Monitoring circuit for determining integrated circuit

Abstract

Aspects relate to monitoring, by an integrated circuit, a timing margin of a logic path and its degradation. In one example, an apparatus includes an integrated circuit having a logic path formed therein; and a monitoring circuit formed in the integrated circuit. The monitoring circuit is configured to monitor a condition of the logical path and generate a sequence of diagnostic codes to indicate the condition of the logical path over time. A monitoring controller is configured to receive diagnostic codes in the sequence of diagnostic codes, store the diagnostic codes in a log along with corresponding timestamps, and determine a condition of the integrated circuit based on the sequence of diagnostic codes.

Description

[0001] Cross-references to related applications

[0002] This patent application claims priority to U.S. Pending Provisional Patent Application No. 63 / 514,774, filed July 20, 2023, and U.S. Non-Provisional Patent Application No. 18 / 482,703, filed October 6, 2023, which are assigned to the assignee of this application and are expressly incorporated herein by reference, as fully set forth below and for all applicable purposes. Technical Field

[0003] All aspects of this disclosure relate to monitoring the logic path of an integrated circuit, and more specifically to determining the condition of an integrated circuit based on a sequence of diagnostic codes from a monitoring circuit. Background Technology

[0004] Integrated circuits (ICs) are designed and manufactured to operate within specific temperature ranges, minimum voltages, and clock speeds. A method for providing reliable operation at a target speed is sometimes referred to as timing convergence. The minimum voltage and other parameters of an IC are selected by considering variations in the manufacturing process and the expected operating environment. An IC intended to operate in an environment with stringent temperature and voltage controls may be able to operate at higher speeds and lower voltages compared to a similar IC intended to operate in outdoor, industrial, or automotive environments.

[0005] IC performance degrades over time and with use. As ICs age, higher minimum operating voltages and slower clock speeds, or both, are required to maintain reliable operation. However, higher voltages increase power consumption and heat generation, and accelerate the rate of degradation. Degradation can lead to a random distribution of failures, typically manifesting as transient or intermittent faults. Because these failures are intermittent, the cause is difficult to pinpoint. Exposure to higher temperatures can result in more pronounced aging and degradation effects. The performance of the power delivery network (PDN) also degrades over time and with use, further contributing to the degradation of IC performance.

[0006] Higher reliability and longer lifespan increase the value of electronic systems. This is especially important for safety-critical and mission-critical systems, such as those in industrial, computing server, and automotive applications. These systems may be deployed under challenging and significantly varying conditions, and failures can cause damage and may not be easily replaceable. Summary of the Invention

[0007] The following content presents an overview of one or more specific implementations to provide a basic understanding of such implementations. This overview is not an exhaustive summary of all anticipated implementations, nor is it intended to identify key or essential elements of all implementations, nor to depict the scope of any or all implementations. Its sole purpose is to present some concepts of one or more implementations in a simplified form as a prelude to the more detailed descriptions that follow.

[0008] In one example, an apparatus includes: an integrated circuit having a logic path formed therein; and a monitoring circuit formed therein. The monitoring circuit is configured to monitor the condition of the logic path and generate a sequence of diagnostic codes to indicate the condition of the logic path over time. A monitoring controller is configured to receive diagnostic codes from the sequence of diagnostic codes, store the diagnostic codes along with corresponding timestamps in a log, and determine the condition of the integrated circuit based on the sequence of diagnostic codes.

[0009] To achieve the foregoing and related objectives, one or more embodiments include the features fully described below and specifically pointed out in the claims. The following description and accompanying figures illustrate certain exemplary aspects of one or more embodiments in detail. However, these aspects are merely indications of a number of ways in which the principles of the various embodiments may be employed, and the described embodiments are intended to cover all such aspects and their equivalents. Attached Figure Description

[0010] Figure 1 This is a diagram of an IC including a monitoring circuit according to various aspects of this disclosure.

[0011] Figure 2 This is a diagram illustrating the logic path according to various aspects of this disclosure and a monitoring circuit suitable for evaluating the performance of that logic path.

[0012] Figure 3 This is a diagram illustrating the activation of a second sensor array subordinate to the first sensor array during a voltage drop, according to various aspects of this disclosure.

[0013] Figure 4 This is a diagram of a single monitoring circuit suitable for evaluating the performance of a logic path according to various aspects of this disclosure.

[0014] Figure 5 This is a diagram of a single monitoring circuit suitable for evaluating the performance of a logic path according to various aspects of this disclosure.

[0015] Figure 6 This is a functional block diagram of a multilayer sensor system based on various aspects of this disclosure.

[0016] Figure 7 This is a functional block diagram of a second multilayer sensor system according to various aspects of this disclosure.

[0017] Figure 8 This is a flowchart illustrating the setting of the switching rate of the second sensor array to obtain a target switching rate according to various aspects of this disclosure.

[0018] Figure 9 This is a diagram of a two-stage sensor array according to various aspects of this disclosure.

[0019] Figure 10 It is a flowchart of various aspects of the logic path of the monitoring integrated circuit according to various aspects of this disclosure.

[0020] Figure 11 This is a flowchart of various aspects of predictive maintenance of integrated circuits according to various aspects of this disclosure.

[0021] Figure 12 This is a flowchart of the correction actions for integrated circuits according to various aspects of this disclosure. Detailed Implementation

[0022] The detailed descriptions following, illustrated with reference to the accompanying drawings, are intended as descriptions of various configurations and are not intended to represent the only configurations in which the concepts described herein can be practiced. To provide a comprehensive understanding of the various concepts, the detailed descriptions include specific details. However, these concepts can be practiced without these specific details. In some instances, to avoid ambiguity regarding such concepts, well-known structures and components are shown in block diagram form.

[0023] Circuits used to monitor the operational status of electronic components within a system-on-a-chip (SoC), integrated circuit (IC), or other electronic system can extend the product's lifespan. Voltage monitoring and clock speed monitoring can be used for this purpose, but they may not be accurate enough. Voltage and clock speed also do not reflect the combined effect of voltage and frequency on operational status.

[0024] As described herein, monitoring circuitry is deeply embedded within an integrated circuit (IC) to measure timing margins near a logic path within the IC and can operate at the same frequency, voltage, and temperature as that logic path. The monitoring circuitry can be constructed to resemble the characteristic circuitry of the corresponding logic path. The operation of the monitoring circuitry simulates actual circuit operation throughout the IC's lifespan. The behavior of the monitoring circuitry is similar to a full-path replica of a critical path within the IC, such as a data path consisting of sequential starting elements, combination elements, and sequential endpoint elements. In this way, each monitoring circuitry acts as a timing margin sensor at its corresponding location within the integrated circuit.

