Flip-chip BGA (ball grid array) implementation offers advantages such as shorter signal wires and a smaller footprint compared to conventional wire-bonding face-up packaging technology. These characteristics are also well-suited for advanced packaging technologies such as 2.5D or 3D packaging. Si-substrate backside of IC chips are open and exposed in flip-chip packaging. In the context of hardware security, attackers can access to the backside of an IC chip easily and use the Si-substrate backside as a contact point for fault injection and side-channel attacks. In this paper, we show that high voltage pulsing (HVP) injection over Si-substrate backside could be a serious threat as IC chips become thinner for low profile and chip stacking. First, using simulations comparing injection from the frontside and from the backside, we show that the HVP injection from the backside has the characteristic ability to induce faults in targeted circuits over a small area and explain the physical mechanism behind this ability. It is also shown that this ability becomes more pronounced as IC chips become thinner. Secondly, we prepare a Si prototype chip and confirm this characteristic ability by experimental results. It is shown that HVP over Si-substrate backside can target flip-flops (the size of each flip-flop is about $13 \mu \mathrm{m}$ times $3 \mu \mathrm{m}$) in the area with an accuracy of about $50 \mu \mathrm{m}$ times $50 \mu \mathrm{m}$ and reproducibly causes bit flips associated with the targeted bytes. Finally, the threat of this attack is demonstrated by performing differential fault analysis (DFA) on AES-128bit and obtaining entire secret key bytes.

Circuits for cryptography are vulnerable to side-channel (SC) attacks. Masking is a countermeasure which splits secrets into random shares. It is provable secure under the assumption that physical leakage of each share is independent of each other. For a secure implementation of masked circuits, this independency assumption must be satisfied after layout. A transistor-level simulator such as SPICE produces analog waveforms that are sufficiently trustworthy to verify timing accuracy. Due to this accuracy, SPICE is expected to be useful for SC leakage verification after layout. However, we demonstrate that the statistical variation of the power noise amplitude in SPICE simulation is not always correct and varies a lot for SC evaluation. We believe it results from the internal time-step creation optimized for efficiency. It causes false-positives in the verification of security order. A small nonlinear function with a domain-oriented masking scheme is used to demonstrate these SPICE-simulation anomalies.

Cryptography hardware is vulnerable to side-channel (SC) attacks on power supply current flow and electromagnetic (EM) emission. This article proposes simulation-based power and EM side-channel leakage analysis (SCLA) techniques on a cryptographic integrated circuit (IC) chip in system level assembly. SCLA measures SC leakage metrics including T-score, SC leakage score, and the number of measurement traces to disclosure, leveraged by a secure system-on-chip design flow toward SC attack resiliency and SC leakage sign off. Power SCLA features the tracking of security sensitive registers within cryptographic logic paths and the automatic assignments of probe points on associated physical power nets. Power supply current traces are efficiently simulated for the large set of input payloads, with direct vector-based and vector-less random switching controls. EM SCLA evaluates magnetic fields created by every piece of metal wiring in metal stacks where power supply current of cryptographic processing flows. The EM emission and EM SCLA from the backside Si surface of an IC chip in flip-chip packaging are experimentally examined with a 0.13 μm test chip. The proposed simulation-based SCLA exhibits the SC leakage metrics of on-chip location and direction dependency as accurately as in the measurements.

Secure hardware systems are threatened by adversarial attempts on integrated circuit (IC) chips in a practical utilization environment. This article provides overviews of physical attacks on cryptographic circuits, associated vulnerabilities in an IC chip, and protection schemes in the vertical unification of systems, circuits, and packaging technologies. The design principles of on-chip monitoring circuits to sense the attackers’ attempts are discussed and tested with Si demonstrators. Physical structures are explored for secure IC chips to establish protections against multimodal side-channel attacks. The backside buried metal (BBM) wirings in a Si substrate are unified with its frontside complementary metal–oxide semiconductor (CMOS) circuits to achieve avoidance, detection, and resiliency against electromagnetic and laser attacks.

On-chip monitor (OCM) circuits capture dynamic power-supply (PS) waveforms within power domains individually bounded by dedicated micro voltage regulator modules (μVRMs). This paper uses OCM to diagnose VLSI circuits with a modular power management, where the evolution over time of the gate switching count, in the clock tree, the flip-flops, and the combinational logics are precisely captured in the OCM voltage waveforms. A mismatch between simulation and measurement gives us a warning for either (1) faulty behavior in the IC hardware, or (2) bugs in the test program. In this paper, we demonstrate an IR-drop-based toggle diagnosis technique using OCM for a prototype chip in 180 nm technology. The OCM measurements at 100 ps and 100 μV are capable of reaching a resolution of 18.7 fC/gate. This is approximately equivalent to the amount of charge consumed by a single two-input NAND gate.

