Configurable Redundancy System for Safety-Critical Applications

Abstract

In some aspects, a device includes: a first processing unit; a first power distribution network coupled to the first processing unit; a first decoupling capacitor coupled to the first power distribution network; a second processing unit configured to be the same as the first processing unit; a second power distribution network coupled to the second processing unit; and a second decoupling capacitor coupled to the second power distribution network, wherein the second decoupling capacitor is configured to have an effect on the second power distribution network that is different from the effect of the first decoupling capacitor on the first power distribution network.

Description

[0001] Priority Claim

[0002] This application claims priority to U.S. Patent Application No. 16 / 774,023, filed on January 28, 2020, entitled "CONFIGURABLE REDUNDANT SYSTEMS FOR SAFETY CRITICAL APPLICATIONS", the entire content of which is incorporated herein by reference.

[0003] This application relates to U.S. Patent Application 16 / 031,813, filed on July 10, 2018, entitled "Diverse Redundant Processing Modules for Error Detection", the entire content of which is expressly incorporated herein by reference. TECHNICAL FIELD

[0004] Aspects of the present disclosure relate to redundant systems and, more particularly, to configurable decoupling capacitors for reducing false negatives in redundant systems. BACKGROUND ART

[0005] Integrated circuits (ICs) are the core components of many electronic systems. High-performance computer systems, including those for medical devices, automotive controllers, satellites, and other advanced processing, require highly reliable, high-quality complex ICs to ensure the security and accuracy of the analytical data they process. Microprocessors and other complex ICs (i.e., GPGPUs) are primarily considered important components in these systems. They are vulnerable to electrical, mechanical, and thermal failure modes similar to other components on a printed circuit board. Sometimes, errors are caused by defective designs, in which case these errors can be considered system errors. Sometimes, processing errors have random causes, in which case these errors can be considered random errors. Random processing errors can be caused by, for example, device aging, power delivery fluctuations, process variations in device manufacturing, cosmic-ray-induced soft errors, and other environmentally induced soft errors. For example, these random causes can affect the temporal propagation of signals such that the signals do not reach components in time, resulting in the components providing erroneous outputs.

[0006] For many applications, occasional random errors are tolerable. However, for certain applications such as safety-critical applications, random errors need to be avoided as completely as possible. Examples of safety-critical applications include, for example, advanced driver assistance systems (ADAS), which may need to comply with safety standards such as ISO 26262 to ensure the functional safety of electrical components (including ADAS) in an automobile.

[0007] A conventional strategy for avoiding random errors is to capture random errors by multiple redundant processors with the same circuit design, perform the same computational tasks on the same input simultaneously, and then compare their outputs. The multiple processors are typically separate, substantially identical cores of a system-on-chip (SoC) device. If the compared outputs match, the comparator provides a pass output indicating no error. If the compared outputs do not match, the comparator provides a no pass output indicating an error.

[0008] Since the tasks and processors are designed to be the same, if the compared outputs do not match, the possible cause is a random error. Then the corresponding computation may be discarded as unreliable and the computation restarted. However, in a multi-processor device such as an SoC, where all processors are manufactured together and co-located on a shared substrate, all processors may be subject to the same random error simultaneously, which may cause the comparator to determine that all outputs are correct even when all outputs are actually in error because they match. For example, a change in the power supply voltage may cause multiple processors to have similar timing faults resulting in multiple erroneous outputs. However, the multiple erroneous outputs match each other, resulting in an incorrect determination that the outputs are error-free. Therefore, this is beneficial for reducing the likelihood of faults caused by power supply voltage changes. SUMMARY OF THE INVENTION

[0009] A simplified overview of one or more embodiments is provided below to provide a basic understanding of such embodiments. This overview is not a comprehensive survey of all contemplated embodiments and is neither intended to identify key or critical elements of all embodiments nor to delineate the scope of any or all embodiments. The sole purpose of this overview is to present concepts related to one or more embodiments in a simplified form as a prelude to the more detailed description that is presented later.

[0010] In one aspect, a device includes: a first processing unit; a first power distribution network coupled to the first processing unit; a first decoupling capacitor; a second processing unit, coupled to the first power distribution network and configured to be the same as the first processing unit; a second power distribution network coupled to the second processing unit; and a second decoupling capacitor, coupled to the second power distribution network, wherein the second decoupling capacitor is configured to have an effect on the second power distribution system that is different from the effect of the first decoupling capacitor on the first power distribution network.

