So, we start with the oscillators quickly today, last time I was talking of an oscillations and I gave a criteria which is called Barkhausen criteria which says the loop gain should have a value equal to 1, either it should have a magnitude equal to 1 and paged accordingly or paged imaginary quantity may be 0 and only real tj omega may be only real value ok. If that occurs we say that oscillations we start or sustained. The first of that version I said that you have a phase shift oscillator basically we want 180 degree phase shift from the network feedback network and we need 180 will come from the transistor. So, this is the first of the series of oscillators which we use this is for discrete transistor this RSCS is of course a bias network. So, just forget about it this is the load and I have 3 RC ladder network kept here and the output of the final RCR is fed back to the gate of the transistor. So, obviously you can see the voltage drop across this R which is nothing but this is remember this is my V0 and this is my Vf the whatever is voltage here is returned to this. Now, the criteria for oscillation should be that this RCR should each should give you 60 degree phase shift is that correct. So, 3 of them will give how 180 degree phase shift 180 will come from transistor. So, total feedback will be 360 degree in phase is that correct in phase. So, if I want if the return is in phase oscillation builds and that is what the circuit is about. Please remember drop across this R is Vf. So, this is the equivalent circuit gm Vgs. Vgs is the gate and I right now assume which is very fair in case of MOSFET that the input impedance of MOSFET is infinite. Though it is not really infinite but it is good enough for infinite.  So, nothing great about R0 parallel Rd is the guy I call Rd dash and then this is a phase shift network. How do I adjust 60 degree for any CR network? The impedance of a CR is how much 1 upon CS plus R the tan inverse imaginary by real value is the phase. So, adjust your RC value such that it gives you a phase of 60 degree is that okay the point just simple RC and you find that it will give you a phase of imaginary tan inverse or imaginary by real and if I put RC correctly I can get at a frequency of oscillation this value should be equal to 60 degree and if that 60, 60, 60 is attained 180 will be the this. So, I put an equivalent circuit of this which is very simple nothing great we are done n times okay. So, you do not need me to say how it is done and I solve this without I will not show you all of it I use Kishoflah I1 current in this loop I2 in this I3 in this wrote 3 equations for 3 loops okay for this I1 times Rd dash plus 1 upon CS minus I2R is gm Rd dash we get with a minus sign this is first for this loop then for the second loop this equation then for the third loop this equation is that okay simple Kishoflah nothing very serious this is a KBL going to be done at every loop currents are assumed we write 3 equations please remember I1 flows in this but I2 flows in this opposite direction that is why the science okay this you are done in your basic circuit courses. So, there is nothing great about as I say there is no RA there is no source resistance there is that okay. So, if I write these 3 equations and you need now because this is given in Seder Smith you can always and this is a trivial network at the end of the course if you cannot solve this network we will have a problem of the course itself okay. Then the feedback voltage as I already said the drop across the final R you can see from this circuit sorry the current in this I3R is essentially the feedback I3R essentially is the feedback voltage. So, it is I3R is Vf we also know the loop gain this is a feedback circuit. So, loop gain is a well times beta which can be written as V0 by Vgs into Vf by V0 or essentially it is Vf by Vgs I have substituted all that equations 3, 4 equations which I used 4 equations I gave you find values corresponding to all this and you get this which can write now the loop gain TS loop gain is also called return ratio okay some books. So, it is Vf by Vgs which is minus gm Rd dash upon 5 1 minus something something plus j time 1 upon omega Rc q minus 6 times 1 upon omega Rc and I substitute R is S is equal to j omega okay I have substituted S is equal to j omega. Now, what is the Barkhausen criteria we said that the real value being 1 it satisfy all of it okay. So, what does mean if the real value has to be 1 the imaginary quantity must be 0 is that correct the real part is magnitude wise 1. So, the other part must be 0 and if that occurs the condition of under that condition to oscillate 1 upon this term should be 0 which gives me a value of omega 0 as 1 upon root 6 Rc. So, can I now fix my frequency by proper choice of Rc I have my oscillating frequency which is 1 upon root 6 1 into Rc. Now, if I take the magnitude which has to be how much 1. So, I use the magnitude part gm upon Rd dash and substitute this omega 0 back in this I get a term gm Rd dash upon 29 substitute omega 0 here and get transfer function value at omega 0 magnitude is gm Rd dash by minus 29 substitute here omega 0 actually omega 0 by Rc 6 will come from here. So, you will get 29. Now, this so, what is the condition of oscillations to start that gain should be larger than gm Rd dash is actually a physical gain of an amplifier. So, that should be larger than 29 or equal to 29 slightly above 29. So, oscillation can start and be sustained is that ok. So, how do I adjust my gm by choice of bias current the DC or I can also if I am on the integrated circuit I can also choose w bias I can choose the size of the capacitors in this specific case we say only bias current can so, adjust your DC network forget whatever gm you want loads also you can adjust because you know Rd dash will decide the gain ok. So, you can adjust that value as long as this value meets 29 choice of current what you do you may be given Rd dash for example, from there you will calculate gm and for that gm find what is the bias current and go back and bias it properly is that ok the method of design opposite given task to oscillate this must be this go back and find gm and therefore, I that and then given that Rc you choose this will be your oscillation is that ok. So, this is the basic phase shift oscillator which is normally only used in discreet. Why I say not used so much in the integrated circuits but I once said realizing a R on a silicon is large area problem. So, no one wants to use Rc networks as far as possible I do not say never use it as far as possible. So, these are the issues which you all should know what we are talking about there are other oscillators of interest we will quickly go through some of them a very famous oscillator credited to Mr. Vinn which is a Vinn bridge oscillator it consists of an opamp and what is this part is called R1 R2 part which feedback is this negative feedback. So, please remember one important factor which I have not stated very obviously to you there are both possible feedbacks are available negative as well as positive and the balance of the two will decide whether it will grow or it will damp if it was stronger negative feedback what will happen it will damp out or fix a value if it is otherwise it may grow and if you have both of them together we may adjust when to oscillate that is exactly what being tried here. I have a R1 R2 as the open loop gain is one upon since it is a non-inverting amplifier kinds. So, AOL is one upon R2 by R1 and the return voltage is something here which is returned to V plus. So, how do you how do you calculate? Let us say