EE_330 Final_Project

Report: Project 5: Physically Unclonable Function [Analog]

Final Project done by: __Isaac_C_Klein__&__Nathan_Nordling_______

Project Report by: _____Isaac_C_Klein__&__Nathan_Nordling________

Lab work date: ______________05/03/2019__________________________

Report submission date:

Lab Section: D

Graded by _______________________________________________________

Score ______________________________________________________

Introduction:
Problem:
In the semiconductor world we have issues of parts
being counterfeited and sold illegally. In a world where
you can surf the web and buy exactly the parts you need
about anywhere you have no way of knowing a counterfeit from
a real deal till its to late... Or can you?
Solution:

PUFs! PUFs are the answer to the problem! A PUF is a

small circuit that can be added to a chip without negatively
affecting the chip, each with their own unique id. By
exploiting the random component of manufacturing error we
can have a 50% chance for each bit in the circuit of being a
1 or a 0… Not convinced? A chance between a 1 and a 0
doesn't seem to be much, but what if we make the number of
bits to be very large. Then for each bit that we add we
double our randomness! What I have in mind is a 32 random
bit PUF, and To give you an idea of how unlikely it is for 2
bits to end up with the same ID, lets use a formula to
calculate the likely hood of two of the same chip being the
same.
EE_330 Final_Project

The Math:

So for each bit I add I double the likelihood of a

unique value. So the chance that we will have the same
value twice is [1/(2bits)] * 100%. So for 32 bits we have:
[1/(232)] * 100% == [1/(4,294,967,296)] * 100% == (2.33 *
10-10) * 100% == (2.33 * 10-8) % == 0.0000000233%. So as we
can see it is very unlikely to fabricate two thirty two bit
PUFs with the same id, but if your still not convinced a 64
bit PUF is just a step away!

The Process:

To create a 32 bit Puf we just need a few simple basic

parts. First off we will use minimal sized pmos and nmos
transistors to build an inverter. By placing two inverters
in a serial loop we create a random chance that one side
should be 0 and the other should be 1 the moment it is
fabricated. Once fabricated it should keep that value
whether it is turned on or off within its loop. Next we tap
the value between these inverters and that is considered one
PUF bit. If we gather and addition 62 more inverters for a
total of 64, we then have all of the inverters necessary for
a 32 bit PUF, all for a small price of 128 minimally sized
transistors.

Whats Next:

After the creation of the 32 bit Puf I now have a 32

bit output which is a problem because chip ports are costly.
So in order to counter this I suggest the addition of a 32
bit shift register which will require: Wait for it: ONLY
ONE PORT! The implementation of the shift register is quite
simple; Using the same Inverters as before and adding logic
for 2 input NAND gates, we can create Multiplexers and D
Latch Flip Flops. Using these pieces we can create a 1 bit
register, which can be used to make 31 just like it. By
connecting the registers serially and initially loading them
with a PUF value, we can use a clock to output each value
from a single port. If that sounds like a deal keep
following along as I show you the process step by step.
EE_330 Final_Project

PART I: THE PHYSICALLY UNCLONABLE FUNCTION (PUF)

INVERTER_SCHEMATIC

To start we have a simple inverter which uses the pmos

pull up network and nmos pull down network to invert
the input. Each transistor is set to minimal size.
EE_330 Final_Project

INVERTER_SYMBOL INVERTER_TEST_BENCH

Using the symbol file for the inverter we create a simple test
bench to see that the output is inverted.

INVERTER_SIMULATION

And all checks out fine!

EE_330 Final_Project

PUF_ONE_BIT_SCHEMATIC

By placing the two inverters in a serial cycle we have created a

1 bit random. All that's left is to power it on using VDD and
VSS to claim our output.

PUF_ONE_BIT_SYMBOL
EE_330 Final_Project

PUF_ONE_BIT_TESTBENCH

Testing the PUF using a regular testbench inst ideal since the
random is caused upon manufacturing, so we have a statistical
based software that mimics manufacturing defect to test the
random variance in the circuit. We will use this later but for
now I will use simple test benches that will prove that its
connected properly with its static data.
PUF_ONE_BIT_SIMULATION

Nothing is out of the ordinary here, just static feedback.

EE_330 Final_Project

PUF_FOUR_BIT_SCHEMATIC

We will now pick up the pace a bit starting from here moving up
the parts. This is a 4 Bit Puf crafted with 4 single bit pufs.