[0011] In another aspect, operate the first processing unit, wherein the first processing unit is electrically coupled to the first power distribution network and the first decoupling capacitor is electrically coupled to the first power distribution network; and operate the second processing unit, which is configured to be the same as the first processing unit, wherein the second processing unit is electrically coupled to the second power distribution network and the second decoupling capacitor is electrically coupled to the second power distribution network, wherein the second decoupling capacitor is configured to have an effect on the second power distribution network that is different from the effect of the first decoupling capacitor on the first power distribution network.

[0012] To achieve the above - described and related purposes, one or more embodiments include the features that are fully described below and particularly pointed out in the claims. The following description and the drawings detail certain illustrative aspects of one or more embodiments. However, these aspects merely indicate the principles of the various embodiments that can be employed in several different ways, and the described embodiments are intended to include all such aspects and their equivalents. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 Illustrates a sample redundant system power distribution network according to an aspect of the present disclosure.

[0014] Figure 2 Illustrates an exemplary redundant system power distribution network according to an aspect of the present disclosure.

[0015] Figure 3A Illustrates an exemplary configurable decoupling capacitor according to certain aspects of the present disclosure.

[0016] Figure 3B Illustrates an exemplary embodiment of a configurable decoupling capacitor using a fuse according to certain aspects of the present disclosure.

[0017] Figure 3C Illustrates an exemplary embodiment of a configurable decoupling capacitor using a transistor according to certain aspects of the present disclosure.

[0018] Figure 4A Illustrates an exemplary placement of a decoupling capacitor in a redundant system power distribution network according to an aspect of the present disclosure.

[0019] Figure 4B Illustrates an exemplary alternative redundant system power distribution network decoupling capacitor placement according to an aspect of the present disclosure.

[0020] Figure 5 Illustrates another exemplary redundant system power distribution network according to an aspect of the present disclosure.

[0021] Figure 6 Illustrates an exemplary method of operating a redundant system according to an aspect of the present disclosure. Detailed Description

[0022] The following detailed description, presented in conjunction with the accompanying drawings, is intended as a description of various aspects and is not intended to represent the only aspects in which the concepts described herein may be practiced. The detailed description includes specific details for providing an understanding of the various concepts. However, it will be apparent to those skilled in the art that these concepts may be practiced without these specific details. In some instances, well-known structures and components are shown in block diagram form to avoid obscuring such concepts.

[0023] The power distribution network distributes power and ground voltage to all devices in the design. In deep submicron technology, shrinking device dimensions, increasing switching frequencies, and increasing power consumption result in large switching currents flowing in the power network and the ground network, which degrades performance and reliability. A robust power distribution network is necessary to ensure reliable operation of the circuits on the chip. Excessive voltage fluctuations in the power grid reduce the switching speed and noise margin of the circuits and inject noise that can cause functional failures. The capacitance between the power distribution network and the ground distribution network is called a decoupling capacitor or attenuator, which acts as a local charge storage device and helps to mitigate the voltage drop at the power supply point. The key to the problems in the design of the power grid is that there are many unknown factors before the end of the design cycle. It is beneficial if the decoupling capacitors for the power distribution network are configurable.

[0024] Figure 1Illustrates a sample redundant system power distribution network according to an aspect of the present disclosure. System 100 may be a SoC device. System 100 includes a plurality of redundant processing units 102 and a voter / comparator 104, the redundant processing units 102 such as a first processing unit 102A, a second processing unit 102B, and a third processing unit 102C. All of the processing units 102 have the same circuit design, including the same circuit specifications, configurations, and physical layout and footprint, such that given the same input 106 and excluding any unique processing errors, the inputs 106 will each produce the same outputs 108A, 108B, and 108C. Note that the inputs 106 to the processing units 102 include commands and data. However, the processing units 102 may be in different locations (but typically in adjacent areas) and may have different orientations.

[0025] The processing unit 102A, 102B, or 102C may be, for example, a central processing unit (CPU), a graphics processing unit (GPU), a neural network processing unit (NPU), a digital signal processing unit (DSP), or other processor / controller. When each of the plurality of processing units 102 performs redundant processing of the corresponding, identical input 106, the voter / comparator 104 compares the corresponding output signals of the processing units 102, such as, for example, outputs 108A, 108B, and 108C, to determine whether a unique processing error has occurred in one of the processing units 102. Specifically, if the voter / comparator 104 determines that the outputs 108A, 108B, and 108C are not exactly the same, the voter / comparator 104 provides an output indicating that at least one of the processing units 102 has suffered a processing error.

