Monitoring for Reliable and Secure Power Management Integrated Circuits via Built-In Self-Test

abstract: Power management circuits are employed in most electronic integrated systems, including applications for automotive, IoT, and smart wearables. Oftentimes, these power management circuits become a single point of system failure, and since they are present in most modern electronic devices, they become a target for hardware security attacks. Digital circuits are typically more prone to security attacks compared to analog circuits, but malfunctions in digital circuitry can affect the analog performance/parameters of power management circuits. This research studies the effect that these hacks will have on the analog performance of power circuits, specifically linear and switching power regulators/converters. Apart from security attacks, these circuits suffer from performance degradations due to temperature, aging, and load stress. Power management circuits usually consist of regulators or converters that regulate the load’s voltage supply by employing a feedback loop, and the stability of the feedback loop is a critical parameter in the system design. Oftentimes, the passive components employed in these circuits shift in value over varying conditions and may cause instability within the power converter. Therefore, variations in the passive components, as well as malicious hardware security attacks, can degrade regulator performance and affect the system’s stability. The traditional ways of detecting phase margin, which indicates system stability, employ techniques that require the converter to be in open loop, and hence can’t be used while the system is deployed in-the-field under normal operation. Aging of components and security attacks may occur after the power management systems have completed post-production test and have been deployed, and they may not cause catastrophic failure of the system, hence making them difficult to detect. These two issues of component variations and security attacks can be detected during normal operation over the product lifetime, if the frequency response of the power converter can be monitored in-situ and in-field. This work presents a method to monitor the phase margin (stability) of a power converter without affecting its normal mode of operation by injecting a white noise/ pseudo random binary sequence (PRBS). Furthermore, this work investigates the analog performance parameters, including phase margin, that are affected by various digital hacks on the control circuitry associated with power converters. A case study of potential hardware attacks is completed for a linear low-dropout regulator (LDO).Dissertation/ThesisMasters Thesis Electrical Engineering 201

Power-Efficient and High-Performance Cicruit Techniques for On-Chip Voltage Regulation and Low-Voltage Filtering

This dissertation focuses on two projects. The first one is a power supply rejection (PSR) enhanced with fast settling time (TS) bulk-driven feedforward (BDFF) capacitor-less (CL) low-dropout (LDO) regulator. The second project is a high bandwidth (BW) power adjustable low-voltage (LV) active-RC 4th -order Butterworth low pass filter (LPF). As technology improves, faster and more accurate LDOs with high PSR are going to be required for future on-chip applications and systems.The proposed BDFF CL-LDO will accomplish an improved PSR without degrading TS. This would be achieved by injecting supply noise through the pass device’s bulk terminal in order to cancel the supply noise at the output. The supply injection will be achieved by creating a feedforward path, which compared to feedback paths, that doesn’t degrade stability and therefore allows for faster dynamic performance. A high gain control loop would be used to maintain a high accuracy and dc performance, such as line/load regulation. The proposed CL-LDO will target a PSR better than – 90 dB at low frequencies and – 60 dB at 1 MHz for 50 mA of load current (IvL). The CL-LDO will target a loop gain higher than 90 dB, leading to an improved line and load regulation, and unity-gain frequency (UGF) higher than 20 MHz, which will allow a TS faster than 500 ns. The CL-LDO is going to be fabricated in a CMOS 130 nm technology; consume a quiescent current (IQ) of less than 50 μA; for a dropout voltage of 200 mV and an IvL of 50 mA. As technology scales down, speed and performance requirements increase for on-chip communication systems that reflect the current demand for high speed data-oriented applications. However, in small technologies, it becomes harder to achieve high gain and high speed at the same time because the supply voltage (VvDvD) decreases leaving no room for conventional high gain CMOS structures. The proposed active-RC LPF will accomplish a LV high BW operation that would allow such disadvantages to be overcome. The LPF will be implemented using an active RC structure that allows for the high linearity such communication systems demand. In addition, built-in BW and power configurability would address the demands for increased flexibility usually required in such systems. The proposed LV LPF will target a configurable cut-off frequency (ƒо) of 20/40/80/160 MHz with tuning capabilities and power adjustability for each ƒо. The filter will be fabricated in a CMOS 130 nm technology. The filter characteristics are as following: 4th -order, active-RC, LPF, Butterworth response, VDD = 0.6 V, THD higher than 40 dB and a third-order input intercept point (IIP3) higher than 10 dBm

RF Integrated Circuits for Energy Autonomous Sensor Nodes.

