PicoEMP – A low-cost Electromagnetic Fault Injection (EMFI) tool | Hacker News Reader

PicoEMP – A low-cost Electromagnetic Fault Injection (EMFI) tool

github.com

56 pointstranspute23 comments

ESD protection is often overlooked in hobbyist designs. Proper shielding and routing, as well as cheap ESD protection diodes, can make a world of difference, in a products lifetime, especially in applications with inductive loads.

you might be surprised how much you can do with a simple spark gap.

a grill lighter or modified milty zerostat can easily inject faults, albeit more manually and less precision than one of these timed devices. but it's also an order of magnitude or two cheaper...

You can also damage parts with those things just from the EMI they radiate.

You know those cigarette lighters with an electric spark? Start a download over wifi, press the lighter a number of times in quick succession. Wifi disconnects.

The first radios were spark gap transmitters (see Hertz's famous experiment). Though to be clear, Hertz's experiment was rather unconventional as the spark gap served as both the transmitting antenna (albeit a fairly noisy one) and also as a switch. Subsequent designs utilize the spark gap only as a high voltage switch. In modern tank circuits, this "switch" is replaced with a solid state transistor (or similar type of devices).

Modern plasma antennas are much more advanced than the traditional spark gaps.

https://en.m.wikipedia.org/wiki/Plasma_antenna

I used this to EMP pulse a locked processor to gain access and extract flash memory from it.

Gave a talk at hardwear.io this year on it. YouTube live stream here: https://youtube.com/live/0tkdst3JE0g

Are there any affordable open source projects in the opposite direction?

I’ve built a rather complex robot with Nema steppers. Now something is messing with the control board and causing the CPU to glitch. Physically apart from the robot, the CPU board works fine for weeks. It also has a completely separate power circuit with optocouplers. So my guess is that it might be the power supply or one of the motors emitting electromagnetic interference. But how would I measure that?

First step is an oscilloscope so you can actually look at what's happening on data lines.

I have one and the power supply lines (to the glitching CPU) seem stable with minimal noise. The CPU-integrated USB2 PHY also retains its connection even during the CPU glitch. A connected Linux workstation will not log any USB connection or disconnection events. And a CDC serial connection will remain open. The power levels to the stepper driver chips also remain stable during the glitch.

So to me, it looks like the glitching happens exclusively inside the CPU. It appears that I’m randomly experiencing the exact same issue that the PicoEMP in the original article can induce.

are you sure it is not just the nemas causing a under voltage situation?

Yes.

1. Stepper and CPU use separate power supplies and are optically decoupled.

2. I’ve monitored min max voltage on the CPU caps and they are fine the entire time, even during glitches.

optical decoupled uart?

No UART at all: Control flow is through USB directly into the CPU, so the serial interface there is purely virtual. And then from CPU to stepper drivers it's Enable, Direction, and Step pins, all of them optically decoupled. The stepper drivers then have their own power supply and caps so that they can't interfere with the CPU power circuitry.

Just a reminder to ensure that you have brownout detection enabled on the CPU/MCU (assuming it's available) and are checking for it in your firmware. Supply drops can be very brief.

Next steps: EMI (near field) probes for your scope.

https://www.rohde-schwarz.com/us/products/test-and-measureme...

My scope is a SDS1204X-E and I don't believe there are any EMI probes that will work with it out of the box. The scopes that can do EMI (in addition to all the other stuff) are $5000+ which is why I was wondering if there are any more affordable single-purpose EMI measurement devices. Amazon is full with devices claiming to measure EMI, but since they usually advertise with people wearing tinfoil hats, 5G shielding burkas, and copper capes, I don't think those are useful for science.

Can you only run one stepper at a time and see if a specific one(s) is causing the issue? Maybe it's physically closer or has a better line of sight to the CPU? Can you shield the board the CPU is on?

In the end, I acquired an EMI probe. The DC +48V cable from power supply to spindle was emitting lots of interference. I had not really considered it because usually EMI is generated by changing voltage and in theory that line should remain at the same voltage. But it seems like tiny sparks in the spindle (or something like that) will momentarily drag down the power supply line, thereby causing HF emissions.

https://www.bunniestudios.com/blog/2023/infra-red-in-situ-ir... (and https://www.youtube.com/live/8aLW4UEuJ_c ) is related, although I don't believe it is glitch specific but the positioning machinery seems like what you're after

Let's hope someone doesn't put on a bigger "antenna" on one of these and start frying electronics from a distance.

Inverse square law to the rescue!

Jokes aside, I've always been curious how much you could accomplish in this direction by driving a microwave magnetron into a horn antenna using an old pulse forming network off ebay... Hell, even travelling wave tubes are getting affordable these days.

Even the actual chipshouter isn’t capable of doing that, really. This thing has a puny amount of power in comparison.

Would this pass EMC certification?

Reply on news.ycombinator.com