PUF_FOUR_BIT_SYMBOL PUF_FOUR_BIT_SIMULATION

PUF_FOUR_BIT_TESTBENCH
EE_330 Final_Project

PUF_SIXTEEN_BIT_SCHEMATIC PUF_SIXTEEN_BIT_STATIC

PUF_SIXETTEN_BIT_TEXTBENCH PUF_SIXTEEN_BIT_SYMBOL
EE_330 Final_Project

PUF_THIRTY_TWO_BIT_SCHEMATIC

We use the same process over and over using multiple of smaller
PUFS to make larger ones, but since we already made a 16 bit put
we only need to multiply that one by 2x instead of 4x to get to
the full 32 bits needed.
EE_330 Final_Project

PUF_THIRTY_TWO_BIT_SYMBOL

With each step closer to the final product I make my designs more
elaborate.
EE_330 Final_Project

PUF_THIRTY_TWO_BIT_TEST_BENCH

PUF_THIRTY_TWO_BIT_STATIC_RESPONSE
EE_330 Final_Project

PART II: THE MONTE CARLOS SIMULATION

Weve been using testbenches an static simulation data so far
to show that the PUFs are consistently static, which helps us
know it is properly connected for the actual test. The Monte
Carlos Simulation will mimic the hardware implementation of the
circuit to observe the random chance in the circuit. So using
the thirty two bit test bench we will add the Monte Carlos
software for a more accurate look at the 32 bit PUF.

MONTE_CARLOS_SIMULATION

On this test the VDD is rising from 0 to its max value of 1.6V.
Along the way each of the 32 bits of the PUF randomly pulls
itself to the 0 ground or current VDD value, this simulation is
ran a total of 100 times to show that the bits arent consistently
going one way or another. The above shows the 32 * 100, 3,200
bends of a curve for the PUF bits.
EE_330 Final_Project

MONTE_CARLOS_SIMULATION_SINGLE_BIT
EE_330 Final_Project

Above we select a single bit to view and as you can see out of
100 simulations that bit is all over the place. This shows the
random factor. But wait, are they just locking in a place
consistently based on the slope of VDD??? Well lets find out
with further simulations below.

Rise: 1u

Rise: 2u

Rise: 5u
EE_330 Final_Project

We can observe that with the increase of time with the rise of
vdd the slope has become much slower, but using the same Monte
Carlos variance of random, we still achieve the same results in
each run. Proving that the values are based on manufacturing
defects and not a VDDs pull on a specific bit. So now that we
have a full working 32 Bit Puf lets move on to the 32 bit shift
register.

PART III: THE SHIFT REGISTER

To make the shift register first we need some inverters,
which we already have. Then we need some NAND gates to make the
rest of the components. So lets start there.

NAND_TWO_INPUT_SCHEMATIC NAND_TWO_INPUT_SYMBOL

Nands are quite simple to make, requiring one pmos and one nmos
per input. The pmos are placed in parallel in the pull up section
and the nmos are placed in series in the pull down section. So
for a two input nand we use 4 minimal sized transistors.
EE_330 Final_Project

NAND_TWO_INPUT_TESTBENCH

NAND_TWO_INPUT_SIMULATION

A B F
1 1 0
0 1 1
1 0 1
0 0 1

And a NAND should function as VDD wherever A and B dont equal VDD
which is what we get so it works. Next we need a good mux.
EE_330 Final_Project

MULTIPLEXER_TWO_INPUT_SCHEMATIC

Logic_Table_Mux

A B SEL NSEL N(NSEL N(SEL* F

*A) B)
0 0 0 1 1 1 0
0 0 1 0 1 1 0
0 1 0 1 1 1 0
0 1 1 0 1 0 1
1 0 0 1 0 1 1
1 0 1 0 1 1 0
1 1 0 1 0 1 1
1 1 1 0 1 0 1
When SEL == 0: if (A == 1) F == 1 else F == 0
When SEL == 1: if (B == 1) F == 1 else F == 0
EE_330 Final_Project

MUX_TWO_INPUT_SYMBOL MUX_TWO_INPUT_SIMULATION

MUX_TWO_INPUT_TESTBENCH

All seems to be testing well. When SEL is up and A is up vout is

up, when SEL is down and B is up vout is up, else vout is down.
EE_330 Final_Project

All implemented with 3 nand and one inverter for a total of 14

transistors per mux. So next we move on to the DFF.

DFF, THE GOOD AND THE BAD:

I had an initial design in mind for the D Latch Flip Flop, that
seemed to work fine for one bit. I couldn't see the damage I was
causing until I started making registers that were not
functioning properly. I will quickly share my original design
for the DFF and show why its broken.

