IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMSI: REGULAR PAPERS, VOL. 55, NO.

11, DECEMBER 2008

3723

A 440-nA True Random Number Generator for Passive RFID Tags

Ganesh K. Balachandran and Raymond E. Barnett
AbstractThis paper describes a 440-nA true random number (RN) generator for passive ultrahigh frequency radio frequency identication (RFID) tags that operate in the 900-MHz band. Since passive tags derive their power supply through the rectication of the incoming RF signal, limited power is available, and hence, a typical total IC current budget is less than a few microamperes. An RN is generated by a passive RFID tag on the y, and it is used by the reader to identify the tag uniquely and communicate with it in a eld consisting of many tags. The RN in this paper consists of a 16-bit-long deterministic binary sequence to which a 3-bit true RN is added. Without the 3-bit true RN, if two tags happen to have the same deterministic 16-bit sequence, a collision occurs, and there is no way to resolve it. In this paper, we propose a power efcient way of generating the 3-bit true RN using the jitter-sampled carrier technique. This technique subsamples the already present 900-MHz RF carrier using a jittered (noisy) clock. The design challenges of sampling a high-frequency signal that swings above and below ground are described. In addition, the generation of a jitter of adequate magnitude with adequate high-frequency spectral content to ensure that the number is truly random is also described. Measurement results on a silicon prototype implemented in a 130-nm analog CMOS process are provided. Index TermsAnalog, circuits, jitter, passive tags, radio frequency identication (RFID), random number (RN), ultralow power.

I. INTRODUCTION

ASSIVE RADIO frequency identication (RFID) tags [1][5] operate without an external battery and, therefore, must derive their dc power supply by rectifying the RF signal whose envelope also carries the incoming data. Fig. 1 shows the front-end circuitry of the RFID tag of this work [6], [7]. In the simplest form of 100% amplitude shift keying (ASK) modulation, the presence of an RF signal indicates a bit 1 and the absence, a bit 0. The incoming RF signal is converted to the dc supply by using a rectier, dc limiter, and voltage regulator to produce the chip Vdd of approximately 1.25 V. Details of the dc limiter and regulator used in this paper are given in [7]. Additionally, a large 250-pF capacitor (denoted in Fig. 1) serves as a reservoir of charge from which by
Manuscript received August 9, 2007; revised January 3, 2008, March 16, 2008, and May 11, 2008. First published June 17, 2008; current version published December 12, 2008. This paper was recommended by Associate Editor B. Zhao. G. K. Balachandran is with Texas Instruments Inc., Dallas, TX 75063 USA (e-mail: ganesh2@ti.com; ganesh_b@ieee.org). R. E. Barnett is with the University of Texas, Dallas, TX 75080 USA, and also with the RF Division, Custom Mixed Signal Group, Texas Instruments Inc., Dallas, TX 75063 USA. Digital Object Identier 10.1109/TCSI.2008.927220

all the circuits can derive their power during the recesses of RF power and during data gaps due to the ASK modulation. The data envelope is recovered by the demodulator and then sliced by the data slicer with respect to an average value of the envelope to generate a bit stream of 1s and 0s. The transmission from the tag to the reader takes place by a process known as backscattering. This scheme relies on controlling the impedance match at the chip-antenna interface, so as to reect or absorb power and hence signal a bit 1 or 0, respectively. The nMOS switch shown in Fig. 1, with its drain connected to node A, shorts the chip input (which is nominally matched to the antenna) to ground so that the energy is reected, indicating a bit 1. Since it is necessary for the reader to communicate with the tag at distances as large as 5 m, under which condition the RF signal at the chip input can be as weak as 0.25 V-peak, the chip current budget is usually limited to 5 A. Therefore, the analog circuit blocks in the chip are designed to operate at supply current levels of a few hundred nanoamperes. On the other extreme, when the reader is close to the tag, the Thevenin voltage of the antenna (when the antenna is modeled as a Thevenin voltage source and a Thevenin impedance) can be as large as 40 V-peak. For this reason, a voltage clamp is added at the input to limit the voltage levels at the pins to within the device ratings. This nonlinear clamp provides a low-impedance path for the excess RF current to ow through. One of the key requirements in the tag is the generation of a 16-bit random number (RN) used by the central reader to identify a tag and communicate with it. In this paper, we propose that every tag contain a preprogrammed 16-bit seed written in its nonvolatile memory during factory calibration. Since 16 bits correspond to only 65536 unique numbers, it is likely to have two or more tags with the same programmed seed value, when the ICs are drawn from different factory lots. For this condition, called a collision, it is impossible for the reader to distinguish between the tags that have the same seed value. In order to resolve the collision, so that the reader can communicate with each of these tags, we propose that a true RN be added to the seed in the event of a conict. The idea is that, since the two or more colliding tags generate independent RNs, they all will, after a few steps, come out of the collision with unique numbers. Of course, if the RN that is added has more bits, then the tags will resolve faster. For example, if ve tags collide with the same seed, then adding a 2-bit RN generated by each of these tags to this seed means that it takes more than one such iteration to come out of lock because the 2 bits only represent four values. However, the use of a higher number of bits requires lesser iteration. Generating more bits requires greater power (due to higher clock frequency) and/or more time. Fig. 2

