A post-processing-free single-photon random number generator with ultra-low latency

The low-latency requirements of a loophole-free Bell test prohibit time-consuming post-processing steps that are often used to improve the statistical quality of a physical random number generator (RNG). Here we demonstrate a postprocessing-free RNG that produces a random bit within 2.4(2) ns of an input trigger. We use the Allan variance as a tool for characterizing non-idealities in the RNG and designing a feedback mechanism to account for and correct long-term drift. The impact of the feedback on the predictability of the output is less than 6.4 × 107 , and results in a system capable of 24 hour operation with output that is statistically indistinguishable from a balanced Bernoulli process.


Introduction
Loophole-free Bell tests [1] have provided conclusive resolution to some of the most fundamental questions on the nature of reality and are now being applied to practical applications such as sources of certifiable randomness [2] and device-independent quantum key distribution [3]. A loophole-free Bell test is a statistical measurement of a correlation parameter observed by space-like separated parties making independent random measurements on correlated particles. Parameter values outside a well-defined bound indicate correlations that cannot be described by any locally realistic model [4]. The first Bell tests were performed by Freedman and Clauser in 1972 [5], Fry and Thompson in 1976 [6], and Aspect et al. in 1982 [7-9]. However, due to technological constraints additional assumptions, or loopholes, had to be made for the results to be interpreted as being incompatible with local realism.
The system presented here was used to help close both the locality and freedom-of-choice loopholes in a loophole-free Bell test [1]. The freedom-of-choice loophole requires that Alice and Bob's measurement settings be chosen randomly and independent of each other, a task suitable for any number of random number generators whose bits are chosen by an understood and trusted mechanism. However, the locality loophole adds the additional requirement that no information about one parties' measurement be accessible to the other party before the measurements are complete. For local hidden-variable theories, this means that for each trial of the Bell test the choice of measurement settings and the measurements themselves must be completed before a signal traveling at the speed of light could reach the other party. This is achieved by space-like separating the two parties; the loophole-free Bell test reported in [1] used distances of 184. 9(1) meters between Alice and Bob [1], opening, in principle, a window of 616. 3(3) nanoseconds during which the measurement settings must be chosen, applied, and the measurements completed. However, accounting for practical limitations (fiber propagation delays, device latencies, etc.) the actual duration of the mutually space-like-separated window was just 138 ns. Having a measurement window as long as possible, and a randomness generation process as short as possible improves the performance of the Bell test, and, in the context of certifiable randomness generation, improves the bit generation rate.
To achieve ultra-low-latency random bit generation, we developed a photon-sampling random number generator (PSRNG) based on single-photon detection of optical states in the high-loss regime [9]. In this approach the state from which the bit is generated, a laser pulse, is produced on-demand at the arrival of a trigger, and the propagation path lengths from the source, through the attenuators to the detector, and the path of the detector signal itself, are all kept to a minimum. As a result, we achieve a random-number-generation latency of 2.4(2) ns, defined as the time between the arrival of the triggering signal and the availability of the random bit at the output. Other recent RNGs designed specifically for loophole-free Bell tests have been reported [10,11] with latencies of 10.54(53) ns and 9.8(2) ns.