DFF_ORIGINAL_SCHEMATIC

So logically this circuit intakes a new value and releases the

old value with the positive trigger. The issue is it doesn't
stop at 1, and before you know it its pulled the whole chain of
32 bits and has created a static mess.
EE_330 Final_Project

Even from the testbench it only seems to grab

a value and release at positive trigger. It
works fine when its alone, but with anymore
then a single bit register and all my data
gets flushed with the rise of a clock.

Now time for the good one.

POSITIVE_EDGE_TRIGGERED_DFF_SCHEMATIC

Looks a lot more clanky, but it works wonders!

EE_330 Final_Project

With the new DFF design we require more parts! Five two input
NAND gates which is a total of 20 transitors, and one more three
input nand which will require an additional 6 transistors. So we
are looking at about 26 transistors per DFF.
So for the new part:

NAND_THREE_INPUT_SCHEMATIC
EE_330 Final_Project

SYMBOL NAND_THREE_INPUT_TESTBENCH

NAND_THREE_INPUT_SIMULATION

A 1 0 1 0 1 0 1 0
B 1 1 0 0 1 1 0 0
C 1 1 1 1 0 0 0 0
VOUT 0 1 1 1 1 1 1 1

So looks like it is logically working correctly.

EE_330 Final_Project

PT_DFF_SYMBOL PT_DFF_TESTBENCH

DFF_SIMULATION

So we are picking up the right values from the input with a

slight delay to the output, which will be ideal for our shifting
register. So without further delay lets go straight to the
register schematic.
EE_330 Final_Project

REGISTER_ONE_BIT_SCHEMATIC

So how this works is the SEL should be initially 0, so that the

mux can be loaded with an initial value of 0 or 1. After a
slight delay the SEL is permanently switched to 1 for the rest of
the simulation. This takes the previous value into the MUX
instead of the initial value for
future cases. This is ideal
because the initially loaded
value for each register should
be sitting and locked in the DFF,
and when the clock triggers a
single value should release from
DFF to the next reg to input to
the next MUX while a single input
is let into that register to
replace it. This creates a chain
effect where each value loaded
will eventually exit the front
leaving all registers empty
again.
EE_330 Final_Project

SHIFT_REGISTER_ONE_BIT_TESTBENCH

SR1B_SIMULATION
Unfortunately, until we get
more bits to work with we can
only load one value and mess
around with enable. So for
purpose of testing simple
functionality I grounded init
and clocked the clock and
previous. I then delay turned
on enable as I would normally
do in this type of a
simulation.
EE_330 Final_Project

ok...Skipping all the rubbish buildup:

THIRTY_TWO_BIT_SHIFT_REGISTER_SCHEMATIC

We've made it to the final piece, now time to test this bad boy!
EE_330 Final_Project

All great things deserve a unique design!

THIRTY_TWO_BIT_SHIGT_REGISTER_TESTBENCH

I attempted to make a three dimensional image with the symbol,

hope its noticeable.
EE_330 Final_Project

THIRTY_TWO_BIT_SHIFT_REGISTER_TESTBENCH

For the final testbench I just assign 32 random bits to go to

either the ground 0 or to VDD 1V. If it consistently in a
orderly fashion rolls the values assigned to the output based on
time, then simply rewiring this design to the 32 bit puf would
give me a hardwired upon fabrication random 32 bit value to come
outside a single output. So lets try it out!
EE_330 Final_Project

<32:0> : 01100100100001110011001010111001 0 Which checks out.

<32:0> : 00101010101001100011011010100101 0 Which checks out.

<32:0> : 00101010001001100111111010001101 0 Which checks out.

EE_330 Final_Project

For the sake of a better picture.

Here I set an output to the next value of each register, so you

can physically see it shift with each bit, just in case you
werent convinced by the validity of the previous tests. The
total transistor count for the shifting register is 14 per mux
and 26 per DFF. Since each register has one of each, each
register has 40 transistors. Then in total we have 32 * 40
transistors for the 32 bit reg which is 1,280 transistors in
total. So, therefore we have both a working 32 bit PUF and a
working 32 bit Shift Register, and therefore…
EE_330 Final_Project

We have the full mothership baby!

THIRTY_TWO_BIT_SHIFTING_PUF

Conclusion:
Since we have proven both part worth efficiently, the final part
does not need a test to suggest that together they can implement
perfectly! The final piece is workable with a single output pin,
an Enable, CLK, VDD, and VSS. Since the total transistor count
is the 64 for the PUF, plus the 1,280 for the register. The total
transistor count for implementation comes to 1,344 transistors.
Which is a few penny's in a pond next to a billion transistor
chip. So, if you want to help make the world a better place with
fewer counterfeited chips, then get your PUF today and secure
your property!