[0026] System 100 further includes a common power distribution network 110. The common power distribution network 110 is coupled to each of the plurality of processing units 102A, 102B, and 102C. To ensure the robust operation of the plurality of processing units 102, decoupling capacitors 112 are coupled to the power distribution network 110. The decoupling capacitors 112 may include one or more on-chip capacitors (e.g., MIM capacitors) or off-chip capacitors (e.g., capacitors on the package or even on the PCB).

[0027] Random failures have the potential to simultaneously affect all of the plurality of processing units 102 and result in the same, corrupted outputs 108A, 108B, and 108C. For example, each of the processing units 102A, 102B, and 102C may experience a power droop event in the common power distribution network 110, resulting in the same timing failure. Therefore, it is beneficial for the power distribution network for the plurality of processing units 102 to have diversity.

[0028] Figure 2 An exemplary redundant system power distribution network in accordance with an aspect of the present disclosure is shown. Similar to system 100, SoC 200 may be an integrated circuit device. SoC 200 includes a plurality of redundant processing units 202 and a voter / comparator 204, the redundant processing units 202 such as a first processing unit 202A, a second processing unit 202B, and in some embodiments a third processing unit 202C. All of the processing units 202 are identical, meaning that apart from inevitable variations, they have the same circuit design, including the same circuit specifications, configuration, physical layout, and footprint, such that given the same input 206 and excluding any unique processing errors, the input 206 will each produce the same outputs 208A, 208B, and 208C. Note that the input 206 to the processing units includes commands and data. However, the processing units 202 may be in different locations (but typically in adjacent areas) and may have different orientations.

[0029] The processing unit 202A, 202B, or 202C may be, for example, a central processing unit (CPU), a graphics processing unit (GPU), a neural network processing unit (NPU), a digital signal processing unit (DSP), or other processor / controller. When each of the plurality of processing units 202 performs redundant processing of the corresponding, identical input 206, the voter / comparator 204 compares the corresponding output signals of the processing units 202, such as, for example, outputs 208A, 208B, and 208C, to determine whether a unique processing error has occurred in one of the processing units 202. Specifically, if the voter / comparator 204 determines that the outputs 208A, 208B, and 208C are not exactly the same, the voter / comparator 204 provides an output indicating that at least one of the processing units 202 has suffered a processing error.

[0030] SoC 200 further includes a common power distribution network 210. The common power distribution network 210 is coupled to each of the plurality of processing units 202A, 202B, and 202C via a respective local power distribution network, such as, for example, a first power distribution network 210A, a second power distribution network 210B, and a third power distribution network 210C. To ensure the robust operation of the plurality of processing units 202, each of the local power distribution networks 210A, 210B, and 210C is coupled to a respective decoupling capacitor, such as a first decoupling capacitor 212A, a second decoupling capacitor 212B, and a third decoupling capacitor 212C.

[0031] Decoupling capacitors 212A, 212B, and 212C can be configured to adjust the impact on the corresponding local power distribution networks 210A, 210B, and 210C. Thus, excluding conventional processing, voltage, and temperature variations, due to differences in decoupling capacitors 212A, 212B, and 212C, local power distribution networks 210A, 210B, and 210C respond differently to power events such as different drops, failures, etc. For example, the capacitance values of decoupling capacitors 212A, 212B, and 212C are configured to be different from each other such that each local power distribution network in local power distribution networks 210A, 210B, and 210C can respond differently to power events. Decoupling capacitor 212A can have a first capacitance value different from the second capacitance value of the second decoupling capacitor 212B. That is, each local power distribution network in local power distribution networks 210A, 210B, and 210C has a different power drop or failure. As a result, the same timing error caused by power supply voltage variations can be minimized or avoided. The likelihood of false negatives from power supply voltage variations is reduced.

[0032] Figure 3A An exemplary configurable decoupling capacitor is shown in accordance with certain aspects of the present disclosure. Decoupling capacitor 300A includes a plurality of capacitors C1, C2, ..., Cm, and the plurality of capacitors C1, C2, ..., Cm are each coupled to a corresponding switch S1, S2, ..., Sm, all of which are coupled to a power rail 310A. The states of switches S1, S2, ..., Sm determine whether the corresponding capacitors C1, C2, ..., Cm are electrically coupled to the power rail 310A. If the switch is turned on or closed, then the corresponding capacitor is electrically coupled to the power rail 310A. Otherwise, if the switch is turned off or disconnected, then the corresponding capacitor is electrolytically decoupled from the power rail 310A. By turning on or off, closing or opening the plurality of switches S1, S2, ..., Sm, decoupling capacitor 300A is configured to have different capacitance values.

