NewAE CHIPSHOUTER CW520 User manual

CHIPSHOUTER®
USER MANUAL
Last Update: Sept 3/2019
© 2018-2019 NewAE Technology Inc. All rights reserved. Specifications are subject to change without
notice. All product names are trademarks of their respective companies. ChipSHOUTER is a registered
trademark of NewAE Technology Inc.
NewAE Technology Inc. makes no representations or warranties with respect to the accuracy or completeness
of the contents of this document and reserves the right to make changes to specifications and product
descriptions at any time without notice. NewAE Technology does not make any commitment to update the
information contained herein. NewAE Technology products are not intended, authorized, or warranted for
use as components in applications intended to support or sustain life. NewAE Technology products are
designed solely for teaching purposes.

ii
LIMITED WARRANTY AND LIMITATION OF LIABILITY
Each NewAE Technology Inc product is warranted to be free from defects in mate-
rial and workmanship under normal use and service. The warranty period is one
year and begins on the date of shipment. This warranty extends only to the
original buyer or end-user customer of a NewAE Technology Inc authorized re-
seller, and does not apply to probes (including EMFI injection tips), exposed
circuit boards, fault injection targets, or to any product which, in NewAE
Technology Inc's opinion, has been misused, altered, neglected, contaminated,
or damaged by accident or abnormal conditions of operation or handling (includ-
ing failing to observe required ESD handling procedures).
Authorized resellers shall extend this warranty on new and unused products to
end-user customers only but have no authority to extend a greater or different
warranty on behalf of NewAE Technology Inc. NewAE Technology Inc.'s warranty
obligation is limited, at NewAE Technology Inc.'s option, to refund of the
purchase price, free of charge repair, or replacement of a defective product
which is returned to a NewAE Technology Inc. within the warranty period. To
obtain warranty service, contact NewAE Technology Inc.
If NewAE Technology Inc. determines that failure was caused by neglect, misuse,
contamination, alteration, accident, or abnormal condition of operation or
handling, including failures caused by use outside the product’s specified
rating, or normal wear and tear of mechanical components, NewAE Technology Inc
will provide an estimate of repair costs and obtain authorization before com-
mencing the work.
THIS WARRANTY IS BUYER'S SOLE AND EXCLUSIVE REMEDY AND IS IN LIEU OF ALL OTHER
WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY IMPLIED
WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. NEWAE
TECHNOLOGY INC SHALL NOT BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL OR
CONSEQUENTIAL DAMAGES OR LOSSES, INCLUDING LOSS OF DATA, ARISING FROM ANY CAUSE
OR THEORY.
Since some countries or states do not allow limitation of the term of an im-
plied warranty, or exclusion or limitation of incidental or consequential
damages, the limitations and exclusions of this warranty may not apply to every
buyer. If any provision of this Warranty is held invalid or unenforceable by a
court or other decision-maker of competent jurisdiction, such holding will not
affect the validity or enforceability of any other provision.
NewAE Technology Inc.
1083 Queen St., Suite 196
Halifax, NS. Canada
[email protected]m