[0025] The monitoring circuitry provides measurement readings to determine the timing margin, which can be used as an estimate of the timing margin for other similarly constructed logic paths, such as those approaching or having already encountered a timing violation. In some examples, the monitoring circuitry generates diagnostic codes to indicate the condition of the corresponding logic path. In some examples, these diagnostic codes are aggregated and transmitted to the monitoring controller. In some examples, the monitoring controller aggregates at least some of these diagnostic codes. The monitoring controller generates a health status signal (e.g., margin depth) in response to these diagnostic codes. The health status signal can be used as notification for corrective actions and / or for predictive analysis of the logic path.

[0026] Using health signals, an IC can initially be configured to operate at a lower voltage and / or a faster clock speed. As the IC ages, the operating voltage may increase and / or the clock speed may decrease. When an IC operates at a lower voltage, its initial power efficiency is higher, and it also has a longer lifespan as the initial voltage and temperature decrease. The IC can be part of a larger system, such as a system-on-a-chip (SoC), a system-in-package (SiP), a multi-chip module, or other system, allowing the entire system to benefit from these advantages. The components described herein can be placed on multiple ICs or a single IC. Health signals can also be used to trigger checks, maintenance, repairs, or various warnings to suit different situations. While aspects are presented in the context of an SoC or integrated circuit, these methods and apparatuses can be applied to multiple SoCs as well as to other discrete ICs, including, for example, electronic control units (ECUs) for collision detection and avoidance, advanced driver assistance systems (ADAS) in automobiles, and other components and systems.

[0027] Operating status signals provide error detectability and also enable predictive analytics for timing margin failures. This predictive analytics can be used to develop predictive maintenance frameworks, such as those for predictive maintenance or end-of-life assessment. Predictive analytics can predict potential failures as equipment ages. This can bring significant benefits to automotive, mission-critical, and industrial applications. Failures can be predicted in advance in the field. Failure modes can also be identified, allowing for changes to be made for future equipment iterations.

[0028] Figure 1This is a diagram of an electronic system 100 with IC 102, which includes monitoring circuitry. IC 102 is powered by a power management IC (PMIC) 104 via multiple voltage rails 126. IC 102 uses a control link 124 to control the PMIC. IC 102 has multiple safety monitoring subsystems 112, 114, and 116; for simplicity, three of these subsystems are shown. Each safety monitoring subsystem can be a processing core or larger processor or a standalone processor, such as a digital signal processor (DSP), graphics processing unit (GPU), video processing unit (VPU), artificial intelligence (AI) engine, neural signal processing (NSP) engine, application-specific integrated circuit (ASIC), inertial reference unit (IRU) sensor or sensor suite, or other electronic equipment.

[0029] In all respects described herein, monitoring circuits 142, 144, and 146 can be used to monitor the timing margin (also referred to as timing guard band) of the entire IC 102. An array of monitoring circuits 142, 144, and 146 can be embedded in a security monitoring subsystem 112 of IC 102. While this description is presented in relation to one or more security monitoring subsystems coupled to a security management subsystem 118, these security monitoring subsystems are autonomously operable. In some applications, such a system may be referred to as a security subsystem, which can be a computing block such as a central processing unit (CPU), graphics processing unit (GPU), artificial intelligence (AI) processing unit, neural signal processing (NSP) unit, input / output (I / O) interface, infrastructure block (such as a memory controller), and other components (whether discrete or within a SoC).

[0030] The security monitoring subsystem may have physical characteristics and environment similar to those of the logical paths 132, 134, and 136 within the security monitoring subsystem 112 being monitored. Although only three logical paths and three monitoring circuits are shown, the security monitoring subsystem may have thousands or millions of logical paths and thousands of monitoring circuits. A security error aggregator 148 is coupled to a security management subsystem 118 within IC 102. In some aspects, the security management subsystem 118 may be referred to as a security island and has additional functionality associated with the security island. Although the security management subsystem 118 is shown as only one security monitoring subsystem coupled to security monitoring subsystem 112, a single security management subsystem may be coupled to all security monitoring subsystems, and additional security management subsystems may be used to receive error information from different components of IC 102. Error information from the security error aggregator 148 is transmitted to the security management subsystem 118, which may be a monitoring controller for analysis. In some examples, the error aggregator 120 receives the error information and stores it in log 122. The security management subsystem 118 can take action on error messages internally.

[0031] An external safety management control unit (SMCU) 106 (e.g., a functional safety system controller) is also able to access error information via external data port 166. While an SMCU is shown, any other suitable external controller may be used alternatively. A safety management subsystem 118 can communicate health messages and error information via control interface 168 (e.g., a serial bus). The external SMCU 106 may be coupled to multiple ICs 102 and multiple safety management subsystems 118 throughout the system. The external SMCU 106 may also be coupled to external devices for reporting, diagnostic, and informational purposes. In some examples, external data port 166 provides functional safety (FUSA) messages to be transmitted to the external SMCU 106. A safety error aggregator 148 can be configured to transmit FUSA-ERROR and FUSA-WARNING messages to the safety management subsystem 118. The safety management subsystem can then use external data port 166 to transmit FUSA-ERROR and FUSA-WARNING, or any other suitable messages, to the external SMCU 106. The security management subsystem can use an external data port to enable the external SMCU 106 to access data.

[0032] In some aspects, a FUSA-WARNING message may be transmitted when the timing margin is within maintenance limits (e.g., timing is slightly beyond expected timing). A FUSA-ERROR message may be transmitted when the timing margin is within zero margin (e.g., timing has no further margin to avoid errors or is close to error conditions). Additional messages may be present to indicate which monitoring circuits or groups of monitoring circuits are operating within or outside the allowable margin and by what amount of margin. These messages may be configured to conform to external standards and provide diagnostic and maintenance information.

[0033] Throughout this paper, timing margin is expressed as the number of buffer or inverter circuits. Typical processor circuitry has 15 to 100 buffer-equivalent delays in the logic path, depending on the frequency. The setup timing margin (also known as the guard band) is measured in units of normalized buffer or inverter delays. In some implementations, the delay line is constructed from inverters. Monitoring circuitry measures the setup timing margin. For the setup time to be sufficient for normal operation, the transition at the endpoint memory element must be fully stable before the next valid edge of the clock signal.

[0034] Maintenance level messages can trigger maintenance operations. For example, the safety management subsystem or CPU or other processing core can enable PMIC 104 to supply a different, safer voltage via voltage rail 126 at the appropriate time (e.g., upon the next startup, during the next drive cycle, or immediately after notification). Maintenance level messages can be monitored over time, allowing consistent messages to escalate error levels and generate diagnostic codes for the external SMCU 106. This may result in the code being displayed on a user interface or transmitted to an external maintenance facility. When a zero margin message is generated, it can be considered a potential safety or failure warning. When a zero margin message recurs after a voltage adjustment or restart, the safety management subsystem can initiate a full or partial shutdown. The safety management subsystem can also notify the external SMCU to take necessary actions according to the safety policies contained within the SMCU, bringing the system into a safe state. A safe state can be a lower performance state, a lower functionality state, or a complete shutdown for one or all systems of IC 102. A safe state can also include notification to the driver or user about errors or new operating states indicating limited functionality. Log 122 is also available via external data port 166 for testing, predictive maintenance, and research purposes to understand the behavior of IC 102 over time.