[0033] Figure 3BAn exemplary embodiment of a configurable decoupling capacitor using fuses in accordance with certain aspects of the present disclosure is shown. Similar to decoupling capacitor 300A, decoupling capacitor 300B includes a plurality of capacitors C1, C2, ..., Cm. Each capacitor in the plurality of capacitors C1, C2, ..., Cm is coupled to a corresponding switch that determines whether the corresponding capacitor C1, C2, ..., Cm is electrically coupled to power rail 310B. However, the switches are implemented as a plurality of electronic fuses F1, F2, ..., Fm. An electronic fuse is a one-time programmable memory that is programmed by applying a programming voltage and forcing a high current density through a conductor link to completely break the link, or to significantly increase the resistance. There are many types of electronic fuses, such as polycrystalline fuses, metal fuses, MOS floating gates, etc. If any of the plurality of electronic fuses F1, F2, ..., Fm is not programmed, there is a low resistance path that couples the corresponding capacitor C1, C2, ..., Cm to power rail 310B. If any of the plurality of electronic fuses F1, F2, ..., Fm is programmed with a high current, the resistance between the corresponding capacitor C1, C2, ..., Cm and power rail 310B is high, and the corresponding capacitor C1, C2, ..., Cm is effectively and permanently (or statically) electrically decoupled from power rail 310B.

[0034] Alternatively, for one example, the electronic fuses F1, F2, ..., Fm can be antifuses. An antifuse is an electrical device that performs the opposite function of a fuse. In contrast to a fuse that starts with a low resistance and is designed to permanently break a conductive path (usually when the current through the path exceeds a specified limit), an antifuse starts with a high resistance and programming it converts it to a permanent conductive path (usually when the voltage across the antifuse exceeds a specific level).

[0035] Alternatively, for another example, the electronic fuses F1, F2, ..., Fm can be programmed by a laser. In this case, the fuses are blown by a laser without an internal programming circuit, thereby allowing or prohibiting various couplings between each capacitor in the plurality of capacitors C1, C2, ..., Cm and power rail 310B. Laser programming has the advantages of saving on-chip programming circuitry and being able to be easily programmed post-silicon.

[0036] Other ways of programming the electronic fuses F1, F2, ..., Fm are possible. Additionally, the coupling between the capacitor and the power rail can be implemented with active devices. Figure 3CAn exemplary implementation of a configurable decoupling capacitor using transistors in accordance with certain aspects of the present disclosure is shown. Similar to decoupling capacitor 300A, decoupling capacitor 300C includes a plurality of capacitors C1, C2, ..., Cm. Each capacitor in the plurality of capacitors C1, C2, ..., Cm is coupled to a corresponding switch that determines whether the corresponding capacitor C1, C2, ..., Cm is electrically coupled to power rail 310C. However, the switches are implemented as a plurality of transistors T1, T2, ..., Tm. Transistors T1, T2, ..., Tm are configured to conduct dynamically or permanently or to cut off dynamically or permanently. As a result, the corresponding capacitors C1, C2, ..., Cm can be coupled to power rail 310C dynamically or statically, or decoupled from power rail 310C dynamically or statically. This can be achieved by applying different fixed voltages to the gates of transistors P1, P2, ..., Pm. The fixed voltages to gates P1, P2, ..., Pm can be the power supply voltage or the ground voltage. The fixed voltages to gates P1, P2, ..., Pm can be provided by a non-volatile memory, such as RRAM, PRAM, MRAM, or a fuse (not shown). The non-volatile memory can be part of a power management unit (not shown) and can be programmed by logic (not shown) in the power management unit.

[0037] In addition, there are alternative ways to fabricate the plurality of capacitors C1, C2, ..., Cm. For example, the plurality of capacitors C1, C2, ..., Cm can be metal-insulator-metal (MIM) capacitors, metal-oxide-metal (MOM) capacitors, metal-on-semiconductor (MOS) capacitors, any other suitable capacitors, or combinations thereof. In MIM capacitors, metal plates are stacked on top of each other and separated by a (thin) silicon oxide layer. Typically, this thin oxide is made in a special processing step because the "normal" oxide between metal layers is much thicker (for robustness), which would result in a significant reduction in capacitance per unit area. MIM capacitors are typically placed on top of a metal stack or placed together with the top metal layer. MOM capacitors consist of vertically and laterally interleaved metal fingers using existing metal layers. Compared with thin-film metal-insulator-metal (MIM) and MOS capacitors, MOM capacitors are widely used in advanced CMOS technologies due to their lower manufacturing cost and higher capacitance density.