there is two impedance as shown here one is called series resistance series impedance R and C in series the other is parallel impedance which is R parallel C straight for this is in series this is in parallel. So, Zp upon Zp plus Zs is essentially Vp by V0 which is your feedback factor is that okay this voltage by this voltage is essentially the ratio of this upon this plus this. So, how much is Zp parallel combination of the R and C. So, R upon 1 plus Rcs this is series. So, Zs is 1 plus Rcs by S is that okay I can substitute this in the beta factor is that okay what I am going to do what is the condition I am looking for that the imaginary value be 0 and the real value be 1 to get a Barkhausen criteria satisfied. So, I now substitute this here gate AO beta what is AO beta the loop gain and in the loop gain I will find real value magnitude be real one at that frequency and pay imaginary quantity 0 same procedure is always followed. So, I substituted this Zp upon Zp plus Zs into 1 plus R2 by R1 because I write so many steps you can write final step please remember I write because I actually keep solving on the paper I do not actually copy many words. So, I just have to do steps rather I cannot get this expression okay. So, when I substituted all of this correctly Rcs to Rcs I get a term and if I divide by Rcs I get of course sorry that function will 1 upon 3 Rcs plus 1 upon Rcs very straightforward function is obtained. Then what do I do calculate Tj omega and then make imaginary quantity 0 and the magnitude at that frequency where this is 0 I get the Tj omega 0 is unity and fall for both of them that is what I did okay do not fall I mean there is nothing really great I did all that I substituted and got the value from Barkhaism criteria Tj omega should be 1 and hence real and imagine be 0. So, j omega 0 Rc upon plus 1 upon j omega 0 Rc is equal to 0 or omega 0 square R square C square is equal to 1. So, omega 0 is 1 upon Rc or the frequency of oscillation is 1 upon 2 pi Rc is that okay. So, adjusting R and C I can adjust the frequency is that okay. In intermediate circuit how could I have realized R by what method I just did last time there is a filter I created using any time I want a pole is 1 upon Rc. But in opams what how do I get that by getting gm 1 upon R is gm and gm can be attained by what way operational trans conductance amplifier OTAs OTAs give you constant gm for a proportion to currents. So, use this is again same gm upon C. So, it is like same thing which we did if I am realizing on a chip I will prefer to use a OTA there to create gm values okay. So, if I substitute this omega 0 Rc in this function I get 1 plus R2 by R1 1 upon 3 is equal to 1 which gives me a condition that R2 by R1 should be very equal to 1 to start it should be slightly more than 1 because initially noise or some extra value has to be provided. So, choose value of R2 by R1 that is what is the gain I am talking 3 that is the non inverting gain is AOL is 3. If I adjust that I will get oscillations at what frequency 1 upon 2 pi Rc. So, it is a procedure is identical look for circuit find it is Tj omega by AOL and beta that is why we did enough work on feedback why I spend so much time because that is the way all circuits can be easily implemented. I also yes phase is 180 degree see what I say at what is Barkhausen 2 criteria is I should 1 is it should be minus 1 as a value which means magnitude 1 and phase 180 is that clear to you if you look at back your initial Barkhausen criteria we said the magnitude be 1 and phase be 180 because Tj omega minus 1 be 1 but alternatively I suggest if the real value exists at that frequency the imagination be 0 that will give the same value. So, at that frequency yes the impedance is real value that is exactly oscillations oscillations are all imaginary quantities do not lead to any oscillations this is the only procedure I showed you either this or that Barkhausen criteria it satisfies I am using the second criteria most of the time okay. So, okay so we have now beam bridge oscillator we have then phase shift oscillators another oscillator yes yeah this is all sinusoidal oscillators yeah but just think of it the oscillators which we are right now talking are all sinusoidal oscillators okay yeah that is you are perfect you are actually employ this circuit and give a small noise signal of any frequency okay and then you verify that fundamental frequency will come as one upon r is that correct what I have said so it is not that I am talking because I wish to talk these are sinusoidal oscillators and they will be means in fact any noise which is random which may have one fundamental out of that it will actually lead to that value okay at that point here you want to see non-sinusoidal yes they will be coming soon you are interested in both yes we will be interested in where do we interest we are get interested because on digital hardware I am looking for square wheels okay so yes I will like to see what is the sinusoidal to non-sinusoidal conversions okay very good another factor which is of interest other than the RC oscillator what is the problem with RC oscillator I say if I want to increase very high frequencies what should be constrained on R and C they should be very small higher the frequency if you are used in your discrete oscillators or discrete functions in the lab to get a very low value of R have you anytime see its tolerance you see go and look for say less than a ohm resistor probably our lab does not have metal film resistor which are typical than ohms now these tolerances are not less than 10 okay so it is smaller value of R with a reasonable value of tolerance less than 1 percent is very very very very very and therefore one will not like to use normal RC oscillators for higher frequencies is that clear to you it is not that I cannot I can certainly reduce R and get higher frequencies but one of the biggest thing what RC oscillators are giving me I have a range of R and C products okay and I can have number of frequency range I can attain for example just to give in that idea C can be a variable how can make C variables variable capacitor how do I get it a set versus V Nikola the characteristics yeah it's got equal and I'm nickel thing one upon C square V diode so a diode query reverse bias kia so it acts like a variable capacitor so if I have a R and variable capacitors there only guarantee you must say that at least you should have small capacitance already existing and add to this variable capacity no explanation given to you at no time circuit or say we are should I always be broken into two parts okay let's say it doesn't short any time any circuit okay so So there are catches in lab which probably you don't use because you realize that so that's the way life is but anyway so I can use varieties of characters and can get a range of RCs what will be these oscillators called if I have C variable with voltage and frequency will be decided by one upon RC C variable V is a control around voltage these are called voltage controlled oscillators VCOs okay so these are essentially will come back to VCO better that's what that's fine so these when we are always thinking R and R and R so why not look for else okay so we say we can use inductor capacitor combination to realize an oscillator and these are called LCOs there are few things which are relevant to them uh compared to RC oscillators LCOs are higher Q can meaning a higher Q come up Q quality factor in terms of max omega L by R R is the series resistance of inductor is that correct this is something we are saying okay before we go ahead let me show you what