[0035] Error aggregator 120 receives margin measurements from security error aggregator 148 in each of the security monitoring subsystems 112, 114, and 116. Margin measurements, or security errors, are aggregated at security error aggregator 148 and stored in log 122. The aggregated margin measurements may be stored in log 122 as a sequence of diagnostic codes collected over time during the operation of IC 102. When a code in the diagnostic code sequence exceeds a pre-configured marginal threshold, the diagnostic code sequence may be stored in log 122. Diagnostic codes may be tested or analyzed to look for aging flags, for example, stored as markers in log 122 or another non-volatile memory or external system of IC 102. As aging flags accumulate over the lifetime of IC 102, the IC may be configured to read these aging flags and apply corrective actions, such as aging compensation, upon any system startup. Reading and application may be performed by security management subsystem 118 or any other suitable component of IC 102 or an external component. After the corrective action is applied, if the monitoring circuit reports an error, warning, or similar problem in the IC, a new aging flag (e.g., a marker) can be stored. Log 122 can be used for diagnostic tracking of the stored aging flags.

[0036] When any IC or part of an IC within IC 102 deteriorates or fails completely for any reason, monitoring circuitry can be used to detect its timing margin. Monitoring circuits 142, 144, and 146 transmit the detected margin level to the safety error aggregator 148. The margin measurement can take the form of a diagnostic code with a single bit for positive or zero margin, or in the form of a diagnostic code with multiple bits (e.g., 2 bits or 8 bits) to indicate the margin. Monitoring circuits 142, 144, and 146 can be configured to monitor specific logic paths 132, 134, and 136, but the detected performance can also indicate the condition of many other paths of the IC (not shown for simplicity). The operating condition of monitoring circuits 142, 144, and 146 can represent the condition of a larger area or a specific segment of IC 102.

[0037] The minimum voltage (Vmin) required for reliable circuit operation degrades over time, making the voltage supplied by the PMIC 104 potentially too low for reliable operation. This can lead to undervoltage issues. Aging and degradation may require a higher voltage setpoint than the one set for the new system during IC manufacturing and testing. IC degradation may also have exceeded the scope of other compensations performed during factory testing and characterization. These compensations may include process variation compensation and temperature variation compensation.

[0038] Monitoring circuits 142, 144, and 146 are used to determine which regions of IC 102 and which types of logic paths 132, 134, and 136 fail to meet the setup timing requirements for reliable operation. In some cases, timing failures in the IC logic paths can lead to malfunctions or complete loss of functionality. The voltages applied to various parts of IC 102 by PMIC 104 via voltage rail 126 can be adjusted via control link 124 between PMIC 104 and safety management subsystem 118. This voltage can be adjusted, for example, increased.

[0039] Time-dependent degradation can be partly caused by electromigration, which effectively increases the resistance of the metal conductors on the IC, passing through the die and also through the package and package connectors. Printed circuit board (PCB) metal traces are also affected by electromigration. Time-dependent degradation can also be caused by the hot carrier injection (HCI) effect, which effectively leads to a gradual shift in the transistor threshold voltage (Vt). Additional time-dependent degradation may be caused by negative bias temperature instability (NBTI) and positive bias temperature instability (PBTI) effects, which can also cause a gradual shift in the transistor threshold voltage (Vt). These degradation phenomena can lead to random errors throughout the IC's logic path.

[0040] Aging and degradation can also lead to defects or short-duration pulse interference in the power delivery network (PDN) and power management integrated circuit (PMIC) that supply power to the voltage rails coupled to the IC. Degradation can also cause excessive clock jitter or short-duration pulse interference in the phase-locked loop (PLL) and clock distribution within the IC. These brief, transient power and clock short-duration pulse interferences or excessive clock jitter can be difficult to detect and can affect circuit operation. Like the ICs they are coupled to, PMICs and PDNs may require higher minimum voltages over time. Higher voltages prevent the random distribution of faults, which typically manifest as transient or intermittent faults that occur momentarily during operation. These faults may stop for a period and then reappear in unpredictable patterns. Another cause of errors is the degradation of capacitors used in PDNs and PMICs. These may no longer be able to adequately respond to changes in IC load. Capacitors also degrade over time, leading to larger voltage drops on the power rails. Some capacitors may lose up to one-third of their original capacitance over the lifespan of the system.

[0041] Monitoring circuits 142, 144, and 146 can be used to monitor the timing effects of voltage-dependent stress, temperature-dependent stress, and activity-dependent stress on the circuitry of an IC (including logic paths, PLLs, and clock distributions). Additionally, monitoring circuits 142, 144, and 146 can be used to monitor the path margins of voltage-dependent stress, temperature-dependent stress, and activity-dependent stress on the circuitry of a PMIC and a PDN. Additionally, monitoring circuits 142, 144, and 146 can be used to monitor the timing effects of physical defects on a PCB, such as capacitors losing proper electrical connection to the PCB. By using a separate circuit with margin control, this circuit can be configured to fail first (e.g., providing an indication of depleted or reduced operating margin) and provide an indication of the depth of margin reflecting the overall effects of silicon performance, voltage, frequency, and temperature. The monitoring circuit fails first because it can be configured to fail before the monitored circuitry. This allows for the early generation of indications for maintenance or initiation of an orderly shutdown. This configuration is referred to in this paper as the worst-case replication path because the monitoring circuitry reflects the worst-case manufacturing and operational conditions regarding failure.

[0042] Monitoring circuits 142, 144, and 146 can take the form of worst-case path replicas of logic paths 132, 134, and 136 within a safety monitoring subsystem with associated checker logic. Critical circuits exhibiting worst-case behavior can be selected for monitoring. The replicated path replicates the timing of the logic circuit path and the sequential elements of the associated combinational logic path. This allows the timing margins of the logic circuit path and the sequential elements of the associated combinational logic path to be replicated. The replicated path can be formed near the logic path 132, 134, and 136 to be monitored. This can include replicated paths deeply embedded in safety-critical circuits and operating at the same frequency, voltage, and temperature as the safety-critical circuits. The monitoring circuit replicates the timing aspects of the operation of the actual safety-critical circuit being monitored during mission mode or another mode. Mission mode is a concept in automotive functional safety. The IC, including the safety monitoring and safety management subsystems, completes the startup and initialization process to enable path margin monitoring. The anticipated safety mechanisms are activated, and fault monitoring of the safety management subsystem is activated. Following these operations, the safety monitoring subsystems 112, 114, and 116, as well as the safety management subsystem, are in task mode while performing their defined safety functions. Path replicas are monitored, and their margin measurements can be used as input for operational status monitoring and as data for predictive analytics. This analytics can predict failures that may later manifest as faults within the monitored path as it deteriorates further.