[0038] The configurability of the decoupling capacitor, as well as the availability of various programming methods and various capacitor types, provides flexibility in terms of providing diversity in the power distribution network for multiple processing units in a redundant system, such as the diversity between power distribution networks 210A, 210B, 210C in SoC 200. For example, by using Figure 3Bthe fuses F1, F2, ..., Fm in or Figure 3C the transistors T1, T2, ..., Tm in Figure 3C , the capacitance values of the decoupling capacitors 212A, 212B, and 212C can be adjusted post-silicon based on measurements and / or tests. Different types of capacitors can also be used to provide diversity. For example, the decoupling capacitor 212A can include only MIM capacitors, while the decoupling capacitor 212B can include only MOM capacitors. Alternatively, each of the decoupling capacitors 212A, 212B, 212C can have a different combination of different types of capacitors. For example, the decoupling capacitors 212B and 212C can include MIM and MOM capacitors, and the decoupling capacitor 212B has more MIM capacitors than the decoupling capacitor 212C. Alternatively, diversity can be provided by a combination of different means. The different means and / or their combinations provide the flexibility to make full use of the on-chip available resources and improve the randomness of the power distribution network variations in different processing units. For example, depending on the process technology, placement, and routing, and design choices, there may be areas for MOM capacitors, MOS capacitors, or MIM capacitors. The combination of different means provides an opportunity to minimize resource requirements while reducing the likelihood of random failures that affect all multiple processing units in a similar way and result in false negatives in redundant systems.

[0039] Alternatively, the diversity of the power distribution networks for different processing units can be achieved by the placement of the decoupling capacitors. Figure 4A An exemplary placement of the decoupling capacitors in the power distribution network of a redundant system according to an aspect of the present disclosure is shown. The SoC 400 can be an exemplary physical implementation of the SoC 200. Similar to the SoC 200, the SoC 400 includes a plurality of redundant processing units, a first processing unit 402A, a second processing unit 402B, and a third processing unit 402C. All the processing units 402A, 402B, and 402C are identical, which means that, apart from inevitable variations, they have the same circuit design, including the same circuit specifications, configurations, and physical layouts and footprints, such that given the same input and excluding any unique processing errors, each processing unit will produce the same output. However, the processing units 402A, 402B, and 402C can be in different positions (but generally in adjacent areas) as shown here and can have different orientations. The black squares 416A, 416B, or 416C in each of the processing units 402A, 402B, and 402C represent reference points. Here, the processing unit 402B is to the right of the processing unit 402A. The processing unit 402C is below the processing units 402A and 402B. In addition, the processing unit 402C is rotated 90 degrees counterclockwise relative to both the processing units 402A and 402B.

[0040] The power distribution network (not shown) in each of the processing units 402A, 402B, and 402C is coupled to a respective decoupling capacitor, such as a first decoupling capacitor 412A, a second decoupling capacitor 412B, or a third decoupling capacitor 412C. The decoupling capacitors 412A, 412B, and 412C can be Figures 3A - 3C the decoupling capacitors in, or can be some other suitable capacitors. The decoupling capacitors 412A, 412B, and 412C can have the same capacitance value or different capacitance values. The positions of the decoupling capacitors 412A, 412B, or 412C within each processing unit 402A, 402B, and 402C are different. Using the black squares 416A, 416B, and 416C as reference points, the decoupling capacitor 412A for the processing unit 402A is in the upper left corner, the decoupling capacitor 412B for the processing unit 402B is in the middle, and the decoupling capacitor 412C for the processing unit 402C is in the upper right corner. Due to the different positions, the influence of each decoupling capacitor on the corresponding power distribution network is different. Thus, diversity is caused.

[0041] Figure 4A A sample implementation of is to have decoupling capacitors only at specific locations. Another alternative sample implementation can be to place capacitors at multiple locations and selectively couple one or more capacitors to the post-silicon power rails through programming. Figure 4B An exemplary alternative redundant system power distribution network decoupling capacitor placement according to an aspect of the present disclosure is shown. For illustrative purposes only, in Figure 4B a set of 3×3 capacitors is placed for each processing unit of the SoC 400. For example, there is a first set of capacitors 422A in the area of the processing unit 402A, a second set of capacitors 422B in the area of the processing unit 402B, and a third set of capacitors 422C in the area of the processing unit 402C. Each set of capacitors is the same, which means they are the same in terms of type, footprint, structure, and position relative to the corresponding processing unit. Each set of capacitors can be selectively coupled to the corresponding power distribution network to act as a decoupling capacitor to the corresponding power distribution network. For example, for the processing unit 402A, only the upper left corner capacitor is selectively coupled to the power distribution network of the processing unit 402A; for the processing unit 402B, only the central capacitor is selectively coupled to the power distribution network of the processing unit 402B; and for the processing unit 402C, only the upper right corner capacitor is selectively coupled to the power distribution network of the processing unit 402C. Transistors or electronic fuses or other suitable devices can be used as switches to achieve the selective coupling.

