A Fully Integrated UHF Passive Tag IC Having One-Time Programmable Memory in Standard CMOS Technology

Vinh Hao Duong, Ngoc Dang Phan, Hyun-Sik Lee, Dasom Park, and Jong-Wook Lee

School of Electronics and Information Kyung Hee University, Suwon, 446-701, Korea,

jwlee@khu.ac.kr

Abstract

We present a 2-Kb one-time programmable (OTP) memory for high security RFID applications. The OTP memory cell is based on a two-transistor (2-T) gate-oxide anti-fuse (AF) for low voltage operation. Improved low power circuit design techniques are used including auto shut-off for program mode and self-timed control for read mode. The designed OTP is successfully embedded into a UHF passive RFID tag IC that conforms to the EPCglobal Gen-2 standard. The tag chip was fabricated in a 0.18 m 1-poly 6-metal standard CMOS process with no additional masks.

Keywords- Tag IC; UHF-band; one-time programmable memory; energy harvesting; CMOS

Introduction

The potential of radio frequency identification (RFID) for automotive information gathering and processing has been recognized for several decades. Recently, there has been growing interest in UHF-band (860-960 MHz) RFID due to its ability to work in a convenient operation range. To store information needed for item identification, non-volatile memory (NVM) is required for its passive RFID operation. In conventional RFID tag IC [1], NVM is usually implemented by using EEPROM. However, EEPROM requires additional masks and optional process leading to increased cost. Also, the data in EEPROM can be falsely modified by electrical tools, thus suffers from reliability problem not suitable for applications requiring high data security.

To meet these security requirements, one-time programmable (OTP) memory, based on a gate-oxide anti-fuse programming method, is a good candidate. Because of its physical change in the gate-oxide, OTP memory provides excellent data security preventing false data modification. Previous works used a three-transistor (3-T) anti-fuse (AF) [2]. However, the read and program currents are very large (~ 1mA) and hence not suitable for RFID tag ICs.

In this work, we present a fully integrated UHF passive tag IC having one-time programmable memory. To support high security low cost RFID applications, we use a two-transistor (2-T) anti-fuse (AF) in the OTP memory. For low power operation, the read/write logic of the OTP memory is designed using improved power saving techniques. To demonstrate the application of the OTP memory, we present measured data

from a fully integrated UHF passive RFID tag IC.

Tag chip architecture

Fig. 1 shows the analog part of UHF-band RFID tag chip system supporting UHF near-field operation. Digital control layer based on the UHF Gen-2 protocol interfaces the analog part. The power management of the analog block includes voltage multiplier, RF limiter, and regulator. The voltage multiplier recovers DC power from a small incident RF signal and regulated voltage is supplied to the entire tag chip.

Fig. 1. Circuit blocks tag IC.

The digital control block of the RFID tag was designed in accordance with EPCglobal Gen-2 standard. To achieve low power operation in the digital control part, several strategies are implemented. The major considerations for low power design focus on minimizing the activity of unnecessary block during the sequential command processing. We use latch-based clock gating for controlling power to inactive blocks. By using the latch, the glitches in the gated clock are removed and correct gating is ensured. Also, we design variable clock frequency optimized as slow as possible for each of the function blocks. Finally, we use three different clock frequencies: 1.92 MHz (main clock) for the pulse-interval-ending (PIE) decoder to minimize tag backscatter rate error, 240 kHz clock for the periphery processing module (random generator, memory control interface, etc), and an encoding clock from 40 kHz to 640 kHz for data encoder.

OTP memory design

,((( ,62&&

Fig. 2 shows the 2-T memory cell composed of an access transistor (AT) using thick-oxide (for reliability during programming) in series with a thin-oxide anti-fuse (AF). Before programming, the AF can be modeled as a capacitor. It changes to a resistor after gate oxide breakdown, representing two memory states. Fig. 3 shows a functional block diagram of the OTP memory. The OTP is composed of a 2-Kb memory cell array and other periphery blocks such as word-line decoders, a high voltage (HV) multiplexer, read/program logics, decoder, control logic, and a high voltage generator. The word-line decoder selects one of 16 rows by decoding the row address ADR [6:3]. For each power word line PWL [15:0], three different voltages (VPP=6.6 V, VDD=1.8 V, and 0 V), depending on operating mode, are supplied to AF cells by the HV multiplexer. The column MUX selects one of eight bit-lines using column address ADR [2:0]. During the read mode, the sense amplifier detects the current in the selected bit-line and reads a word of data through DOUT [15:0]. Depending on the operation mode, the R/W control logic provides internal signals: CP_EN to enable the high voltage generator in program mode, SA_EN to enable the sense amplifier, and LAT_EN to allow data storage from the sense amplifier. The WL driver selects one of 16 rows in the cell array. In read mode, the voltage level of row word line (RWL) is the same as VDD. In the program mode, an intermediate voltage VBT = 3.3 V is applied to RWL.

