In Situ Time-Based Sensor for Process Identification Using Amplified Back-End-of-Line Resistance and Capacitance

TL;DR

This paper introduces a sensor that uses chip metal routing to measure process variations, improving accuracy with a three-configuration method.

Contribution

A novel three-configuration measurement approach that reduces error in RC time-constant estimation for in situ process authentication.

Findings

The three-configuration method reduces measurement error by over 82% compared to direct measurement.

The analytical model aligns closely with simulations, with a maximum difference of 2.6%.

Sensor results show a maximum error of 6.1% when compared to direct measurements from a DMA.

Abstract

This paper presents an in situ time-based sensor designed to provide process authentication. The proposed sensor leverages the inherent metal routing within the chip to measure the RC time-constants of interconnects. However, since the routing metal is typically designed to minimize resistance and capacitance, the resulting small RC time-constants pose a challenge for direct measurement. To overcome this challenge, a “three-configuration” measurement approach is introduced, incorporating two auxiliary components—poly resistor and metal-insulator-metal (MIM) capacitor—to generate three amplified RC time-constants and, subsequently, deduce the routing time-constant. Compared to directly measuring the routing time-constants, this approach reduces measurement error by over 82% while incurring only a 25% area penalty. A straightforward analytical model is presented, taking into account the impact of parasitic capacitances within the discharge path. This analytical model exhibits an excellent concurrence with simulated results, with a maximum difference of only 2.6% observed across all three configurations and a 3.2% variation in the derived routing time-constant. A set of five variants of the time-based sensor are realized using a 130 nm CMOS process. Each variant consists of 44 samples distributed across 11 dies on two wafers. To verify the precision of the proposed sensor, identical resistors and capacitors are fabricated alongside them, forming a direct measurement array (DMA) that is measured using external equipment. After adjusting the routing resistance and capacitance values in the simulations to correspond to the mean values obtained from the DMA measurements, the proposed sensor’s measured results demonstrate a close alignment with simulations, exhibiting a maximum error of only 6.1%.

Figures

Full text

1. Introduction

In recent years, the importance of hardware security has significantly grown, raising concerns about vulnerabilities in semiconductor devices and circuits. These vulnerabilities pose risks such as the potential leakage of sensitive information and the compromise of the entire system’s reliability and performance [1,2,3]. To tackle these vulnerabilities, the concept of the device fingerprint has emerged as a potential solution. In the realm of wireless networks, RF fingerprint, also known as RF distinct native attribute (RF DNA), has been developed to identify and classify authorized devices based on their unique features of the individual devices [4,5,6,7].

Similarly, techniques such as die identification [8,9,10,11] and die authentication [12,13,14,15] have been proposed to enhance the security across the entire life cycle of the global supply chain. Die identification involves assigning a unique serial number to each individual die, while die authentication verifies the device’s origin of manufacturing to ensure its authenticity.

Physical Unclonable Functions (PUFs) offer a promising approach for chip identification by leveraging inherent manufacturing variations in integrated circuits [8,9,10,11,16,17,18,19,20,21,22,23]. PUFs generate unique challenge-response pairs (CRPs) that serve as digital fingerprints, enabling reliable chip identification. Nevertheless, while PUFs excel in die identification, they exhibit shortcomings in die authentication. It is important to note that PUFs’ digital output bits lack correlation with the distinct attributes of the original foundry, thus restricting their potential for die authentication.

To address this issue, a process characterization function (PCF) has been proposed, leveraging the unique process characteristics of the foundry to enable die authentication [12,13,14,15]. For example, the authors in [12] decompose path delays into the delays incurred by logic gates, extracting threshold voltage and effective channel length as distinct signatures for distinguishing between different foundries. Similarly, ref. [13] adapts the successive-approximation-register (SAR) analog-to-digital converter (ADC) architecture, leveraging the mismatch in the metal-oxide-metal (MOM) capacitor as a means of authentication. Another proposed approach, as outlined in [14], involves reducing the activation time (the time it takes for a row of DRAM cells to become accessible) and then observing the resulting error patterns as distinctive authentication characteristics. Likewise, the author in [15] examines the pattern of the partial erase process of Flash memory to identify the fabrication origin. Another approach proposed in [24], a machine learning-based approach is used to infer the fab-of-origin by analyzing production test data (276 probe-test measurements per die) from RF transceivers fabricated in two separate facilities, offering a scalable solution for origin classification.