I am really talking about this is essentially called a tank circuit or a resonance circuit inductance parallel to a capacitor acts like a resonator or tank circuit how does it work if inductance is ideal and capacitor is ideal initially let's say it has some noise or something picks up something charge on this that half CV square sorry half CV square will be the energy stored if I apply some voltage across this half CV square energy will be stored on the capacitor remove the voltage then it will discharge it through inductor and it will receive half Li square energy here and since it is no dissipation going on this energy will be dissipated back into capacitor and keep doing this infinite times okay this is therefore called resonator okay resonance at and the frequency if I equate impedance for this and I will get 1 upon LC root LC is the frequency at which this will resonate now in real life there is nothing called ideal inductance so if there is a small r situated in series to an inductor then IR will be able to some drop potential drop across which means there will be loss of energy dissipated in the resistor so what will happen every time you charge it back some energy will be lost so as if oscillation will start damping down okay so our eye this is essentially we say energy dissipation factor is called the quality factor and therefore if r is 0 which is ideal how much is the Q for this infinite so larger the Q better is the time circuit that means the frequency response will be something like this sharper response at a given frequency is that correct ideally where it should be go to infinite okay at that frequency only it should have value other places no value but that may not occur in real life it may have some narrow band in which it will rise and fall okay and the maximum will occur at resonating frequency so is that point clear to you so LC tank circuit or LC resonator circuit is the best way to create oscillations the only problem as I said that since going to lose some energy it must be replenished all that we are saying is replenish replenishment of lost energy and if that happens oscillation will be sustained is that clear oscillations will be sustained jitna energy upna dhona so permanently LC oscillators is that clear to you this is the trick which we are following all LC oscillators so that is what I was saying to you it has a very high Q 1 upon omega RC omega L by R and therefore since inductance will vary from very small to very high inductance can be as low as femtohenry's or at least nanohenry's or below picohenry's actually the resistance come karnatur inductance ka kya karne se resistance come what should be the type of inductance I should be type means inductance is generally wire wound okay so wire ka kya property hai jo resistance come karega thicker wire is that correct so if you are using a thicker wire area is higher obviously its resistance is lower so if you have seen a transformer you see how wires they actually wound okay because of very low inductances they want there okay so because inductance values can be minimized and capacitance for a diode or any other can be at least go to femtoferrate we have seen in mass time this is how much capacitance I could go down up to femtoferrate so I have very large frequency operation possible with LC oscillators so is that clear why not RC people always ask this question that when RC was doing so great a job so simple a job why are we looking for an LC network at all the reason is obviously at much higher frequency of operation the problem is low dissipations and very high frequency operation the only difficulty it will give is at one frequency it will operate tank circuit which what it means is bandwidth related to where up to which it can give frequency will be limited in RC you have wide range of frequencies at a moment is that clear that is the advantage which RCs provide over LCs therefore we say tunability is very small but it does not matter it gives a very high frequency performance where do you think we need high frequencies while we are working on say whatever 2G or 3G or what are 890 megahertz and above if you are working on lieutenants you are working on 2 to 4 gigahertz events so if you are working on higher people are now looking for 60 gigahertz satellite phones so we are really looking for very high frequency generations these are not the only generating systems they are different other generators RF4 should teach you what are those but right now we should say any LC oscillator is therefore used only for constant frequencies very sharp frequencies and much higher frequencies okay there are two very famous LC oscillators in literature they were first made if you are I do not know whether you recollect very first talk I showed you some diodes made out of vacuum tubes DD forest vacuum diode huge 6 inch tube first oscillator was made using vacuum tubes okay so it is not that is present but let us see which are these two Colpitt and Colpitt's oscillator and Hartley also very famous oscillators last 70 80 years these are popular the other oscillator which is the most important oscillator in every work where we are working right now is a crystal so is that why I am clubbing this with LC obviously I believe that the crystal equivalent says like a LC network this is my assumption which I can prove but not in this course okay so let us say typical BJT based oscillator and then I show you a equivalent of mass equivalently I just show you the circuit diagram what is Colpitt is saying okay you have a transistor how much phase it will give me 180 degree this is my load across this is the AC equivalent term please remember this R is essentially the load is that clear to you R is essentially the load then I put a tank circuit across this but I did machine there I divided this net capacitance into two parts the center one I grounded and I put this so what is the purpose of this grounding in between and what is essentially it is trying to give you what is this voltage across this we are going where so this C2 is essentially creating a feedback is that okay this is the net output voltage divide by this is a divider this is a ground potential C2 upon this plus this is essentially giving me the feedback factor okay so I am now looking into a transistor plus LC network with a load here with a divider to make this I can do just the opposite of Colpitt what is opposite means same circuit replace L by C this circuit is called heart lay oscillator you know it is like a derived situation okay that is what all research is about but that is what you are thinking is okay if this works the other should collulary must work for it corresponding system must work for you so your duality has that here have you heard any time this word duality in your physics course so the whole nature is in duality right now matter or waves you know you have your problem duality is a game in the life okay okay I said you know you can do there is no difference this terminal is same as this terminal a v0 a v0 okay this is my vgs across c2 okay or rather okay then which is trivial okay okay please look at it I am now seeing currents at this known v0 a gmbgs current same direction okay v0 upon one upon a c1 is another third current is that clear if you say this then it is v0 upon ls plus one upon sc2 is the fourth current all currents should sum up to 0 so this is equation one if I want to calculate vgs this upon ls plus one upon lc I think I must be right this should be c2 correct so one upon sc2 upon ls plus into v0 is that okay substitute this vgs in the equation one and then all terms will be in what v0 