Semiconductor equipment
The semiconductor device stabilizes pulse counting in even-stage ring circuits by using a pulse input and edge detection circuit to ensure pulses with a predetermined width are counted, addressing the instability of existing systems and enabling efficient true random number generation.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- RENESAS ELECTRONICS CORP
- Filing Date
- 2024-10-11
- Publication Date
- 2026-04-23
AI Technical Summary
The challenge of stably counting pulses generated by an even-stage ring circuit due to small pulse widths, which leads to unstable true random number generation, is addressed by the semiconductor device.
The semiconductor device incorporates a pulse input circuit, an edge detection circuit, and a counter circuit to ensure that pulses with a predetermined pulse width larger than a certain threshold are used for stable counting, regardless of the holding state or process variations.
This configuration allows for stable counting of pulses from an even-stage ring circuit, ensuring reliable true random number generation without the need for transistor-level analysis, thereby facilitating rapid realization of a stable random number generation circuit.
Smart Images
Figure 2026068908000001_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a semiconductor device.
Background Art
[0002] Non-Patent Document 1 discloses a technique for generating true random numbers using an even-stage ring circuit.
Prior Art Documents
Non-Patent Documents
[0003]
Non-Patent Document 1
Summary of the Invention
Problems to be Solved by the Invention
[0004] Since the pulse width of the pulses generated by the even-stage ring circuit is small, there is a problem that it is difficult to stably count the pulses.
[0005] The present disclosure has been made to solve such problems, and an object thereof is to realize a semiconductor device capable of stably counting the pulses output from an even-stage ring circuit.
[0006] Other problems and novel features will become apparent from the description of this specification and the accompanying drawings.
Means for Solving the Problems
[0007] A semiconductor device according to one embodiment includes a pulse input circuit to which a first pulse from an even-numbered ring circuit is input to each of the two pre-stage counters, each comprising a flip-flop constituting two pre-stage counters having different holding states, an edge detection circuit to which an edge detects the edge of the output of the two pre-stage counters and outputs a second pulse having a predetermined pulse width larger than a predetermined value based on the edge, and a counter circuit to which the second signal is input to a post-stage counter, wherein the edge detection circuit is configured to output the second pulse or a step-shaped signal if the pulse width of the first pulse is smaller than the predetermined value. [Effects of the Invention]
[0008] According to the above embodiment, it is possible to provide a semiconductor device that can stably count pulses output from an even-numbered ring circuit. [Brief explanation of the drawing]
[0009] [Figure 1] This is a circuit diagram of an even-stage ring circuit. [Figure 2] This graph shows the waveform of the pulses output from even-numbered ring stages. [Figure 3] This is a diagram illustrating the configuration of a circuit that generates a true random number seed. [Figure 4] This diagram illustrates the variation in the minimum pulse width required to operate the counter. [Figure 5] This diagram illustrates the variation in minimum pulse width depending on the counter's holding state. [Figure 6] This diagram illustrates the simulation results of the count value obtained by a counter circuit connected to an even-stage ring circuit. [Figure 7] This is a circuit diagram of a semiconductor device according to Embodiment 1. [Figure 8] This is a diagram illustrating the operation of the semiconductor device according to Embodiment 1. [Figure 9]This is a diagram for explaining the variation in the minimum pulse width in the semiconductor device according to Embodiment 1. [Figure 10] This is a diagram for explaining the verification result of the operation of the semiconductor device according to Embodiment 1. [Figure 11] This is a circuit diagram of the semiconductor device according to Embodiment 2. [Figure 12] This is a diagram for explaining the operation of the semiconductor device according to Embodiment 2. [Figure 13] This is a circuit diagram of the semiconductor device according to Embodiment 3.
Mode for Carrying Out the Invention
[0010] For the sake of clarity of explanation, the following description and drawings are appropriately omitted and simplified. In each drawing, the same reference numerals are assigned to the same elements, and duplicate explanations are omitted as necessary. In addition, each element described in the drawings as a functional block that performs various processes can be hardware-wise composed of a CPU (Central Processing Unit), a memory, and other circuits, and software-wise can be realized by a program loaded in the memory or the like. Therefore, it is understood by those skilled in the art that these functional blocks can be realized in various forms by hardware, software operating on the hardware, or a combination thereof, and is not limited to any one of them.