This study investigates a new side-channel leakage observed in the inner rounds of an unrolled hardware implementation of block ciphers in a chosen-input attack scenario. The side-channel leakage occurs in the first round and it can be observed in the later inner rounds because it arises from path activation bias caused by the difference between two consecutive inputs. Therefore, a new attack that exploits the leakage is possible even for unrolled implementations equipped with countermeasures (masking and/or deglitchers that separate the circuit in terms of glitch propagation) in the round involving the leakage. We validate the existence of such a unique side-channel leakage through a set of experiments with a fully unrolled PRINCE cipher hardware, implemented on a field-programmable gate array (FPGA). In addition, we verify the validity and evaluate the hardware cost of a countermeasure for the unrolled implementation, namely the Threshold Implementation (TI) countermeasure.

A side-channel attack on a reference-charge flow in successive approximation register (SAR) analog-to-digital converters (ADCs) discloses analog information acquired at a sensor frontend. A random interrupt dithering masks the correlation between analog input and reference charge flow by injecting extremely-large dither of 1/4 full scale. An internal dither-tracking comparator yet guarantees rail-to-rail operation, resulting in no penalty in conversion accuracy. The comparator functions as a physical-random source for dithering. The unpredictable randomness based on comparator metastable operation by thermal noise enhances the security level while the shared use of the comparator reduces the associated hardware overhead. The additional silicon area penalty for the proposed technique is only 7% of an unprotected ADC core area. A 10-bit 1 MS/s secure SAR ADC was fabricated in 0.18 um CMOS. The measurement results demonstrate the proposed secure ADC suppresses the information leakage from 4.6-bit to 0.8-bit against reference-charge side-channel attack.

This article proposes highly efficient Advanced Encryption Standard (AES) hardware architectures that support encryption and both encryption and decryption. New operation-reordering and register-retiming techniques presented in this article allow us to unify the inversion circuits in SubBytes and InvSubBytes without any delay overhead. In addition, a new optimization technique for minimizing linear mappings, named multiplicative-offset, further enhances the hardware efficiency. We also present a shared key scheduling datapath that can work on-the-fly in the proposed architecture. To the best of our knowledge, the proposed architecture has the shortest critical path delay and is the most efficient in terms of throughput per area among conventional AES encryption/decryption and encryption architectures with tower-field S-boxes. The proposed round-based architecture can perform AES encryption where block-wise parallelism is unavailable (e.g., cipher block chaining (CBC) mode); thus, our techniques can be globally applied to any type of architecture including pipelined ones. We evaluated the performance of the proposed and some conventional datapaths by logic synthesis with the NanGate 45-nm open-cell library. As a result, we can confirm that our proposed architectures achieve approximately 51-64 percent higher efficiency (i.e., higher bps/GE) and lower power/energy consumption than the other conventional counterparts.

I. VLSI Systems: A Glance Into The Last Decades Since their inception in 1970s, VLSI systems have enabled several new technological capabilities and made them accessible to an unceasingly wider range of users, reaching a scale that has been exponentially increasing over the decades[1](seeFig. 1). Relentless integration of more complex systems has driven such remarkable evolution, as made possible by the inexorable miniaturization. As shown inFig. 1, more functionality has been crammed in a consistently smaller form factor, as exemplified by the physical volume shrinking of computers by 100 X/decade[2],[3]. At the same time, the energy per task has been decreasing at 10–100 X/decade, as shown inFig. 2, for several systems and system-on-chip subsystems[4]. This allowed packing more capabilities into the same power envelope, as generally observed in the electronic systems, even before the advent of the integrated circuit[5].

An SR-latch can be regarded as primitive to build a True Random Number Generation (TRNG) or Physically Unclonable Function (PUF). Indeed, when the SR inputs of the latch are tied together and go from an unknown state (i.e. S=R=1) to a memory state (i.e. S=R=0), the behaviour depends on the balance between the NAND or NOR gates composing the latch. With the process mismatch, there is a great chance that the latch converges towards the same state, thus creating a PUF equivalent to a SRAM-PUF or latch-PUF. However, if the latch is well-balanced, it can enter a metastable state and converges to a stable state depending on the input noise, thus making a TRNG. In order to make sure some latches are able to behave like a TRNG, and some like a PUF, we consider a set of latches driven by the same SR signal. A test-chip in 28nm UTBB-FDSOI technology has been designed with 1024 latches in order to analyze the behavior. The FD-SOI technology enables easy change of the performances of gates using the body biasing, which consists in applying a specific body voltage to each gate. Hence, the two NOR gates composing the SR-latch can be tuned individually to get the optimality, i.e. the maximum entropy, for both PUF and TRNG. The results show that the optimal point is the same for both PUF and TRNG, and that the proposed structure can generate concurrently a PUF with high reliability, and a TRNG with high speed.