While these papers have proposed various die authentication methods, they pose challenges in seamless integration into other circuits. This is attributed to the necessity for a designated area for PCF circuits, which not only complicates integration but also introduces susceptibility to targeting by attackers. To address this limitation, we propose the use of an in situ time-based sensor that directly measures the RC time-constants of the back-end-of-line (BEOL) metal routing. This sensor can be seamlessly integrated into the functional routing of any system-on-chip (SoC) to provide robust die authentication, as illustrated in Figure 1. To the authors’ best knowledge, this work presents the first in-situ measurement of the RC time-constants of the BEOL metal interconnect.

Additionally, in advanced technology nodes, the RC time-constant of the metal traces increases [25,26], while the time-domain resolution improves, enhancing the sensor authentication accuracy.

The remainder of the paper is organized as follows. Section 2 details the proposed in situ time-based sensor design and its operation. An analytical model of the proposed sensor is presented in Section 3, considering the impact of parasitic capacitances in the discharge path. This model demonstrates a close correlation with simulation results. Section 4 provides the implementation details of the circuit blocks, while Section 5 offers an in-depth analysis of the measurement outcomes. The conclusion is presented in Section 6.

2. Proposed Time-Based Sensor

In this section, we introduce the proposed in situ time-based sensor and elucidate its circuit operation. This sensor capitalizes on the chip’s internal metal routing to directly gauge the RC time-constants of interconnects. Since the routing metal is typically optimized to minimize resistance and capacitance, employing this direct measurement strategy results in significant measurement error that diminishes the efficacy of authentication. To address this challenge, a “three-configuration” measurement technique is proposed, and its measurement error is analyzed. Finally, the impact of the process, voltage, and temperature variations is discussed in this section.

2.1. Architecture Overview

In the realm of electronic devices, it is common to find resistance-to-digital converters (RDCs) and capacitance-to-digital converters (CDCs) that serve the purpose of estimating input resistance and capacitance. Typically, these devices employ on-chip resistors and capacitors as internal references. Yet, inherent process variations can cause on-chip reference values for resistance and capacitance to shift, requiring the use of an external reference to convert these on-chip references into absolute values [27,28,29]. To overcome this limitation, we propose an in situ time-based sensor that leverages the system clock and its accuracy as a timing reference, eliminating the need for an external reference and allowing the measurement of absolute values of the time-constants without additional calibration.

The direct measurement time-based sensor is composed of four main elements, as illustrated in Figure 2a. To begin, a time-constant generation (TCG) block enables an assessment of RC time-constant involving $[eqn]$ and $[eqn]$ , which represent the resistor and capacitor of the BEOL metal routing. Subsequently, a pulse generator transforms the voltage stored on $[eqn]$ from the voltage domain into time domain $[eqn]$ pulses. Following this, a counter acts as a quantizer in the time domain, gauging the duration of these $[eqn]$ pulses. Lastly, a timing controller coordinates the functions of these elements, ensuring the proper sequence of operations. The RC time-constant can be derived from the accumulated discharge cycle, denoted as $[eqn]$ .

This architecture is primarily digital, with an exception of one analog subcircuit, the current source. Its predominantly digital architecture makes it synthesizable, reducing the integration effort into other circuits and across different technologies.

2.2. Circuit Operation

Figure 2a presents the block diagram depicting the direct measurement time-based sensor, while Figure 2b displays a timing diagram illustrating the relative signals. The time-based sensor operates in two distinct phases: an initial phase and a discharging phase. During the initial phase, a current source, I, is used to charge the node $[eqn]$ to a threshold voltage, $[eqn]$ , by closing the switch $[eqn]$ for time duration $[eqn]$ . This charging process can be expressed as:

$$[eqn]$$

Subsequently, the voltage signal $[eqn]$ is converted into a time-domain signal using a pulse generator, producing a corresponding $[eqn]$ pulse signal. The pulse width of the $[eqn]$ signal is then quantized by the system clock, $[eqn]$ , resulting in a digital code, $[eqn]$ , that is stored in the timing controller for later processing.

Following the initial phase, the discharging phase begins by closing switch $[eqn]$ and resetting the $[eqn]$ node to a ground state. Subsequently, the switch $[eqn]$ is closed for a duration equivalent to twice of the charging period, $[eqn]$ , leading to the $[eqn]$ node being charged to a voltage $[eqn]$ :

$$[eqn]$$

The $[eqn]$ voltage is transformed into another $[eqn]$ pulse, which is then quantized to yield $[eqn]$ . By comparing the digital values $[eqn]$ and $[eqn]$ , it can be determined whether the $[eqn]$ node has fallen below the threshold voltage $[eqn]$ . Notably, due to the negative gain of the pulse generator, a higher voltage results in a shorter pulse width, leading to a smaller $[eqn]$ when compared to $[eqn]$ .

