Electrical Engineering Stack Exchange is a question and answer site for electronics and electrical engineering professionals, students, and enthusiasts. It only takes a minute to sign up.
Sign up to join this community
Scenario: A chip is read/write protected by programming a security bit in its onboard flash memory. Normally this would mean it cannot be re-written. Would a dose of X-rays be capable of erasing the flash to the extent the part could be reprogrammed? So, a number of questions.
a) How much X-ray flux is required?
b) Are such X-ray sources easily available?
c) Would the X-ray flux cause permanent damage to the chip?
d) Has this been done by anyone?
Floating gate flash is susceptible to X-ray, but you risk damaging the onboard charge pump if you subject the device to sufficient energy to guarantee erasure of all bits (the only way to guarantee that you have erased the security bits).
It is possible to erase memory cells at certain energy levels that will not significantly damage the cells, but the exact level is not really known and varies with process and unfortunately that energy level is what fries the onboard programming charge pump.
Floating gate device memory cells are particularly sensitive to energy levels in the < 9keV range; see this and this application notes from Spansion (originally from AMD).
It is possible to make X-ray sources in this range, but probably not cheaply, and this risks damaging the memory cells such that they are not recoverable.
I have had ordinary post-solder X-ray (tungsten source, very little energy below 40keV) flip bits from programmed to de-programmed, but it is somewhat rare.
That same source, when turned up to around 140keV, fried the charge pump and some of the flash memory cells in a power sequencer (flash based programme).
The short answer is that yes, flash can be deprogrammed by X-ray, but with no guarantee of the operation of the device if you successsfully get the device de-programmed and just what energy level for a given part is very unlikely to be known.
The erase event is quite simple (according to research available in IEEEXplore): The floating gate is programmed by tunneling electrons across the tunnel oxide between the control and floating gates.
X-ray is simply high energy photons that produce electron-hole pairs on the floating gate - as electrons have a higher energy level than holes, more electrons than holes migrate, resulting in a net loss of electrons on the floating gate when the event ends and recombination takes place; whether this is sufficient to de-programme the cell is device dependent.
a) Probably depends on the chip.
b) Probably not.
c) Probably, if the dose was high enough. See (a)
d) Probably, if only for academic purposes.
But either way, frequently the lock bits only prevent you reading/writing the contents of the flash, but don't stop you issuing an erase command. So you instruct the chip to erase itself and in the process it erases the lock bits. This isn't a security issue as the chip has been erased so the content of the flash which is being protected from read back is gone. Probably worth exploring that option before resorting to ionising radiation.
This is probably worth reading. It's a report by Spansion on the impact of X-rays on their Flash devices.
That report also points to an IEEE Journal Paper[1] which if you have access to (e.g. at a Uni) might be worth reading. If you don't have access, it basically gives some figures for things like the approximate total dose that would cause failure in different sorts of commercial devices. For microcontrollers it quotes a dose of anywhere from 15 to 70 kRads is likely to cause failure. Flash memory is quoted as anywhere between 5 and 15kRads. That essentially answers (c).
[1] Blish, R.C.; Li, S.X.; Lehtonen, D., "Filter optimization for X-ray inspection of surface-mounted ICs," in Device and Materials Reliability, IEEE Transactions on , vol.2, no.4, pp.102-106, Dec 2002
Any such bulk exposure to X-rays would erase the entire chip, and could possibly cause damage (see some old usenet threads, of which I was a participant). It was suggested early on by Intel to bulk erase EPROM chips in non-windowed packages but I don't think it was used much, if at all.
That is not the method typically used.