Laser based Fault Injection (LFI) and Electromagnetic Fault Injection (EMFI) are powerful techniques commonly for fault injection against security critical circuits. Since LFI/EMFI creates faults by incurring high energy disturbances, they can be detected in advance by sensing the disturbance using a embedded detector. In this paper, a PLL based sensor system for detecting laser fault injection is presented. Experiments show a high detection rate, with significant power security margin, whilst maintaining low hardware cost, on multiple FPGA platforms.

Matsuda et al. proposed a countermeasure against laser fault injection that uses distributed on-chip sensors. The sensor raises an alarm by detecting an electrical phenomenon caused in conjunction with a bitflip. A cryptographic module can stop releasing a faulty ciphertext by using the alarm. In this paper, security and limitation of the countermeasure by Matsuda et al. is rigorously evaluated. We show that an attacker can get side-channel information by observing how the sensors react to laser fault injection. That enables the attacker to probe intermediate values in a chip non-invasively. On the one hand, under a chosen-plaintext setting, the laser-based probing enables to run the conventional probing attack on AES by Schmidt and Kim. On the other hand, under a ciphertext-only setting, the laser-based probing raises a new challenge: the attacker is given correct ciphertexts and corresponding single-bit probing results. We propose a new ineffective fault analysis against AES based on linear cryptanalysis that can be used in the above setting.

As I start my second two-year term (2017–2018) as the Editor-in-Chief (EIC) of the IEEE Transactions on Very Large Scale Integration Systems (TVLSI), I wish the TVLSI readership a very happy new year and continued professional success. It gives me great pleasure to report on the state of the journal and our performance metrics. Over the past two years, TVLSI has seen a healthy increase in the number of submissions—from 687 in 2014 to 770 in 2015, and at the time of writing of this editorial, we are at 760 submissions for 2016. We expect the number of submissions for 2016 to cross 800 before the end of the year. TVLSI, therefore, continues to be the premier archival journal for university researchers and industry practitioners in the broad area of VLSI system design.

Electromagnetic injection (EMI) is a powerful and precise technique for fault injection in modern ICs. This intentional fault can be utilized to steal secret information hidden inside of ICs. Unlike laser fault injection, tedious package decapsulation is not needed for EMI, which reduces an attacker's cost and thus causes a serious information security threat. In this paper, a PLL-based sensor circuit is proposed to detect EMI reactively on chip. A fully automatic design flow is devised to integrate the proposed sensor together with a cryptographic processor. A high fault detection coverage and a small hardware overhead are demonstrated experimentally on an FPGA platform.

As a typical semi-invasive attack against cryptographic primitives, laser fault injection (LFI) has emerged as a serious threat for security ICs. However, very few countermeasures against LFI have been proposed in previous literature. In this paper, a logic-level countermeasure for sensing the malicious laser injection on FPGA is presented. The implemented logic consists of a digital inverter ring oscillator (RO) for detecting the frequency disturbance by laser, and a Phase Locked Loop (PLL) to monitor the frequency ripple in RO, for generating an 'alarm' signal. The effectiveness of this countermeasure is validated by a series of laser scan on Xilinx Virtex-5 FPGA. The experimental results show that the detection rate reaches up to 92.82% for protecting the registers in slice, and the countermeasure offers a significant security margin against LFIs.

Combination of a supply-current equalizer (EQ) and a micro EM probe sensor (EMS) exhibits strong resiliency against major three DPA/DEMA/LEMA low-cost side-channel attacks on a cryptographic processor. Test-chip measurements with 128bit AES cryptographic processor in 0.18μm CMOS successfully demonstrate the secret key protection from all three attacks. A digital-oriented circuit implementation together with a careful design optimization minimize the hardware overhead of EQ and EMS to +33%, +1.6% in area, +7.6%, +0.15% in power, and ~0%, -0.2% in performance of an unprotected AES, respectively.