As $[eqn]$ is found to be smaller than $[eqn]$ , the timing controller triggers a discharge pulse to turn on the switch $[eqn]$ for one clock period, $[eqn]$ , and increments the count of the discharge cycle, $[eqn]$ , where $[eqn]$ represents the digital value of the accumulated discharge cycles. While the discharge switch is closed, the charge stored on $[eqn]$ begins to discharge through the resistor $[eqn]$ . This discharge process follows an exponential decay pattern, resulting in a new voltage, $[eqn]$ , on node $[eqn]$ . Subsequently, this new voltage generates another $[eqn]$ pulse along with the corresponding digital code $[eqn]$ .

The comparison and discharge process continues until the voltage on $[eqn]$ node drops below the threshold voltage $[eqn]$ , signaling the conclusion of the discharge phase. The entire discharge process spanning from $[eqn]$ to $[eqn]$ can be represented by:

$$[eqn]$$

Here, $[eqn]$ represents the total discharge period. Rearranging the terms, the accumulated discharge cycle can be expressed as the corresponding RC time-constant:

$$[eqn]$$

For a detailed visual overview of the described processes, a complete operation flowchart is depicted in Figure 3.

2.3. Measurement Error in Direct Measurement

The discrete discharge process described in the preceding section results in quantization error that is pivotal to consider because it can influence the effectiveness of the authentication process. An ideal discharge cycle can be obtained by rewriting Equation (4) and taking the quantization error into consideration:

$$[eqn]$$

where q ( $[eqn]$ ) denotes the quantization error. It is important to note that as the discharge process progresses and the $[eqn]$ node voltage drops below the threshold voltage, the quantization error assumes a positive value and is subtracted in the ideal discharge cycle.

The measurement error, expressed as a percentage of the discharge cycle, can then be calculated as:

$$[eqn]$$

Given that the quantization error ranges from zero to one, maximizing the discharge cycle corresponds to minimizing measurement error. However, the routing time-constant may be in the same order as the clock period, leading to a small discharge cycle and a large measurement error. For example, a long connecting metal trace in a 130 nm CMOS process could have a point-to-point resistance of 6 kΩ ( $[eqn]$ ) and a total capacitance to ground of 1.5 pF ( $[eqn]$ ). Assuming a system clock of 500 MHz, this could result in a measurement error of up to 22%. Such a large error significantly diminishes the precision of the measured time-constants, limiting the effectiveness of the RC sensor in authenticating die origins.

2.4. Three-Configuration Measurement

In light of the measurement error issue highlighted in the proceeding section, this section presents a “three-configuration” measurement technique aimed at improving the accuracy of the measured RC time-constant. This approach’s primary objective is to reduce the measurement error by utilizing three larger RC time-constants to derive the routing time-constant, $[eqn]$ .

The realization of the “three-configuration” measurement technique involves incorporating two additional components, namely $[eqn]$ and $[eqn]$ , as depicted in Figure 4. These elements, realized through a poly-resistor and a metal-insulator-metal (MIM) capacitor, facilitate the achievement of high resistance and capacitance values within a compact area, thereby minimizing area overhead. While it is possible to reduce measurement error by using larger values of $[eqn]$ and $[eqn]$ , pursuing this approach would result in a significantly greater area consumption compared to the “three-configuration” method.

The “three-configuration” approach follows the same operation concept as described in Section 2.2, albeit employing different components. Three larger time-constants are measured by closing and opening the resistor and capacitor switches, $[eqn]$ and $[eqn]$ , in Figure 4, and can be expressed as follows:

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$

where $[eqn]$ denotes the discharge cycle, with n being an index corresponding to one of the three larger RC time-constants. After measuring the three larger time-constants, the desired routing time-constant, $[eqn]$ , can be derived by multiplying the first two larger RC time-constants and dividing by the third:

$$[eqn]$$ $$[eqn]$$

where $[eqn]$ represents the effective discharge cycle of $[eqn]$ . However, it is important to note that each of the three measurements is subject to its own quantization error. To account for this, Equations (7)–(9) can be adjusted as follows:

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$

Here, $[eqn]$ (where $[eqn]$ ) represents the quantization error associated with each of the three large time-constants. By substituting Equations (12)–(14) into Equation (10), the routing time-constant $[eqn]$ , alongside its corresponding quantization error, can be determined. The complete derivation can be found in Appendix A.

$$[eqn]$$

It is worth noting that the second term, $[eqn]$ , in the above equation accounts for the quantization error arising from the “three-configuration” measurement technique. To significantly mitigate this quantization error, the values of the auxiliary components in this prototype are selected to be 10× those of the routing resistance and capacitance.

$$[eqn]$$

This selection of auxiliary components results in $[eqn]$ $[eqn]$ . Consequently, the corresponding discharge cycle becomes 11 times larger than that of a direct measurement ( $[eqn]$ ). This choice of selection in the auxiliary components directly impacts the measurement error of the derived $[eqn]$ , which simplifies to

$$[eqn]$$

Compared to the measurement error obtained from the direct measurement in Equation (6), the three-configuration measurement method reduces the measurement error by 82% through the use of auxiliary components with 10× resistance and capacitance values. Despite using additional elements, it only results in a 25% increase in the overall footprint, owing to the high resistance and capacitance density achieved by the poly resistor and the MIM capacitor in the target 130 nm CMOS process.