[0043] The output can be provided to more advanced software systems for evaluation. Monitoring circuitry can be used to reduce costs in automotive safety, aging tracking, predictive maintenance, power optimization, and testing. Using more advanced software, events marking IC aging can be logged and used to adjust the IC's voltage, frequency, and activity in the next startup or drive cycle. Aging tracking can be performed by storing aging flags once per drive cycle into non-volatile memory (e.g., a log). These flags are then read at the next system startup. Power management IC voltage settings can be increased based on the number of aging flags until a maximum voltage limit is reached. Once the maximum voltage limit is reached, a maintenance event can be declared.

[0044] Figure 2 This is a generalized diagram of a logic path and a monitoring circuit suitable for evaluating the performance of that logic path. A portion of IC 200 may have thousands or millions of transistor circuits forming a logic path that operates at a specific switching rate. The switching rate is determined by the switching activity of the corresponding transistor switches. For example, a logic path that changes the state from 0 to 1 in one cycle and then from 1 back to 0 in the next cycle has the maximum switching rate. Logic paths that are rarely used (e.g., square root circuits) will have lower switching rates than logic paths that are frequently used (e.g., adder circuits). In addition to the nature of the circuit, the switching rate depends on the input clock rate and duty cycle of each specific switching device (e.g., transistor, logic gate, etc.). Accordingly, different parts of the IC and different circuits within each part have different switching rates. Inputs or feedback are received at the starting storage element 202 (e.g., a collection of flip-flops) and applied to logic path 204 (e.g., a combinational logic path) for processing. Logic path 204 generates an output that is transmitted to the endpoint storage element 206 (e.g., an additional set of flip-flops) to provide output that is transmitted to other logic paths (not shown) for additional processing. From a timing perspective, signal feedbacks 208 and 210 represent a generalized structure of the monitored logic paths within IC 200.

[0045] Monitoring circuit 201 can be used as a sensor and has a start-point storage element 212 that generates deterministic or random values ​​as input to the replicated logic path 214. The replicated logic path 214 is not used to generate or process data, but rather to replicate the timing aspects of the operations associated with the logic path 204 to be monitored. The replicated logic path 214 can be formed in a manner corresponding to that of logic path 204 and can be formed with a lower manufacturing margin, such that the replicated logic path 214 may fail before logic path 204. The replicated logic path 214 is driven at the same voltage and experiences the same temperature as logic path 204. The switching rate of the replicated logic path 214 can be controlled, resulting in degradation similar to, slower than, or faster than that of logic path 204, for example, slightly faster degradation. For some instances, the switching rate may be slightly faster than that of logic path 204, but for others, it may be slightly slower. The replicated logic path 214 can operate in worst-case conditions to ensure that errors are generated before system failure. The copy logic path 214 can also operate at a known switching rate that has a predetermined relationship with the expected worst-case switching scenario of the functional path.

[0046] In some examples, a simple switching rate control mechanism (not shown) can be implemented using time window averaging. The switching rate mechanism can be coupled to the input of the starting storage element 212 or to the clock input of a circuit (not shown). The switching rate mechanism applies the input at an regulated rate or provides the clock signal at an regulated rate to achieve a specific switching rate. Within a given periodic time window, the number of switches of the monitoring circuit is counted. If the observed switching rate is higher or lower than a preset threshold, the switching rate of the replicated logic path 214 is adjusted upwards or downwards to the preset value for the next time window. In examples, such as... Figure 6 , Figure 7 and Figure 9 As shown, there are two path margin sensor arrays, and the monitoring circuit 201 is a representative example of the sensors in either the first or second sensor array. In some respects, the sensors in the first and second sensor arrays are identical but have different switching rates. In some respects, the sensors in the second sensor array are configured and manufactured to more closely resemble the corresponding monitored circuit. The number of times the second sensor array switches within a periodic time window is counted. (As shown in...) Figure 3 , Figure 6 and Figure 7In more detail within the context, if the observed switching rate of the second sensor array is higher than a preset threshold, then for the next time window, the replication path margin threshold of the first sensor array used to activate the second sensor array can be adjusted to reduce the trigger frequency by a preset value. When the time window includes both active and inactive periods within the same time window, changing the threshold used to activate the second sensor array will shift the switching rate of the entire window toward the desired target. The second sensor array can switch at the system clock rate when active, but the duty cycle of the monitoring circuitry will be reduced. Similarly, if the observed switching rate is low, the opposite adjustment is made.

[0047] Because the switching rate is characterized for a specific manufacturing process and circuit configuration, its impact on aging degradation may be known, for example, predetermined based on semiconductor process and operating voltage / temperature conditions. The worst-case switching condition, expressed as the switching rate, may also be known. In some examples, the worst-case switching rate condition may be chosen as the target to be achieved by replicating logic path 214.

[0048] The output of the replication logic path 214 is provided to a configurable delay chain 218 coupled to the endpoint storage element 216. The configurable delay chain 218 produces multiple versions of the output of the replication logic path 214 with different delay amounts. Registered versions of the output of the configurable delay chain 218 are passed from the endpoint storage element 216 to the check circuit 220. The path cycle time 230 between the starting storage element 212 and the endpoint storage element 216, with the delay chain 218 configured for the lowest delay, can be considered as worst-case negative timing relaxation timing convergence. Timing checks can be performed using the configurable delay chain 218. The check circuit 220 compares the registered version captured by the endpoint storage element 216 at the output of the configurable delay chain 218 with a reference value from the checkpoint storage element 224 that did not pass through the replication logic path 214. Using this comparison, the timing margin of the sensor is determined at the check circuit 220. The timing margin between the output of replication logic path 214 and the input of endpoint storage element 216 is determined by a comparison at check circuit 220. Checkpoint storage element 224 provides the expected value. Endpoint storage element 216 provides the captured value after the delay caused by replication logic path 214 and configurable delay chain 218. If the values ​​from endpoint storage element 216 and checkpoint storage element 224 are the same, the timing margin to endpoint storage element 216 is at least the amount of configurable delay chain 218. Check circuit 220 generates an error or margin code 222 for replication logic path 214 to reflect this comparison. Check circuit 220 generates error or margin code 222 as a timing margin status message. This message can be sent to an aggregator or monitoring controller (not shown). In the illustrated example, the actual endpoint is not loaded into the check. The check is performed based on the value received from endpoint storage element 216.

[0049] Storage elements 212, 216, and 224 are clock-driven, and the checking circuit 220 can be driven by the same clock to generate error / margin status codes. Monitoring circuit 201 can also operate with a specific duty cycle using an enable signal (not shown). A monitoring controller (not shown) can drive the enable signal (e.g., high or low, or on or off) to control monitoring circuit 201. Multiple redundant monitoring circuits may exist in any desired integrated circuit area. The monitoring controller may be able to individually disable any monitoring circuit using the enable signal. Measures may also exist to globally disable all monitoring circuits using a common signal coupled to the enable signal or a broad addressing scheme.