terms all terms will be v0 terms okay if v0 I just collected the term gm plus sc2 plus one plus lc2 s square into one upon yes yeah of course you write down I have no objection but I just want to say you these are now quite trivial they are quite trivial because we are just solving kishof law and nothing great you can answer why I have to solve to get that expression that is the way I am so if you collect of course this is given in sedrasmith's book so it is nothing really great I just check later now if oscillation is to sustain or start yes you will if v0 is 0 there are no oscillations is that output 0 no oscillation so if v0 has to be finite then and if this equation has to be correct then the term inside the bracket must be 0 okay if I substitute again substitute s is equal to j omega real value plus imaginary value 0 Barkhausen criteria says that at omega 0 real value should be one and imaginary value be equal to 0 okay so all kia this term ko 0 kia so I got omega 0 square lc2 upon r is equal to sorry one kia to gm plus r this or this will give me omega 0 this ko sol kia sorry yeh iski value abhi nahi nikand yeh real value adi one hai to gm plus one upon r is omega 0 square lc2 by r or to say omega 0 square important abhi omega 0 ki value ani hai will substitute here this is equal to one okay real value should be equal to one this is my real value okay so it is ko one kia hai to yeh expression argument yes okay how to get frequency omega 0 by equating imaginary quantity 2 I just made this 0 and this one for Barkhausen criteria at omega 0 okay at oscillating frequency the magnet real part should be one and imaginary part be 0 okay sustained oscillation gamma to is ko one kia to yeh term aagai imaginary ko 0 kia to omega 0 mil kia mirko one upon root lc1 c2 upon c1 plus c2 is omega 0 ko ko last function me substitute kia so I got a ratio of c2 by c1 is equal to gmr so as long as your gmr has a value of c2 by c1 okay slightly greater than c2 by c1 that oscillator cold pit oscillator will oscillate at one upon root lc1 c2 upon c1 plus c2 c2 by c1 you are going to adjust you are going to get a frequency from here a value of c2 by c1 assume one capacitor and get the second one substitute here and you will get frequency of oscillation given an operating frequency get the ratio of c1 c2 from here come back substitute here and say okay what should be gm to sustain this frequency is that clear this is design why it is called design because I am not interested in gm value or r value I am interested should oscillate at 100 megahertz or 800 megahertz that is what I will say so what do I give I go this expression see valid c1 by c2 come here and find what gmr I should use to have a oscillations gmr adjusts by bias is that okay is the design clear to you I am always telling you what is the design design is just the opposite in that sense output will be told to you this is what I want come back and find what should lead to this okay this is how we do it in designs okay inductance will have to assume or I will be giving you typically inductances for higher frequency should be less than one nano Henry less than a typical value but why it should be less than one nano Henry can you think of it if you want to go to gigahertz then if you do not keep it less than nano then you can go to nano and giga giga is 10 to power 9 square means 10 to power 18 value you have to get square term so if their product will not be 99 will not be below minus 9 minus 9 then you will not be able to get 18 in square so always remember that inductance should be less than a nano Henry typically 0.0 0.8 or 0.6 nano these are used even lower can be used for higher is that correct so length typically inductances are decided in chip by the wire which wire the bonding wearable the chip ka silicon se jom nichet pin athi hai us may have under a wire bond karthi wire o wire ka inductancy less than nano Henry that we use that we do not even put an inductance okay this is what the game is all of them go through our design issue bata baya kya kar hard lay karna hi to kya na cheya kya hoon hain cheya nahi kodasa vice hai phir se circuit sol kar hi hai aur hard lay oscillator ke condition aingi one upon l1 plus l to c under root of that will be the hard lay frequency is that point clear to you pulpit or hard lay mai koi parak nahi hai ush mein ratios hc ke hain ish mein ratios inductance can be okay kodasa functions simplify hojaga inductance kyon kya kya hoon one upon jomegar nahi upar hi ritha ish mein one upon CS niji aane se hame sha wo do do term leki aate okay ish mein thodasa relatively easier expressions aate hai okay so we have already said that two popular lc oscillators are discussed one using heartland technique or one using culpates method the other is using this is ke bahin hai kyon se oscillator us ke phase shift oscillator which are essentially rc oscillators okay have a naya oscillator we all use and I think all of you have used the last oscillator which we use very often from this kind it's oscillators is called crystal oscillators normally crystals which we use are quartz crystals aapko samja wo la 33 kilo hertz ka crystal chaiya ya 3 megahertz ka 3.1 megahertz ka crystal chaiya kya kya deke batal sattein ki ye 3.1 megahertz kaha hai aur ye 33 kilo hertz kya de crystal toh aisa ish mein pamp kya seal ritha hai uske leads dole leads nikhle ritha kya bahin kya batal sattein ki ye lower frequency kaha hai aur ye higher frequency niche likha hai mein hai pada pado frequency depend on the mass of the crystal or the size of the crystal larger mass ho gha toh kya ho gha higher frequency hoge kum frequency hoge so jitta bada quartz crystal khair zingas nahi lower frequency ka ritha hai jitna chota quartz crystal khair zingas nahi lower higher frequency ka ritha hai what is the property of crystal it it follows a electromechanical resonance uska dosana naan kya hai piezo effect say piezo electric effect if you apply a electric field to such materials then it provides mechanical vibrations or vice versa okay this is also doable piezo electricity is the word which we use there so what we do is that we pick up a quartz crystal with soldered contacts on that okay and advantage of these crystal oscillators is this is temperature independent to great extent it is not correct alt 2000 degree pe wo bhi ye ho jaya chauja 150 degree pe quartz melt ho gha hai 800 degree se hi actually flow should ho gha hai it is called that glass flow or you have seen it na glass blowing karthai na na flame kya bha chauja saap tak toh poora mental toh aisa manla yama sujo ki kisi bhi temperature but normal operating range is 150 degree to minus 55 degree centigrade ah Alaska se lekar rajasthan ke dither tak wo chal na chai okay so this is temperature independent time stable means kya aaj ek frequency kal thoda din ba 23 frequency okay so it is time stable okay so that is why it is used extensively but what is the difficulty with this it is non-tunable impact it is a fixed frequency oscillator is ka jobi natural frequency now funny part the crystal which I am crystal which I am going to show you now does not really work the way we thought okay crystal oscillator is like a tank circuit okay the only difference between this circuit and the equivalence is something different it has an inductance it has a series capacitance ch it has a small series resistance arc and it has a parallel capacitance lcs this is equivalent circuit of a crystal okay I will come back it but just to show you so this is the resistance so q kab jada hoga the r jo hai 0 ke taro typically crystals ke q jo hai me hai value hai me any way I