iii
Table of Contents
Introduction.................................................... 5
Safety Information ............................................. 6
High Voltage Warnings .......................................... 9
Packing Information ........................................... 11
Background and Quick Start Guide .............................. 14
Device Architecture ........................................... 15
Specifications................................................. 17
General Specifications ...................................... 17
I/O Characteristics ......................................... 18
High Voltage Characteristics ................................ 18
Pulse Source Characteristics ................................ 19
Inserted Pulse Characteristics .............................. 19
External Connections .......................................... 22
SMA High Voltage Output ..................................... 22
Attaching/Removing SMA Connectors ......................... 23
SMB Trigger Input ........................................... 23
DC Power Jack ............................................... 26
RJ12 Expansion Connector .................................... 25
Oscilloscope Probe Connectors ............................... 26
Pulse Generation .............................................. 27
Generated Pulse vs. Inserted ................................ 27
Active-High vs. Active-Low Inputs ........................... 27
Basic Pulse Generator ....................................... 28
Programmable Pulse Generator ................................ 28
Simple EMFI Target (CW322) .................................... 30
Ballistic Gel EMFI Target (CW522) ............................. 33
Injection Tip Usage ........................................... 36
Avoiding Spark Discharge .................................... 38
Oscilloscope Pulse Shape Monitoring ........................... 39
Adjusting for Oscilloscope Setting .......................... 41
Forced-Air Cooling ............................................ 43
Fault Modes.................................................... 46
Probe Disconnected Fault .................................... 47
Over-Temperature Fault ...................................... 48
Triggered when Disarmed ..................................... 49
Trigger Length Invalid ...................................... 49
Internal Faults ............................................. 50
Serial Interface .............................................. 51
Command List ................................................ 52
USB Interface ............................................... 59
Python API Interface .......................................... 61

iv
XY(Z) Table Connection ........................................ 62
Troubleshooting ............................................... 63
Table of Figures
Figure 1: Overview of ChipSHOUTER device architecture. ........ 15
Figure 2: 4mm tip pulse width ................................. 20
Figure 3: 1mm tip pulse width ................................. 21
Figure 4: External connectors on the ChipSHOUTER. ............. 22
Figure 5: RJ12 Connector on ChipSHOUTER Panel. ................ 25
Figure 6: CW322 Simple Target ................................. 30
Figure 7: CW522 Ballistic Gel ................................. 33
Figure 8: Detail of the 4MM/CCW tip construction. ............. 36
Figure 9: Detail of included probes. .......................... 37
Figure 8: Inserted pulse viewed on oscilloscope screen. ....... 39
Figure 11: Tuning oscilloscope probe. ......................... 41
Figure 10: Example calibration waveform. ...................... 42
Figure 11: Removing blanking plug. ............................ 44
Figure 14: Adding air inlet adapter. .......................... 44
Figure 15: USB Interface for ChipSHOUTER ...................... 59
Revision
Release Date
Changes
1.1
9-SEPT-2019
•Fix RJ12 pinout, small clarifica-
tions throughout, add more detail of
external hardware trigger, add more
detail of probe construction.
1.0
20-JULY-2018
•Initial release, minor fixes.
0.2
16-JULY-2018
•Add troubleshooting section.
0.1
13-JULY-2018
•Pre-Pre-Release.

ChipSHOUTER Users Manual: Introduction
5
Introduction
The CW520 (ChipSHOUTER) is a fully-featured Electromagnetic
Fault Injection platform that can be used to discover and
characterize vulnerabilities in embedded systems. ChipSHOUT-
ER makes EMFI available to test labs, engineering
development firms, educators, and embedded enthusiasts. With
a flexible API and bundled practice targets the system is a
platform for experimentation and education right out of the
box. Paired with an X-Y table and some basic python script-
ing the ChipSHOUTER becomes a fully automatable EMFI
platform capable of precision testing and fault characteri-
zation. This manual will give a basic background for the
principles behind the device, using it safely, and example
injections on included targets. Users will also be directed
to further reading on advanced uses, where professionals and
researchers can take advantage of the modular design to fur-
ther fine tune their processes and experiments.

ChipSHOUTER Users Manual: Safety Information
6
Safety Information
CAREFULLY READ BOTH THE FOLLOWING GENERAL SAFTEY
INFORMATION, AND SAFTEY INFORMATION IN THE SECTION ENTITLED
“HIGH VOLTAGE WARNINGS”:
•This product generates strong electronic and mag-
netic fields:
oDO NOT use around persons with implanted
or attached medical devices such as pace-
makers, implanted defibrillators, or
medication pumps.
oDO NOT use around safety-critical devices,
or anything were interruption of device
function would be undesirable.
•DO NOT touch the injection tip or high voltage
connector when device is armed or discharging.
•DO NOT aim or position the injection tip onto a
person or other living tissue.
•This product is capable of PERMANENTLY DESTORYING
devices under test.
•This product is capable of PERMANENTLY DAMAGING
devices under test. NEVER return a tested device
to service, even if it appears operational, as
the functionality of this device could be affect-
ed.
•DO NOT operate the product with covers removed or
the case open. Hazardous voltage exposure is pos-
sible.
•IF you hear or notice electrical discharge, imme-
diately discontinue operation and remove power