For security-critical applications, the security and trust of devices must be tested before shipping. In this paper, we promote the use of On-Chip Power noise Measurements (OCM), in order to test security using side-channel techniques. We then propose for the first time a standard side-channel measurement setup using OCM. Finally, we provide some key ideas on methodology to integrate the validation of hardware security and trust in the standard testing flow, exploiting OCM.

A side-channel attack exploiting EM-field leakage from a cryptographic processor IC is an existing serious threat to our information society. EM radiation during the IC operation is captured by an EM probe and the correlation to the crypto processing is statistically analyzed to reveal the secret information although it is protected in a software (algorithm) domain. This paper presents a reactive hardware (implementation) domain countermeasure against this EM attack, namely EM attack sensor. An on-chip sensor coil detects EM probe approach and reacts to protect the secret information from the tamper attack. The sensor concept and low-cost digital circuit implementation are reviewed, and the detail of the design-automation methodology highly-compatible to standard EDA tools is presented. A small hardware overhead of the sensor is silicon-proven in an actual 0.18μm CMOS test-chip implementation together with a 128bit AES crypto core. The test-chip measurements demonstrate successful sensor operation against the actual EM probe attack.

Optimal error feedback filters for A/D converters of remote sensors in networked control systems are studied. It is shown that if the transfer function from the quantization error to the output of interest has a minimum phase, then its inverse is the optimal error feedback filter in terms of any kind of norms of errors. For general LTI systems, the design of error feedback filters is formulated as an optimization problem, which can be numerically solved. A design example is provided to demonstrate the effectiveness of our proposed method.

This paper presents an adaptive supply-resonance (SR) suppression scheme at a product testing stage. Dedicated to each product in different assembly forms, an on-chip power-delivery-network analyzer identifies SR frequency and autotunes notch filter for SR noise suppression. The feasibility has been silicon-proven by a prototype demonstration in 0.18μm CMOS successfully.

In this paper, we present an efficient countermeasure against fault sensitivity analysis (FSA) based on configurable delay blocks (CDBs). FSA is a new type of fault attack, which exploits the relationship between fault sensitivity (FS) and secret information. Previous studies reported that it could break cryptographic modules equipped with conventional countermeasures against differential fault analysis (DFA), such as redundancy calculation, masked and-or, and wave dynamic differential logic. The proposed countermeasure can thwart both DFA and FSA attacks based on setup time violation faults. The proposed ideas are to use a CDB as a time base for detection and to combine the technique with Li's countermeasure concept that removes the dependency between FSs and secret data. The postmanufacture configuration of the CDBs allows minimization of the overhead in operating frequency that comes from manufacture variability. In this paper, we also present an implementation of the proposed countermeasure in application-specified integrated circuit, and describe its configuration method. We then investigate the hardware overhead of the proposed countermeasure for an advanced encryption standard processor and demonstrate its validity through an experiment.

The direct radio frequency power injection (DPI) method was extended using on-chip voltage waveform monitoring and built-in self-test techniques. Static random access memory (SRAM) has been chosen as a demonstrator of the extended DPI method and exhibits a higher susceptibility against the lower interference frequency. This response is explained when we consider the time length of the threshold against how long the supply voltage stays lower than the specific voltage determined for a SRAM core. This voltage is also found to be comparable but slightly smaller than the static voltage margin of SRAM cells. In-place measurements using the extended DPI provide an in-depth understanding of the susceptibility and help us to enhance the immunity of VLSI circuits.

An on-chip monitoring technique has realized in place diagnosis of power noise problems. On-chip voltage noise monitor (OCM) circuits are overviewed with some examples of integration in silicon chips. The OCM captures power noise waveforms in a silicon chip and provides the opportunities of diagnosis on unfavorable invisible events within a die. In-band interference of radio-frequency (RF) communication channels by power noise coupling in RF systems-on-chip (SoC) integration, and information leakage through power noise side channels from a cryptographic core are demonstrated.