[0042] Figure 5Shows another exemplary redundant system power distribution network according to an aspect of the present disclosure. System 550 includes two parts: SoC 500 and off-chip components, and a plurality of decoupling capacitors, for example, a first decoupling capacitor 512A, a second decoupling capacitor 512B, and a third decoupling capacitor 512C. SoC 500 includes a plurality of redundant processing units 502A, 502B, and 502C, and a voter / comparator 504. Except for inevitable variations, all of the processing units 502A, 502B, and 502C are identical, which means they have the same circuit design, including the same circuit specifications, configurations, and physical layout and footprint, such that given the same input 506 and excluding any unique processing errors, each processing unit will produce the same outputs 508A, 508B, and 508C. Note that the input 506 to the processing units includes both commands and data. However, the processing units 502A, 502B, and 502C may be in different locations (but typically in adjacent areas) and may have different orientations.

[0043] The processing units 502A, 502B, or 502C may be, for example, a central processing unit (CPU), a graphics processing unit (GPU), a neural network processing unit (NPU), a digital signal processing unit (DSP), or other processor / controller. When each of the plurality of processing units 502A, 502B, and 502C performs redundant processing of the corresponding, identical input 506, the voter / comparator 504 compares the corresponding output signals of the processing units 502A, 502B, and 502C (e.g., outputs 508A, 508B, and 508C) to determine whether a unique processing error has occurred in one of the processing units 502A, 502B, and 502C. Specifically, if the voter / comparator 504 determines that the outputs 508A, 508B, and 508C are not exactly the same, the voter / comparator 504 provides an output indicating that at least one of the processing units 502A, 502B, and 502C has suffered a processing error.

[0044] SoC 500 also includes a plurality of local power distribution networks coupled to the corresponding processing units 502A, 502B, and 502C, a first power distribution network 510A, a second power distribution network 510B, and a third power distribution network 510C. For example, the local power distribution network 510A is coupled to the processing unit 502A, the local power distribution network 510B is coupled to the processing unit 502B, and the local power distribution network 510C is coupled to the processing unit 502C.

[0045] Each of the plurality of local power distribution networks 510A, 510B, and 510C has one or more IO terminals 514A, 514B, or 514C, and the IO terminals 514A, 514B, or 514C provide coupling of the corresponding local power distribution network 510A, 510B, or 510C to one of the decoupling capacitors 512A, 512B, and 512C. For example, the first one or more IO terminals 514A provide a first interface for coupling between the local power distribution network 510A and the decoupling capacitor 512A, the second one or more IO terminals 514B provide a second interface for coupling between the local power distribution network 510B and the decoupling capacitor 512B, and the third one or more IO terminals 514C provide a third interface for coupling between the local power distribution network 510C and the decoupling capacitor 512C. The IO terminals 514A, 514B, and 514C refer to the interfaces for external connection of the SoC 500 for connecting the SoC 500 to the external world. If the SoC 500 is a die, the IO terminals 514A, 514B, and 514C are IO pads on the die. If the SoC 500 is a chip, the IO terminals 514A, 514B, and 514C are IO pins on the package substrate.

[0046] The decoupling capacitors 512A, 512B, and 512C can be on the package substrate or PCB, or embedded in the package substrate or PCB. They can be ceramic capacitors, thin film and paper capacitors, aluminum, tantalum, and niobium electrolytic capacitors, polymer capacitors, etc. The capacitance of each of the decoupling capacitors 512A, 512B, and 512C can be different to create diversity in power delivery to the processing units 502A, 502B, and 502C. To enable different capacitances, the decoupling capacitors 512A, 512B, and 512C can be programmable or tunable.

[0047] Figure 6 An exemplary method 600 of an operational redundancy system in accordance with an aspect of the present disclosure is shown. At 602, operate a first processing unit (e.g., processing unit 202A, 202B, 202C, 402A, 402B, 402C, 502A, 502B, or 502C). The first processing unit is electrically coupled to a first power distribution network (e.g., power distribution network 210A, 210B, 210C, 510A, 510B, or 510C). A first decoupling capacitor (e.g., decoupling capacitor 212A, 212B, 212C, 412A, 412B, 412C, 512A, 512B, or 512C) is electrically coupled to the first power distribution network.