1549-8328/$25.00 2008 IEEE

Authorized licensed use limited to: TEXAS INSTRUMENTS. Downloaded on December 19, 2008 at 08:10 from IEEE Xplore. Restrictions apply.

3724

IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMSI: REGULAR PAPERS, VOL. 55, NO. 11, DECEMBER 2008

Fig. 1. Front-end circuitry of an RFID tag.

shows a simplied description of how the RN is used to distinctly identify the tags and establish communication between each of the multitude of tags and the single reader. This paper describes a 440-nA ultralow power circuit that generates such a true 3-bit true RN. The circuit derives its randomness from device noise. The number of bits is chosen as 3 to get an ideal compromise between power consumption and how fast the conict is resolved. The 3 bits forming the RN are generated by sampling the 900-MHz RF carrier thrice using a jittery 320-kHz clock. Section II describes prior methods of RN generation that were used primarily for high-security data encryption and their applicability, or the lack thereof, for an ultralow power application such as the RFID tag. Section III describes the required characteristics of the RN. Section IV describes the regenerative latch, and Section V describes the negative charge pump used to control the sampling switch. Section VI discusses the generation of the 320-kHz jittery clock. Finally, Section VII provides measurement results, followed by the conclusion in Section VIII. II. METHODS USED FOR RN GENERATION RN generation circuits have been used widely for cryptography and spread spectrum applications. The methods used for the RN generation for these applications can broadly be classied into three categories [8]: 1) direct amplication of noise using a wideband high-gain amplier or a regenerative latch[12][16]; 2) sampling of a high-frequency oscillator with a low-frequency jittery oscillator [11]; and 3) discrete time chaotic systems using analog signal processing techniques whose output is spectrally at and the numbers are uniformly distributed [17][20]. All these methods generate RNs that are highly random. However, these use circuits that consume several hundreds of microamperes of current. For the purpose of the RFID tag, the RN generator is only used to resolve a collision. The randomness (denoted by an autocorrelation func) tion that should be as close as possible to an impulse at

Fig. 2. Communication protocol between reader and tags and the need for an RN to resolve collision.

Authorized licensed use limited to: TEXAS INSTRUMENTS. Downloaded on December 19, 2008 at 08:10 from IEEE Xplore. Restrictions apply.

BALACHANDRAN AND BARNETT: TRUE RANDOM NUMBER GENERATOR FOR PASSIVE RFID TAGS

3725

is not of paramount importance. What is important is that the current consumption of the circuit must not exceed 0.5 A and that operation should be feasible with power supply voltages as low as 0.9 V. In addition, the system dictates that the time taken to generate the RNs should not exceed 10 s. For cost reasons, the circuit should not occupy more area than 100 100 m. Considering these unique RFID tag constraints, method 3) is not suitable due to the large number of complicated circuitry and high current consumption involved. Furthermore, even though a stream of bits obtained as a result of this technique is random, it will differ from a stream of bits obtained from a similar chip only to the extent of the device mismatches and imperfections. Usually, such streams will be identical for a certain number of bits and then start to become different. The divergence point will be reached when the cumulative effects of device mismatch or gain error over a certain number of cycles exceeds a comparator threshold. Clearly, for the application of the RFID, what is most important is that two chips produce different RNs. This method will not achieve this effectively. Method 1) uses device noise to make a decision of a bit 1 or 0, i.e., if the device noise is greater than a certain threshold, the bit is a 1 and vice versa. This can be done in several ways. One can amplify the white noise of a resistor and then use a comparator to obtain a random bit [10]. These schemes need a high-gainbandwidth low-offset amplier and are not suitable for the RFID application because a high gainbandwidth requires a larger current consumption. If a low-bandwidth amplier is used, then the output noise spectrum will be concentrated around dc. This leads to a high correlation from one sample to the next. Therefore, a high bandwidth is required. A high gain is required to create a large swing of the amplied noise such that it overcomes the offset of the comparator that ultimately produces the bit stream. Other schemes [13][15] combine the high-gain amplier and comparator into a regenerative latch which has a very large gain at the regeneration instant and also has a high bandwidth. These schemes need feedback loops for offset correction. This adds additional complexity, extra circuitry, and current consumption. For the highest quality of the RN, the use of device noise is the most desirable. The hurdles that need to be overcome in such an implementation are the device imperfections like the offset, nite bandwidth, etc. Depending on the quality of the RN required, one has to increase power consumption and also introduce more sophisticated feedback loops. Method 2) also uses device noise but does so in the time domain instead of voltage or current domain by creating a low-frequency jittery clock and using it to sample a high-frequency oscillator. By processing in the time domain, method 2) makes the circuit insensitive to device offsets. Device offset only results in a duty cycle error which is not of much concern because it is only the rising or falling edge of the jittery clock that matters. Used as such, this will also be power hungry because a high-frequency (hundreds of megahertz) oscillator consumes a large current (hundreds of microamperes). However, if the RF signal is used instead of the high-frequency clock, then it saves a lot of power. This has to be done without loading the antenna signicantly. The circuit described in this paper uses this approach to generate the RN.

