Harmonic Response of Ring Oscillators under Single ElectroMagnetic Pulsed Fault Injection

Ring Oscillators (ROs) are essential building blocks in digital devices used for instance in clock generation, True Random Number Generators (TRNGs), Physical Unclonable Functions (PUFs) or on-chip voltage or temperature sensors. Their response to laser pulses, EM (ElectroMagnetic) harmonic fault injections or radio frequency interferences injected into the power distribution network has already been extensively studied. In this paper, we present experimental characterization results of EM pulsed fault injection performed on ROs implemented in FPGAs. We highlight the occurrence of harmonic responses with variable characteristics depending on several parameters, such as the RO placement within the FPGA chip, the timing and location of the injection and the electromagnetic pulse width and amplitude. We show that the usual fault model based on Single Event Transients (SETs) can only partially explain the faulty behavior, even after a single pulse injection.