[0011] New problems found by the present inventor In recent years, security measures have become essential in SoC (System-on-a-chip), and true random number generation is a core function. A plurality of true random number seed circuits have been proposed, and an even-stage ring circuit is one of them. In the even-stage ring circuit shown in FIG. 1, the buffer logic is composed of two stages of inverter logic. Considering the buffer logic and the NAND inverter logic, the total number of stages of the even-stage ring circuit in FIG. 1 is 14 stages.
[0012] In an even-numbered ring circuit, by inputting H, i.e., "1", to the START terminal, edges (e.g., rising edge and falling edge) are generated at two locations within the ring. Pulses corresponding to the two edges circulate through the circuit while gradually decreasing or increasing the pulse width, and finally the two edges collide and the pulse disappears. Variations occur in the number of circulations and locations of pulse disappearance due to thermal noise, and this variation can be used as the seed for true random numbers.
[0013] To observe the pulse, a counter circuit is connected to one or more nodes (e.g., N1 to N8) of the even-numbered ring circuit. Figure 2 shows the simulation waveform of this pulse. The upper part of Figure 2 shows the waveform of the pulse from 0 ns to 10 ns, and the lower part shows the waveform of the pulse after 60 ns. "1" is input to the START terminal at 2 ns, and a pulse is generated. The two edges gradually approach each other, and at approximately 65 ns, the two edges collide and the pulse disappears. Since the pulse is disappearing, the pulse width may become extremely small.
[0014] The even-numbered ring circuit and the counter circuit are implemented using an automatic placement and routing tool. Due to using an automatic placement and routing tool, the amount of variation in the pulse width leading to pulse disappearance is greatly affected by the implementation situation, and due to the Min pulse width characteristic that depends on the holding state of the flip-flop, a state occurs where the count value of one or more flip-flop counters connected to the nodes of the even-numbered ring circuit is always 1 (or always 0). The Min pulse width is the minimum pulse width of a pulse that can change the holding state of the flip-flop counter.
[0015] When the count value is always 1, the count value cannot be used as the true random number seed. To avoid such a state, it is necessary to extract the parasitic capacitance and netlist with resistance of each of the even-numbered ring circuit and the counter circuit implemented by the automatic placement and routing tool, and perform transistor-level analysis, which poses the problem of requiring a great deal of man-hours and time.
[0016] Figure 3 shows an example of a circuit for generating a random number seed. Counter circuits are connected to each of the nodes N1 to N8 of the even-numbered ring circuit in Figure 1. The XOR gate aggregates the output of the counter circuits into 1 bit. When the count value of all counter circuits becomes 1, the output of the XOR gate will always be 0, so the counter circuit placed after the XOR gate will always output 0.
[0017] Figure 4 shows the process variation in Min pulse width, power supply voltage VDD variation, and junction temperature T. j This shows the variation. The vertical axis represents the minimum pulse width [ps]. The inventors set the power supply voltage to 1.1V and the junction temperature to T j Simulations were performed with the temperature set to 25°C and the process conditions set to Nominal (Typ), SS (Slow-Slow), FF (Fast-Fast), FS (Fast-Slow), and SF (Slow-Fast). In addition, the inventors set the process conditions to Nominal and the bonding temperature T j The simulation was performed with the temperature set to 25°C and the power supply voltage VDD set to a minimum of 1.0V and a maximum of 1.2V. The inventor also performed a simulation with the process conditions set to nominal, the power supply voltage VDD set to 1.1V, and the junction temperature T j The simulation was performed with a minimum temperature of -40°C and a maximum temperature of 125°C.
[0018] The dotted line represents the minimum pulse width when the counter circuit's holding state changes from H to L, i.e., from 1 to 0. The solid line represents the minimum pulse width when the counter circuit's holding state changes from L to H, i.e., from 0 to 1. From the simulation results, it can be seen that the minimum pulse width varies depending on the holding state of the counter circuit and the process.
[0019] This section explains the effect of the counter circuit's holding state on the Min pulse width, using an example where the process conditions are nominal. The Min pulse width is 40 ps when changing the counter circuit's holding state from "1" to "0", and 30 ps when transitioning the counter circuit's holding state from "0" to "1". Therefore, when a pulse with a pulse width between 30 ps and 40 ps is input, the counter circuit's holding state cannot transition from "1" to "0", but it can transition from "0" to "1". Thus, when a pulse with such a pulse width is input, the counter circuit's holding state will always be "1". Also, as mentioned above, the Min pulse width depends on the process, power supply voltage VDD, and junction temperature T. j Because it varies depending on the factors, stable counting operation cannot be guaranteed.