Fig. 3. Block diagram of the RN generator.

III. DESIRED CHARACTERISTICS OF THE RN The 3-bit RN is produced by sampling the 900-MHz input RF signal three timesonce for each bitat three successive falling edges of the jittery 320-kHz clock, shown as CLK_SAMP in Fig. 3 which also shows a block diagram of the RN generator. The input RF signal swings above and below ground. The resultant bit is a 1 or 0, depending on whether the RF signal is sampled when it is above or below ground. The input limiter network ensures that the swing is symmetric above and below ground, ensuring equal probability of 1s and 0s. The noise buffer in Fig. 3 adds extra jitter to the edges of the input clock denoted as CLK_IN to produce the sampling clock, denoted as CLK_SAMP. The sampled signal is converted to CMOS levels using the differential regenerative latch. Finally, the output of the differential latch is resampled by a D ip-op so that it can be processed by the digital state machine in a synchronous fashion. We need the probability of producing all eight numbers (0 to 7), represented by the 3 bits, to be the same. This is needed to resolve a collision in as little time as possible by repeatedly generating RNs until the colliding tags come up with different numbers. In order that the probability of generating any of the eight numbers is the same, three conditions should be satised. A. Equal Probability of 1s and 0s For any sample, the probability that it results in a bit 1 should be the same as that of a bit 0. This condition has implications on the latch offset and the duty cycle of the waveform at the input of the latch. Fig. 4 shows how a latch offset of 125 mV effectively decreases duty cycle, thereby resulting in a higher probability of generating a bit 0. This is because the latch will generate a bit 1 only when the RF signal is above the offset value. Unlike input referred voltage offset in circuits like ampliers, the input referred voltage offset in dynamic regenerative latches is signicantly dependent on the imbalance in capacitive loads at various nodes. In this design, latch offset is reduced by careful layout techniques. The latch offset is estimated using simulations such as 60 mV (3-sigma) for a supply voltage of 1 V with a nominal process corner and at room temperature. Clearly, the latch offset is pronounced only at low RF signal levels. At higher RF levels, the signal slope is so steep near zero voltage that the time the signal is above zero is nearly same as the time the signal is below zero. Furthermore, at high RF levels, the supply voltage is also high, and therefore, the latch offset is itself low. Although,

Authorized licensed use limited to: TEXAS INSTRUMENTS. Downloaded on December 19, 2008 at 08:10 from IEEE Xplore. Restrictions apply.

3726

IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMSI: REGULAR PAPERS, VOL. 55, NO. 11, DECEMBER 2008