Many RNGs have significant bias in their raw output and require post-processing algorithms to achieve an unbiased output. Such post-processing necessarily adds to the time between the initiation of the random process and the delivery of an unbiased bit. Eliminating the need for any post-processing allows for the prompt delivery of random bits, but it leaves the system susceptible to changes in uncontrolled parameters that can result in a slow, long-term drift in the ratio of zeros to ones output by the RNG. Such drifts are common in the raw output of physical RNGs and are typically addressed with techniques such as hash functions [12], or sequential applications of exclusive-or (XOR) gates [10]. Instead of post-processing, and the attendant latency it adds, we have developed a feedback system that keeps the bit bias close to the ideal over arbitrary times. By employing clock stability and frequency analysis techniques, we identify the time scale on which the free-running PSRNG deviates from a Bernoulli (binary random) process with equal probabilities of 0 and 1, and we developed the feedback based on this understanding. In this manner we can eliminate drift and maintain highly balanced low-latency random bit generation over arbitrary time scales. The fact that this PSRNG is a controlled Bernoulli process rather than a truly free-running process means that with sufficient statistics the effects of the feedback control will be evident in the observed variance. However, we show that the strength of control required to eliminate drift is so low that an output sample 24 hours long (at a rate of ≈ 1×10 5 bits/s) is indistinguishable from an unbiased process and passes the National Institute of Standards and Technology (NIST) SP 800-22 random number test suite [13] without any postprocessing. Such performance means that our PSRNG can serve as an ultra-fast "coin flip" for measurement-basis selection, maximizing the trial window length in loophole-free Bell tests.

Methodology
The PSRNG, shown in Fig. 1, begins the generation of each random bit on receipt of a trigger, allowing for a precise bound to be placed on the time between when a bit is requested and when it is generated. Upon the trigger's arrival, a pulse-forming circuit consisting of a toggle flip-flop (TFF) and an AND gate with length-mismatched inputs produces a 950 ps electrical pulse that is amplified and used to drive a high-speed 850 nm vertical-cavity surface-emitting laser (VCSEL). The VCSEL generates a 300 ps optical pulse that is collimated, attenuated by 4.3×10 6 , and focused onto the active area of a single-photon avalanche diode (SPAD) module. To reduce latency, avalanche signals are discriminated by a dedicated high-speed comparator (cmp) inserted within the circuitry of the SPAD module, and output bit values are determined from whether or not a detection event occurs in an interval whose beginning and end is defined by clocking two fast D-type flip-flops (DFFs).
The length of the detection interval is set to 750 ps by the difference of two electrical path lengths. Delay 1 sets the beginning of the detection interval to the start of the measured photon-detection distribution, as indicated in Fig. 2. The end of the detection interval is determined by delay 2 , at which time the readout DFF is clocked, sampling the state of the SPAD [11]. If a detection occurred, a logical-1 is recorded, otherwise a logical-0 is recorded. The setup and hold times of the flip-flops are small, and we have tuned delay 2 such that the position of the clock edge is on the tail end of the distribution of photon arrival times registered by the SPAD, as shown in Fig. 2. This cutoff was chosen to roughly balance the influence of the clock's arrival time on the bit bias while retaining low latency. We note that this balance could be adjusted depending on the relative importance of latency and bit bias in the ultimate application.
SPADs exhibit dark counts and have some recovery time after each detection event during which they are inactive [14]. This imposes a unique requirement on single-photon-detectorbased RNGs for low-latency bit generation in a loophole-free Bell test. If a dark count has occurred within one recovery time prior to when a bit is requested, then the resulting bit value is not guaranteed to be causally isolated from the other Bell-test party. The low-latency RNG reported in [11] generates randomness in a similar manner to the one presented here. That system reduces the probability of these non-low-latency events and suppresses the influence of afterpulsing by XORing the output bits of two separate systems. In our case, we identify all instances when the SPAD was inactive at the time of a bit request by means of "not-ready" DFF 1 and DFF 2 . The operation of DFF 1 is asynchronous to that of the trigger; upon being clocked by any detected avalanche, its output will remain high for a time determined by delay 3, until it is reset. Delay 3 is tuned to slightly longer than the 55(1) ns recovery time of the detector. If a detection occurs immediately before the input trigger, the output of not-ready DFF 1 will be high when sampled after delay 1 , and the NR output will indicate logical-1 to indicate that the SPAD was not armed and ready when a bit was requested. Due to the low dark count rate of the SPAD, not-ready events occur at a rate of ≈ 10 −5 per trigger.
