Reference Clock Spur

The spur appears at a precise, invariant offset from the carrier, exactly equal to the reference oscillator frequency (F_ref). Unlike phase noise, which spreads continuously, this is a discrete tone. If a 10 MHz reference clock leaks into a 2.4 GHz carrier, the spur will always be found at 2.410 GHz or 2.390 GHz. This deterministic relationship makes it a highly reliable identification feature, as the offset does not depend on modulation or data rate.

The power level of the reference spur relative to the carrier (dBc) is a direct function of PLL loop filter rejection and PCB isolation. Manufacturing variances in capacitor values, trace parasitics, and bond-wire coupling cause the spur amplitude to vary significantly between otherwise identical devices.

• Typical values range from -40 dBc to -80 dBc
• Variations of 5-15 dB are common between units of the same model
• This amplitude is stable over temperature and time, making it a persistent biometric

The primary mechanism generating this spur is imperfect filtering of the reference frequency in the phase-locked loop. The loop filter is designed to suppress the reference feedthrough, but component tolerances create a unique rejection notch depth and shape. Key factors include:

• Capacitor dielectric absorption causing memory effects
• Op-amp input offset voltages in active loop filters
• Charge pump current mismatch creating a DC offset that modulates the VCO Each of these imperfections leaves a distinct imprint on the spur's amplitude and phase.

Reference spurs must be carefully distinguished from local oscillator phase noise during fingerprint extraction. While phase noise is a continuous, stochastic spreading of the carrier, a reference spur is a coherent, deterministic tone. In a spectrum analyzer view:

• Phase noise: A smooth skirt that falls off with offset frequency
• Reference spur: A sharp spike rising above the noise skirt at exactly F_ref offset This distinction is critical for feature vector construction; confusing the two will degrade classifier accuracy.

Beyond the PLL, reference clock energy can couple directly into the VCO or PA through shared silicon substrates and power supply rails. This creates a secondary spur mechanism independent of the loop filter. The coupling path is highly sensitive to:

• Die attach voiding and epoxy variations
• Bond wire loop height and proximity
• Power supply rejection ratio (PSRR) of on-chip regulators These physical variations produce a spur component that is extremely difficult to clone, as it depends on the three-dimensional assembly of the packaged IC.

The reference spur's frequency offset is crystal-controlled and therefore extremely stable (typically ±10-50 ppm over temperature). The amplitude does drift slightly with temperature as component values shift, but this drift follows a repeatable, device-specific curve. This allows for:

• Drift compensation algorithms that track the spur amplitude over time
• Multi-spur fingerprinting where the relative amplitudes of multiple reference harmonics provide a temperature-invariant ratio This stability makes the spur a cornerstone feature for long-term device authentication.