Fig. 2 Circuit schematic and layout of OTP memory cell.

Fig. 3 Block diagram of proposed OTP memory.

Due to the process variations, actual time-to-breakdown TBD may vary between programmed memory cells. With a fixed program time, much power is wasted in memory cells with relatively short TBD since the short-circuit current flows through these cells. To alleviate this problem, we propose an auto shut-off technique where the program time is adaptively decided. As shown in the program logic of Fig. 3, the auto shut-off controller contains a current sensor, a timer, and

control logic. In the auto shut-off program mode, the program operation starts at the rising edge of the PRGM signal, and the current sensor and timer determine the program completion time. When AF is broken, a large current flows through the memory cell. The current sensor detects such current flow and enables the output signal. Then, the timer waits for a predefined period (350 ns) and activates the current limiting function using a transistor switch. Such an approach effectively limits the time duration when short-circuit current flows in the AF, reducing unnecessary power dissipation during programming. After all cells have been broken, the auto shut-off circuit disables PWL and terminates the program operation.

High voltage generator

In addition to VPP needed for AF breakdown, we use an intermediate voltage VBT =3.3 V to protect AT. These voltages are generated using the high voltage generator shown in Fig. 4(a). The high voltage generator includes two charge pumps (4-stage and 2-stage), two switches (VPP / VBT and VBT / VDD), timing control, and a ring oscillator. The ring oscillator is used to generate clock for the charge-pump. The charge pumps use thick-oxide transistors to generate VPP = 6.6 V and VBT = 3.3 V, respectively. Output of the charge pump is regulated by gated-clock regulation loop. The timing control arbitrates the two switches. At the beginning of programming operation, VBT_EN is enabled and VBT is switched to 3.3V for a pre-defined time before VPP is ramped up to 6.6 V. At the end of programming, VPP is discharged to VDD before VBT is switched to VDD. In this way, we can maintain reliable voltage in AT during programming operation. To reduce the peak charge current, variable clock is used in the high voltage generator.

Ringoscillator

4-stage charge pump

Gated clock regulation

2-stage charge pump

Gated clock regulation

VBT / VDDswitch

VPP / VBTswitch

Time control

&3B(1

IREF&/.

&/.B*$7(

&/.B*$7(

VPP_CP

VBT_CP

VPP

VBT

VDD

VBT

933B(1

9%7B(1

933B/$7

9%7B/$7

VREF

9%7B(1

: 2

933B(1

(a)

VDD

VOUT

01

01

01

01

01

01

01

01

01

&/.

&/.

& & & &

& & & &%&/.

%&/.

IOUT

(b) Fig. 4 (a) Block diagram of high voltage generator. (b) Schematic

of the proposed charge pump.

In order to boost voltage without reducing the threshold voltage or adding extra switches, we propose a new charge pump having additional bootstrap branch, as shown in Fig.

,((( ,62&&

NhannguyenHighlight

4(b). The charge pump uses thick-oxide transistors to generate VOUT 6.6 V. The charge transfer in the main branch is performed by MN1-MN4 with capacitors C1-C4. The bootstrap branch is comprised of transistor MN5-MN8 with capacitors C5-C8. Only the main branch transfers the charges to the output. Since the bootstrap branch controls the gate of the main branch, the loading of this bootstrap branch is very low. Therefore, the transistor and capacitor sizes are kept as small as possible to reduce the area and power consumption. The clock frequency is 3.5 MHz, which is generated by on-chip ring oscillator. CLK1 and CLK2 have opposite phases and have amplitude VDD. The bootstrapped clock signal BCLK1 has the same phase as CLK1 (BCLK2 is in the same phase as CLK2); however, its amplitude increases to 2VDD by the bootstrap circuit

To switch the HWL between 1.2 and 6 V in programming mode, a high voltage (HV) multiplexer with zero static current is used (Fig. 5). The HV multiplexer use a cross-coupled high voltage latch with thick-oxide transistors. The nominal operation voltage for thick oxide transistor is 3.3V. In order to remove the stress problem when applying high voltage to the transistors, two transistors are stacked to withstand the high voltage.