am showing you that value typical q jo hai 10 to power 4 se jada re actually what does that mean r is practically 0 omega l by r is 10 to power 4 which means r is very very small or negligible so tank circuit ka crystal oscillator me jo equivalent circuit use ho taya ho jaya ho taya lcs ls ne kete go ke ho series mein lcs shunted by cp is the equivalent circuit of a crystal r is present but as I said normally q's of all quads crystals are more than 10 to power 4 so r is neglected in all analysis problem kaya r hoga toh circuit link bada jayi accuracy kuch bada bina okay so if I say before I come the frequency depends on size most important quality of this quartz crystal is it has a very large q and q is greater than 10 to power 4 or above okay. So equivalent circuit of a crystal typical r is less than millions we just get it the inductance of a quartz crystal equivalence is around 100 Henry's the series capacitance is around 0.5 femtofenry femto ferrats and the parallel capacitance is with the order of few picoferrats is that okay lcs r parallel cp is the equivalent circuit of a crystal so r ko toh main a 0 kadeya ye iski typical value hai this is the symbol this is the symbol of a crystal can you think what is the cp value is coming from parallel plate capacitor ka jo capacitance hai wo uska cp hai is that right so baar ke terminal pe jovi dikhra hai wo uska cp hai what is cs could be this is because of the die what is called dipole moment of the ionize material kept there which is an inductive series to that so that is cs which is typically less than femtofenrats if iska any minute zs nikala reactance why nikala some do uska and if I plot it versus frequency okay z hai na ya why hai iska a omega ke term me plot kia so I figure out that at omega equal to omega s which I call series frequency of this okay omega s why it becomes capacity in lower frequency 1 upon jo minus sign aya isle ism totically a omega p thak wo higher value leta hai inductance is that okay to me and if the omega p ke ishar dekhka toh cp isko dominate karta aar uska ye capacity vata ye cs ls ka combination hai aur ye cp ka hai omega s is the series frequency resonant frequency omega is parallel resonant frequencies series and parallel resonant frequencies are called omega s omega p please remember tank circuit even series lc circuit is also a tank circuit and it has a own 1 upon lc as its frequency is that it is called series frequency parallel kareng hai toh bhi 1 upon root lc jo a raya wo bhi parallel combination fare usko uska parallel reason the reason why it is different will be obvious when I show you that okay now as I say cp is is very large compared to cs what does that essentially means if cp is are much that means omega s any terms iski nikali so omega s and omega p ye bhi kuli a dosre ke pass methe if they are very close to each other what does that mean that means anything less than this frequency the crystal will act like what capacity anything slightly larger than omega s but limited by omega p what will you act like inductor so crystal oscillator wale low kareng hai kya apne jo culprit oscillator banaya tha me kya banaya tha apne doh capacitor aur ek inductor rala tha toh iss inductor ke jagar aap ek crystal laga and up to what frequency at what frequency it will always give you inductive between omega s and omega p that is why it is called tuned iss narrow band me hi wo sir inductance behavior dega wo oscillate kar kulbit ke iss ka jo equivalent inductance hai iss ke jo formula me ne call pit ka diya hai na wo wai hai iss me inductance ki value will come from the crystal is that okay so this is how crystal oscillators are actually used crystal oscillators do not really gives own oscillation per se directly they fit into a call pit combination and you replace your inductance by a crystal okay and the voltage here should be such that and the frequency we are operating should be such this behaves like an inductor that those frequency this call pitch oscillator will oscillate between omega s and omega p and if c1 is much larger whatever the value i give larger or smaller if cp is much larger than cs then omega s and omega p very close to each other and which means at that frequency this will oscillate permanent so if crystal acha iss ke advantage kya hai the narrow band that means sharp hai it is stable because crystal address temperature independent is that jo bhi temperature instability aah se aane wo kise kum ho rahi hai why it will be much less yeh kansa feedback jaar hai feedback aaya na usko stabilize kar okay iss ke karan hilne nahi dega yeh iss ko stabilize kar dega toh this system is perfectly usable in any system where you are looking for oscillations of constant frequency independent of time and temperature this is called crystal oscillators because there are some other version opium ke saar books me dega okay main aapko basic bataya ke how do i use a crystal in any oscillating systems omega p is because of lncp it has an equivalent see the piezoelectric effect if i apply voltage the natural frequency is equivalent of putting this tank circuit it is a piezo electricity theory which i am not solving for you assume right now equivalent circuit is this how many of us cannot be later because see the c s idea is write zs and find that is that okay which i have not done it but i just showed you what to oh sorry yeh okay essentially i sorry but essentially what i was saying that you just use a crystal in place of inductance rest culprit remains similar okay. So ek aadmi mujhe kaya de ki sab sinusoid is sinusoid hai to chalo ek aapko pahela dikhate non-sinusoidal okay baaki uske baat thode next time bataan here is a circuit which is used for ring oscillator what is ring means it is a ring these are standard inverters okay ek do tin on main a likha odd number now ek thode si theory kar ke dekhain yeh draw kar loa yeh sorry non inverting inverter nahi sorry they are all inverting inverters the word i have used have you heard of this word non inverting inverters perverse the idea is simple i have an inverter let us say the capacitance here and a load capacitance here this was storing 0 so this will store 1 okay but next time yeh 1 isko charge kar kaya to yeh piriye 0 yeh 1 hotaar yeh depending on the delay it will keep changing so at any given time i do not know whether output is 1 or 0 phase kithna hai 180 ish meter so this cannot oscillate it cannot sustain it it is so meh nega aacha yeh baat hai kya do inverter 1 80 usriya kha 180 0 1 0 in phase return ho gaye to oscillate karna 0 180 180 180 360 page aagya criteria solve hum bhaap dekhon ish meh kain to bhi Barkhaudhan criteria solve nahi hua meet nahi hua yeh jaha bhi meet kar rahe hai meh aapko ish ki theory nahi batonga aap socho nahi to next of operation the omega 0 where it can become unity is only 0 what does 0 means dc so this will oscillate for dc yes yeh di 1 yaha 5 volt hai 0 volt hai 5 volt hai yeh karthair dc value fix rahe so it is a dc oscillator which is not oscillate isko kya bolte aakki liye circuit ko abis ka circuit ka dosara figure batata kya hai latch yeh latch hai to fix kar deta hai latch kar deta hai ho okay so it is still an oscillator for a dc but dc oscillator is not called oscillator so essentially 2 inverters though it gives a phase value correctly it does it does satisfy Barkhaudhan ko hum bhi at 0 frequency therefore it does not really oscillate ish le kya jaroori ho gya di it dosa to jada inverter laga nahi bada hai is that clear to you why more than 2 otherwise it will never oscillate yeh to 360 mila aapko phase to adjust kar bhi when magnitude 1 nahi karega is frequency