC Testsetup Pentium I Testsetup Pentium II

12 Personal Computer Test Setup TEM Waveguide during test removed Generator Floppy Disk Drive E L H H Recharger PC-System ISA-Monitor-Card Power Supply Unit

13 Measurement Results Breakdown Failure Rates 1 0,8 0,6 0,4 0,2 0 BFR AT-Systems E [kv/m] 1 0,8 0,6 0,4 0,2 0 BFR ATX-Systems PI-75 PI-100 PI-200 PII-266 PIII-266 PIII-450 PIII-500 E [kv/m] - Impact of UWB pulse (t r = 100 ps, t fwhm = 2,5 ns) - Breakdown Failure Rates separated into AT and ATX Systems

14 Measurement Results Effect of different Program States Address register initialization Counter register initialization Side register initialization Timer-0-initialization Timer-1-initialization Timer-2-initialization BT [kv/m] 16,9 17, ,5 17, ,8 15, ,6 13,4 12,8 13,8 12,5 11,8 12,7 11,3 11, Impact of UWB (t r = 100 ps, t fwhm = 2,5 ns) - Influence of program states on breakdown effects is negligible - In the following BT values determined as average over different program states

15 Impact of UWB (t r = 100 ps, t fwhm = 2,5 ns) Continuous increase of the susceptibility with progress of the computer generation Which is the most responsible factor? - Clock rate? - Strukture Size - Number of Transistors... Parameters are linked and not separable! Measurement Results Breakdown Thresholds BT BT [kv/m] 21,6 17,9 17,3 AT-Systems 14,2 12,3 9,8 8,9 8,5 7,4 ATX-Systems 4 3,4 3, PI-75 PI-100 PI-200 PII-266 PIII-266 PIII-450 PIII-500

16 Measurement Results Breakdown Thresholds BT and CPU-Parameters 21,6 17,9 17,3 2 1,6 1,5 1,5 14,2 12,3 1, ,8 8,9 8,5 7,4 0,8 0,6 0,6 4 3,4 3,2 0,4 0,35 0,28 0,28 0,25 0, PI-75 PI-100 PI-200 PII-266 PIII-266 PIII-450 PIII PI-75 PI-100 PI-200 PII-266 PIII-266 PIII-450 PIII ,E+07 2,8E CPU Clock Rate in MHz 450 3,E+07 Number of Transistors on CPU 2,E+07 2,E ,E ,E ,E+00 9,5E+06 7,5E+06 7,5E+06 3,3E+06 3,3E+06 4,5E+06 1,2E+06 1,2E+06 2,8E+04 1,3E+05 2,8E PI-75 PI-100 PI-200 PII-266 PIII-266 PIII-450 PIII BT in kv/m Minimum Structure Size at CPU in µm PI-75 PI-100 PI-200 PII-266 PIII-266 PIII-450 PIII

17 Measurement Results Breakdown Bandwidth BB Impact of UWB (t r = 100 ps, t fwhm = 2,5 ns) BB [kv/m] AT-Systems 21,6 ATX-Systems Decrease of the breakdown bandwidth with progress of the computer generation ,6 14,4 7,2 11,7 7,3 11,8 14, ,6 1,8 1, PI-75 PI-100 PI-200 PII-266 PIII-266 PIII-450 PIII-500

18 Measurement Results Effect of different Clock Rates BT [kv/m] MHz 100 MHz 200 MHz 450 MHz 500 MHz retained unchanged Pentium-I-Mainboard RAM 8 MB BIOS changed CPU 1 P-I 75 MHz CPU 2 P-I 100 MHz CPU 3 P-I 200 MHz 2 0 Pentium I Pentium III - Impact of UWB pulse (t r = 100 ps, t fwhm = 2,5 ns) - Influence of clock rates is very low 2 0 retained unchanged Pentium-III-Mainboard RAM 8 MB BIOS changed CPU 1 P-III 450 MHz CPU 2 P-III 500 MHz