[0020] Referring to Figure 5, the second and fourth graphs from the top each represent the output waveforms of a counter circuit connected to an even-stage ring circuit. In the second graph from the top, the initial holding state of the counter circuit is "1", and in the fourth graph from the top, the initial holding state of the counter circuit is "0". The first and third graphs from the top represent the waveforms of pulses input to the counter circuit. Referring to the second graph from the top, the counter output does not change with a pulse with a pulse width of 35 ps, but referring to the fourth graph from the top, the counter output changes from "0" to "1" with a pulse with a pulse width of 35 ps. Thus, it is possible for the output of the counter circuit to always be "1".
[0021] Figure 6 shows the simulation results of the count value when a counter circuit is connected to nodes N1 to N8 of the even-stage ring circuit in Figure 1 and pulses are generated. The process conditions are SS, the power supply voltage VDD is 1.0V, and the junction temperature is T jThe temperature was set to -40°C. The output of the 1-bit counter at all nodes is 1. This is because the minimum pulse width depends on the holding state of the counter circuit. This problem occurs frequently in even-stage ring circuits that generate pulses with small pulse widths, making it difficult to generate a true random number seed using an even-stage ring circuit.
[0022] Embodiment 1 Figure 7 is a circuit diagram showing a semiconductor device 100 according to Embodiment 1. The semiconductor device 100 includes a pulse input circuit 10, an edge detection circuit 20, and a counter circuit 30.
[0023] The pulse input circuit 10 includes pre-stage counters 121-122 and NOT gates 111-112.
[0024] The pre-stage counter 121 includes a reset terminal (RN), a pulse input terminal, a data input terminal (D), and an output terminal (Q). The NOT gate 111 inverts the output A of the output terminal of the pre-stage counter 121 and outputs it to the data input terminal. The pulse input terminal receives a pulse IN (also called the first pulse) output from the even-stage ring circuit. In the initial state of the pre-stage counter 121, the hold state of the pre-stage counter 121, i.e., output A, is reset to "0" based on the signal input to the reset terminal. The pre-stage counter 121 outputs the 1-bit count value of the pulse IN input to the pulse input terminal as output A. The pulse input terminal may also be a clock input terminal.
[0025] The pre-stage counter 122 includes a set terminal (SN), a pulse input terminal, a data input terminal (D), and an output terminal (Q). The NOT gate 112 inverts the output B of the output terminal of the pre-stage counter 122 and outputs it to the data input terminal. The pulse input terminal receives the pulse IN output from the even-stage ring circuit. In the initial state of the pre-stage counter 122, the hold state of counter 1 is set to "1" based on the signal input to the set terminal. The pre-stage counter 122 outputs the 1-bit count value of the pulse IN input to the pulse input terminal as output B.
[0026] The preceding counters 121 and 122 are composed of flip-flops. The subsequent counters 321 to 323, which will be described later, are similarly composed of flip-flops.
[0027] The edge detection circuit 20 includes NOT gates 211-212, AND gates 221-222, and OR gate 23.
[0028] The NOT gate 211 (also called a delay element) delays and inverts the output A of the preceding counter 121. The delay amount may be, for example, 70 ps. The AND gate 221 outputs the logical AND of the output of the NOT gate 211 and the output A of the preceding counter 121 as pulse C. Pulse C has a pulse width corresponding to the delay amount generated by the NOT gate 211. This pulse width is set large enough to change the output of the counter circuit 30 regardless of the holding state of the counter circuit 30. In other words, this pulse width needs to be set larger than a certain threshold (predetermined value). The AND gate 221 detects the rising edge of the output A of the preceding counter 121 and outputs pulse D based on the edge.
[0029] The NOT gate 212 (also called a delay element) delays and inverts the output B of the preceding counter 122. The delay amount may be, for example, 70 ps. The AND gate 222 outputs the logical AND of the output of the NOT gate 212 and the output of the preceding counter 122 as pulse D. Pulse D has a pulse width corresponding to the delay amount generated by the NOT gate 212. This pulse width is set to be large enough to change the output of the counter circuit 30 regardless of the holding state of the counter circuit 30. The AND gate 222 detects the rising edge of the output B of the preceding counter 122 and outputs pulse D based on the edge.