jaha wo ban karra hai transfer function wo sir 0 degree 0 frequency vehicle match hola aap kar ke dekhon nahi ish le mila nahi bata nahi nahi aapko bata dia ki ish ka equivalence yeh hai by stable element hai yeh yeh hi me aapko bata nahi aapko kyaise sushtein lo mein aapko thoda hint di yeh very relevant why 2 inverters do not actually oscillate okay. So yeh the odd inverters laga hai aur hare ek me ek capacitor bhi laga hai 3 laga hai sanju to this is iss ke andar ek registers hoonge equivalently arm register of resistance jo honge to yeh jo RC network hai yeh 180 180 180 and actually 180 hoon plus network se 180 laaya the total phase 360 pe aayega aur e the yeh sanju hain 5 hain sanjini yeh ek aur beech me daal ya. So any odd number will actually give you 180 and network will give you another 180 like a phase shift so it will start giving you square wave generation. aapko ala-galak hints de de. Oscillator to yeh hain. When you start monitoring oscillations here kya laga hain yeh aapko scope pe dekhne ke liye kya laga hain yeh aapko probe laga hain yeh aapko. is that clear to you. So the buffer essentially takes you out of that probe business is that correct. So in real life me ek chautha inverter lagta hai jiske output pe humne actually inverted output is that clear to you ok. So let us so we want to see some kind of a square wave generation or even triangle or any sawtooth kya se banayenge to is ke liye ek circuit hai prasla introduce krtaun hain aur pe next time aapkaun. Ek aur circuit hume use krna padega ho sab karne ke liye uska naam hai comparator uska naam hai comparator yes jitne capacitor Rc total milke 180 degree kya create karna kya odd inverters ka phase 180 aayega 360 plus 360 or 720 plus ek 180 aayega netwars se 180 aayega. So phase return north summe 360 return phase shift oscillator ka jo principle hai wo hi use kya. Is that correct. In phase component baapas return hona chari is that correct. All the curve. Nee nee wo to solve krna hi padega nahi transfer function value imaginary 0 or real value 1 krte karna. We karke nahi dikhaya aapko bata hai ki or se hi ho sake hain otherwise. Okay you are right ek open hai usko e di open defam jaisa use kya no feedback. You have two inputs V1 and V2 your power supplies of VDD and VSS it is a 5 and minus 5 2.5 minus 2 whatever value you put and you have a V0. Ye sada defam ka output haisk kya ho gha V0 a times difference of this. But iska gain kya hota hai minus a times V1 minus V2 ko kya bolte hum lo difference voltage. So a times PD with a minus sign is the V0 is that clear. Vd is the difference signal V1 minus V2 a time this is defam ka theory hai difference gain kya time signal amplifier. If I plot the same thing on a sheet on a graph V0 versus differential I see from small less value of say this is V1 minus V2 at 0 if there is no offset output is 0. If V1 minus V2 is positive or rather it should be opposite sign because say minus sign the case for minus later. It should rather than as simple as that. If it is minus the output will go high and it is plus output will go minus VSS is values ko main a nam di VH and VL. What is the gain function dV0 by dVn is the gain of any amplifier which is in this case VH minus VL by point this the x value delta delta equal I do not know. So if I substitute this 5 volt 5 volt and let us say the gain is 10 to power 5 for open loop gain for this opam I use or defam. Then 2 delta is 0.1 millivolt is that clear 0.1 millivolt or gain badange or V100 micro volt se bhi nicha aasapta hai. So this characteristics can then loop delta will become close to 0 if this value is very very high then tends to infinity let us say delta will tends to 0. So what will ideal opam gain is the infinite mana to transfer kesa hoga at V2 minus V1. Vd positive hai to minus VSS pe chala gaya Vd negative hai to plus Vd is that correct. Yeh kya dikhna aapko yeh kesa characteristics dikhna aapko mechanically ya electrically aapko yeh digital main switch. So a comparator with a high gain creates like a switch square way ka hati hai. On off yeh na on off okay. So now you can think that if I have a comparator I should be able to create on off situations which means square way. Is that point clear. Next time yeh dikhna kya to main ek square way upko comparator ke tarap se create kar saktaon. So a comparator other than comparison itself is a one another advantage it has. It will also give me equivalent of a on off switch okay and that I can utilize to create square. Triangle karna hi to kya karna chahi. Queer ka triangle kese kapte. Pupar gaya aisa karna integrate karo. Bahas ek integrator laga do to square sa integrate hoke triangle ho ja hi na. Kike uske voltage kum jaada karna hi kya karna chahi hai ek limiter dioclamping karo jis volt pe chai maa ro close ko. Sab kuch jo abhite pada hai wo laga hai la. Is that correct. This is essentially what the non sinusoidal oscillators do using comparators. But pure comparator hum use nahi karenge the kind of comparator I am going to use is called Schmidt trigger. So next time we start with Schmidt trigger.


my name is Anil Tone from Bahia, Brazil. I have the flag of USA, Brazil of course, Paraguay and Argentina. Yes, it's my room. I have a lot of stuff because I travel to USA and I bought the flag. This is my dream to be a diplomat and now I'm Spanish, English, French. Now I'm 24 years old and I'm an English teacher. Right now I'm teaching English and it's cool. And what's the name of the cat? His name is Johnny. Johnny? Okay, hi Johnny. I'm sorry for that. Now Johnny is international. An international cat.


Hi, my name is Jan Sturbisch and I'm going to present join work with Anita and Georg on breaking the inter-post-puff with reliability attacks. I want to start with a quick introduction, what are physical and cloneable functions? So puffs are a hardware function. You can think of them as a module embedded on an integrated circuit. And these have an interface where you can apply challenges and then you get a response and you can think of these in the context of this talk as bit victors. So the puff maps bit vectors to bit vectors. And the trick is that the process variations that occur during manufacturing of the integrated circuit guarantee uniqueness of this mapping. So whenever you implement two different or when you manufacture two different instances puff A and puff B they will have a unique mapping and so you can identify them by their responses. You can use them in a very simple protocol where you have an enrollment phase after manufacturing and there you build a secret database of challenge response pairs. And then later in the field the puff can be authenticated by selecting a specific challenge and checking whether the response sent from the puff is the same as the one in the database. Now this protocol can only work for so-called strong puffs because they have a really large challenge space that is exponential in some design parameter. So the advantages of these puffs are that they are cheaper to manufacture and supposedly they are more secure than traditional crypto based solutions. So here you don't have a secret key that you need to protect. And just assume that invasive physical attacks are not really feasible on puffs at least in an ideal scenario. Now why don't you see strong puffs in the field deployed in the field? Well all candidates so far that have been proposed have been broken by modeling attacks. So what an attacker can try to do is they can record a large set of challenge response pairs. This is assumed that it's feasible in the attacker model. And then they can try to build some mathematical model. And