ChipSHOUTER Users Manual: Safety Information
7
from the ChipSHOUTER by unplugging the power
source. Check connections are secure and for dam-
age to the probe. If probe is damaged destroy and
discard it, and replace with an undamaged probe.
•IF you notice smoke or unusual odors emitted from
the ChipSHOUTER, immediately discontinue opera-
tion and remove power from the ChipSHOUTER by
unplugging the power source. Store the device
where it cannot accidently be used, and contact
us for repair or replacement information.
•DO NOT operate the product with the air inlet
cover removed without connecting an air hose. If
an air hose is removed immediately replace the
air inlet cover.
•Repairs must only be performed by an approved
technician.
•DO NOT expose the ChipSHOUTER to water or other
liquids, DO NOT submerge the ChipSHOUTER in water
or any liquid, and do not use ChipSHOUTER as a
bath toy under ANY circumstances.
•Keep ChipSHOUTER away from children and especial-
ly smart dogs.
•DO NOT use ChipSHOUTER or any accessories if they
appear damaged in any way, paying careful atten-
tion to the insulation on the injection tips.
•CAREFULLY READ the high voltage warnings section.
•Familiarize yourself with the warning and label
pictures from the table below.

ChipSHOUTER Users Manual: Safety Information
8
Symbol
Description
Symbol
Description
WARNING. RISK OF DANGER.
WARNING. HAZARDOUS
VOLTAGE. Risk of electric
shock.
Consult user documenta-
tion. DC (Direct Current)
Conforms to European
Union directives. AC (Alternating Current)
For indoor use only. Do not disassemble unit.
This product complies with the WEEE directive marking require-
ments. The affixed label indicates that you must not discard
this electronic product in domestic household waste. Product
Category: With reference to the equipment types in the WEEE
Directive Annex I, this product is classed as category 9 “Moni-
toring and Control Instrumentation” product. Do not dispose of
this product as unsorted municipal waste. Please contact us to
dispose/recycle this product.

ChipSHOUTER Users Manual: High Voltage Warnings
9
High Voltage Warnings
In addition to the safety warnings regarding the ChipSHOUTER
operation, there are some specific additional warnings re-
lated to the high voltage circuitry. Please carefully read
both the “Safety Information” in addition to these “High
Voltage Warnings”. All users of the ChipSHOUTER must be
aware of these warnings.
•ChipSHOUTER can generate strong magnetic and
electrical fields. DO NOT use around safety-
critical equipment. DO NOT allow a person with an
implanted or on-body medical device near the
ChipSHOUTER.
•The SMA center pin has hazardous voltage present.
DO NOT touch or otherwise expose this connection.
•DO NOT touch the injection probe or high voltage
connector when device is armed or discharging.
•DO NOT attempt to arm the ChipSHOUTER without a
EMFI injection probe attached.
•DO NOT use the ChipSHOUTER to generate a spark-
gap discharge. In addition to exposing hazardous
ChipSHOUTER can generate hazardous voltages. It
is very important that everyone who will be operat-
ing the ChipSHOUTER carefully reads and
understands this manual and the warning instruc-
tions. If you have questions about these warnings
please contact NewAE immediately.