Afterpulsing, or an increase in the background noise correlated with a prior detection event, could induce correlations of logical-1s in the PSRNG if the time between triggers is short relative to the timescale over which afterpulsing persists [11]. For the SPAD used in this work, typical 1/e afterpulsing times are < 50 ns, and when operating at 100 kHz with a 750 ps detection interval, there is no discernable correlation of logical-1s in 24 hours of data acquisition (see below).
To monitor the PSRNG's performance and to calculate the feedback signal, the state of the RND and NR outputs are monitored by a microcontroller. A high-speed digital fanout makes a copy of the input trigger that is routed to the microcontroller, which initiates an interrupt service routine that records the value of the RND and NR bits. If the NR signal is high, the RND bit is discarded. After each 100 000 valid bits (≈ 1 s), the number of observed logical-1s, n 1 , is used to make an estimate of the PSRNG's bit bias p, where p = n 1 /(100 000). The microcontroller also records various other measurements including temperature, DAC register status, and NR rate, which are transmitted over a serial port for real-time monitoring.
Under feedback, the amplitude of the optical state, and thus the bit bias p, is tuned by adjusting the forward voltage across the VCSEL. The voltage is controlled by the microcontroller via a two-channel 16-bit digital-to-analog convertor (DAC) and a summing amplifier. The DAC channel outputs are separately divided down to form coarse and fineadjustment voltages v c and v f , and are added to a DC voltage v a of 4.3 V. The output of the summing amplifier biases the VCSEL's anode, and the output of the RF amplifier (located on the cathode) is also biased at 4.3 V. During the period between triggers, the forward voltage across the VCSEL is < 300 mV, low enough that after optical attenuation, spontaneous emission makes no measurable contribution to the background count rate of the SPAD. The DAC channels are divided down such that 1 least significant bit (LSB) in the coarse channel corresponds to a change in p of 5.15×10 −7 , and 1 LSB in the fine channel corresponds to a change of 5.32×10 −8 . The PSRNG's measured bit bias while the DAC is varied over its full range is shown in Fig. 3.
With feedback disabled the output bit bias can slowly drift enough to render the system unusable for high-quality random bit generation. The causes are identified as largely thermal, and to minimize their effect the system is mounted on an aluminum plate and enclosed in an insulated acrylic box. An active temperature controller and Peltier stage are used to control the temperature of the aluminum plate, with the controller's temperature monitor positioned at the location of the pulse-forming circuit, the region we have determined to be the most sensitive to temperature changes. In addition, low temperaturecoefficient components have been used where possible. Thermal control alone reduces the free-running PSRNG's bit bias drift to ≈ 2×10 −4 per day under typical laboratory conditions.

Drift characterization
It is likely that the overall instability observed in the free-running PSRNG is a combination of both known (i.e., thermal and 1/f noise) and unknown causes. To assist in identifying the composition of the drift, we use the Allan variance [15].
Unlike the standard variance, which is referenced to a sample's mean and diverges for most types of drift, the Allan variance is referenced to adjacent measurements, and thus is useful for analyzing the character of long-term drift. The slope of the Allan variance versus measurement interval depends on the noise type, making it a useful tool for diagnosing noise sources. The Allan variance is one half of the average squared difference between successive measurements made at a sampling interval τ; where y i is the i th of M measured values averaged over the sampling interval, τ. It is conventional to report the Allan deviation, σ y (τ), which is simply the square-root of the Allan variance. For normally distributed white noise, the Allan deviation exhibits a τ −1/2 dependence on the sampling interval. Other types of noise behave differently: 1/f noise goes like τ 0 , and random-walk frequency noise goes like τ 1 . This behavior assists in identifying the composition of a system's overall output, and the strength and timescales over which the various types of noise are dominant. We used this technique to identify the types of noise present in our system and to develop an effective feedback protocol.