[0048] At 604, simultaneously, operate a second processing unit (e.g., processing units 202A, 202B, 202C, 402A, 402B, 402C, 502A, 502B, or 502C that are not the first processing unit). The second processing unit is configured to be the same as the first processing unit. The second processing unit is electrically coupled to a second power distribution network (e.g., power distribution networks 210A, 210B, 210C, 510A, 510B, or 510C). A second decoupling capacitor (e.g., decoupling capacitors 212A, 212B, 212C, 412A, 412B, 412C, 512A, 512B, or 512C) is electrically coupled to the second power distribution network. The second decoupling capacitor is configured to have an effect on the second power distribution network that is different from the effect of the first decoupling capacitor on the first power distribution network.

[0049] Different effects can be obtained from different methods. For example, the first decoupling capacitor can have a first decoupling capacitance value, and the second decoupling capacitor has a second decoupling capacitance value that is different from the first capacitance value. Both the first decoupling capacitor and the second decoupling capacitor can be programmable (e.g., decoupling capacitors 300A, 300B, or 300C). As an alternative example, different effects can be obtained from the placement of the first decoupling capacitor and the second decoupling capacitor. The position of the first decoupling capacitor relative to the first processing unit can be different from the position of the second decoupling capacitor relative to the second processing unit (e.g., the placement of the decoupling capacitors in 400).

[0050] The foregoing description of the disclosure is provided to enable a person having ordinary skill in the art to make or use the disclosure. Various modifications to the disclosure will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other variations without departing from the spirit or scope of the disclosure. Thus, the disclosure is not intended to be limited to the examples described herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An apparatus, comprising: a first processing unit; a first power distribution network coupled to the first processing unit; a first decoupling capacitor coupled to the first power distribution network; a first switch coupled to the first decoupling capacitor for adjusting the capacitance of a power signal received by the first processing unit from the first power distribution network; a second processing unit configured to be identical and redundant to the first processing unit, the second processing unit receiving the same input as that received by the first processing unit, and the second processing unit performing the same processing on the input as that performed by the first processing unit; a second power distribution network coupled to the second processing unit; a second decoupling capacitor coupled to the second power distribution network, wherein the second decoupling capacitor is configured to have an effect on the second power distribution network that is different from the effect of the first decoupling capacitor on the first power distribution network; a second switch coupled to the second decoupling capacitor for adjusting the capacitance of a power signal received by the second processing unit from the second power distribution network; and a comparator coupled to the first processing unit and the second processing unit for comparing the outputs of the first processing unit and the second processing unit, the comparator determining whether at least one of the processing units has suffered a processing error.

2. The apparatus according to claim 1, wherein the first decoupling capacitor has a first capacitance value and the second decoupling capacitor has a second capacitance value different from the first capacitance value.

3. The apparatus according to claim 1, wherein the first decoupling capacitor is programmable.

4. The apparatus according to claim 3, wherein the first decoupling capacitor is one-time programmable by a plurality of electronic fuses.

5. The apparatus according to claim 4, wherein the plurality of electronic fuses are programmed by laser.

6. The apparatus according to claim 4, wherein the plurality of electronic fuses are programmed by a programming voltage.

7. The apparatus according to claim 3, wherein the first decoupling capacitor comprises a plurality of capacitors and a plurality of switches, each of the plurality of switches being coupled to one of the plurality of capacitors.

8. The apparatus according to claim 1, wherein each of the first switch and the second switch is a transistor.

9. The apparatus according to claim 1, wherein each of the first switch and the second switch is an electronic fuse.

10. The apparatus according to claim 1, wherein the position of the first decoupling capacitor relative to the first processing unit is different from the position of the second decoupling capacitor relative to the second processing unit.

11. The apparatus according to claim 10, further comprising: a first group of capacitors in the area of the first processing unit; a second group of capacitors in the area of the second processing unit, wherein the second group of capacitors is the same as the first group of capacitors.

12. The device according to claim 11, wherein the first decoupling capacitor is one or more capacitors in the first group of capacitors, and the second decoupling capacitor is one or more capacitors in the second group of capacitors.