2.5. Process, Voltage, and Temperature Variations

The time-based sensor employs a current source to generate two proportional voltages and measures the time-constants by monitoring the discharge period. As long as the ratio of the charging periods is precise, the proportional voltages are accurate, leading to precise time-constant values. Despite the absolute value of the current source varies due to process, voltage, and temperature (PVT) variations, the approach remains robust as it primarily relies on the accuracy of the on-chip clock rather than requiring a precise on-chip voltage or current reference. Furthermore, given the sensor’s brief operational duration, we can safely assume that voltage and temperature remain stable without experiencing transient variations across the circuit’s operation.

3. Analytical Model

In this section, an analytical model of the TCG block is introduced. The model is both comprehensive and straightforward, effectively providing insights into how the parasitic capacitances associated with MOSFET switches and resistors influence the sensor’s discharge cycle. The accuracy of this model is validated through a comparison with the circuit simulation results.

3.1. Charge Redistribution Effect

One critical factor that significantly impacts the discharge cycle of the time-based sensor is the presence of parasitic capacitances within the discharge path, specifically associated with the resistors ( $[eqn]$ and $[eqn]$ ) and the MOSFET switches ( $[eqn]$ and $[eqn]$ ). To establish a straightforward yet effective model, the parasitics of the $[eqn]$ and $[eqn]$ , initially following a distributed RC model, are simplified to a $[eqn]$ -model with two lumped capacitors, $[eqn]$ , at both ends.

Similarly, the junction capacitances, $[eqn]$ , of the MOSFET switches are modeled as capacitors at the source and drain terminals. To streamline the model, the overlapped capacitance, $[eqn]$ , and channel capacitance, $[eqn]$ , are simplified to two capacitors, $[eqn]$ and $[eqn]$ , representing the gate-to-source and gate-to-drain capacitances, respectively.

Considering that $[eqn]$ and $[eqn]$ are both connected to the substrate, they can be merged. Consequently, the parasitic capacitances at internal nodes, $[eqn]$ and $[eqn]$ , within the discharge path can be simplified into two lump parasitic capacitors, $[eqn]$ and $[eqn]$ , as illustrated in Figure 5a. Specifically, $[eqn]$ includes the parasitic capacitance from $[eqn]$ , $[eqn]$ , and $[eqn]$ , while $[eqn]$ contains the parasitics of $[eqn]$ , $[eqn]$ , and $[eqn]$ .

Additionally, to streamline the symbols, $[eqn]$ , $[eqn]$ , and the parasitic capacitance of $[eqn]$ and $[eqn]$ are combined into a single capacitor, denoted as $[eqn]$ , which is responsible for storing the charge on the $[eqn]$ node, as shown in Figure 5a. The ensuing discussion will focus on the effects of $[eqn]$ and $[eqn]$ , while the impacts of $[eqn]$ and $[eqn]$ of the discharge switch, which results in a clock feedthrough effect, will be covered subsequently.

With a comprehensive understanding of the key parasitic capacitances in the TCG block, we now delve into the details of the discharge process. Upon closure of the switch $[eqn]$ , the charge stored on $[eqn]$ redistributes, flowing through $[eqn]$ and $[eqn]$ to ground as well as to the parasitic capacitors, $[eqn]$ and $[eqn]$ , as illustrated in Figure 5b. Voltages $[eqn]$ and $[eqn]$ are determined by the resistor-divider ( $[eqn]$ , $[eqn]$ , and $[eqn]$ ) present in the discharge path. In contrast, when the discharge switch is opened, the charge flow from $[eqn]$ ceases, and the charge stored on $[eqn]$ and $[eqn]$ discharges to ground, as depicted in Figure 5b. Given that the discharge switch OFF time being significantly longer than the time-constants of the parasitic capacitors, $[eqn]$ and $[eqn]$ nodes are reset to ground when the discharge switch is opened. Therefore, each cycle of closing and opening the discharge switch results in an additional loss of charge from $[eqn]$ , calculated as $[eqn]$ . As the cumulative number of discharge cycles increases, the charge redistribution effect becomes more pronounced, leading to an overall reduction in the number of discharge cycles.