[0030] The OR gate 23 outputs pulse E (also called the second pulse) which is the logical OR of pulse C output from AND gate 221 and pulse D output from AND gate 222. The pulse width of pulse E is equal to the pulse width of pulse C and pulse D.
[0031] The counter circuit 30 includes a downstream counter 321 and a NOT gate 311. The NOT gate 311 inverts the output OUT of the output terminal of the downstream counter 321 and outputs it to the data input terminal. A pulse E is input to the pulse input terminal of the downstream counter 321. The downstream counter 321 may also have a set terminal and a reset terminal. The downstream counter 321 outputs the 1-bit count value of pulse E as output OUT.
[0032] Figure 8 shows the results of a simulation of the operation of the semiconductor device 100. The upper time chart in Figure 8 shows the simulation results when the downstream counter 321 is held down before the first pulse is input to the semiconductor device 100, i.e., when the output OUT is "0". The lower time chart in Figure 8 shows the simulation results when the downstream counter 321 is held down before the first pulse is input, i.e., when the output OUT is "1".
[0033] The pulse width of pulse IN gradually decreases in the order of 105 ps, 70 ps, and 35 ps. Referring to the upper time chart, when the pulse width is 35 ps, the output A of the pre-stage counter 121 does not change from "1" to "0" due to the influence of the Min pulse width mentioned above. However, even in this case, the edge detection circuit 20 outputs pulse E, and the output OUT of the subsequent counter 321 changes from "0" to "1". Also, referring to the lower time chart, when the pulse width is 35 ps, the output B of the pre-stage counter 122 does not change from "1" to "0", but the edge detection circuit 20 outputs pulse E, and the output OUT of the subsequent counter 321 changes from "1" to "0". Therefore, it can be seen that Embodiment 1 solves the problem of the output of the subsequent counter 321 being fixed at "1".
[0034] Referring to Figure 9, the process, power supply voltage VDD, and junction temperature T are shown. j In response to the variation, the piecewise graph showing the minimum pulse width of pulse IN when the output OUT of the subsequent counter 321 changes from "1" to "0" and the piecewise graph showing the minimum pulse width of pulse IN when the output OUT changes from "0" to "1" overlap with each other. Therefore, Embodiment 1 can achieve stable counting operation.
[0035] Figure 10 shows the results of a simulation of the output of each semiconductor device 100 when a semiconductor device 100 is attached to each of the nodes N1 to N8 of the even-stage ring circuit in Figure 1. The phenomenon in which the output of all nodes N1 to N8 becomes "1" does not occur, and the correct count value is output.
[0036] Embodiment 1 enables stable counting of pulses output from an even-stage ring circuit. Embodiment 1 eliminates the need for transistor-level analysis for each product, allowing for the rapid realization of a stable random number generation circuit.
[0037] Embodiment 2 Figure 11 is a circuit diagram of the semiconductor device 100a according to Embodiment 2. Comparing Figure 7 and Figure 11, the edge detection circuit 20 has been replaced with the edge detection circuit 20a.
[0038] The edge detection circuit 20a includes a NOT gate 24 (also called a delay element) and an EXOR gate 25. The NOT gate 24 delays and inverts the output B of the preceding counter 122. The EXOR gate 25 outputs the exclusive OR of the output A of the preceding counter 121 and the output D of the NOT gate 24 as output E. The output E of the EXOR gate is input to the subsequent counter 321.
[0039] The edge detection circuit 20a detects the edges of output A of the preceding counter 121 and the edges of output B of the preceding counter 122. The edge detection circuit 20a is configured to output pulses with a pulse width corresponding to the delay amount, based on the edges. This pulse width is set to be large enough to change the output of the counter circuit 30 regardless of the holding state of the counter circuit 30. Furthermore, if the pulse width of pulse IN output from the even-numbered ring circuit is small and output A of the preceding counter 121 or output B of the preceding counter 122 does not change, the edge detection circuit 20a is configured to output a step-like signal. Even when a step-like signal is input, the output OUT of the subsequent counter 321 also changes.