19 Measurement Results Effect of different RAM Values ,5 9,2 8,9 8,6 8,7 8 MB RAM 16 MB RAM 32 MB RAM 128 MB RAM 64 MB RAM 8 MB RAM 16 MB RAM 64 MB RAM 32 MB RAM 128 MB RAM retained unchanged Pentium-I-Mainboard CPU P-I 200 MHz BIOS BT [kv/m] ,4 6,7 7,1 7,2 6,6 8 6 changed RAM 8, 16, 32, 64, 128 MB Pentium I-200 MHz Pentium II-266 MHz 2 0 retained unchanged Pentium-II-Mainboard CPU P-II 266 MHz BIOS - Impact of UWB pulse (t r = 100 ps, t fwhm = 2,5 ns) - Influence of RAM value is negligible changed RAM 8, 16, 32, 64, 128 MB

20 DT [kv/m] Board Measurement Results ,5 889,2 875,5 805,4 37,2 55, Board 386DX20 CPU 386DX25 CPU 387DX25 CPU 486SX25 CPU 486SX33 CPU - Impact of EMP (t r = 7.5 ns, t fwhm = 180 ns) Destruction Thresholds of Components Mainboard CPU BIOS RAM 486DX33 CPU 486DX66 CPU 386 L&H BIOS 386 BIOS 486 BIOS 486 Key. BIOS 286 KB RAM 1 MB RAM - Destruction level of mainboards very low in comparison with CPU, BIOS and RAM

21 Destruction Effects on Chiplevel High Reproducibility at Logic Devices (NAND Gates) A3 Chip 1 A3 Chip 2 A1 A1 A2 NAND in Standard TTL - Technology A2 NAND in Standard TTL - Technology Impact ImpactofofEMP, EMP,trt == ns, ns,tfwhm t == ns ns r fwhm Identical Identicaldestructions destructionsatatdifferent differentchips chips Component Destructions Onchipwire Destructions (Level 1) (Level 2)

22 Destruction Effects on Chiplevel Destructions in Detail PN-Junction, Flashover Onchipwire Destruction Chip 1 NAND in Standard TTL - Technology A1 A2 A3 Flashover identical Layouts identical Destructions!!! PN-Junction, Flashover Onchipwire Destruction Chip 2 A1 A2 A3 Flashover

23 Destruction Effects on Chiplevel CPU - Destructions a) b) c) d) - Impact of EMP (t r = 7.5 ns, t fwhm = 180 ns) - High reproducibility of destruction effects (as observed at investigation of logic devices)

24 Destruction Effects on Chiplevel CPU - Destructions Bondpads a) b) c) d) - Impact of EMP (t r = 7.5 ns, t fwhm = 180 ns) - High reproducibility of destruction effects (as observed at investigation of logic devices) - Destruction effects mostly in the vicinity of bondpads

25 Destruction Effects on Chiplevel Low-Power-Schottky-TTL-Inverter 3b Component Destructions Onchipwire Destructions Bondwire Destructions (Level 1) (Level 2) (Level 3)

26 Destruction Effects on Chiplevel DX 33 processor g b d - Impact of EMP t r = 7.5 ns t fwhm = 180 ns - Very high pulse amplitude 1,5 MV/m destructions - All destructions in the vicinity a h c f e of bondpads

27 Destruction Effects on Chiplevel CPU - Destructions a) b) c) d) e) f) g) h)

28 Summary Influence of program states on breakdown effects is negligible Influence of RAM value is negligible Strong increase of the susceptibility with progress of the technology Factors: - Clock Rate - Strukture Size Not separable! - Number of Transistors Destruction thresholds of mainboards much lower as of CPU-, RAMor BIOS-Chips High reproducibility of destruction effects as observed at logic devices - Prediction of destructions on chiplevel possible - High trustiness of test procedure