The exponential growth in the semiconductor industry has enabled computers to pervade our everyday lives, and as we move forward many of these computers will have form factors much smaller than a typical laptop or smartphone. Sensor nodes will soon be deployed ubiquitously, capable of capturing information of their surrounding environment. The next step is to connect all these different nodes together into an entire interconnected system. This “Internet of Things” (IoT) vision has incredible potential to change our lives commercially, societally, and personally. The backbone of IoT is the wireless sensor node, many of which will operate under very rigorous energy constraints with small batteries or no batteries at all. It has been shown that in sensor nodes, radio communication is one of the biggest bottlenecks to ultra-low power design. This research explores ways to reduce energy consumption in radios for wireless sensor networks, allowing them to run off harvested energy, while maintaining qualities that will allow them to function in a real world, multi-user environment. Three different prototypes have been designed demonstrating these techniques. The first is a sensitivity-reduced nanowatt wake-up radio which allows a sensor node to actively listen for packets even when the rest of the node is asleep. CDMA codes and interference rejection reduce the potential for energy-costly false wake-ups. The second prototype is a full transceiver for a body-worn EKG sensor node. This transceiver is designed to have low instantaneous power and is able to receive 802.15.6 Wireless Body Area Network compliant packets. It uses asymmetric communication including a wake-up receiver based on the previous design, UWB transmitter and a communication receiver. The communication receiver has 10 physical channels to avoid interference and demodulates coherent packets which is uncommon for low power radios, but dictated by the 802.15.6 standard. The third prototype is a long range transceiver capable of >1km communication range in the 433MHz band and able to interface with an existing commercial radio. A digitally assisted baseband demodulator was designed which enables the ability to perform bit-level as well as packet-level duty cycling which increases the radio's energy efficiency.PhDElectrical EngineeringUniversity of Michigan, Horace H. Rackham School of Graduate Studieshttp://deepblue.lib.umich.edu/bitstream/2027.42/110432/1/nerobert_1.pd

Nano-Watt Modular Integrated Circuits for Wireless Neural Interface.

In this work, a nano-watt modular neural interface circuit is proposed for ECoG neuroprosthetics. The main purposes of this work are threefold: (1) optimizing the power-performance of the neural interface circuits based on ECoG signal characteristics, (2) equipping a stimulation capability, and (3) providing a modular system solution to expand functionality. To achieve these aims, the proposed system introduces the following contributions/innovations: (1) power-noise optimization based on the ECoG signal driven analysis, (2) extreme low-power analog front-ends, (3) Manchester clock-edge modulation clock data recovery, (4) power-efficient data compression, (5) integrated stimulator with fully programmable waveform, (6) wireless signal transmission through skin, and (7) modular expandable design. Towards these challenges and contributions, three different ECoG neural interface systems, ENI-1, ENI-16, and ENI-32, have been designed, fabricated, and tested. The first ENI system(ENI-1) is a one-channel analog front-end and fabricated in a 0.25µm CMOS process with chopper stabilized pseudo open-loop preamplifier and area-efficient SAR ADC. The measured channel power, noise and area are 1.68µW at 2.5V power-supply, 1.69µVrms (NEF=2.43), and 0.0694mm^2, respectively. The fabricated IC is packaged with customized miniaturized package. In-vivo human EEG is successfully measured with the fabricated ENI-1-IC. To demonstrate a system expandability and wireless link, ENI-16 IC is fabricated in 0.25µm CMOS process and has sixteen channels with a push-pull preamplifier, asynchronous SAR ADC, and intra-skin communication(ISCOM) which is a new way of transmitting the signal through skin. The measured channel power, noise and area are 780nW, 4.26µVrms (NEF=5.2), and 2.88mm^2, respectively. With the fabricated ENI-16-IC, in-vivo epidural ECoG from monkey is successfully measured. As a closed-loop system, ENI-32 focuses on optimizing the power performance based on a bio-signal property and integrating stimulator. ENI-32 is fabricated in 0.18µm CMOS process and has thirty-two recording channels and four stimulation channels with a cyclic preamplifier, data compression, asymmetric wireless transceiver (Tx/Rx). The measured channel power, noise and area are 140nW (680nW including ISCOM), 3.26µVrms (NEF=1.6), and 5.76mm^2, respectively. The ENI-32 achieves an order of magnitude power reduction while maintaining the system performance. The proposed nano-watt ENI-32 can be the first practical wireless closed-loop solution with a practically miniaturized implantable device.PhDElectrical EngineeringUniversity of Michigan, Horace H. Rackham School of Graduate Studieshttp://deepblue.lib.umich.edu/bitstream/2027.42/98064/1/schang_1.pd