The tolerance of RF ICs against on-chip in-band interferers is diagnosed from the viewpoints of the quality of wireless channels compliant with LTE standards. The on-chip interferers inevitably propagate from other active circuits like digital backend processors through silicon substrate coupling in the same die of system-level integration. An in-system diagnosis platform of RF ICs presented in this paper relates the impacts of such interferers on the circuit-level response and system-level communication performance metrics. The figures of communication quality at a system level, like EVM, BER and throughput are concurrently evaluated with the strengths of interferers in different forms and at different locations in a silicon chip. The interferers are measured as the in-band signal to spurious power ratio at the output of RF ICs, the magnitude of substrate voltage fluctuations at the proximity of RF ICs, and related with the amount of power current consumed by base-band digital ICs. The tolerance of RF ICs is represented by the maximum strength of on-chip interferers for sustaining prescribed communication performance. The diagnosis system is divided into two parts, (i) a system-level RF simulator handling modulation and demodulation of real communication vectors in LTE format and also enabling hardware connectivity with RF ICs, and (ii) a silicon emulator of on-chip interferers coupled to the RF ICs. A 65 nm CMOS chip incorporates an on-chip arbitrary noise generator, an on-chip waveform capture, and RF IC for LTE receiver front end, and demonstrates the entire diagnosis.

Analog IP cores exhibit a multivariate response to dynamic variations of an operation environment, that are typically represented by power and substrate voltage changes. A testbench provides a silicon area to embed and diagnose custom IP cores with power delivery and substrate networks, where the area is surrounded by on-chip precision waveform capturing and configurable power and substrate noise generation circuits. The coefficients of noise propagation and noise coupling are quantitatively derived for fabless IP cores processed in a target technology, that will be further linked with EDA tooling for the successful adoption of such IP cores in SoC integration.

An on-chip waveform capturing technique demonstrates 8.5 ENOB and 62.7 dB SFDR at 200 Ms/s for analog signals with 25-MHz bandwidth and 2.5 V rail-to-rail offset DC level, suitable for testing and self diagnosis of a mixed-signal chip. The area of 0.004mm2in a 90 nm CMOS chip is only required for the integration of probing front end circuitry, with the help of an efficient discretization algorithm on a digital data processing chain involving on-chip logic paths, an off-chip 8 bit micro controller, and PC. Waveform acquisition at the system throughput of 1.9 transaction/point is achieved, by minimizing the number of slow-speed transactions between external measurement equipments and PC.

On-chip monitors are used in a dual role of dynamically monitoring the behavior of a die as well as verifying EDA tools for integrity in sub-100-nm CMOS SoC designs. This paper describes on-chip measurement techniques of supply noise, delay variation, substrate crosstalk, as well as inter-/intra-circuit operation interferences, along with their usage for verification/calibration of physical-level analysis methodologies. Silicon case studies include dynamic supply and delay variability as well as analog signal deterioration evaluated in 90-nm/180-nm chips.

An on-chip multichannel waveform monitoring technique enhances built-in test and diagnostic capabilities of systems- on-a-chip (SoC) integration. The proposed multichannel monitor includes multiple probing front-end modules and a single shared waveform acquisition kernel that consists of an incremental variable step delay generator and an incremental reference voltage generator, featuring adaptive sample time generation for the operation of a target circuit and unidirectional waveform acquisition flow for area-efficient control. A 16-channel prototype in 0.18-mum CMOS technology demonstrated on-chip waveform acquisition at 40-ps and 200-muV resolutions. Combined on- and off-chip streamed-bit processing achieves background continuous waveform acquisition at 260 ms per single timing point for repetitive signals, while eliminating the integration of on-die high-capacity memory. A 700 mum times 600 mum area was occupied by a waveform acquisition kernel and an additional 60 mum times 100 mum area for each front-end module. The developed on-chip multichannel waveform monitoring technique is waveform accurate, area efficient, and suitable for diagnosis toward power supply and signal integrity in analog and digital circuits in mixed-signal SoC integration.

The design of compact noise detector circuitry that could be embedded and arrayed within a high-density large-scale digital circuit was demonstrated. In-depth characterization of dynamic power-supply and ground noises by the built-in noise detection technique can validate and/or calibrate dynamic power-supply analysis (IR drop) methodologies that are becoming requisite to nanometer scale digital integrated circuits.

A substrate-coupling equivalent circuit can be derived for an arbitrary guard ring test structure by way of F-matrix computation. The derived netlist represents a unified impedance network among multiple sites on a chip surface and allows circuit simulation for evaluation of isolation effects provided by guard rings. Geometry dependency of guard ring effects attributes to layout patterns of a test structure, including such as area of a guard ring as well as location distance from the circuit to be isolated by the guard ring. In addition, structural dependency arises from vertical impurity concentrations such as p+, n+, and deep n-well, which are generally available in a deep-submicron CMOS technology. The proposed simulation based prototyping technique of guard ring structures can include all these dependences and thus can be strongly helpful to establish isolation strategy against substrate coupling in a given technology, in an early stage of SoC developments