as soon as their mathematical model is able to perform this mapping from challenges to responses with high fidelity, high accuracy, then the security of the puff is broken. So where now does our contribution come in? At chess 2019 again I introduced a new design, the Interpose Puff. And this design had some new ideas to provide security against the state of the art attacks. Especially the focus was on reliability attacks, which are the most devastating attacks because they require the smartest training set. Already a year later at chess 2020, I showed that security is not quite as good as the security of the eye puff as it was claimed or as it was hoped. And this year we show that also reliability attacks are possible, which breaks the original security claims. So to understand the attack and the design, we need some preliminaries. First, you need to know the Arbiter Puff, which is the building block of most strong puffs. It consists of a number of stages. And you can see that each stage has a challenge bit applied. And what this challenge bit does is basically it determines whether the path is that the signal path that runs through the stage across or whether they are sent straight through. So here, for example, is zero is applied and the blue and the red path is across. Now to query the puff, you apply a signal at the beginning, and then you have two signals racing through these stages. And at the end, the arbiter determines which of the two signals arrives first. And this determines the single response bit. So what the arbiter does is it evaluates the sign of the delay difference D. Now as it turns out, this puff can be modeled very well with just N plus one parameters where N is the number of stages. And to do this, you have a weight vector W, which basically is equal to or equals the physical delays that are applied to the signals. And you have a parity vector, which is basically a function of the applied challenge. And with these two vectors, you can compute the true delay by simple scalar multiplication. Now, if you model a real puff, what you always have is noise. So whenever you have two signals racing through here, there will be some noise and you can model this with a Gaussian variable. And as you can see on the bottom right, you have a decision threshold. And whenever the delay is below that, the response bit is zero. And if it's higher than this decision threshold, it's one. And you can see if the noise is large enough and it gets added to your true delay, it might be possible that you cross the decision threshold and your response bit flips. This will become important later on. And we'll talk about the reliability attack. So as you saw, the puff can be described by a very simple linear model. This means that it can be trivially broken by modeling attacks. So what people did was they composed puffs consisting of multiple arbitrary puffs. So the most well-known one is the XOR puff, where you have multiple arbitrary puff instances and their responses are just simply XOR together to get a single response bit. And this non-linearity really helps. It increases your training set size. So now your training set size is exponential in the number of arbitrary puffs that are in your design. But still there's a problem because as we saw, the arbitrary puffs are noisy. So you cannot combine too many of these. Otherwise, your response bit will be really noisy and you cannot use the puff in authentication. All practical instance sizes of this puff can be broken. We'll see you later. Now, based on the XOR puff, again, I developed the interpose puff, which is basically a composition. You have the upper XOR puff, which introduces a new challenge bit into the original challenge. And then you have the lower YXOR puff, which is evaluated now on this augmented challenge. And this RY then is your true response bit. So how do you attack these puffs? So the general model is you have challenges and responses. You have a lot of pairs of these. This is your training set. And now you're trying to find a model that maps these challenges to the responses.  So it has a weight vector w. Now, what you can always do as an attacker, you can just pick a random w. You can start somewhere in weight space and then try to make your way to a good solution that provides a good mapping. So one thing you can do is you can get a local loss function L. And what this function does is it basically measures how well your current pick w is in predicting a single challenge. The response for a single challenge. And based on this function, what you can do is you can build a sum that basically tells you for your whole training set, how well your current pick w is performing. And now you can enter an optimization loop where you evaluate your loss. And then you try to tune your w such that you move towards a minimum in this loss landscape. So if you use gradient descent, for example, you evaluate the gradient at the point where currently are and then follow the gradient towards the optimization of the loss function. So this is how you can think. These texts performed. So in the classical modeling, you just use challenge for the response pairs. And then I showed that logistic regression is able to break XOR paths for all basically all possible or feasible instance sizes. These are at all showed how this technique can be adapted to the interpose path. So they did not provide a fully differentiable model of the ipath. Instead, they showed that you can basically divide and conquer the interpose path and attack the the different parts separately. So now turning to the reliability attack. What you can do as an attacker is you can query the path, for example, an avatar path multiple times for the same challenge. So you have one challenge and you have, in this case, T repetition T times the response bit. And as we saw the response may flip at certain times if the noise is large enough based on these T response bits what you can compute as a reliability score. And this just basically tells you how noisy your response bit is for the specific challenge. Now the observation is that this reliability score gives you information how the magnitude of the delay difference D looks like. So looking at the blue example, we can see that the true delay is pretty close to the decision threshold. This means that you don't need a lot of noise to cross this decision threshold. So your response will be rather noisy. In contrast, an orange you can see that your true delay is pretty far away from the decision threshold. So you would need a lot of noise which is quite unlikely to cross to the other side. So this is a stable response. So there we have this connection and this information that you get from the reliability score. So how do you use this to attack X or paths. The observation is that the reliability score of the single outer path correlates with the overall reliability score of the of the global response bit. And this is simply because due to the X operation, whenever you are noisy, our type of a for example flips its response bit, then also the global response bit will flip. So we have this direct correlation. And on the previous slides, we saw that in turn the reliability score of your individual arbitra pass correlates with the magnitude of the delay difference. So now we have one value that can be observed by the attacker, and one value that can be predicted by your model. And now this directly leads to a text in which you can find the arbitra pass. And what you do is you simply try to find with an optimization routine would you try to find an arbitra path that has a high Pearson correlation