1 (denoted by the total black area) is the same as the probability that the bit is 0 (denoted by the total white area). C. Bandwidth of Voltage Noise That Generates the Jittery Clock A jittery clock is produced when a voltage noise is superimposed on a clock with shallow (i.e., nonsteep) slopes (Fig. 7). The bandwidth of this noise should be at least ten times the clock frequency. This will make the resultant jitter samples nearly white. If this were not true and the bandwidth were much smaller than the clock period, then the voltage noise changes very little from one clock period to another. Therefore, the time jitter will also be nearly the same since the two are related as shown in Fig. 7. This, along with a condition that the clock period be , will result in the three samples being the a multiple of same [20]. If the bandwidth of the voltage noise is much larger than the clock frequency, then the jitter samples that occur at the clock rate will contain the aliased high-frequency voltage noise resulting in the discrete Fourier transform of the jitter samples being white. IV. REGENERATIVE LATCH Fig. 8 shows the schematic of the latch and the Schottky diode-based limiter. The limiter consists of the 80-fF coupling capacitor, the 100-k resistor, and the back-to-back connected Schottky diodes. The limiter serves two purposes. The rst purpose, already touched upon in the last section, is to make the signal swing at node A symmetric and ensure a 50% duty cycle. A back-toback Schottky diode clamp limits the signal to between 0.4 and 0.4 V at node A. The other purpose is to ensure that the sampling switch connecting nodes A and C does not experience a signicant change in resistance between positive and negative swings. Without this clamp, the switch resistance is higher for positive signals than for negative signals due to a lower gate-source overdrive for positive signals. If the switch resistance is signicantly large (due to a large swing), then the pole formed by this resistance and the sampling capacitor will be smaller than the RF frequency, and the signal gets distorted. This will result in a signal at node C with a duty cycle less than 50%. This will cause more 0s in the bit stream than 1s. Now, if the Schottky diode pair was directly connected to the antenna, it would load the antenna (even when the RN circuit is not operational) and divert some power away from the rectier and the RF demodulator (Fig. 1). This leads to unnecessary wastage of power particularly at low RF levels. In order that the Schottky pair does not load the antenna, an impedance in the form of a capacitor is introduced between the input and the Schottky pair. The lower the value of this capacitor, the greater the impedance and the lesser the loading. However, too high an impedance will result in the swing at node A being smaller than the latch offset due to the voltage division occurring due to the impedance of this capacitor and that of the Schottky diodes. The 80-fF capacitor is chosen to reduce loading while, at the same time, provide a healthy signal swing at node A. The explanation of the timing diagram for the clocks in Figs. 3 and 8 is shown in Fig. 9.

Fig. 4. Effect of latch offset on the effective duty cycle.

Fig. 5. How a large rms value of jitter will result in equal probabilities of 1s and 0s.

at very high RF levels, there is a signicant distortion of the waveform due to the upper and lower clipping thresholds of the input clamp (Fig. 1) being different. In this case, the upper clipping level is around 1.5 V, and the lower clipping level is 0.6 V. This asymmetry causes the waveform at node A in Fig. 1 to have a non 50% duty cycle. For this reason, as will be seen in the next section, a limiter comprising antiparallel Schottky diodes is used so that this asymmetric waveform is clipped at a much lower level, thereby presenting a near 50% duty cycle waveform to the latch in Fig. 3. B. RMS Time Jitter The RMS value of the time jitter produced by the noise buffer (Fig. 3) should be, as a rule of thumb, at least six [22]. If this condition times the time period of the RF signal is much less than were not true (i.e., if it happens that ) and if the clock period were a multiple or a near multiple , it will result in the three sampled bits being the same of with a very high probability. This can easily be seen from Fig. 5 where, in the limiting case, if the jitter is zero, the sampled data is made will be xed (always a 0 or 1). However, if , then the probability of a bit 1 (i.e., the much larger than probability that the falling edge of the noisy clock occurs when the RF signal is greater than zero) is almost 0.5. Making an approximation that the jitter at a certain rising clock edge has a Gaussian distribution with a standard deviation of - , one can easily see from Fig. 6 that the probability that the bit is

Authorized licensed use limited to: TEXAS INSTRUMENTS. Downloaded on December 19, 2008 at 08:10 from IEEE Xplore. Restrictions apply.

BALACHANDRAN AND BARNETT: TRUE RANDOM NUMBER GENERATOR FOR PASSIVE RFID TAGS

3727

Fig. 6. Gaussian distribution of the jitter and the probability of generating a 1 and 0.