[0040] Referring to the upper time chart in Figure 12, the output A of the pre-stage counter 121 does not change with a pulse with a pulse width of 35 ps, but the output E of the edge detection circuit 20a changes in a step-like manner, and the output OUT of the subsequent counter 321 changes from "0" to "1". Also, referring to the lower time chart in Figure 12, the output B of the pre-stage counter 122 does not change with a pulse with a pulse width of 35 ps, but the output E of the edge detection circuit 20a changes in a step-like manner, and the output OUT of the subsequent counter 321 changes from "1" to "0". Thus, Embodiment 2 also solves the problem of the output OUT of the subsequent counter 321 being fixed.
[0041] Embodiment 2 can be implemented in a smaller area because it uses fewer gates compared to Embodiment 1.
[0042] Embodiment 3 Figure 13 is a circuit diagram showing a semiconductor device 100b according to Embodiment 3. Comparing Figure 7 and Figure 13, the counter circuit 30 has been replaced by the counter circuit 30b. The counter circuit 30b is configured as a multi-bit counter circuit.
[0043] For example, the output of the edge detection circuit 20 is input to the pulse input terminal of the subsequent counter 321. The inverted signal of the output x0 of the subsequent counter 321 is input to the data input terminal of the subsequent counter 321. The output x0 of the subsequent counter 321 is input to the pulse input terminal of the subsequent counter 322. The inverted signal of the output x1 of the subsequent counter 322 is input to the data input terminal of the subsequent counter 322. The output x1 of the subsequent counter 322 is input to the pulse input terminal of the subsequent counter 323. The inverted signal of the output x2 of the subsequent counter 323 is input to the data input terminal of the subsequent counter 323. The count value by the counter circuit 30b is determined based on the output x0 of the subsequent counter 321, the output x1 of the subsequent counter 322, and the output x3 of the subsequent counter 323.
[0044] The number of downstream counters included in the counter circuit 30b may be two or four or more. Also, the edge detection circuit 20 in Figure 13 may be replaced with the edge detection circuit 20a of Embodiment 2.
[0045] Embodiment 3 allows pulses output from an even-stage ring circuit to be counted by a multi-bit counter.
[0046] Although the present invention has been specifically described above based on embodiments, it goes without saying that the present invention is not limited to the above embodiments and can be modified in various ways without departing from its essence. [Explanation of Symbols]
[0047] 100, 100a, 100b Semiconductor 10. Pulse input circuit 111, 112, 211, 212, 24, 311 NOT gates 121, 122 Pre-stage counter 20, 20a Edge detection circuit 221, 222 AND Gate 25 EXOR Gates 30, 30b Counter Circuit 321, 322, 323 Rear counter
Claims
1. A pulse input circuit comprising a flip-flop that constitutes each of two pre-stage counters having different holding states, wherein a first pulse from an even-stage ring circuit is input to each of the two pre-stage counters, An edge detection circuit that detects the edges of the outputs of the two preceding counters and outputs a second pulse having a predetermined pulse width that is larger than a predetermined value based on the edges, A counter circuit comprising a subsequent counter to which the second pulse is input, Equipped with, The edge detection circuit is configured to output the second pulse or a step-shaped signal when the pulse width of the first pulse is smaller than the predetermined value. Semiconductor equipment.
2. In the semiconductor device described in claim 1, One of the two preceding counters is composed of a flip-flop with a reset function, and the other of the two preceding counters is composed of a flip-flop with a set function.
3. In the semiconductor device described in claim 1, The edge detection circuit includes a delay element that generates a delay corresponding to the predetermined pulse width, The predetermined pulse width is set to be large enough to change the output of the subsequent counter regardless of the holding state of the subsequent counter.
4. In the semiconductor device described in claim 1, The edge detection circuit is A first delay element that generates a delay corresponding to the predetermined pulse width based on the edge of the output of one of the two pre-counter stages, A second delay element that generates a delay corresponding to the predetermined pulse width based on the edge of the output of the other of the two preceding counters, An OR gate outputs the logical OR of the pulse generated by the first delay element and the pulse generated by the second delay element as the second pulse. It is equipped with.
5. In the semiconductor device according to claim 1, The edge detection circuit includes a delay element that delays and inverts the output of one of the two pre-counters, and outputs the exclusive OR of the output from the delay element and the output from the other of the two pre-counters as the second pulse.
6. In the semiconductor device according to claim 1, The aforementioned counter circuit is a multi-bit counter.