The measurement value y i in Eq. (1) is the average of τ measurements of the bit bias p, where p is the average of 100 000 output bits, as described above. In our PSRNG, the amount of time it takes to produce 100 000 valid low-latency bits varies slightly due to triggers that arrive when the system is "not-ready." Thus, it is it worthwhile to highlight the following subtle distinction: traditionally the Allan sampling interval is measured in time, but in our case the sampling interval τ is measured in numbers of measurements of p, each of which takes about one second when triggered at 10 5 Hz.
To characterize the drift in the PSRNG we disabled the feedback and acquired 96 hours of random output. Figure 4 shows a plot of the Allan deviation for this dataset. The red dashed line is the behavior expected for a white noise source, while the solid blue line is the output of the PSRNG with feedback disabled. Without feedback, the PSRNG displays white noise characteristics out to a sampling interval of 10 3 (approximately 10 3 s).
To ensure that there are no overlooked deviations in the region τ < 10 3 that might have been averaged out, we used an extension of the Allan deviation, the dynamic Allan deviation (DADEV) to analyze the τ < 10 3 region. The DADEV is intended to characterize systems that exhibit levels of instability that may vary in time and is calculated by splitting the full data set into smaller windows, calculating the Allan deviation of each, and comparing their behavior [16,17]. The DADEV of the 96 hour dataset, separated into 44 windows of length 4 hours, and overlapping by 2 hours, is shown in Fig. 5. No short-term instabilities can be seen, indicating that without feedback the PSRNG's output is well modeled as random white noise for sampling intervals less than 10 3 (≈ 10 3 s).
Without feedback, at longer averaging periods (τ > 10 3 ) significant deviation begins to occur between the measured σ y (τ) and a white noise process. The τ 0 and τ 1 characters of the Allan deviation beyond 10 3 in Fig. 4 suggest that the non-white noise includes a combination of flicker and random-walk type frequency noise [15]. We find that the observed Allan deviation from τ = 10 0 to τ = 10 5 can be reasonably well fit (R 2 = 0.9829) by modeling the PSRNG's output as the sum of an ideal white noise process and a single random walk process of the form X t = ρX t-1 + ε, where ρ = 1, and ε is a white noise process with mean μ = 0 and variance σ ε 2 = 2.8(1) × 10 −13 .

Feedback
Based on the Allan deviation analysis above, we applied the feedback model illustrated in Fig. 6 to the PSRNG, where the output is the sum of an ideal white noise process w(t) and a random walk o(t). The bit bias p of the system is measured by the microcontroller, and with an appropriately designed filter f(t) we can estimate the magnitude of o(t) by monitoring the deviation from the expected behavior of an ideal white noise process. The mean of the white noise process is controlled by adjusting the VCSEL's voltage bias, thereby tuning the probability of detection to eliminate o(t), leaving a random signal well approximated by white noise.
When determining the type of digital filter to use, we note that the majority of non-white components reside at frequencies less than f c ≈ 2x10 −4 Hz, as revealed by a discrete Fourier transform (DFT) of measured bit biases and shown in Fig. 7. This suggests that f(t) be of the low-pass type, with a stop band at frequencies higher than f c . Given the constraints imposed by both the bit generation rate and the microcontroller, we implemented f(t) as a simple moving-average filter. To estimate an appropriate length for the averaging window, we compare how the variances of the two processes scale with averaging length. From the Allan deviation we estimated the additional noise to be a random walk in p with variance σ rw 2 = 2.8 × 10 −13 . Assuming a perfectly balanced Bernoulli process, the variance of n 1 (t) would be 2.5×10 4 counts, which gives a variance in p = n 1 (t)/10 5 of σ wn 2 = 2.5 × 10 −6 , since Var(aX) = a 2 Var(X). When averaged over M measurements the variance of a white noise process scales as 1/M, while the variance of a random walk process scales as M. Given the values above, we find the observed variances of the two processes become equal at an averaging length of 2989 measurements of n 1 (t), or ≈ 50 minutes.