V. NEGATIVE CHARGE PUMP TO CONTROL THE SAMPLING SWITCH One can see from Fig. 8 that the voltage at node A can go 0.4 V below ground. Therefore, the nMOS switch between nodes A and C can be turned off only by pulling its gate voltage below ground. This is achieved by using a negative charge pump (Fig. 10) that produces a voltage of 0.65 V nominally but can be as high as 0.4 V at low Vdd levels and high temperatures when the leakage is higher. The negative charge pump has a tripler topology which means that, if the threshold voltages are zero and there are no parasitics, the charge pump will produce a no load voltage of 3 Vdd. In reality, the voltages will be clamped to about 0.75 by the parasitic body diodes associated with the MOS transistors. The level shifter in Fig. 10 is required because the control levels for the sampling to . switches are changed from VI. JITTERY CLOCK GENERATION , The characteristics needed for the jitter ( bandwidth of jitter generating voltage 10 fclk) were already discussed in detail in Section III. This section will focus on the implementation, keeping the very low current consumption in mind. Fig. 11 shows the circuit used for this purpose. When CLK_IN is low, a 20-nA current is made to slew into a 10-fF load capacitor, creating a shallow slope. The noise from the reference bias M0 and M1 contribute to the effective voltage noise that causes time jitter. Transistor M2 is just added for mirroring accuracy since M1 has the switch transistor M3 at its source when it is conducting current. At this point, the reason why 3 bits, and not more, are chosen for the RN generator is also explained. In other words, the reason for choosing 320 kHz as the noisy clock frequency is described. The time available in the RFID system for the generation of the RN is about 16 cycles of the 1.28-MHz system clock, the fastest clock in the system. In this time window, one can take the approach of generating a sequence that is long, for example, 12 bits, using the 1.28-MHz clock or just generating 3 bits using a 1.28-MHz/4 clock. Clearly, the longer the random bit sequence, the greater the chance that two tags that are colliding will be able to produce distinct RNs in the next run. However, with a

Fig. 7. Jitter generation mechanism.

Noise is added to the falling edge of CLK_IN by making the slope low (more on the noise addition will be discussed in Section VI). CLK_IN is chosen to be a 320-kHz 25% duty cycle clock derived off the main 1.28-MHz clock through division by 4. The duty cycle is chosen as 25% and not 50% to minimize the slope and hence make it susceptible to jitter on the falling edge. The resultant internal noisy clock CLK_X is passed through a series of inverters to make the edges sharp. The CLK_SAMP, thus produced, has a duty cycle of 50% nominally but varies with process and temperature depending on the load capacitance and the current that causes the slew. The signal n_LATCH is a delayed version of CLK_SAMP. At the falling edge of CLK_SAMP, the sampling takes place, and the latch regeneration starts at the falling edge of n_LATCH. The output of the regenerative latch (shown as RN latch output in Fig. 9) lasts only for the time that n_LATCH is low. Therefore, the regenerative latch output is relatched into a D ip-op at the rising edge of CLK_IN. Clearly, in order that the latch output is ready at the rising edge of CLK_IN, we need

(1) where, from Fig. 9, is the on time of n_LATCH, is the is the time time taken for the regeneration of the latch, and period of the 320-kHz clock. This condition, as will be shown in the section on the noise buffer, is easily met.

Authorized licensed use limited to: TEXAS INSTRUMENTS. Downloaded on December 19, 2008 at 08:10 from IEEE Xplore. Restrictions apply.

3728

IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMSI: REGULAR PAPERS, VOL. 55, NO. 11, DECEMBER 2008

Fig. 8. Schematic of the latch and Schottky diode limiter.

Fig. 9. Timing diagram.

1.28-MHz clock having 50% duty cycle, the slope of the internal clock CLK_X (Fig. 11) has to be high (i.e., steep). A steep slope means that the jitter produced will not be large. The reason why the slope has to be high, if a 1.28-MHz 50% duty cycle clock is used, can easily be seen from Fig. 9. If the slope is very low, then it can be seen that the CLK_X waveform that is slewing down will not cross the trigger threshold of the inverter following it (INV2 in Fig. 11). Therefore, no jittery clock will be produced. Even if it crosses, the duty cycles of the CLK_SAMP and n_LATCH waveforms will be so high that the regenerative latch (Fig. 8) will not have enough time to reach its nal output levels. For these reasons, a 3-bit RN is generated using a 320-kHz (1.28-MHz/4) clock. The resulting expected value of the time taken to resolve out of a collision was found to satisfy the system requirements. Fig. 12 shows the ac voltage noise spectral density of the CLK_X voltage if it were held at a dc value equal to the trigger V and the tranvoltage of the next inverter

sistor M3 (Fig. 11) were turned on. There is a lot of icker noise in the spectrum, making it look as though the energy might be concentrated at low frequencies. However, the sampled voltages kHz) will at these instants (i.e., at intervals of contain the aliased noise components from higher frequencies (i.e., slabs of 320-kHz frequencies) and, as a result, will look almost white as shown in Fig. 13. The rms value of the jitter can be calculated as shown in Fig. 7 as

(2)

, the RMS voltage noise, found by integrating the spectrum in Fig. 13 over the sampling frequency of 320 kHz, is 13.2 nA and fF, from Fig. 11, the value mV. Using is found to be 6.6 ns. This value is about six times of the time period of a 900-MHz RF carrier.