An analytical model of the TCG block can be developed by establishing Kirchhoff’s Current Law (KCL) for nodes $[eqn]$ , $[eqn]$ , and $[eqn]$ :

$$[eqn]$$

where $[eqn]$ is the on resistance of the discharge switch. To accurately capture the discharge behavior, the analytical model is solved for every discharge cycle.

3.2. Clock Feedthrough Effect

In addition to the charge redistribution effect caused by parasitic capacitances in the discharge path, the two parasitic capacitors $[eqn]$ and $[eqn]$ of the discharge switch induce a clock feedthrough effect. This impact alters the voltages at nodes $[eqn]$ and $[eqn]$ during both the low-to-high and high-to-low transitions of the discharge pulse. While $[eqn]$ and $[eqn]$ are voltage-dependent, the time-based sensing method inherently averages this nonlinearity during operation, and the analytical model uses these average values to maintain compactness while preserving accuracy.

Upon the rising edge of the discharge pulse arrival, the voltages at nodes $[eqn]$ and $[eqn]$ increase due to capacitive coupling. This increase in voltage slows down the discharge process on $[eqn]$ , as depicted in Figure 6. Conversely, during the falling edge, the voltages at nodes $[eqn]$ and $[eqn]$ decrease, resulting in an accelerated discharge process.

It should be emphasized that while the low-to-high and high-to-low transitions sum a zero effect on $[eqn]$ node, this is not the case for the $[eqn]$ node. When the falling edge of the discharge pulse arrives and $[eqn]$ opens, the discharging path of $[eqn]$ is disconnected. Hence, the decrease in voltage on the $[eqn]$ node does not affect $[eqn]$ and merely accelerates the reset process. To incorporate this clock feedthrough effect into the analytical model, a non-zero initial condition is used for the $[eqn]$ node when solving the equations. This approach captures the impact of the clock feedthrough effect while preserving the simplicity of the analytical model.

3.3. Simulation Results

In order to validate the effectiveness of the proposed analytical model, a comparison is drawn between its simulation results and those obtained from circuit simulations. The simulations were performed using a 130 nm CMOS process with extracted parasitics included. As illustrated in Figure 7, a close alignment can be observed between the results derived from the analytical model and the circuit simulations across all three larger RC time-constants. A summary of the simulation results for these RC time-constants is provided in Table 1. Notably, the difference between the analytical model and the circuit simulations is maintained below 3.2%, underscoring the high level of accuracy attained by the model.

4. Implementation Details

This section delves into the design and implementation of the in situ time-based sensors. In order to address the impact of process variation, Monte Carlo simulations, including extracted parasitic, are employed to estimate the post-fabrication results. A thorough examination and interpretation of the simulation outcomes are also presented.

4.1. TCG Block

The architecture of the TCG block is illustrated in Figure 4. For simplicity, the bias circuitry is omitted from the figure. To minimize parasitic capacitances, all switches are implemented with minimum length NMOS devices. It is important to note that while regular NMOS devices are used for the $[eqn]$ switch, thick gate devices are chosen for the remaining switches connected to the $[eqn]$ node to minimize leakage current. Additionally, both the $[eqn]$ and $[eqn]$ switches are designed with turn-on resistance significantly smaller than the $[eqn]$ , ensuring that the time-constant measurement is dominated by the $[eqn]$ , $[eqn]$ , $[eqn]$ , and $[eqn]$ .

4.2. Pulse Generator

The objective of the pulse generator (Figure 4) is to convert the voltage $[eqn]$ from voltage domain to an equivalent time domain $[eqn]$ pulse, which is subsequently qunatized using the system clock. This time-domain measurement approach contrasts with direct voltage measurement using an ADC, which would require an accurate on-chip voltage reference and incurs area overhead, making the time-domain method a more efficient alternative. This conversion is achieved through the combination of a voltage-controlled delay line (VCDL), an inverter, and a NOR gate, as illustrated in Figure 8a. When $[eqn]$ is settled, a trigger signal, $[eqn]$ , is dispatched from timing controller to the pulse generator. The VCDL and the inverter transmit the transition to their respective outputs with distinct propagation delays, as shown as $[eqn]$ and $[eqn]$ , respectively. Subsequently, the delay difference is converted into an $[eqn]$ pulse by the NOR gate, which then proceeds to a counter for quantization. Since $[eqn]$ is negligible compared to $[eqn]$ , the $[eqn]$ pulse width is approximately equal to $[eqn]$ .

Figure 8b shows the schematic of the VCDL, consisting of 26 current-starved inverters followed by 26 regular inverters in an alternating pattern. By limiting the discharge current via the $[eqn]$ voltage, the propagation delay of the VCDL can be effectively controlled. The dynamic range of VCDL, covering the voltage range from $[eqn]$ to $[eqn]$ , is depicted in Figure 8c and spans from 37 ns to 182 ns.

