Noise Floor

Piñata (as most embedded targets out there) needs certain preparation before proceeding to an evaluation. We describe the process usually as follows:

 

"Remove as much decoupling capacitors as possible, starting with the biggest ones until the target doesn't boot anymore, then put the last one back."


The reasoning behind this is that the capacitors are considered to be simply buffers or "fast charging batteries" that absorb oscillations in the power consumption. This is good for providing stable power to the chip, but when doing SCA or FI we want to respectively see the tiny oscillations or are deliberately causing them. So when we model a target (see the picture bellow) it makes sense to remove as much as possible until we reach the "it is too unstable to operate" barrier. In these scenarios we always blame the power supply for not being more stable

Resonance Frequency

Resonance Frequency is another effect that can render a target unstable and requires a different approach to resolve. In the picture below the wire is modeled as a coil (which is common in electronics). The inductance on this coil is tiny as it's just a simple wire and normally we consider it negligible.

Although, a capacitor and an inductor form what is known as a LC circuit (LC circuit). Such a circuit has an resonance frequency which causes strong power and voltage oscillations between the capacitor and the inductor. When removing capacitors we reduce the resonance frequency of the circuitry until it roughly matches a frequency already present in the signal. Because of the 'resonance' it will no go away. At that point the voltage and power oscillations can prevent the chip from booting properly. Since this is happening completely at the target side there is nothing you can do on the power supply side to resolve this :(


Combining Both Effects

The figure bellow shows what happens when both of the above effects are modeled together which plots the stability of the target (white space) based on the capacitance (C) and inductance (L). A normal device exists somewhere in the top left corner of this plot but when we start reducing C (for SCA or FI) we either hit the noise floor (NF) or the area where the resonance frequency matches the existing signal (RF). Both result in an unstable target. 



How to resolve the resonance issue?

Where the noise floor can be lowered with a better (more stable) power supply, this won't help with the resonance issue. Here you need to disturb the resonance frequency which can be done in a variety of ways (good/medium/bad options):

  1. Shorten the wire. This will reduce the inductance (move left in the plot) of the coil and you may be able to remove more capacitors
  2. Extend the wire. This will increase the inductance (move right in the plot) of the coil which disturbs the resonance effect however you increase other noise effects like resistance and EM
  3. Add capacitors again. This will increase the capacitance (move up in the plot). Obviously this would help for this issue but not with your setup as we were removing them for good reason
  4. Remove more capacitors. This will decrease the capacitance (move down in the plot). Theoretically this might help (you may hit the bottom right area) but by the time you are well out of resonance range, you probably run into the noise floor.
  5. Add resistor in series on target side, higher values have more effect and will dampen the oscillations (fades/narrows RF band in plot) but also will cause a bigger voltage drop. This solution will affect the power consumption in a nonlinear way RLC circuit 
  6. Add resistor in parallel with the target. smaller values have more effect and will dampen the oscillations (fades/narrows RF band in plot) but also increase the power consumption in a constant and stable fashion RLC circuit