# Security Implications for Ultra-Low Power Configurable SoC FPAA Embedded Systems
## 5 FPAAs for Unique Functions
Figure 6 shows the effective circuit to analyze for the unique function block, the circuit one would see for each FG switch current source (M1) in the chosen sequence. The CABs have a compiled nFET current mirror, and other element are switch elements. Further stages threshold the output signal, as well as communicate the signal, to other on- or off-chip digital components. Figure 5: Example of generating unique functions for secure codes implemented in an SoC FPAA. The approach is based on device mismatch, typical of other digital and analog implementations. Threshold Voltage (\(\Delta V_{T0}\)) mismatch at a chosen locations in nearly one million FG devices gives the resulting code. The resulting outputs, scanned through shift registers available throughout the IC, would be thresholded to yield a digital code. The FG elements would be programmed to bias the resulting code as desired, modulating the mismatch pattern. Typically, one would program all elements to the same current to bring out the mismatch pattern (e.g., [3]). The programmed values would be retained for the operation of the FPAA IC, showing \(\mu\)V shift over a typical 10-year lifetime. The balanced structure means, within the W/L mismatch of the nFET and pFET threshold currents, effects of supply are negligible, as well as other chip-global environmental effects. FG charge directly account for threshold voltage differences. We get a common-source circuit topology where the gain and logical threshold is independent of temperature [45]. The circuit is symmetric with matching components. The potential combinations offer many opportunities for secure circuits build around, or hidden by, the core system functionality. The two transistors from the CAB nFET current mirror are drawn identical. All of the switch transistors are drawn identical. Two switches, which are same layout (one from a group of devices), and two nFET devices which are identical. The particular ones could be anywhere on the chip, large number of combinations. Capacitors ( C ) into the FG match; the potential connected to it has minimal effect, whether GND or intermediate voltage typical for temperature resistant circuits (e.g., [45]). Source voltages are tied to \(V_{dd}\) or GND, the same as their substrates, and therefore has no effect in this circuit. The FG voltages, \(V_{fg1}\) and \(V_{fg2}\) are just set by programming. One can analyze the resulting supply and temperature effects on the circuit in Figure 6. The MOSFET transistor model for subthreshold and near-threshold channel current (I) in saturation as a function of source (\(V_{s}\)), drain (\(V_{d}\)), and gate (\(V_{g}\)) voltages is [45]  
\[I=I_{th}e^{(\kappa(V_{g}-V_{T0})-V_{s}+\sigma V_{d})/U_{T}} \tag{1}\]  
where \(\kappa\) and \(\sigma\) are the gate and drain to surface potential coupling, respectively. \(I_{th}\) is the current at threshold, \(V_{T0}\) is the threshold voltage, and U\({}_{T}\) is kT/q or the thermal voltage (25.8 mV). \(V_{T0}\) is typically a combination of a constant term due to charge and barrier differences and an nFET or pFET proportional to U\({}_{T}\). \(\kappa\) and \(\sigma\) are weak functions of temperature (e.g., \(<\)200 ppm/C), and \(I_{th}\) is a weak power law between 0 and 1/2 of temperature. Solving KCL around \(V_{1}\) and \(V_{out}\), we get  
\[\kappa_{n}(V_{1}-V_{T0n3})+\sigma_{n}V_{1} =\kappa_{p}(V_{dd}-V_{fg2}-V_{T0p2})+\sigma_{p}(V_{dd}-V_{1})\] \[\kappa_{n}(V_{1}-V_{T0n4})+\sigma_{n}V_{out} =\kappa_{p}(V_{dd}-V_{fg1}-V_{T0p1})+\sigma_{p}(V_{dd}-V_{out}) \tag{2}\]  
Subtracting these two terms, we get the large signal solution for M1, M2, M3, and M4 in saturation as  
\[V_{out}=V_{1}+\frac{\kappa_{p}(V_{fg2}-V_{fg1}+V_{T0p2}-V_{T0p1})-\kappa_{n}( V_{T0n3}-V_{T0n4})}{\sigma_{n}+\sigma_{p}} \tag{3}\]  
Figure 6: Effective circuit diagram and the PVT analysis for the unique function circuit. The Volatile switch line set to \(V_{dd}\) for this circuit. All transistors are drawn identical. The FG voltages, \(V_{fg1}\) and \(V_{fg2}\) are set by programming.