4.3. Counter

To digitize the $[eqn]$ pulse width, a sequence of D-flip-flops (DFFs) is connected in series, with their outputs (QB) looped back to the data (D) to form a counter. An AND gate is employed at the counter’s front end as an enabling mechanism, as depicted in Figure 9. Considering the system clock is 500 MHz, an eight-bit counter is chosen to cover the dynamic range of the VCDL, where $[eqn]$ and $[eqn]$ are the least-significant bit (LSB) and the most-significant-bit (MSB) of the $[eqn]$ , respectively. This counter design provides a simple yet effective approach to digitize the $[eqn]$ pulse width.

4.4. Timing Controller

The timing controller coordinates the sequential operations of each block within the system. Illustrated in Figure 10a, the state machine of the timing controller comprises four distinct states: $[eqn]$ (resetting the $[eqn]$ node), $[eqn]$ (charging the $[eqn]$ node), $[eqn]$ (quantizing the voltage on the $[eqn]$ node and comparing it to the threshold voltage), and $[eqn]$ (discharging the $[eqn]$ node). Each state is associated with a finished signal, denoted as $[eqn]$ , where n represents one of the four states. Additionally, there is a $[eqn]$ signal that determines whether the system is in the discharging phase. After the state machine enters the $[eqn]$ state twice, the $[eqn]$ signal is raised, restricting the state machine’s transitions to alternate between the $[eqn]$ and $[eqn]$ states.

Upon initialization of the time-based sensor, $[eqn]$ is set high, generating a reset pulse, $[eqn]$ , which resets the voltage on the $[eqn]$ node, as demonstrated in Figure 10b. Subsequently, the falling edge of the pulse triggers a DFF, raising the finished signal $[eqn]$ to a high state. Once activated, this signal lowers $[eqn]$ and initiates the $[eqn]$ state. For clarity, only two states logic are shown in Figure 10b, yet the remaining states are implemented in a similar manner.

4.5. Time-Based Sensor

For the sake of design validation, a set of five RC variants with different resistor and capacitor values have been implemented. The five variants, denoted as R-hC, hR-C, R-C, 2R-C, and R-2C, represent combinations of resistors and capacitors at 0.5× (notated as h), 1×, and 2× their nominal values. In these configurations, the nominal values for $[eqn]$ and $[eqn]$ are 6 kΩ and 1.5 pF, respectively. As discussed in Section 2.4, the auxiliary components are chosen to be 10 times larger than $[eqn]$ and $[eqn]$ to significantly reduce the quantization error, leading to $[eqn]$ at 60 kΩ and $[eqn]$ at 16 pF for the R-C variant. Detailed parameters for R-C variant are listed in Table 2.

To estimate the distribution of the discharge cycle after fabrication, the parasitic extracted time-based sensors are simulated with 200-point Monte Carlo simulations. The simulation results for the three configurations and the derived routing time constant are summarized in Table 3. For the purpose of brevity, only the R-C variant is reported. The simulated mean value ( $[eqn]$ ) and standard deviation ( $[eqn]$ ) for each configuration are tabulated, providing a statistical characterization of the discharge cycle distribution. The $[eqn]$ column represents the RC time-constants used in simulations, while the $[eqn]$ column provides the calculated time-constants derived from the mean value of the discharge cycle. Discrepancies between these values are presented as a percentage difference in the $[eqn]$ column.

As discussed in Section 3.1, the charge redistribution effect is influenced by several factors, including the storing capacitor $[eqn]$ , the parasitic capacitors $[eqn]$ and $[eqn]$ , the resistors $[eqn]$ and $[eqn]$ , and the number of the discharge cycle. Consequently, while the calculated time-constant in each configuration is smaller than the designed value, the level of the charge redistribution effect varies among them. For instance, the $[eqn]$ configuration, with an error of 11.5%, exhibits less discrepancy than the $[eqn]$ configuration, which has an error of 26.6%, due to its larger storing capacitor. However, in the $[eqn]$ configuration, despite having a large storing capacitor, it accumulates the highest number of discharge cycles. This frequent occurrence of charge redistribution results in more significant charge loss from $[eqn]$ and, consequently, leads to the largest error among the three configurations.

The discharge cycle of the routing time-constant, $[eqn]$ , is derived in Table 3 based on Equation (11). As expected from Equation (17), the error is significantly reduced through the calculation of the quotient $[eqn]$ , thereby mitigating the influence of the charge redistribution effect. Consequently, the derived routing time-constant yields a more accurate result with a minimal error of 0.89%.