ChipSHOUTER Users Manual: High Voltage Warnings
10
voltages, this may generate U.V. light and other
dangerous radiation. ChipSHOUTER will also be se-
verely damaged during the discharge process, as
the spark-gap discharge exceeds allowed dv/dt
ratings of the driver circuit.
•The insulation on the injection probes must be
unbroken for your protection. Carefully inspect
the probes for damage to the insulation, and de-
stroy (to prevent accidental reuse) and discard
any damaged probes.
•DO NOT position the injection probes in such a
manner they will scrape conductive areas of the
device under test.
•The SMA connector shell is NOT connected to the
enclosure (chassis). Do not short the SMA con-
nector shell to the enclosure or ground, as
otherwise high voltages and currents could pass
through this connection.
•Do not connect anything besides a EMFI injection
probe or included accessory to the ChipSHOUTER
output.

ChipSHOUTER Users Manual: Packing Information
11
Packing Information
①
ChipSHOUTER CW520 Main Unit ⑧SMB to SMA adapter
②
19V / 3.4A Power Adapter ⑨SMB to BNC adapter
③
Injection probe/tips (1mm, 4mm) ⑩SMB Cable
④
Isolated USB Adapter +
RJ12 Cable
+ Micro USB Cable ⑪CW521
Ballistic Gel SRAM
Target + USB Cable
⑤
SMA Saver (Installed) ⑫CW322 Simple EMFI
Target
+ CR2032 Battery
⑥
SMA Right angle adapter ⑬Cooling air adapter
and
4mm wrench
⑦
Oscilloscope Probe Adapter (x2)

ChipSHOUTER Users Manual: Packing Information
12
1. The ChipSHOUTER CW520 main unit is the EMFI fault in-
jection platform itself.
2. The 19V power supply provides DC power to the Chip-
SHOUTER.
3. The injection probe tips must be added onto the end of
the ChipSHOUTER before using the device. Do not touch
the probes during operation.
4. The Isolated USB adapter provides a computer interface
to the ChipSHOUTER.
5. The SMA Saver is a sacrificial SMA male to female
adapter. It is added onto the ChipSHOUTER to save wear
and tear on the ChipSHOUTER SMA connector. The SMA
Saver can easily be replaced in case it is damaged.
6. The SMA right angle adapter is used in combination
with a horizontal mount XY table.
7. The oscilloscope probe adapter allows monitoring of
the pulse inserted at the tip of the ChipSHOUTER it-
self.
8. The SMB to SMA adapter allows interfacing the external
trigger input with the ChipWhisperer trigger outputs,
or other equipment with logic-level SMA outputs.
9. The SMB to BNC adapter allows interfacing the external
trigger input with regular lab equipment.
10.The SMB cable is used to connect the external trigger.
11.The Ballistic Gel SRAM target provides detailed infor-
mation about the effectiveness of a fault injection
pattern.
12.The Simple EMFI target allows quick validation that a
fault injection probe is working.

ChipSHOUTER Users Manual: Packing Information
13
13.The cooling air adapter allows you to insert dry high-
pressure air into the ChipSHOUTER for cooling. The
adapter may look different or be of different material
thank shown here.
We are continuously improving our products. Some of the ac-
cessories or the device may look different than the photos
used for this manual, but this is part of our continuous re-
finement of the product. If you have questions about the
parts received please contact us.

ChipSHOUTER Users Manual: Background and Quick Start
Guide
14
Background and Quick Start Guide
Electromagnetic Fault Injection (EMFI) is a way of injecting
transient faults into electronic systems without direct
electrical contact. This is accomplished by generating a
rapidly changing magnetic field directed at the Device under
Test (DuT). Changing magnetic fields cause induced currents
in the DuT, resulting in changing voltage levels on internal
signals. These changing voltage levels can cause incorrect
read (or write) operations, affecting results of latches,
registers, and more. Corrupting memory, resetting lock bits,
skipping instructions, and inserting faults into crypto-
graphic operations are all applications of EMFI. This can be
used for embedded security research, validating fault-
tolerance of algorithms, and validating fault-tolerance of
entire systems.
To use the ChipSHOUTER in its simplest configuration you
need only three things: the ChipSHOUTER itself, the included
19V power adapter, and one of the included injection tips.
Attach the tip to the high voltage output of the device, and
the power adapter to the DC input. Holding the ARM button
arms the device and pressing pulse generates a fault. Press-
ing ARM again will disarm the device. Application of the
device and more detail on performing injections is included
in the sections pertaining to the included targets.