[0050] Even if margin violations occur during voltage and frequency change events due to the system's Dynamic Voltage and Frequency Scaling (DVFS) functionality, a margin code can still be generated. While individual clock and voltage monitors could introduce monitoring limitations and monitoring gaps during DVFS system transitions, this is unnecessary for this type of monitor. The described monitoring circuitry is capable of continuously monitoring the IC and is independent of operation, such as the voltage and frequency state of the monitored circuit. A single monitoring circuitry can be used for continuous coverage, or multiple monitoring circuitry can be used as a sensor array for continuous coverage. Monitoring remains continuous even when clock and voltage monitors are unavailable.

[0051] The switching rate of the replication logic path 214 can be controlled, and the entire path from the starting storage element 212 to the ending storage element 216, etc., can be turned off or disabled to reduce power consumption. In some examples, margin codes are continuously reported at the selected switching rate. In some examples, a second sensor array of the monitoring circuitry also switches during worst-case system conditions. Additional monitoring during worst-case conditions can provide continuous margin depth reporting when the system requires it.

[0052] Figure 3 This is a diagram depicting sensor activation in two sensor arrays during a voltage drop in a two-stage arrangement. The sensors in each sensor array can be formed by monitoring circuitry 201, or as... Figure 4 and Figure 5 As shown. The first sensor array (L1) has a continuously operating clock signal 302 reflecting the continuous monitoring function of the L1 array. The clock signal on Figure 300 is shown as the transition between high and low logic levels on the vertical axis relative to the time on the horizontal axis. The voltage 304 applied to the IC is shown as the amplitude on the vertical axis relative to the time on the horizontal axis. The voltage 304 is affected by various conditions such as load, temperature, and aging that cause voltage changes. A voltage trigger level 306 is shown to depict the concept of two-level monitoring. The voltage trigger level 306 is controlled by comparing a timing margin threshold with a margin indication from the L1 sensor array.

[0053] At time 312, a drop in voltage 304 below voltage trigger level 306 triggers margin violation indication 308, causing it to transition from a low logic level to a high logic level at time 316. The margin violation indication 308 of the L1 array can then be used to trigger the enable signal 310 of the second sensor array (L2), causing it to transition from a low logic level to a high logic level at time 318. When this event occurs, voltage trigger level 306 is correspondingly used to enable the L2 sensor array as voltage 304 has moved to an area requiring more active monitoring. Similarly, an increase in voltage 304 above voltage trigger level 306 at time 314 causes margin violation indication 308 to transition from a high logic level to a low logic level at time 320. This subsequently causes enable signal 310 to transition from a high logic level to a low logic level at time 322.

[0054] When enable signal 310 is high, the L2 sensor array is clocked by clock signal 332 between time 318 and time 322. The L2 clock signal has a flat region 330 (e.g., a disable region) before enable signal 310 goes high at time 318 and a flat region 334 after enable signal 310 returns to low at time 322. The L2 sensor array can provide higher accuracy (also referred to as greater depth or greater reporting depth), an indication of timing margins for the monitored circuitry of the IC, or may produce the same depth. In some implementations, the L2 sensor array can provide higher accuracy by using a larger number of monitoring circuits in the array, regardless of whether the monitoring circuitry of the L2 sensor array is the same as or different from that of the L1 sensor array. In some implementations, the L2 sensor array can provide greater depth by using a larger number of delay elements in a configurable delay chain. In a two-level (L1, L2) system, corrective actions and health reports can be based on an indication of higher accuracy margins for the L2 sensor array. When enable signal 310 is at a low logic level, the power consumption of the L2 sensor array is reduced or eliminated because operation is stopped. This also reduces heat and aging of the rest of the IC. As shown, the dwell time of enable signal 310 is monitored to infer the actual average switching rate of the L2 array.

[0055] Figure 4This is a diagram of a single monitoring circuit 400, suitable for use as a sensor as described herein, and providing a building block for a larger array of monitoring circuits suitable for evaluating the performance of logic paths. A system clock 402 is supplied to a start-point storage element 424. A start timing signal 418 from the start-point storage element 424 is applied to a worst-case replication path 416. The worst-case replication path simulates the operation and wear of the logic circuitry of the analog IC. Surrounding components control the switching rate of the worst-case replication path 416 and provide a timing criterion for comparison with the timing of the worst-case replication path 416. This timing criterion comes from a checkpoint storage element 428 that conveys the expected result at timing output 430. This expected result is the result of producing a fully functional monitored circuit with robust timing margins. The difference between the timing criterion and the worst-case replication path is derived at match checks 432, 434 to determine the timing margin. The output signal 414 of the worst-case replication path 416 is applied to a delay chain 440 and the input of a zero-margin point storage element 412. In the worst case, the replication path 416 operates with timing and switching rates set by the monitoring controller (not shown) to best reflect the condition of the associated logical path.

[0056] Delay chain 440 generates a delayed version 442 of output signal 414. In some aspects, multiple delayed versions 442 of output signal 414 exist, and all of these versions are supplied to multiplexer 446. Multiplexer 446 is controlled by an external margin configuration signal 448, which may be provided by, for example, a monitoring controller (not shown), to select one delayed version of delay version 442 as the output 450 of multiplexer 446 to margin point storage element 452. Margin point storage element 452 uses system clock 402 to generate an appropriate timing signal 454 to be applied to a reduced margin match check 432. The timing signal 454 from margin point storage element 452 is a registered version of output signal 450, which represents the overall timing of the worst-case copy path 416 with the additional delay 440. The amount of delay is controlled by the margin configuration signal 448 at multiplexer 446. Then, the reduced margin matching check 432 compares the timing signal 454 at the output of the margin point storage element 452 with a reference from the check point storage element 428 to determine the reduced margin indication 460.

[0057] Zero-margin point storage element 412 also receives the output signal 414 of the worst-case replication path 416 and the system clock 402, and generates timing signals 436 to be applied to the zero-margin match check 434. The inputs to the zero-margin point storage element 412 have no delay from the delay chain 440 or the multiplexer 446. The zero-margin match check 434 then compares the timing signal 436, the zero-margin signal from the zero-margin point storage element 412, with the same reference from the checkpoint storage element 428 to determine a zero-margin indication 462. Timing signals 454 and 436 provide the observed outputs to determine the margin and zero-margin condition of the worst-case replication path circuit 416. The timing signals reflect the timing of the worst-case replication path 416. Timing output 430 provides a reference, such as the expected value used for timing checks.