Authorized licensed use limited to: TEXAS INSTRUMENTS. Downloaded on December 19, 2008 at 08:10 from IEEE Xplore. Restrictions apply.

BALACHANDRAN AND BARNETT: TRUE RANDOM NUMBER GENERATOR FOR PASSIVE RFID TAGS

3729

Fig. 10. Negative charge pump and the level shifter.

Fig. 11. Generation of the jittery clock.

VII. MEASUREMENT RESULTS Fig. 14 shows the negative output (OUT_M) of the regenerative latch in Fig. 8 after buffering with an inverter. This waveform is captured in the test mode where there is a provision to continuously run the RN generator and obtain many samples. A tiny (9 9 m) pad is added at the output of this inverter, and the pad is probed with a pico probe. This is done because the inverters use very small sized devices to reduce current consumption and, therefore, are not capable of driving large capacitive loads.

The 320-kHz clock that is shown is, however, not the same as the 25% duty cycle 320-kHz CLK_IN that is used to drive the RN generator. This is done so as not to load timing sensitive paths by putting extra inverters or probe pads. The 320-kHz clock shown in Fig. 14 has the same rising edge time as CLK_IN and is just used for the illustration of the time period. During the reset phase of the latch (i.e., when n_LATCH is high), the latch output is connected to ground (Fig. 8), and hence, upon inversion by the inverting buffer, the value is a HIGH. These values are indicated by an R in Fig. 14. The 0 and 1 indicate the data values.

Authorized licensed use limited to: TEXAS INSTRUMENTS. Downloaded on December 19, 2008 at 08:10 from IEEE Xplore. Restrictions apply.

3730

IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMSI: REGULAR PAPERS, VOL. 55, NO. 11, DECEMBER 2008

Fig. 15. Occurrence of various RNs from one million samples.

Fig. 12. Voltage noise spectral density of CLK_X at the instant of crossover.

Fig. 13. Noise spectrum of the sampled noise containing aliased components.

Fig. 15 shows the occurrence of various RNs (0 through 7) from one million backscatter measurements with an RF carrier of 900 MHz. It is to be noted that the RN generator is powered off after the generation of each RN. It is powered on only after about 2 ms to generate the RN for the next backscatter signal. In a real application, this duration for which it is powered off is also variable. Since the duration for which it is powered off is much larger than the 12- s duration in which the RN measurement is done, one can make the assumption that each 3-bit sample is uncorrelated from the previous 3-bit sample generated about 2 ms before. Therefore, it is not meaningful to obtain a string of bits, group three adjacent bits to form a number, and obtain the autocorrelation of these numbers. What is more important is to see how the latch offset changes the probability of 1s and 0s. From Fig. 15, it can be inferred that the samples are highly uncorrelated. That is, the probability that a given sample is, for example, a 1 is independent of the fact that the previous sample is a 1 or 0. This can be easily seen by the following observations. The probabilities of the occurrence of 1(001), 2(010), and 4(100) are almost the same (7.5%). Therefore, the probability is the same whether the 1 occurs in the beginning of the stream, the middle, or the end. Similarly, the probabilities of the occurrence of 3(011), 5(101), and 6(110) are almost the same (15%). From the probability of the occurrence of 7(111), one can derive the probability of the occurrence of 1 as (3) One can easily see that this value of also satises the other cases, namely, the probability of the occurrence of no 1s, one 1, and two 1s, respectively, according to the following:

(4) This particular measurement is done at a low power level to ensure that the system functions well at this level. The supply

Fig. 14. RN data stream from output of regenerative latch.

Authorized licensed use limited to: TEXAS INSTRUMENTS. Downloaded on December 19, 2008 at 08:10 from IEEE Xplore. Restrictions apply.