Although averaging up to 2989 samples increases confidence in p, during this time the system is also drifting. The expected travel of a random walk process with variance σ 2 approaches 2Mσ 2 ∕ π for large M, which for M = 512 and the random walk estimated from the Allan variance, corresponds to a change in p of 0.995×10 −6 , or 0.995 bits. We have chosen to attempt to keep the output balanced to within 1/(50 000) of the ideal 0.5 (a mean of 50 000(1) logical-1s in 100 000 bits). Numerical simulations show that performance is relatively insensitive to small changes in M, with window sizes ranging from 200 to 2000 samples having residuals within 10 % of each other. Therefore, to keep the amount of uncorrected drift low and allow for faster-indexing arithmetic in the microcontroller we chose M to be 512.
To determine the feedback gain g, we first note that this type of feedback has a critical gain value g c , above which the system becomes unstable and oscillates. Thus g c serves as an upper bound for the feedback gain. To determine g c for a given M we examine the recurrence relation of the averaging filter, To further optimize the gain, we again turn to the Allan deviation. Applying too little feedback will underestimate the random-walk component and allow the system to drift, resulting in an increase in the Allan deviation at longer averaging periods. Similarly, too strong a feedback signal will cause an overcorrection towards the desired setpoint, reducing the probability of the more extreme values located in the tails of the ideal probability distribution, resulting in a lower-than-expected Allan deviation at longer averaging periods. Combined with the averaging filter's ripple-like stopband performance, overestimating the drift also results in the addition of higher frequency components, and a larger-than-expected variance at averaging periods close to integer multiples of M.
Using g c as a starting point, we numerically simulate applying averaging-filter feedback to the uncontrolled dataset used in Fig. 4 and calculate the Allan deviation of the result. We find that the residual difference between the resulting Allan deviation and that of an ideal white noise process exhibits a unique minimum at a gain value of g min = 0.32/(512 2 ), as shown in Fig. 8. We use this value for the feedback gain.

Entropy loss
The feedback is based on past events, and therefore its contribution to the current state of the RNG must be considered accessible to all prior to the next output. To estimate the amount of information about the PSRNG's next output bit that can be gained from knowing its prior history, we assume that p ≈ 0.5, and each measurement of n 1 (t) will belong to a binomial distribution with standard deviation σ = np(1 − p) = 158.1 bits. The standard deviation of the sum inside the feedback window of length M = 512 is Mσ = 3577.7 bits, and when multiplied by the optimum gain factor g min results in an applied feedback value of 0.0043 bits, or an adjustment to p < 4.3×10 −8 for a prior output history over the averaging window that is within one standard deviation of the mean. This shows that the per-second adjustments made by the feedback system are typically very small.
If we consider the extreme case of the feedback being calculated from an output sequence that is 5σ from the mean, then Δp = 2.15×10 −7 . With knowledge of this anomalous event an attacker trying to predict the subsequent output would gain an advantage equal to the excess predictability of the next bit. An ideal random bit has predictability 0.5, but a partially random bit has an excess predictability equal to 2×max[p(0), p(1)] -1. For the extreme 5σvalue of Δp, this results in an excess predictability of 4.3×10 −7 , a very small advantage [10]. We note that for our system, a 5σ event will occur, on average, once every 38.6 days.
Empirically, we confirmed the behavior of the feedback by recording the DAC register values for a 96 hour dataset when the feedback was operational, a histogram of which is shown in Fig. 9. The largest observed feedback signal was a per-sample correction of ± 6 DAC bits, corresponding to Δp = 3.19×10 −7 , and an excess predictability of 6.4×10 −7 . The slight increase over the theoretical estimate is due to the bit resolution of the DAC being larger than the estimated average Δp.