[0058] As mentioned above, the start timing signal 418 drives the input of the worst-case replication path at the desired switching rate. To enable the sensor and adjust the switching rate of the start timing signal 418 of the start point storage element 424, the start timing signal is also provided to NAND gate 420, which performs a NAND operation on the start timing signal 418 and, for example, an enable signal 422 from a monitoring controller, to generate a NAND output 426. The NAND output drives the operation of the start point storage element 424 based on the enable signal 422. The checkpoint storage element 428 receives the start timing signal 418. The NAND output 426 is coupled back to the start point storage element 424. As a result, the start point storage element 424 generates the start timing signal 418, which switches when the enable signal 422 to the NAND gate 420 is active. The checkpoint storage element 428 generates a timing output 430 reflecting the timing of the start point storage element 424. When worst-case replication path 416 generates an output with reduced margin or maintenance level, timing output 430 is applied to reduced margin match check 432 to generate reduced margin indication 460, as described above. When worst-case replication path 416 generates an output with zero margin or error level, timing output 430 is also applied to zero margin match check 434 to generate zero margin indication 462, as described above. Therefore, monitoring circuit 400 generates at least one of the following two signals: reduced margin indication 460 and zero margin indication 462. This allows indication of the condition of the underlying IC in the region of the monitoring circuit. These two signals can be translated into diagnostic codes, and the outputs of many monitoring circuits can be aggregated or combined in any way to generate diagnostic codes with higher precision or more bits. Monitoring circuits can be used in first-level or second-level sensor arrays, and many such monitoring circuits 400 can exist in each array. Further multiplexer output 450 can be used with further match checks to generate more indications.

[0059] Figure 5 This is a diagram of another single monitoring circuit 500, which can form an array suitable for evaluating the performance of logic paths. Worst-case replication path 506 operates using a start timing signal 530 and a switching rate set by a monitoring controller (not shown) to best reflect the condition of the associated logic path. Worst-case replication path 506 generates an output signal 504, which is directly applied to the margin point storage element library 502 and the delay chain 508.

[0060] The system clock signal 520 (clk) is also supplied to the margin point storage element library 502, for example, to generate a set of flip-flops that are applied to the corresponding match checks 522, 524, 526 for multiple timing outputs 512, 514, 516. The delay chain 508 receives the output signal 504 from the worst-case replication path and generates a delayed version 510 of the output signal 504. This delayed version allows the margin point storage element library 502 to form the basis for multiple timing outputs 512, 514, 516 and has a higher latency than... Figure 4 A simpler circuit is shown. Although three timing outputs are shown, more timing outputs can exist, for example, six or eight timing outputs for six-bit or eight-bit margin codes. In some respects, only one or two timing outputs may exist for one-bit or two-bit margin indications.

[0061] The start point storage element 536 generates a start timing signal 530 in response to the system clock 520 and the NAND output 534. (Similar to...) Figure 4 For example, when NAND gate 532 is enabled by the enable signal, the start timing signal 530 is switched. The start timing signal 530 is provided to checkpoint storage element 538. Checkpoint storage element 538 is also coupled to system clock 520 (clk) to generate a timing output 518 reflecting the state of startpoint storage element 536. The timing output 518 is applied to each of match checks 522, 524, 526 to collectively generate multiple bit diagnostic codes, such as margin codes. Each match check 522, 524, 526 receives the same timing output 518 from checkpoint storage element 538 and compares this timing output with different timing outputs 512, 514, 516 from margin point storage element library 502 to perform different timing comparisons and generate different portions of the margin code. The outputs of each match check 522, 524, 526 are combined to create margin codes that can be used as diagnostic codes or indications of the condition of ICs in the monitored area. These codes can be aggregated with codes from other monitoring circuits.

[0062] Figure 6This is a functional block diagram of a multi-layer sensor system. SoC 602 contains a logic path 604 of the SoC's processor and memory, monitored by two levels (L1 and L2) of monitoring circuitry. The logic path and monitoring circuitry are distributed throughout the SoC, but for better illustration of function and connections, they are shown as isolated in the diagram. A first sensor array 606 represents the first level (L1), and a second sensor array 608 represents the second level (L2). Both the first sensor array 606 and the second sensor array 608 are coupled to a monitoring controller 610 via a control channel 611. [The last sentence appears to be incomplete and possibly refers to a different system or technology.] Figures 2 to 5 The monitoring circuitry described in any one or more of the above can be used to form a sensor array. The two-stage monitoring circuitry allows the condition-enabled controller 642 to enable the second sensor array 608 in response to a margin indication from the first sensor array 606.

[0063] In some examples, the second sensor array 608 is enabled less frequently, allowing for more accurate tracking of the SoC's logic path and memory aging by matching the SoC's worst-case switching rate. In any real-world circuit, the duty cycle or switching rate of each subsystem is less than 100% because not all circuitry is always in use. Depending on the manufacturing technology, circuitry ages and degrades at different rates, depending on its operating duty cycle or switching rate. In many VLSI technologies, transistor switches age faster at lower switching rates. Therefore, a sensor operating at 100% switching rate during normal system operation will not age at the same rate as the logic path being monitored. Thus, reducing the sensor's switching rate allows the sensor to more accurately track the aging of the monitored circuitry.

[0064] Furthermore, the second sensor array 608 can be turned off or operated at a low duty cycle to reduce power consumption while still providing monitoring coverage during voltage drop events. A margin state 644 from the first sensor array 606 is applied to a conditional enable controller 642, which can be implemented as part of the monitoring controller 610 or as a separate component. When the margin state indicates that more accurate margin tracking is appropriate, such as during a voltage drop event, the conditional enable controller 642 generates an enable signal 646 to enable the second sensor array 608. The sensors are configured near the logical path 604 of the processor and memory and are operated to replicate the worst-case operation of the corresponding logical path.

[0065] In this example, a first sensor array 606 is formed within an integrated circuit of SoC 602. The sensors in the first sensor array 606 have paths through the integrated circuit and are configured to generate a first-level indication of the condition of the integrated circuit. Similarly, a second sensor array 608 is formed within the integrated circuit. The sensors in the second sensor array 608 have paths through the integrated circuit and are configured to generate a second-level indication of the condition of the integrated circuit. In this description, the path through the integrated circuit is a path that has been fabricated as part of the integrated circuit using the same or similar technology as the monitored circuit. Multiple sensors can provide distributed coverage through the IC to observe the effects of localized changes and deploy different kinds of replicas to reflect more paths through the IC. The first-level and second-level indications can be multiple-bit diagnostic codes or have some other format. In some aspects, the second-level indication provides full reporting accuracy or full reporting depth relative to the first-level indication. In some aspects, the sensors in the first sensor array and the sensors in the second sensor array have the same accuracy, resolution, reporting depth, and operating range. The sensors between the first and second sensor arrays can be similar or identical. Accuracy in terms of resolution and measurement error can also be the same. In some respects, the sensors in the first sensor array have lower accuracy, lower resolution, or a smaller operating range, and are used to enable the second sensor array as described below. In such respects, the first sensor array determines certain degradation of the timing margin, and then the second sensor array is able to report the timing margin with full reporting accuracy or full reporting depth.