4.6. Direct Measurement Array

In addition to the in situ time-based sensors, standalone layouts of $[eqn]$ and $[eqn]$ structures have been fabricated alongside the sensors, resulting in a direct measurement array (DMA). The structures of DMA resistor array and DMA capacitor array are depicted in Figure 11, and detailed in [30]. Notably, since external equipment is used to measure the DMA, the precise outcomes from the DMA are utilized as a benchmark for the validation of the accuracy of the time-based sensors.

The structure of the DMA resistor array is illustrated in Figure 11a. A single cell is enabled at a time by activating its corresponding $[eqn]$ signal. An accurate external current source is then utilized to measure the resistance values of $[eqn]$ . Notably, owing to the high input impedance of the voltage meter, the current $[eqn]$ exclusively flows through $[eqn]$ and the parasitic resistance, $[eqn]$ , without being drawn into the voltage meter. Concurrently, the voltage meter measures the voltage across the $[eqn]$ , and the resistance vale of $[eqn]$ can be determined by: $[eqn]$ . It is noteworthy that the measurement accuracy may be influenced by the leakage of the MOSFET switches. To mitigate this issue, thick gate devices are adopted in this structure. Simulations indicate that the leakage current of thick gate device is at a pA level.

The structure of the DMA capacitor array is depicted in Figure 11b. Similar to the resistor DMA, a single cell is activated at a time through the utilization of an $[eqn]$ signal. The operation involves the input of a clock signal, $[eqn]$ , into a non-overlapping clock circuit, which generates two distinct clock phases, $[eqn]$ and $[eqn]$ . These clock signals ensure the PMOS and NMOS do not turn on simultaneously. Specifically, when $[eqn]$ is in its low state, the PMOS is in an ON-state, while the NMOS is in an OFF-state, thereby allowing a voltage source, $[eqn]$ , to charge the $[eqn]$ capacitor. Conversely, when $[eqn]$ is in its high state, the PMOS turns off, and the NMOS turns on, leading to the discharge of $[eqn]$ to a ground state, $[eqn]$ . The value of $[eqn]$ can then be determined by measuring the average current, $[eqn]$ , drawn from the voltage source $[eqn]$ , utilizing the formula $[eqn]$ [31]. Note that even though the clock, $[eqn]$ , has a 50% duty cycle, the on-time of the PMOS and NMOS are not equal to half of the clock period due to the propagation delay of the inverter chain. This discrepancy can introduce a measured error in the determination of $[eqn]$ . To mitigate this error, half of the clock period needs to be significantly larger than the delay of the inverter chain. Simulations show that the delay of the inverter chain is about 130 ps.

5. Measurement Results

An array of the five time-based sensor variants has been fabricated in a 130 nm CMOS technology with a 1.5 V supply voltage. The die photo, shown in Figure 12, reveals a total area of 2.5 mm × 2.6 mm, accommodating 81 DMA-resistance cells, 108 DMA-capacitance cells, and 20 time-based sensors.

The layout of a single time-based sensor (R-C variant) occupies an area of 182 µm × 165 µm.

Measurement data have been collected from 11 chips, with four from one wafer and the remaining seven from another wafer.

To ensure accuracy, each reported data point is the average of three measurements which helps suppress the impact of noise.

5.1. Direct Measurement Array—Resistor Array

The DMA-resistor array comprises three types of resistor cells labeled as hR, R, and 2R, with values of 3 kΩ, 6 kΩ, and 12 kΩ, respectively. These values correspond to 0.5×, 1×, and 2× of the nominal resistance values. Each cell type includes 27 identical elements, bringing the total to 81 elements within the resistor array.

The external current source is supplied by a Keithley-2400 unit (Keithley Instruments, Inc., Solon, OH, USA), configured to provide a current of 10 µA, while the voltage measurements are carried out using a Keysight-34420A device (Keysight Technologies, Inc., Santa Rosa, CA, USA). Given that the leakage current observed from simulations is at the pA level, the impact of the leakage current is negligible.

Measured results from the first wafer, encompassing four chips, are presented in Figure 13a,c,e. The displayed bimodal shape of the histogram is attributed to die-to-die variation and the small sample size. As the sample size increases, it is expected that the distribution would converge toward a Gaussian distribution. Similarly, results from the second wafer, involving seven chips, are plotted in Figure 13b,d,f. Notably, the second wafer’s three resistance cell mean values consistently exhibit a 10% elevation compared to those of the first wafer, likely due to process variation. When compared to circuit simulations in the typical-typical (TT) corner, the mean values of the measured results across two wafers are approximately 22% higher for all three resistor cells, as summarized in Table 4. This discrepancy may be attributed to the difference between models and real manufacturing process as well as process variations. This discrepancy highlights the critical need for the DMA measurements, as simulation results alone are insufficient.