Results
With feedback enabled, another dataset of over 96 hours was taken. The measured σ y (τ), along with the free running and expected results from simulation, are shown in Fig. 10. In comparison to the free-running dataset, the difference between the feedback-controlled system and an ideal white noise process has been greatly reduced; σ y (τ) closely matches white noise behavior out to averaging periods of 10 5 , or approximately 27.6 hours. As can be seen in the residual difference between the two, the poor stop-band performance of the moving-average filter slightly raises the variance at shorter intervals (10 2 < τ < 10 3 ); this effect could be reduced somewhat by designing a higher-order filter. Figure 11 shows the observed bit biases with and without feedback.
The feedback-controlled PSRNG's output was evaluated with the NIST statistical test suite for random numbers [13]. When split into 24 hours datasets the feedback-controlled output consistently passed all tests. When analyzed as a single 96 hour dataset, the output narrowly fails. This is not unexpected, because with enough statistics the presence of feedback can be detected, as the feedback suppresses certain long-term behaviors that an ideal RNG would exhibit.
To visualize the timescales over which the PSRNG's output is indistinguishable from a pure random source, we compare the results of a particular test in the NIST test suite, the frequency test, for different time periods. At each iteration, 100 N-second blocks are extracted from each of the 96 hour datasets, with individual blocks being uniformly spaced to avoid testing only a small interval of data. For this test, a minimum 96 of the 100 tests must pass for the sequence to be considered random. As shown in Fig. 12, the behavior of the PSRNG without feedback almost immediately falls below this bound, while the application of feedback enabled the statistics to appear random until block sizes reach ≈ 2300 seconds. The period required to gather 100 blocks of this size is ≈ 64 hours.
The study of our relatively low-bitrate system highlights a critical deficiency that may be overlooked in the statistical testing of other physical random number generators. The 100 kHz rate of the PSRNG is several orders of magnitude lower than many modern RNG systems; for our system a 96 hour dataset produces only 34.56 Gb, and processing this dataset with the NIST test suite took over three days on a standard desktop computer. For systems with bit generation rates of hundreds of gigabits per second, a 96 hour dataset would result in many petabytes, a size infeasible to test without specialized computing resources. Often, RNGs operating at high rates only test several gigabytes of data [19], which translates into ≈ 1 ms of operation. Such a brief sample is insensitive to the long-term drifts that are typical in many electronic systems. Conclusions drawn from such brief tests include significant assumptions about the system's time (in)dependence. For many applications, particularly those involving security, those assumptions open potentially fatal issues, thus a more exhaustive testing approach that examines a system's long-term behavior is required. For RNGs with high bit rates, this could be accomplished by only storing the per-second (or longer) count totals and executing the test suites, or Allan deviation analysis, on the compressed bit totals.

Conclusions
We have presented an on-demand, ultra-low latency random number generator capable of generating a bit only 2.4 (2) ns after request, and with excess predictability of just 6.4×10 −7 . This type of specialized RNG is required for applications such as a loophole-free Bell test, which requires stringent bounds on the temporal extent of the bit generation process. Free running, the system exhibits drift that would require frequent adjustment to maintain an unbiased output, but with the addition of a feedback method we can eliminate the drift to such a degree that 24 hours of continuous output can pass the NIST RNG test suite.
While the moving average filter used to identify the drift was not optimal, its performance was sufficient for this initial exploration. Other filter types may be explored in the future. Where low-latency is required, reducing as much of the noise as possible through passive means is preferred over active methods, since stronger feedback results in a greater excess predictability through knowledge of the feedback signal.
As demonstrated above, the Allan variance is a particularly useful tool for quantifying an RNG's time-domain stability and characterizing any non-idealities it may have. We find that Fourier analysis is useful to coarsely identify the relevant bandwidth over which feedback is needed (in our case the non-white frequency components largely reside below 2×10 −4 Hz), but the Allan variance was useful for bounding and fine tuning the strength of the feedback. The Allan variance has been used previously to analyze ring-oscillator-based RNGs, where it revealed an unknown random-walk-like behavior [20]. Finally, we find that some type of long-timescale characterization is important for RNGs that are put into continuous use, and this may be an overlooked, but nonetheless critical shortcoming of ultra-high speed RNGs for which the high output rate makes acquiring and testing long-term datasets particularly challenging.