BALACHANDRAN AND BARNETT: TRUE RANDOM NUMBER GENERATOR FOR PASSIVE RFID TAGS

3731

REFERENCES
[1] R. Weinstein, RFID: A technical overview and its application to the enterprise, IEEE IT Prof., vol. 7, no. 3, pp. 2733, MayJune 2005. [2] K. V. S. Rao, An overview of backscattered radio frequency identication system (RFID), in Proc. Microw. Conf. Asia Pacic, Nov. 30Dec. 3, 1999, vol. 3, pp. 746749. [3] R. Glidden, C. Bockorick, S. Cooper, C. Diorio, D. Dressler, V. Gutnik, C. Hagen, D. Hara, T. Hass, T. Humes, J. Hyde, R. Oliver, O. Onen, A. Pesavento, K. Sundstrom, and M. Thomas, Design of ultralow-cost UHF RFID tags for supply chain applications, IEEE Commun. Mag., vol. 42, no. 8, pp. 140151, Aug. 2004. [4] RFID Analog Front End Design Tutorial Auto-ID Lab at University of Adelaide [Online]. Available: http://autoidlab.eleceng.adelaide.edu.au/ Tutorial.html [5] U. Karthaus and M. Fischer, Fully integrated passive UHF RFID transponder IC with 16.7 W minimum RF input power, IEEE J. Solid-State Circuits, vol. 38, no. 10, pp. 16021608, Oct. 2003. [6] R. E. Barnett, G. K. Balachandran, S. Lazar, B. Kramer, G. Konnail, S. Rajasekhar, and V. Drobny, A passive UHF RFID transponder for EPC Gen 2 with 14 dB sensitivity in 130 m CMOS, in Proc. Int. Solid-State Circuits Conf., Feb. 1115, 2007, pp. 582583. [7] G. K. Balachandran and R. E. Barnett, A 110 nA voltage regulator system with dynamic bandwidth boosting for RFID systems, IEEE J. Solid-State Circuits, vol. 41, no. 9, pp. 20192028, Sep. 2006. [8] C. S. Petrie and J. A. Connelly, A noise-based IC random number generator for applications in cryptography, IEEE Trans. Circuits Syst. I, Fundam. Theory Appl., vol. 47, no. 5, pp. 615621, May 2000. [9] C. S. Petrie and J. A. Connelly, The sampling of noise for random number generation, in Proc. IEEE ISCAS, May 30June 2 1999, vol. 6, pp. 2629. [10] W. T. Holman, J. A. Connelly, and A. B. Dowlatabadi, An integrated analog/digital random noise source, IEEE Trans. Circuits Syst. I, Fundam. Theory Appl., vol. 44, no. 6, pp. 521528, Jun. 1997. [11] C. S. Petrie and J. A. Connelly, Modeling and simulation of oscillatorbased random number generators, in Proc. IEEE ISCAS, May 1215, 1996, vol. 4, pp. 324327. [12] R. Brederlow, R. Prakash, C. Paulus, and R. Thewes, A low-power true random number generator using random telegraph noise of single oxide-traps, in Proc. IEEE Int. Solid-State Circuits Conf., 2006, pp. 16661675. [13] J. Holleman, B. Otis, S. Bridges, A. Mitros, and C. Diorio, A 2.92 Whardware random number generator, in Proc. 32nd Eur. Solid State Circuits Conf., Sep. 2006, pp. 134137. [14] C. Tokunaga, D. Blaauw, and T. Mudge, True random number generator with a metastability-based quality control, IEEE J. Solid-State Circuits, vol. 43, no. 1, pp. 7885, Jan. 2008. [15] D. J. Kinniment and E. G. Chester, Design of an on-chip random number generator using metastability, in Proc. 28th Eur. Solid State Circuits Conf., Sep. 2002, pp. 595598. [16] S. Yasuda, H. Satake, T. Tanamoto, R. Ohba, K. Uchida, and S. Fujita, Physical random number generator based on MOS structure after soft breakdown, IEEE J. Solid-State Circuits, vol. 39, no. 8, pp. 13751377, Aug. 2006. [17] M. Delgado-Restituto, F. Medeiro, and A. Rodriguez-Vazquez, Nonlinear switched-current CMOS IC for random signal generation, Electron. Lett., vol. 29, no. 25, pp. 21902191, Dec. 9, 1993. [18] S. Ozoguz, A. S. Elwakil, and S. Ergun, Cross-coupled chaotic oscillators and application to random bit generation, Proc. Inst. Elect. Eng.Circuits, Devices, Syst., vol. 153, no. 5, pp. 506510, Oct. 2006. [19] C.-C. Wang, J.-M. Huang, H.-C. Cheng, and R. Hu, Switched-current 3-bit CMOS 4.0-MHz wideband random signal generator, IEEE J. Solid-State Circuits, vol. 40, no. 6, pp. 13601365, Jan. 2005. [20] T. Addabbo, M. Alioto, A. Fort, S. Rocchi, and V. Vignoli, A feedback strategy to improve the entropy of a chaos-based random bit generator, IEEE Trans. Circuits Syst. I, Fundam. Theory Appl., vol. 53, no. 2, pp. 326337, Feb. 2006. [21] B. Jun and P. Kocher, The intel random number generator, A White Paper Prepared for Intel Corporation by Cryptography Research Inc. [Online]. Available: http://www.cryptography.com/resources/whitepapers/IntelRNG.pdf [22] M. Bucci, L. Germani, R. Luzzi, A. Triletti, and M. Varanonuovo, A high-speed oscillator-based truly random number source for cryptographic applications on a smart card IC, IEEE Trans. Comput., vol. 52, no. 4, pp. 403409, Apr. 2003.