[0066] A monitoring controller 610 is coupled to a first sensor array 606 and a second sensor array 608, and is configured to receive a first-level margin indication and a second-level margin indication. The monitoring controller 610 or a conditional enable controller 642 can actuate the second sensor array 608 in response to a margin depth indicated by the first-level indication falling below a threshold. A control channel 611 is coupled to the monitoring controller 610, the first sensor array 606, and the second sensor array 608. The second sensor array can be actuated by an enable signal from the monitoring controller 610 on the control channel 611, and disabled by a disable signal from the monitoring controller 610 on the control channel 611. In another embodiment, the second sensor array can be actuated by an enable signal 646 from the conditional enable controller 642.

[0067] The monitoring controller 610 includes a switching rate controller 612 coupled to a first sensor array 606 (L1 array) and a second sensor array 608 (L2 array) to control the switching rate of the second sensor array 608. In some examples, the switching rate of the first sensor array 606 is closely related to the system clock rate. In some examples, the switching rate controller 612 controls the switching rate of the first sensor array 606 and the second sensor array 608. In some examples, the switching rate controller 612 is configured to: observe an enable signal 646 of the second sensor array 608 and infer the switching rate of the second sensor array 608; compare the switching rate of the second sensor array 608 with the worst-case switching rate of the system; and adjust the switching rate of the second sensor array 608 in response to the comparison by adjusting a margin threshold of the first sensor array 606 on which the actuation of the second sensor array 608 is based. The switching rate controller can adjust the switching rate of the second sensor array 608 to increase or decrease the degradation of the second sensor array 608 relative to the logic path 604. The switching rate controller can observe the switching rate of the second sensor array 608 by counting the number of enable events of the second sensor array 608 within a pre-configured time window. In some examples, the number of enable events of the second sensor array 608 is counted by observing the enable signal 646. The second sensor array 608 is activated by the enable signal 646. When enabled, the enable signal 646 can enable the clock or allow the start point for internal switching within the second sensor array 608. The switching rate controller 612 operates such that the enable signal 646 follows a target switching rate.

[0068] The first sensor array 606 includes a first aggregator 632 for aggregating first-level indications (e.g., aggregating first diagnostic codes) for the sensors in the first sensor array 606 and generating margin codes from the first sensor array 606. Similarly, the second sensor array 608 includes a second aggregator 634 for aggregating second-level indications (e.g., aggregating second diagnostic codes) for the sensors in the second sensor array and generating margin codes for the second sensor array 608. The monitoring controller 610 receives margin codes from the first aggregator 632 and the second aggregator 634 via a control channel 611. When a first-level indication or a second-level indication suggests a warning or error, interrupt logic 636 of the SoC 602 may be activated to notify the system, or the event may be logged in a sticky tag in log 614 for later reading by the monitoring controller 610 or an external SMCU 630. The system may take appropriate corrective action or provide trigger or maintenance status according to a security policy. The interrupt logic may be configured to initiate a shutdown process for at least a portion of the integrated circuit in response to a margin code. Interrupt logic 636 can be integrated with monitoring controller 610 or other components of SoC 602.

[0069] The monitoring controller 610 is also coupled to or includes a log 614 to store diagnostic codes from the first sensor array 606 and the second sensor array 608. The monitoring controller 610 receives margin codes over time as a sequence of diagnostic codes. The monitoring controller can form the sequence of diagnostic codes and store it in the log along with a corresponding timestamp and other concurrently occurring information, such as temperature, frequency, or indications of the current use case, or instruct the processor to store them together in the log. The monitoring controller 610 can be configured to store the diagnostic code sequence in the log 614 when a code in the sequence exceeds a pre-configured marginal threshold. The monitoring controller 610 can use the diagnostic code sequence to determine the condition of the integrated circuit. The monitoring controller can then generate a health signal and transmit the health signal to a higher layer, such as an external security MCU 630. In some examples, the monitoring controller 610 compares the health signal to a threshold and transmits the health signal to a higher layer in response to the health signal exceeding the threshold.

[0070] Log 614 can also be used to store aging flags. Aging flags can be analyses that have been applied to a sequence of diagnostic codes, for example, using marginal thresholds. As an example, aging flags can be used to mark aging events (such as maintenance events), such as speed degradation of the logical path 604 of the processor and memory. Aging flags can include indications of a maintenance event and indicate additional diagnostic information, such as the applied voltage setpoint, the applied clock frequency, temperature, timestamps, and other information (e.g., use case, system lifetime, etc.). Aging flags can be used at system startup to indicate when the voltage should be increased at the next startup. The number of aging flags and the last voltage setpoint can be used to predict when the voltage can no longer be increased, and thus predict the end of the system's lifetime.

[0071] The external SMCU 630 can take different corrective actions upon receiving a status signal. In some examples, the external SMCU interprets diagnostic code sequences by monitoring the external data port access log 614 of the controller 610 or SoC 602. In some examples, the external SMCU 630 transmits a shutdown command to the SoC 602. In some cases, the SMCU transmits a shutdown command to a safety island (not shown). In some cases, the SMCU transmits a shutdown command to the central processing subsystem of logical path 604 of the SoC 602. The shutdown command can be received in the form of an interrupt, software message, or hardware reset signal.

[0072] The external SMCU 630 can also be coupled to other external components (e.g., external display 620 and maintenance facility 622) to transmit, for example, maintenance events to external display 620 and / or maintenance facility 622. The monitoring controller 610 or the external SMCU 630 can generate user notifications in response to analyzing diagnostic code sequences. These user notifications can be transmitted to external display 620. User notifications can also be transmitted to maintenance facility 622 via a radio interface or a wired interface. The radio interface may include wireless internet, Wi-Fi, cellular, unlicensed frequency bands, or other wireless communication systems and protocols. The monitoring controller 610 or the external security MCU can also determine fault conditions of the integrated circuit, and user notifications can indicate that the system associated with the IC is not functioning correctly. This notification can be transmitted to external display 620, maintenance facility 622, or another system.

[0073] In addition to external notifications, the monitoring controller 610 can also initiate various corrective actions. Depending on the specific implementation, corrective actions are described as being initiated by the monitoring controller 610, but alternatively, one or more of these corrective actions may be taken by an external SMCU 630, different security management subsystems of the SoC 602 (not shown), the logic path 604 of the SoC 602's processor and memory, or another component. The monitoring controller 610 receives diagnostic codes and determines the condition of the integrated circuit, as mentioned above. Corrective actions may, for example, modify the power supply voltage of the logic path 604 via a power management circuit 618 coupled to the monitoring controller 610. The power management circuit 618 may be a PMIC as described above, or any other suitable power management circuit. The monitoring controller 610 initiates voltage corrective actions to modify the power supply voltage by sending commands to the power management circuit 618. The monitoring controller 610 can modify the power supply voltage by sending commands to the power management circuit 618, which in turn supplies voltage to the IC via a power delivery network 616. In some respects, a maintenance event is identified when there is no more room for additional corrective actions—that is, when the maximum number of aging compensation steps have been taken to exhaust a particular compensation. As an example, the power supply voltage of the power management circuit cannot rise above a predefined value. Once this value is reached, the next corrective action is not to increase the voltage again, but to identify a maintenance event.