ChipSHOUTER Users Manual: Device Architecture
15
Device Architecture
Figure 1: Overview of ChipSHOUTER device architecture.
Fundamentally, the ChipSHOUTER provides a high voltage
charge that is discharged through an inductor (the “injec-
tion tip”). This injection tip generates a powerful magnetic
field that can be used to induce faults in a target device.
To make using the device easier, the ChipSHOUTER in-
cludes a microcontroller that controls device operation.
This includes detection of fault conditions such as over-
temperature or invalid operational requests. Once a fault is

ChipSHOUTER Users Manual: Device Architecture
16
active, the device will prevent “arming” (turning on the
high-voltage circuit) until the condition is cleared, and
possibly acknowledged by the user.
This microcontroller can also generate pulse waveforms.
These waveforms can either be basic pulses of a specified
lengths, or more complicated patterns involving switching
the high voltage on/off in 21nS time-steps.
To reduce the delay between a trigger event and the
pulse injection, a special hardware trigger is also present
that directly drives the high-voltage switch. This hardware
trigger allows entirely arbitrary on/off pulses to be sent
into the injection tip. This hardware trigger can be used
with general-purpose test equipment or specific power analy-
sis equipment such as the ChipWhisperer.
The output connector is a SMA connector jack. For safety
reasons the device uses “high-side” switching, which means
the high voltage is present ONLY during the pulse operation
itself. The output includes two current-limiting resistors
to prevent device destruction even when discharging into a
direct short, and two catch diodes to absorb the reverse
voltage spike generated by the collapsing magnetic field.

ChipSHOUTER Users Manual: Specifications
17
Specifications
General Specifications
Power supply (ChipSHOUTER DC Input)... 19V DC ±10%, 3.4A
Power consumption (standby)........... 0.4W Typical
Power consumption (armed)............. 5W Typical
Power consumption (charging/pulsing).. 5W to 50W Typical
Power supply (AC-DC adapter).......... 100–240VAC, 50/60Hz, 1.5A
Size (ChipSHOUTER main unit).......... 130 x 55 x 25 mm
Weight (ChipSHOUTER main unit)........ 180 g
Altitude
Operating......................... 2000 m
Storage........................... 12 000 m
Storage Temperature................... -40°C to 60°C
Operating Temperature................. 5°C to 40°C
Relative Humidity..................... Noncondensing
0 % to 80 % @ 5°C to 30°C
Decreasing linearly to 50 % @ 40°C
Safety
EN 61010-1:2010.................. Pollution Degree 2
Electromagnetic Compatibility
International.................... EN 61326-1: Portable Electromagnetic
Environment; EN 61326-2-2 CISPR 11: Group 2, Class A
Group 2: This equipment intentionally generates RF
energy that is used in electromagnetic coupling, in-
ductive coupling, and capacitive coupling for
material analysis or inspection.
Class A: This equipment is suitable for use in all
establishments other than domestic and those directly
connected to the public low voltage power supply net-
work that supplies buildings used for domestic
purposes.
There may be potential difficulties in ensuring elec-
tromagnetic compatibility in other environments due
to conducted and radiated disturbances.
Emissions that exceed the levels required by CISPR 11
can occur when the equipment is connected to a test
object. The equipment may not meet the immunity re-
quirements of this standard when test leads and/or
test probes are connected.