Fig. 5. Schematic of the proposed HV multiplexer.

Tag chip and measured data

Fig. 6 shows the layout and microphotograph of the fabricated 2-Kb OTP memory using a 0.18 m 1-poly 6-metal standard CMOS process. To protect the core circuit from ESD, 3.3 V interface I/O cells provided by foundry are used. The total area of the chip including the I/Os and bonding pads is 1.8 1.7 mm2 where the OTP memory occupies 425 320 m2.

(a) (b) Fig. 6. (a) Layout and (b) photograph of the fabricated OTP memory.

Fig. 7(a) shows the measured transient response of the high voltage generator with 6.6 A load current on VPP. A pattern generator (PI-11008) is used to generate the PRGM control signal. By using gated-clock regulation, the high voltage

output VPP is 6.65 V with a small voltage ripple. The start-up time (from VDD to VPP) required for switching power in program mode is 67 s. Fig. 7(b) shows the measured results in program mode. The drop in VPP indicates that the OTP memory cells have been broken successfully.

(a)

(b) Fig. 7. (a) Measured results of the high voltage generator (b) Measured programming operation.

Fig. 8 shows the measured results in read mode. By switching the address input, the reading programmed cell, then reading un-programmed cells, shows that the read logic control and sense amplifier work correctly. As can be observed, the read access time is 50 ns at 1.8 V, and the sense amplifier can be sensed in a short time about 20 ns.

Fig. 8. Measured results in read mode with both programmed and un-programmed cells.

A fully integrated UHF passive RFID tag IC with OTP memory was also fabricated and tested. Fig. 9 shows the layout of the UHF-band RFID tag IC including OTP memory. The total area of the chip including I/O and bonding pads is 2.3 1.5 mm2 where OTP memory occupies 0.43 0.31 mm2. The analog part of the tag IC includes a rectifier, regulator, bandgap reference, demodulator, and modulator [4]. Half of chip area is consumed by storage capacitor of 500 pF. A signal generator (SMIQ) and pattern generator (PI-11008) are used to

,((( ,62&&

provide an RF signal with Gen-2 command modulation. The modulation index is set to 90%. Fig. 10 shows the measured results of the tag response for the Query and ACK commands [6]. The result shows the successful operation of the tag IC, generating RN16 signal and PC+EPC+CRC-16 data from OTP memory.

Fig. 9 Layout of UHF-band RFID tag chip with OTP memory using 0.18 m standard CMOS process.

Backscatter Backscatter

Query ACK

RN16 PC+EPC+CRC-16

Modulator enable

Fig. 10 Measured response of the tag IC for a series of reader commands.

Table I shows the performance summary of the OTP memory in comparison with designs from other works. The current consumption is used to compare the overall performance of the OTP memory for RFID applications. Better performance is indicated by lower power consumption. Our design uses single VDD in read mode and achieves an access time significantly reduced compared to [3]. The EPPROM in [5] achieved 35 ns access time; however, it consumes large power in program mode; our work uses the lowest voltage (~ 6 V) during programming mode, thus suitable for low powerRFID applications. A recent study [3] realizes a fully integrated EPC Gen-2 tag IC using the standard CMOS process. This study uses a three-transistor (3-T) OTP memory cell, the size of which is larger than the two-transistor (2-T) cell used in our study. Furthermore, the small size (128 bit) of the OTP memory is not enough to implement the advanced encryption standard (AES) algorithm [4]. Our tag IC contains 16x more memory (2 Kb) than [3], and our work requires similar power during the read operation. These results suggest that our work is competitive compared to EEPROM in terms of power consumption and access time. With the proposed various low power design techniques, our approach using gate-oxide AF in

standard CMOS shows great potential to meet the low cost and high security RFID requirements.

Table I. Performance comparison with non-volatile memories.