13. The device according to claim 12, wherein the first decoupling capacitor is configured to be coupled to the first power distribution network by selectively coupling one or more capacitors in the first group of capacitors, and the second decoupling capacitor is configured to be coupled to the second power distribution network by selectively coupling one or more capacitors in the second group of capacitors.

14. The device according to claim 1, wherein the first processing unit and the second processing unit are in a system-on-chip (SoC), and the first decoupling capacitor and the second decoupling capacitor are outside the SoC.

15. The device according to claim 14, further comprising first one or more input / output (IO) terminals and second one or more IO terminals, the first one or more IO terminals being configured to provide a first interface for coupling the first decoupling capacitor to the first power distribution network; the second one or more IO terminals being configured to provide a second interface for coupling the second decoupling capacitor to the second power distribution network.

16. The device according to claim 14, wherein the first decoupling capacitor and the second decoupling capacitor are in a package substrate.

17. The device according to claim 14, wherein the first decoupling capacitor and the second decoupling capacitor are in a printed circuit board (PCB).

18. The device according to claim 1, wherein the comparator is configured to determine whether the output of the first processing unit and the output of the second processing unit are the same.

19. The device according to claim 1, further comprising: a third processing unit, configured to be the same as the first processing unit and the second processing unit; a third power distribution network, coupled to the third processing unit; and a third decoupling capacitor, coupled to the third power distribution network, wherein the third decoupling capacitor is configured to have an effect on the third power distribution network that is different from the effect of the first decoupling capacitor on the first power distribution network or the effect of the second decoupling capacitor on the second power distribution network.

20. The device according to claim 1, wherein the first processing unit, the first power distribution network, the first decoupling capacitor, the second processing unit, the second power distribution network, and the second decoupling capacitor are integrated in a system-on-chip (SoC).

21. A method, comprising: operating a first processing unit, wherein the first processing unit is electrically coupled to a first power distribution network, and a first decoupling capacitor is electrically coupled to the first power distribution network, and a first switch is coupled to the first decoupling capacitor for adjusting the capacitance of a power supply signal received by the first processing unit from the first power distribution network; and An operation is configured to have a second processing unit that is identical and redundant to the first processing unit. The second processing unit receives the same input as the input received by the first processing unit, and the second processing unit performs the same processing on the input as the processing performed by the first processing unit. Wherein the second processing unit is electrically coupled to a second power distribution network, and a second decoupling capacitor is electrically coupled to the second power distribution network. A second switch is coupled to the second decoupling capacitor for adjusting the capacitance of the power signal received by the second processing unit from the second power distribution network. Wherein the second decoupling capacitor is configured to have an influence on the second power distribution network that is different from the influence of the first decoupling capacitor on the first power distribution network; Comparing the outputs of the first processing unit and the second processing unit using a comparator coupled to the first processing unit and the second processing unit; and Determining, using the comparator, whether at least one of the processing units has suffered a processing error.

22. The method according to claim 21, wherein the first decoupling capacitor has a first capacitance value, and the second decoupling capacitor has a second capacitance value different from the first capacitance value.

23. The method according to claim 21, wherein the first decoupling capacitor is programmable.

24. The method according to claim 21, wherein the position of the first decoupling capacitor relative to the first processing unit is different from the position of the second decoupling capacitor relative to the second processing unit.

25. The method according to claim 24, further comprising: Selectively coupling one or more capacitors in a first group of capacitors in the area of the first processing unit to the first power distribution network; and Selectively coupling one or more capacitors in a second group of capacitors in the area of the second processing unit to the second power distribution network, wherein the second group of capacitors is the same as the first group of capacitors.

26. The method according to claim 25, wherein the first decoupling capacitor is one or more capacitors in the first group of capacitors, and the second decoupling capacitor is one or more capacitors in the second group of capacitors.

27. The method according to claim 21, wherein the first processing unit and the second processing unit are in a system-on-chip (SoC), and the first decoupling capacitor and the second decoupling capacitor are outside the SoC.

28. The method according to claim 27, wherein the SoC includes a first one or more input / output (IO) terminals and a second one or more IO terminals. The first one or more IO terminals are configured to provide a first interface for coupling the first decoupling capacitor to the first power distribution network, and the second one or more IO terminals are configured to provide a second interface for coupling the second decoupling capacitor to the second power distribution network.

29. The method according to claim 21, further comprising: Determine whether the output of the first processing unit is the same as the output of the second processing unit.

30. The method according to claim 21, wherein the first processing unit, the first power distribution network, the first decoupling capacitor, the second processing unit, the second power distribution network, and the second decoupling capacitor are integrated in a system-on-chip (SoC).

Images