ChipSHOUTER Users Manual: Specifications
18
USA (FCC)........................ 47 CFR 15 subpart B. This product is
considered and exempt device per clause
15.103.
Operation is subject to the following two conditions:
(1) this device may not cause harmful interference
and (2) this device must accept any interference re-
ceived, including interference that may cause
undesired operations. You must discontinue use of
this device if it causes interference to another us-
er, and remedy the interference before continuing
operation of this device.
I/O Characteristics
Serial command interface.............. 3.3V CMOS Serial, 115200 baud, 8N1
Protocol ............................. (1) ASCII command prompt
(2) Binary
Serial connection..................... RJ12 connector with GND, TX/RX,
3.3V output, and switchable pulse/arm
pin.
Hardware trigger connector type ...... SMB connector, center-positive
Hardware trigger threshold ........... 2V
Hardware trigger absolute max ratings -0.5V to 6.5V
Hardware trigger impedance............ 50Ω/ 1.8KΩ(Switchable)
Hardware trigger level................ Active-high / Active-Low (Switchable)
Injected waveform monitor............. BNC connector for mating with standard
1MΩ|| 10-25pF oscilloscope input. Ad-
justable compensation trimmer for fine-
tuning match.
Voltage monitor attenuation........... 20x attenuation
Voltage monitor output range.......... ±25V into properly matched oscilloscope
input
High Voltage Characteristics
Characteristic
Min
Typ
Max
Units
Programmable voltage range
150
500
V
Charge rate
30
40
V/ms
Charge energy
625
mJ
Measured voltage accuracy via digital
interface
±(5% + 10V)

ChipSHOUTER Users Manual: Specifications
19
Pulse Source Characteristics
Pulse generator source................ (1) Internal pulse generator, basic
(2) Internal pulse generator,
programmable pattern
(3) External hardware trigger
Characteristic
Min
Typ
Max
Units
Basic pulse generator
Pulse width range
80
960
nS
Pulse width resolution
80
nS
Pulse width jitter
350
pS std-dev
Pulse dead-time (between repeats)
1
1000
mS
Pulse repetition count (per
Trigger event)
1
10000
Programmable pattern generator
Pulse width resolution (time-steps)
20.83
nS
Time-steps per pulse
1
5000
Time-steps
Total pulse width
0.0208
100
uS
Pulse output state per time-steps
1/0
Pulse width jitter
tested pulse width of 80nS
350
pS std-dev
Hardware Input Trigger
Delay
Tested high voltage 150V to 500V
75
nS
Delay jitter
Tested high voltage 150V to 500V
150
pS std-dev
Width jitter
Tested high voltage 150V to 300V
800
pS std-dev
Width jitter
Tested high voltage 300V to 500V
220
pS std-dev
Inserted Pulse Characteristics
Characteristic
Min
Typ
Max
Units
Pulse width into 1mm injection tip
15
80
TYPICAL nS
Pulse width into 4mm injection tip
24
480
TYPICAL nS
Minimum consecutive pulse spacing
Tested with 4mm injection tip at
voltage setting of 500V
2 Pulses
100
ns
3 Pulses
175
ns
For details of the pulse insertion see following text.

ChipSHOUTER Users Manual: Specifications
20
While the pulse generator characteristics show that a
wide variety of pulses can be applied to the injection tip,
the actual resulting pulse characteristics will depend con-
siderably on the tip properties itself. It is not possible
to achieve every injection result on every tip.
Insertion of multiple pulses may require adjusting the
driven pulses, which is achieved with the “monitor” port
output. As an example, achieving (approximately) the same
pulses multiple times is shown with the following pattern
trigger waveform setting for 1, 2, and 3 pulses. Note the
spacing between pulses varies as well:
s w 1110
s w 111011110
s w 111000011110000111110
The following figures (Figure 2 and Figure 3) show exam-
ples of possible range of pulses that can be achieved on one
test of the provided 1mm and 4mm tips.
10
100
1000
100 150 200 250 300 350 400 450
Pulse Width (ns)
Peak Output Voltage (Measured)
4mm Tip Pulse Width Limits
Maximum Minimum
Figure 2: 4mm tip pulse width