5.2. Direct Measurement Array—Capacitor Array

The DMA-capacitor array comprises three types of capacitor cells denoted as hC, C, and 2C, with values of 0.73 pF, 1.45 pF, and 2.88 pF, respectively, corresponding to 0.5×, 1×, and 2× capacitance values. Each cell type contains 36 identical elements, yielding a total 108 elements within the capacitor array.

The clock signal is generated using Agilent E8267D equipment (Keysight Technologies, Inc., Santa Rosa, CA, USA), employing on-chip buffers to produce a square wave with a 50% duty cycle at 20 MHz.

The voltage sources $[eqn]$ and $[eqn]$ are provided by Keithley-2400 unit set at 1.5 V and 0 V, respectively. Since half of the clock period is 25 ns, significantly larger than the delay of the inverter chain, the measured error due to the shortened charging period is negligible. Figure 14 presents the measured results separately for each wafer. Due to die-to-die variation and a small sample size, the histograms deviate from a Gaussian distribution. Notably, unlike the resistor array, the mean values across the three capacitor cells from both wafers are notably similar. When compared to circuit simulations in the TT corner, the mean values of the measured results closely match, with a maximum error of 2.5%. These results are summarized in Table 5.

5.3. Time-Based Sensors

In addition to the DMA resistor and capacitor arrays, an array of time-based sensors has been fabricated. This array consists of five RC variants, each comprising four sensor units, resulting in a total of 20 sensors on a single chip.

The R-C variant operates at 500 MHz and consumes 16.2 mW from a 1.5 V supply. It is worth noted that the time-based sensors only need to be activated when an authentication verification is required, hence the power consumption is not a significant concern.

Based on DMA results, the measured mean values of $[eqn]$ and $[eqn]$ deviated from the circuit simulation values, especially for the resistor values. To account for this deviation, adjustments are made to the $[eqn]$ and $[eqn]$ values in the time-based sensors’ simulations using the mean values measured from the DMA. This modification led to closely matched results between simulations and measurements across the five variants, with a maximum error of 6.1%, as summarized in Table 6.

Discrepancies between the simulations and the measurements can be attributed to within-die variation (DMA vs. time-based sensor) and variations in the parasitic capacitance values within the discharge path, which are not accounted for in the simulation results. These fluctuations can lead to different levels of charge redistribution, resulting in varying discharge cycles. It is important to emphasize that the observed maximum deviation of 6.1% does not solely reflect sensor measurement error but instead encompasses the cumulative impact of effects such as intra-die process variations and model limitations.

For context, prior work by Jin et al. [32] has shown that RC time constants in a 55 nm CMOS process can vary by up to ±50% due to PVT effects. Compared to this baseline, the 6.1% deviation observed here reflects significantly higher measurement fidelity than the intrinsic variation within a single foundry. It therefore stands to reason that the proposed method is capable of distinguishing devices fabricated in different foundries, where variation is expected to be even greater.

The distribution of the derived discharge cycles for $[eqn]$ is shown in Figure 15, with separate data for each wafer. Notably, the discharge cycles of the second wafer consistently exceed those of the first wafer, aligning with the DMA resistor array results. Similar to the histograms shown for the DMA, as the sample size increases, the distribution is expected to converge toward a Gaussian distribution.

6. Conclusions

This paper introduces an in situ time-based sensor capable of characterizing the RC time constants of the BEOL routing, enabling process attestation. Leveraging inherent process variations during manufacturing, the sensor facilitates die authentication. To address the resolution issue arising from a slow clock frequency, a three-configuration measurement method is proposed. Theoretical analysis shows that utilizing two auxiliary components with 10× resistance and capacitance values can reduce measurement error by 82%.

An analytical model is developed to study the impacts of each component in the TCG block on the discharge cycle, including the parasitic capacitances of the MOSFET switches and those of the resistors in the discharge path. The model simplifies these parasitic capacitances while incorporating charge redistribution and clock feedthrough effects, achieving close alignment with circuit simulations.

To validate the accuracy of the time-based sensors, a DMA with identical layouts of $[eqn]$ and $[eqn]$ alongside the sensors is fabricated. The DMA enables accurate resistance and capacitance measurement using external equipment. By updating the $[eqn]$ and $[eqn]$ values in the time-based sensor simulations in accordance with the DMA results, a strong correlation between the simulations and measurements is observed, validating the effectiveness of the proposed sensor.

In summary, the time-based sensor presented in this work offers a promising solution for process attestation, contributing to the advancement of secure and reliable hardware systems.