Issues related to substrate noise in system-on-chip design are described including the physical phenomena responsible for its creation, coupling transmission mechanisms and media, parameters affecting coupling strength, and its impact on mixed-signal integrated circuits. Design guidelines and best practices to minimize the generation, transmission, and reception of substrate noise are outlined, and different modeling approaches and computer simulation methods used in quantifying the noise coupling phenomena are presented. Finally, experiments that validate the modeling approaches and mitigation techniques are reviewed

The multi-channel waveform monitoring technique enhances the built-in test and diagnostic capability of mixed-signal VLSI circuits. An 8-channel prototype system incorporates adaptive sample time generation with a 10-bit variable step delay generator and algorithmic digitization with a 10-bit incremental reference voltage generator. The prototype, in a 0.18-/spl mu/m CMOS technology, demonstrated on-chip waveform acquisition at 40-ps and 200-/spl mu/V resolutions. The waveforms were as accurate as those by an off-chip measurement technique, while more than 95% reduction of the waste time in waveform monitoring was achieved. The area of 700 /spl mu/m /spl times/ 600 /spl mu/m was occupied by a single waveform acquisition kernel that was shared with eight front-end modules of 60 /spl mu/m /spl times/ 200 /spl mu/m each. The developed on-chip multi-channel waveform monitoring technique is waveform accurate, area efficient, and low cost, which are all requisite factors for a diagnosing methodology toward mixed analog and digital signal integrity in the system-on-chip era.

A Transition Controllable Noise Source (TCNS) generates substrate noises with controlled transitions in size, interstage delay, and direction. The noises are measured in a 100-ps 100-uV resolution by a linear substrate voltage detector that uses a front-end PMOS source follower probing substrate potential and a back-end latch comparator for sampling/digitizing the source follower output. A 0.4-um CMOS test chip demonstrates the effectiveness of these circuits in performing advanced researches on the substrate noise.

This paper describes a clustering algorithm for vector quantizers using a “stochastic association model”. It offers a new simple and powerful soft- max adaptation rule. The adaptation process is the same as the on-line K-means clustering method except for adding random fluctuation in the distortion error evaluation process. Simulation results demonstrate that the new algorithm can achieve efficient adaptation as high as the “neural gas” algorithm, which is reported as one of the most efficient clustering methods. It is a key to add uncorrelated random fluctuation in the simi- larity evaluation process for each reference vector. For hardware imple- mentation of this process, we propose a nanostructure, whose operation is described by a single-electron circuit. It positively uses fluctuation in quantum mechanical tunneling processes.

No abstract available.

Substrate crosstalk modeling and analysis tec hniques for a reliable SoC oriented mixed signal IC design are outlined.Substrate noise measurements b y use of a source follo w erand a latc hed comparator clearly indicate that L 1 di=dt and R 1 i eects on Vdd/Gnd wirings appear in the substrate.An experimental full chip substrate crosstalk v eri cation system based on a macroscopic substrate noise model efciently analyzes the analog performance degradation relev an t to the digital activit y on the same chip.

No abstract available.

Analog-digital merged circuit architecture using pulse modulation signals and its application to functional image sensors with parallel focal plane processing are reported. The architecture is based on switched current integration and time domain charge-to-pulse conversion techniques. Parallel analog calculations such as add/sub and multiply/add are realized with low supply voltage and low power dissipation utilizing deep-sub /spl mu/m CMOS technologies. A functional CMOS image sensor which realizes parallel PWM readout, block averaging for gray scale image data, and simple pattern detection, and calculations for x- and y-projections and centers of gravity of binary image data, is proposed. A functional image sensor test chip with 56/spl times/56 pixels was fabricated in a 6 mm/spl times/6 mm chip with a 0.8 /spl mu/m CMOS technology is described.

A transition-controllable noise source is developed in a 0.1-/spl mu/m P-substrate N-well CMOS technology. This noise source can generate substrate noises with controlled transitions in size, interstage delay and direction for experimental studies on substrate noise properties in a mixed-signal integrated circuit environment. Substrate noise measurements of 100 ps, 100-/spl mu/s resolution are performed by indirect sensing that uses the threshold voltage shift in a latch comparator and by direct probing that uses a PMOS source follower. Measured waveforms indicate that peaks reflecting logic transition frequencies have a time constant that is more than ten times larger than the switching time. Analyses with equivalent circuits confirm that charge transfer between the entire parasitic capacitance in digital circuits and an external supply through parasitic impedance to supply/return paths dominates the process, and the resultant return bounce appears as the substrate noise.