Fig. 16. Chip photograph.

voltage under this level is typically between 0.9 and 1 V. Therefore, the strength of the latch is not high, and therefore, it is susceptible to offsets. At higher power levels, when the supply reaches its full regulated value of about 1.2 V [7], the probability of the occurrence of 1s and 0s is close to 50%. This can be seen through Fig. 14 where the supply voltage is healthy at 1.2 V, and as a result, the numbers of 0s and 1s are nearly equal. The reason for this has been explained in Section III-A. Fig. 16 shows the chip photograph. The RN generator block is located close to the RF pad and occupies an area of 0.0056 mm . The current consumption of this block is 440 nA and is found out through simulations on the extracted layout since there was no provision to measure the current consumption of every individual block on the silicon die. The total measured current consumption of the chip matches that of extracted simulations, and hence, the simulated value of 440 nA is considered accurate. VIII. CONCLUSION A 440-nA RN generator circuit is described. This circuit is implemented as part of a 900-MHz passive RFID tag in a 130-nm analog CMOS process. The purpose of the circuit is to resolve a collision in case two or more tags have the same ID programmed into them and are simultaneously communicating with the reader. The requirements on the jittery low-frequency clock that samples the RF carrier are described in detail. The design of the regenerative latch and also the negative charge pump that is used to control the sampling switches are described. Finally, the jittery-clock-generation circuit is described followed by measurement results on silicon. ACKNOWLEDGMENT The authors would like to thank B. Kramer, S. Lazar, K. Doddamane, and L. Williams of Texas Instruments Incorporated for their help during the course of this project.

Authorized licensed use limited to: TEXAS INSTRUMENTS. Downloaded on December 19, 2008 at 08:10 from IEEE Xplore. Restrictions apply.

3732

IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMSI: REGULAR PAPERS, VOL. 55, NO. 11, DECEMBER 2008

Ganesh K. Balachandran received the B.Tech. degree from the Indian Institute of Technology, Chennai, India, in 1997 and the M.S. and Ph.D. degrees from the Georgia Institute of Technology, Atlanta, in 1999 and 2001, respectively, all in electrical engineering. He is currently with Texas Instruments Incorporated (TI), Dallas, TX, where he has been worked on precision voltage regulation and measurement circuits, ultrahigh frequency radio frequency identication circuits, and other low-power RF circuits. His current focus is on the design of high-performance sigma-delta analogdigital converters, active lters, and other baseband circuits for cell phones. Prior to joining TI in 2004, he was with Analog Devices, Inc. from 2002 to 2003, where he designed frequency synthesizers and radio baseband circuits. During the summers of 1998 and 2000, he was with Conexant Systems, Newport Beach, CA, and IBM T. J. Watson Research Center, Yorktown Heights, NY, respectively.

Raymond E. Barnett received the B.S. degree from the University of Illinois, UrbanaChampaign, in 1992 and the M.S. degree from the University of Minnesota, Minneapolis, in 1997, both in electrical engineering. He is currently working toward the Ph.D. degree in electrical engineering at the University of Texas, Dallas. From 1992 to 1997, he was an Analog/MixedSignal IC Design Engineer with VTC Inc., Bloomington, MN, where he worked on hard disk and tape drive preampliers and read channels and, from 1999 to 2000, was a Senior Design Engineer, engaged in advanced magnetic read (MR) preamplier design for disk drive applications. He was a Principal Mixed-Signal Design Engineer with an Atmel start-up design center located in Bloomington, where he worked on advanced DVD-RAM read channels and preampliers from 1997 to 1999. In 2000, he was with a start-up design center for the Storage Products Group, Texas Instruments Incorporated, Bloomington, where he worked on advanced MR preampliers between 2000 and 2004 and, in 2001, was elected as a Senior Member of the Technical Staff. Since 2004, he has been with the RF Division, Custom Mixed Signal Group, Texas Instruments Incorporated, Dallas, working on various low-power ultrahigh frequency band RF circuits, with a major focus on radio frequency identication devices. He is the holder of over 20 patents granted or pending in integrated circuit design.

Authorized licensed use limited to: TEXAS INSTRUMENTS. Downloaded on December 19, 2008 at 08:10 from IEEE Xplore. Restrictions apply.