비디오 클럭 주파수 보상 구조를 이용한 디스플레이포트 수신단 설계

학위논문 (박사)-- 서울대학교 대학원 : 전기·컴퓨터공학부, 2014. 8. 정덕균.This thesis presents the design of DisplayPort receiver which is a high speed digital display interface replacing existing interfaces such as DVI, HDMI, LVDS and so on. The two prototype chips are fabricated, one is a 5.4/2.7/1.62-Gb/s multi-rate DisplayPort receiver and the other is a 2.7/1.62-Gb/s multi-rate Embedded DisplayPort (eDP) receiver for an intra-panel display interface. The first receiver which is designed to support the external box-to-box display connection provides up to 4K resolution (4096×2160) with the maximum data rate of 21.6 Gb/s when 4 lanes are all used. The second one aims to connect internal chip-to-chip connection such as graphic processors to display panels in notebooks or tablet PCs. It supports the maximum data rate of 10.8 Gb/s with 4-lane operation which is able to provide the resolution of WQXGA (2560×1600). Since there is no dedicated clock channel, it must contain clock and data recovery (CDR) circuit to extract the link clock from the data stream. All-Digital CDR (ADCDR) is adopted for area efficiency and better performances of the multi-rate operation. The link rate is fixed but the video clock frequency range is fairly wide for supporting all display resolutions and frame rates. Thus, the wide range video clock frequency synthesizer is essential for reconstructing the transmitted video data. A source device starts link training before transmitting video data to recover the clock and establish the link. When the loss of synchronization between the source device and the sink device happens, it usually restarts the link training and try to re-establish the link. Since link training spends several milliseconds for initializing, the video image is not displayed properly in the sink device during this interval. The proposed clock recovery scheme can significantly shorten the time to recover from the link failure with the ADCDR topology. Once the link is established after link training, the ADCDR memorizes the DCO codes of the synchronization state and when the loss of synchronization happens, it restores the previous DCO code so that the clock is quickly recovered from the failure state without the link re-training. The direct all-digital frequency synthesizer is proposed to generate the cycle-accurate video clock frequency. The video clock frequency has wide range to cover all display formats and is determined by the division ratio of large M and N values. The proposed frequency synthesizer using a programmable integer divider and a multi-phase switching fractional divider with the delta-sigma modulation exhibits better performances and reduces the design complexity operating with the existing clock from the ADCDR circuit. In asynchronous clock system, the transmitted M value which changes over time is measured by using a counter running with the long reference period (N cycles) and updated once per blank period. Thus, the transmitted M is not accurate due to its low update rate, transport latency and quantization error. The proposed frequency error compensation scheme resolves these problems by monitoring the status of FIFO between the clock domains. The first prototype chip is fabricated in a 65-nm CMOS process and the physical layer occupies 1.39 mm2 and the estimated area of the link layer is 2.26 mm2. The physical layer dissipates 86/101/116 mW at 1.62/2.7/5.4 Gb/s data rate with all 4-lane operation. The power consumption of the link layer is 107/145/167 mW at 1.62/2.7/5.4 Gb/s. The second prototype chip, fabricated in a 0.13μm CMOS process, presents the physical layer area of 1.59 mm2 and the link layer area of 3.01 mm2. The physical layer dissipates 21 mW at 1.62 Gb/s and 29 mW at 2.7 Gb/s with 2-lane operation. The power consumption of the link layer is 31 mW at 1.62 Gb/s and 41 mW at 2.7 Gb/s with 2-lane operation. The core area of the video clock synthesizer occupies 0.04 mm2 and the power dissipation is 5.5 mW at a low bit rate and 9.1 mW at a high bit rate. The output frequency range is 25 to 330 MHz.ABSTRACT I CONTENTS IV LIST OF FIGURES VII LIST OF TABLES XII CHAPTER 1 INTRODUCTION 1 1.1 BACKGROUND 1 1.2 MOTIVATION 4 1.3 THESIS ORGANIZATION 12 CHAPTER 2 DIGITAL DISPLAY INTERFACE 13 2.1 OVERVIEW 13 2.2 DISPLAYPORT INTERFACE CHARACTERISTICS 18 2.2.1 DISPLAYPORT VERSION 1.2 18 2.2.2 EMBEDDED DISPLAYPORT VERSION 1.2 21 2.3 DISPLAYPORT INTERFACE ARCHITECTURE 23 2.3.1 LAYERED ARCHITECTURE 23 2.3.2 MAIN STREAM PROTOCOL 27 2.3.3 INITIALIZATION AND LINK TRAINING 30 2.3.3 VIDEO STREAM CLOCK RECOVERY 35 CHAPTER 3 DESIGN OF DISPLAYPORT RECEIVER 39 3.1 OVERVIEW 39 3.2 PHYSICAL LAYER 43 3.3 LINK LAYER 55 3.3.1 OVERALL ARCHITECTURE 55 3.3.2 AUX CHANNEL 58 3.3.3 VIDEO TIMING GENERATION 61 3.3.4 CONTENT PROTECTION 63 3.3.5 AUDIO TRANSMISSION 66 3.4 EXPERIMENTAL RESULTS 68 CHAPTER 4 DESIGN OF EMBEDDED DISPLAYPORT RECEIVER 81 4.1 OVERVIEW 81 4.2 PHYSICAL LAYER 84 4.3 LINK LAYER 88 4.3.1 OVERALL ARCHITECTURE 88 4.3.2 MAIN LINK STREAM 90 4.3.3 CONTENT PROTECTION 93 4.4 PROPOSED CLOCK RECOVERY SCHEME 94 4.5 EXPERIMENTAL RESULTS 100 CHAPTER 5 PROPOSED VIDEO CLOCK SYNTHESIZER AND FREQUENCY CONTROL SCHEME 113 5.1 MOTIVATION 113 5.2 PROPOSED VIDEO CLOCK SYNTHESIZER 115 5.3 BUILDING BLOCKS 121 5.4 FREQUENCY ERROR COMPENSATION 126 5.5 EXPERIMENTAL RESULTS 131 CHAPTER 6 CONCLUSION 138 BIBLIOGRAPHY 141 초 록 152Docto