8. Phase-Locked Loop (PLL) // Linear IC Applications // bhaswanth

A control loop that locks an oscillator to a reference frequency. PLLs are everywhere: every cell phone, every CPU, every USB receiver, every clock recovery in a network card.

8.1 Block diagram

plaintext

                                            ┌── Loop ──┐
   Reference clock ──[Phase Detector]──┐    │  Filter  │
                          ↑            └────┤  (LPF)  ├──[VCO]── Output
                          │                 └─────────┘   │
                          └── ÷N divider ────────────────┘
                              (program N for desired
                               output frequency)

The phase detector compares the phase of the reference and the output (after dividing by N). Its DC output is the phase error. The loop filter (a low-pass or PI controller) feeds the VCO's control voltage. The VCO produces an output at $f_{out} = N \cdot f_{ref}$ , in phase with $f_{ref}$ .

8.2 Capture and lock ranges

Lock range. Once locked, the range over which the VCO can follow the reference if the reference moves. Wider than the capture range.
Capture range. Starting from unlocked, the range over which the loop will pull in to lock. Narrower than the lock range because the loop filter has to settle.
Free-running frequency. The VCO's natural frequency with zero control voltage.

Lock time depends on the loop bandwidth: tighter loop pulls in faster but with less noise rejection.

8.3 PLL applications

Frequency synthesis. Set $N$ to any integer, get any multiple of the reference. Fractional-N synthesizers allow non-integer multiplication for finer frequency steps. Every cell phone uses one to step in 200 kHz channels from a 26 MHz crystal.
Frequency translation. Mix VCO with a reference offset.
AM/FM/FSK demodulation. When the VCO is locked to an FM signal, the VCO control voltage is the demodulated message.
Clock recovery. In serial communications (USB, Ethernet, SATA, PCIe), the receiver's PLL extracts the clock from the data stream so that the bits can be sampled in the middle of the eye.
Tone decoders. Detect specific audio frequencies (DTMF telephone tones).
CPU clock multipliers. Crystal at 25 MHz, PLL multiplies by 160, output is 4 GHz CPU clock. Without the PLL you cannot reach GHz from a quartz crystal.

8.4 The 565 PLL

The NE565 (Signetics, 1971) is the classic monolithic PLL. Operates 0.001 Hz to 500 kHz, with internal divider for frequency multiplication. Inputs: reference and VCO output. Outputs: VCO frequency and phase detector. Tunable via external R, C, and a control resistor for the VCO. Used in tone decoders, FM demodulators, and basic clock recovery.

Modern PLL chips are integer-N or fractional-N, with much wider frequency range (the ADF4351 covers 35 MHz to 4400 MHz), sub-Hz resolution, and on-chip VCO + reference divider.

8.5 Hardware-security implications

Glitching the PLL reference. A momentary disturbance on the input clock pin can knock the VCO off lock, sending it into the wrong frequency briefly. Logic in the chip clocks at the wrong rate, races, and may skip security checks.
Jamming the PLL loop filter. Coupling RF energy into the loop-filter capacitor's PCB trace shifts the filter's settling and the locked frequency.
Clock recovery as a side channel. The eye diagram of a recovered clock leaks information about the data being transmitted (its activity factor, its data-dependent timing jitter), useful for traffic analysis and side-channel attacks.