The system has been packaged in a small enclosure with its own power supply, temperature controller, USB interface, and user display. Two copies of the system are being used in further Bell-test experiments, and another is being incorporated into the NIST Randomness Beacon, which is a public service providing time-stamped and digitally signed random bit strings [21]. Schematic of the photon-sampling random number generator (PSRNG). A rising edge input to the toggle flip-flop (TFF) initiates the bit-generation process. A 950 ps electrical pulse drives a gain-switched VCSEL, whose output is attenuated and focused onto the active area of a SPAD. Detections are recorded by two flip-flop paths (not-ready and readout), which are clocked at fixed intervals determined by various delays. A logical-1 output from the notready DFF 2 corresponds to an event for which the SPAD was inactive (not-ready; NR) before the trigger arrived. If the NR output is logical-0 then the output of readout DFF, RND, is the low-latency random bit. Both the RND and NR bits are fed back to the microcontroller (μC) for use in calculating feedback, which is then applied by adjusting the forward bias across the VCSEL with the digital-to-analog converter (DAC).

Fig. 2.
Example photon-arrival-time distribution as measured by a time tagger, and the position of the temporal gating window. Events resulting from detections prior to the start are discarded, and the stop is placed such that timing jitter has a minor effect on the random bit bias. Measured bit-bias resolution of the coarse (left) and fine (right) channels of the DAC. Linear fits are used to estimate the resolutions to be 5.15(6)×10 −7 and 5.32(4)×10 −8 for the coarse and fine channels, respectively. We note that under typical operation, the full range of the fine channel is sufficient to keep the PSRNG balanced to 0.5 (green dashed line). Allan deviation (top) and residuals (bottom) of 96 hours of output with feedback disabled (blue), and an ideal white noise process (red dashed). Significant deviation occurs for sampling intervals greater than 10 3 . Although not illustrated, no significant deviation was revealed for sampling intervals < 1 s, suggesting the absence of shorter-term non-white noise. Collection of 44 dynamic Allan deviation calculations and σ = 0.99 confidence surfaces (heavy red line) expected for an ideal white noise source. The tight grouping of the individual plots indicates that without feedback the PSRNG is statistically indistinguishable from a white noise process over these sampling intervals. The DADEV is typically illustrated as a 3D surface, however, since no instabilities were visible we displayed the 2D plot. The filtering and feedback scheme. By designing an appropriate digital filter f(t), the random walk can be subtracted off, leaving a random signal well approximated by white noise. The DFT of the feedback-disabled (red) PSRNG's bit bias p demonstrates that the uncontrolled system deviates from white noise for frequencies below 2×10 −4 Hz. No discernable deviations occurred at higher frequencies. After feedback (blue), these frequency components are significantly reduced.  Histogram of the differences between successive fine DAC register values for a 96 hour dataset. The majority of the time the feedback value is actually 0 bits (no change), while the largest change is ±6 DAC bits, or Δp = 3.19×10 −7 . Allan deviation (top), and its residual difference from white noise (bottom), out to τ = 1×10 5 for the measured PSRNG's output with (red) and without (green) feedback, along with simulated results generated by applying the feedback in software to a free-running dataset (blue). For comparison, the Allan deviation of white noise is also shown (black). Bit bias for the PSRNG with (blue) and without (red) feedback enabled, when averaged into 1000 sample blocks. The random walk noise has been reduced, resulting in a stationary process centered around the desired mean. Proportion of passing values for the frequency (monobit) test without (red) and with (blue) feedback [13]. A minimum of 96 passes out of 100 (solid magenta line) are needed to conclude the sequence is behaving randomly. With feedback enabled the output of the PSRNG appears random until ≈ 2300 blocks of 100 seconds each have been sampled, or 64 hours. After this period there are enough statistics for the test suite to identify the influence of the weak feedback used to eliminate drift.