with your observed global reliability score. So and whenever you run this optimization, it yields you exactly one arbitra path can you that. Now the observation is that you need to run this attack multiple times, because you need all of the individual arbitra pass. And what can happen is that the probability that you encounter each other path in the optimization runs is probably not not equal. So in this case, for example, I have a type of a, which is just more likely to be found because it's it's minimal is more pronounced compared to a type of B. So some arbitra pass are more likely to be learned than others. And this is exactly the idea that Union and I used for the security of their construction, because they said, okay, we have this XOR arbitra path. If we put it in the top, then it will have much less effect on the overall. And the overall response but so the correlation between the reliability of the X XOR arbitra pass and the overall reliability score is pretty low. And according to the analysis, this means that it's highly unlikely that all XOR arbitra paths that belong to this top path will be actually found. In general, we could follow the argument and with simulations we could see that indeed the X arbitra paths have a lesser correlation with the global reliability score. And internally the Y paths, you will find them more easily because they have a larger correlation. However, we came up with the idea that you don't have to run the, the same optimization routine always again, instead you can resort to adaptive reliability attacks. And the idea is, let's say, you have found the first minimum. So you have optimized in this area and in the topology of this blue curve. You have found a minimum somewhere here. What you can do is now you can modify your optimization target. You can say, okay, I never want to go here again. So I add additional loss where I ended up. And now you end up with a new target function, this green one, which does not have the same minimum anymore over here. So you will explore other minimum in the lost landscape. So you might end up over here if you run the optimization now again. And this is already, yeah, this idea is already direct, direct challenge to the IPAW security argument. And next we will see a few more steps that we and I took to get a practical attack. So learning one avatar path at a time still, if you do this adaptive attack, still is somewhat cumbersome. We found that you need a lot of manual tuning. So instead to build like an efficient attack, we sort of resorted to learning all other paths at once. So you perform the reliability take in parallel on all other paths. And to prevent them from conversion to the same solution, you discourage the similarity by adding constraint terms. And we did another modification, which is also important. We added another term to the, to the optimization goal. And this term is basically your classic machine learning attack, which just measures how well your model produces predictions for the response bit. So now you have three terms the classical logistic regression loss. So your global model how well does it predict responses. So you have another term in blue, which encourages the individual other paths to show a high correlation with the reliability score. And you have one optimization goal, which discourages the other paths from converging to the same solution. So it's counteracts a little bit this reliability correlation term. So, it doesn't take overhand. And some experiments, again, simulations that show that this, including all your available information is actually beneficial. So in blue we have the original reliability attack and orange you have a constraint term so now the outer part of this courage from converging to the same solution and green, additionally, is logistic regression loss. And what you can see is that an attacks on the 55 interpose path that with our modified approach in green, then you actually are able to find all other paths and to model the complete path. So, I briefly want to mention some technical steps that were also important in our attack in the original reliability attack. The optimization routine was CMA is which is a evolutionary strategy evolutionary evolutionary strategy approach, and we just replace this by gradient descent, because we actually found a differential model. The gradient descent usually beats CMA yes. So we also had to find a differential model of the iPath. We just had to modify the computation of the feature vectors of this parity vector phi. And, yeah, the details on the paper it's just a small technical step, and then you have a complete differential model of the complete iPath. Another another technical issue that we had to solve was finding good constraints for the iPath, because you really really need to watch out that you don't end up with why a puffs in places where you need the X out of the puffs because this design is as a metric, but the reliability attack in the original formulation does not know this and cannot sort them. So this actually took quite a lot of time and again I refer to the paper where we have all the details on this. So, looking briefly at the results. What we can see here is that we were able to break the 110 iPath. This is important because it was proposed as a secure instantiation. And the 110 iPath with 64 stages of a size. If you were to run a classical machine learning attack. Then you probably wouldn't be successful because it would require billions of challenges, but with the reliability information included you just need a couple hundred thousand. And the time is also very much feasible and as always could be further optimized. So be able to run attacks on on xx iPaths for example the 77 iPath. I have to mention that this was a bit more involved we had to run the attack in multiple stages. Because there's a lot of fiddling around with this numbers and with optimization goals. So this is an area where the our attack would still be improved, but nevertheless we were able to as I said break the 77 iPath. The most important takeaway result is basically the scaling of the attack. In blue is our attack. And the y axis is scaled rhythmically. And what you can see is, is that the that our tech scale somewhat linearly. So in contrast you have three other curves here, which are all logistic regression based attacks. And these all scale exponentially and they don't take reliability information to account. So the takeaway is, if you take the reliability information you can and you can attack really really large instances and security of the iPath in this attacker model is actually broken. So what's the conclusion as I said, the iPath actually does not hold up to its claims unfortunately reliability attacks are still possible. And what we really want to show it also show is with with our methodology is that these attacks. You have a lot of flexibility in building these. There's a lot of specifics about certain optimization algorithms do not matter as much, you have a lot of freedom and how you can compose compose optimization objectives and so the takeaways it's it's somewhat hard and technically involved to to run these attacks. And to really test your design on on for certain state of the art attacks it's really not that easy. So technical note, in the future, if you want to run such kind of attacks on on your own designs to find improvements. Do use modern libraries like pie torch tensor flow to develop these attacks that makes it much much easier and it's much more enjoyable and crafting code by yourself or grading computation for example. All right, thanks for your attention.