What is electromagnetic fault injection (EMFI)?

Electromagnetic fault injection (EMFI) is a hardware security testing technique that uses short, controlled electromagnetic pulses to temporarily disturb the operation of a semiconductor device. By injecting energy into specific areas of a chip at precisely controlled moments, security engineers can induce faults and observe how the device responds to abnormal conditions.

EMFI works by generating a fast electromagnetic pulse through a specialized probe positioned above the target device. The pulse creates a localized disturbance within the chip, potentially affecting circuit behavior, timing, memory operations, or cryptographic calculations. By controlling the pulse timing, strength, and location, engineers can investigate how the device behaves under fault conditions and identify potential security weaknesses.

How does EMFI differ from voltage glitching?

Both techniques attempt to induce faults, but they target the device differently. Voltage glitching injects faults through the device's power supply. EMFI injects energy directly into localized regions of the device using electromagnetic pulses. Because EMFI can target specific areas of a chip without modifying the power supply, it often provides greater flexibility when evaluating complex or highly integrated devices.

How does EMFI differ from laser fault injection?

Laser fault injection uses focused light to target specific regions of silicon, often requiring physical access to the die. EMFI uses electromagnetic pulses and can frequently be performed directly on packaged devices without chip preparation. This makes EMFI an attractive option for many security evaluations where preserving the target device is important.

Do I need to decapsulate a chip before performing EMFI?

In many cases, no. One of the key advantages of EMFI is that testing can often be performed directly on packaged devices without exposing the silicon die. This reduces preparation time and allows engineers to evaluate products in a form closer to their deployed state.

What is the difference between unidirectional and bidirectional fault injection probes?

Different probe designs produce different electromagnetic field characteristics and attack profiles. Depending on the evaluation objective, engineers may choose a unidirectional or bidirectional probe to optimize targeting accuracy, fault generation, and attack coverage. The most suitable option depends on the device under test and the type of fault injection campaign being performed.

Can EMFI be automated?

Yes. EMFI systems can be combined with positioning systems and Inspector software to automate scanning, fault injection campaigns, parameter sweeps, and result analysis. Automation helps improve repeatability and accelerate vulnerability discovery.

Does EMFI damage the target device?

EMFI is generally designed to create temporary and controlled faults rather than permanently damage the device. However, as with any fault injection methodology, testing should be performed within appropriate operating conditions and evaluation procedures.

Does EMFI integrate with Inspector software?

Yes. Inspector software supports automated fault injection workflows, attack campaign management, parameter exploration, and result analysis. Combined with positioning systems and fault injection probes, it helps create efficient and repeatable EMFI evaluations.

Is EMFI safer for the target device than other fault injection methods?

Yes, it reduces the risk of permanent device damage compared to laser-based methods, since you're not directly ablating or heating the silicon with concentrated optical energy.

Do I need to know exactly where to target the chip before starting, or can EMFI help me find that?

You typically don't need to know the exact location upfront, a common workflow uses a larger coil to scan broadly across the chip surface (often combined with automated XYZ-stage scanning) to identify sensitive regions, then switches to a smaller, more focused coil to refine and repeat the fault at that precise spot.

Electromagnetic Glitching

Here's the page we think you wanted. See search results instead:

Popular Configurations

Build My Product

Overview
All Models
Accessories
Software
Support

Inject Precise Electromagnetic Faults to Uncover Vulnerabilities

Electromagnetic fault injection (EMFI) enables security engineers to introduce controlled faults into a target device using precisely generated electromagnetic pulses. By focusing electromagnetic energy on specific areas of a chip, evaluators can influence device behavior during security-critical operations, helping uncover vulnerabilities, assess countermeasures, and validate a device's resistance against fault attacks.

Electromagnetic glitching can often be performed directly on packaged devices, making it a practical approach for evaluating modern secure elements, microcontrollers, system-on-chip (SoC) devices, and other embedded technologies. By generating localized electromagnetic disturbances without requiring direct access to the silicon, security teams can efficiently assess device resilience, identify exploitable fault conditions, and investigate the effectiveness of implemented security countermeasures.

Using specialized fault injection probes combined with precision positioning systems and software automation, engineers can perform highly localized attacks with accurate timing and repeatable execution. Adjustable pulse parameters, interchangeable probe coils, and automated scanning capabilities allow teams to efficiently identify vulnerable areas, reproduce fault conditions, and refine attack scenarios.

Whether used for vulnerability research, certification evaluations, countermeasure validation, or advanced security testing, electromagnetic glitching provides a powerful and flexible fault injection methodology for assessing the resilience of modern embedded devices.

Inject Localized Faults

Generate targeted electromagnetic disturbances to influence specific regions of a device and evaluate security weaknesses.

Test Packaged Devices

Perform fault injection evaluations without chip de-packaging, reducing preparation time and preserving target devices.

Bypass Optical Countermeasures

Assess devices protected against laser-based attacks using an alternative fault injection methodology that is not detected by light-sensing mechanisms.

Automate and Repeat Evaluations

Combine precision probes, positioning systems, and Inspector software to execute repeatable fault injection campaigns and efficiently identify vulnerable areas.

Maximum voltage

100 V ± 10% to 475 V ± 10%
Maximum frequency

1 MHz
Product type

Unidirectional fault injection probe, Bidirectional fault injection probe
Technology

Device Security

Most Popular Configurations

Bidirectional Fault Injection Probe

Model

DS1121B

The DS1121B Bidirectional Fault Injection Probe delivers high power electromagnetic (EM) pulses to precise, user-defined locations on a target device. Its rapid pulse generation is designed to meet the stringent requirements of both commercial and certified testing environments.

Unidirectional Fault Injection Probe

Model

DS1120A

The DS1120A Unidirectional Fault Injection Probe performs localized faults on modern chips using fast, predictable, and high-powered electromagnetic pulses.