[5] [2] [3] This work

Process 0.35 m

EEPROM

0.18 m

standard

0.18 m

standard

0.18 m

standard

Cell type EEPROM 3-T OTP 3-T OTP 2-T OTP

Memory size 2-Kbit 32-Kbyte 128-bit 2-Kbit

Programming voltage Internal External Internal Internal

Supply

Voltage

Read 1.5 / 2.5 / 3.3 V 1.8 V 1 / 1.8 / 3.5 V 1.8 V

Program 1.5 / 2.5 / 15.5 V 1.8 / 3.25 /

15.5 V 1.8 / 3.5 /

7.8 V 1.8 / 3.3 /

6.6 V

Current

consumption

Read 40 A 1.1 mA 1.66 A 17.5 A

Program 250 A 170 mA NA 58.5 A

Access time 35 ns 150 ns 1.6 s 50 ns

Auto shut-off No No No Yes

Acknowledgment

This work was supported in part by the Mid-career Researcher Program (No. 2012-001327) and in part by the Basic Science Research Program (2011-0021309) through National Research Foundation (NRF) grant funded by the Korea government. The chip fabrication and CAD tools were made available through the IC Design Education Center (IDEC), Korea.

References

[1] R. Barnett and J. Liu, An EEPROM programming controller for passive UHF RFID transponders with gated clock regulation loop and current surge control, IEEE J. Solid-State Circuits, vol. 43, no. 8, pp. 1808-1815, Aug. 2008.

[2] H. K. Cha, et al., A 32-KB standard CMOS anti-fuse one-time programmable ROM embedded in a 16-bit microcontroller, IEEE J. Solid-State Circuits, vol. 41, no. 9, pp. 2115-2124, Sep. 2006.

[3] J. Yin, et al., , A system-on-chip EPC Gen-2 passive UHF RFID tag with embedded temperature sensor, IEEE J. Solid-State Circuits, vol. 45, no. 11, pp. 2404-2420, Nov. 2010.

[4] J.-W. Lee, et al., A fully integrated HF-band passive RFID tag IC using 0.18 m CMOS technology for low cost security applications, IEEE Trans. Ind. Electron, vol. 58, No. 6, pp.2531-2540, June 2011.

[5] S. Liu, C. Zou, F. Zhang, and M.Deng, New design of EEPROM memory for RFID tag IC, IEEE Circuits and Devices Magazine, vol. 22, no. 6, pp. 53-59, Dec. 2006.

[6] EPCglobal, EPC radio-frequency identity protocols Class-1 Generation-2 UHF RFID air interface Ver. 1.2.0, 2008.

,((( ,62&&

/ColorImageDict > /JPEG2000ColorACSImageDict > /JPEG2000ColorImageDict > /AntiAliasGrayImages false /CropGrayImages true /GrayImageMinResolution 200 /GrayImageMinResolutionPolicy /OK /DownsampleGrayImages true /GrayImageDownsampleType /Bicubic /GrayImageResolution 300 /GrayImageDepth -1 /GrayImageMinDownsampleDepth 2 /GrayImageDownsampleThreshold 1.50000 /EncodeGrayImages true /GrayImageFilter /DCTEncode /AutoFilterGrayImages false /GrayImageAutoFilterStrategy /JPEG /GrayACSImageDict > /GrayImageDict > /JPEG2000GrayACSImageDict > /JPEG2000GrayImageDict > /AntiAliasMonoImages false /CropMonoImages true /MonoImageMinResolution 400 /MonoImageMinResolutionPolicy /OK /DownsampleMonoImages true /MonoImageDownsampleType /Bicubic /MonoImageResolution 600 /MonoImageDepth -1 /MonoImageDownsampleThreshold 1.50000 /EncodeMonoImages true /MonoImageFilter /CCITTFaxEncode /MonoImageDict > /AllowPSXObjects false /CheckCompliance [ /None ] /PDFX1aCheck false /PDFX3Check false /PDFXCompliantPDFOnly false /PDFXNoTrimBoxError true /PDFXTrimBoxToMediaBoxOffset [ 0.00000 0.00000 0.00000 0.00000 ] /PDFXSetBleedBoxToMediaBox true /PDFXBleedBoxToTrimBoxOffset [ 0.00000 0.00000 0.00000 0.00000 ] /PDFXOutputIntentProfile (None) /PDFXOutputConditionIdentifier () /PDFXOutputCondition () /PDFXRegistryName () /PDFXTrapped /False

/CreateJDFFile false /Description >>> setdistillerparams> setpagedevice