[0074] The monitoring controller 610 can determine the timing margin of the integrated circuit and increase the power supply voltage to increase that timing margin. The monitoring controller can set a flag in the configuration register 638 of the power management circuit 618 to trigger a speed test of logic path 604 upon integrated circuit restart. Depending on the specific implementation, the test can be of another type. In some aspects, if the margin deteriorates, a built-in self-test (BIST) of the SoC or its components can be performed to ensure proper SoC operation. In some aspects, corrective action can be, for example, reducing the functionality of the system by disabling some parts or features of the system. In some aspects, the system can take corrective action at the next drive cycle or the next system startup by using an aging flag in non-volatile memory.

[0075] The monitoring controller 610 can be configured to store a flag in the monitoring controller's log 614 to modify the power supply voltage after an integrated circuit reboot. Results from the first aggregator 632 and the second aggregator 634, or only the second aggregator, can be used to determine aging flags for the logical path 604 of the processor and memory. The aging flags can be stored in the log 614 as a time-varying sequence of diagnostic codes. The monitoring controller can be configured to read the aging flags and apply corrective actions, such as aging compensation, increasing the voltage supply, limiting system functions, and / or reporting the condition to the user, and / or preventing the system or a portion of the system from starting, upon any system startup.

[0076] In some examples, log 614 or another memory can be used as a sticky register to accumulate events related to margin indications. For example, if the sensor array detects a reduced margin indication within a cycle, the sticky register will store this condition until the register is explicitly cleared. Monitoring controller 610, an external SMCU 630, or other devices or software can periodically read the sticky register at the end of a drive cycle or upon restart and take corrective action based on the margin indication events stored therein. This corrective action can be the same as or similar to a corrective action taken in response to an interrupt from interrupt logic 636.

[0077] In one example, interrupts are addressed by storing the event log in a sticky register (which is a non-volatile register). Zero margin indications may require immediate action, but reduced margin indications can be stored in the log or other non-volatile locations. Any margin indication events are stored for future use at the end of the drive cycle. Upon system startup, the event log in the sticky register is read, and any voltage adjustments to the IC are made as indicated in the event log.

[0078] Figure 7 This is a functional block diagram of the second-level multilayer sensor system. SoC 702 contains multiple logic paths 704 of the SoC's processor and memory, monitored by two levels (L1 and L2) of monitoring circuitry. The logic paths and monitoring circuitry can be connected to... Figure 6 The logic path and monitoring circuit shown are similar. A first sensor array 706 represents the first stage (L1), and a second sensor array 708 represents the second stage (L2). Both the first sensor array 706 and the second sensor array 708 are coupled to the monitoring controller 710 via a control channel 711. The second sensor array 708 can be actuated by an enable signal from the monitoring controller 710 on the control channel.

[0079] Monitoring controller 710 is coupled to a first sensor array 706 and a second sensor array 708, and is configured to receive corresponding first-level margin indications and second-level margin indications. The margin indication may be an indication of the setting timing margin condition. Monitoring controller 710 may actuate the second sensor array 708 in response to one or more first-level indications (e.g., one or more first-level indications falling below a threshold). The second sensor array may be configured to replicate the worst-case operating instance of the corresponding logic path. The second sensor array may also have significantly more sensors than the first sensor array.

[0080] The monitoring controller 710 includes a switching rate controller 712 coupled to a first sensor array 706 (L1 array) and a second sensor array 708 (L2 array) to control the switching rate of the second sensor array 708 via a control channel 711. The first sensor array 706 includes a first aggregator 732 coupled to the control channel 711 to aggregate first-level indications for the sensors in the first sensor array 706 and generate margin codes from the first sensor array 706. Similarly, the second sensor array 708 includes a second aggregator 734 coupled to the control channel 711 to aggregate second-level indications for the sensors in the second sensor array and generate margin codes for the second sensor array 708. The monitoring controller 710 receives margin codes from the first aggregator 732 and the second aggregator 734 via the control channel 711. The monitoring controller can combine the margin codes from the first aggregator 732 and the second aggregator 734 to generate a final margin code. When a margin code from the second aggregator or both the first and second aggregators suggests a warning or error, the interrupt logic 736 of the SoC 702 can be activated to notify the system.

[0081] The monitoring controller 710 is also coupled to or includes a log 714 to store diagnostic codes from the first sensor array 706 and the second sensor array 708. This log may store a series of diagnostic codes, aging flags, and other events. The log may also store additional diagnostic information, such as the applied voltage setpoint, applied clock frequency, temperature, timestamps, and other information (e.g., use case, system lifetime, etc.). The monitoring controller may generate a health signal and transmit it to a higher layer, such as an external SMCU 730.

[0082] The external SMCU 730 can take action in response to health signals from the monitoring controller, or in some examples, the external SMCU accesses the log 714 via the external data port of the monitoring controller 710 or SoC 702. The external SMCU 730 can also be coupled to other external components, such as maintenance facilities 722. In addition to external notifications, the monitoring controller 710 can initiate various corrective actions, such as increasing the power supply voltage, to increase timing margins. In some aspects, corrective actions are taken at the next drive cycle or the next system startup by using aging flags in non-volatile memory.

[0083] Figure 8 The operation of the switching rate controller 612 is described in more detail. The target switching rate can be established based on the characteristics of the circuit being monitored under worst-case conditions or in any other way. In many ICs, a switching rate lower than the system clock rate (e.g., the system clock rate) is common for many subsystems and shortens lifespan, i.e., increases circuit wear, compared to continuous operation at the clock rate. A target rate that will cause the monitoring circuitry to age faster than the expected normal operation of the circuitry within the IC can be selected. The amount of aging can be increased depending on the intended use of the monitoring circuitry of the IC and the second sensor array 608. The switching rate controller 612 alters the activity level or duty cycle of the sensor array to meet the target rate. While the monitoring circuitry can operate at the system clock rate when enabled, the same approach can be used when the clock rate of the sensor array is lower than the system clock rate.

[0084] At 802, the total number of switches of the sensor array is measured during a time window. This time window includes the time during which the sensor array is not enabled and the time during which the sensor array is enabled. This total number is then tested against a target rate. At 804, if the total number exceeds the target, a threshold is decreased at 806. This threshold is used to activate the second sensor array. In the example, the first sensor array 606 generates a margin state 644, which is analyzed in the conditional enable controller 642, for example, by a threshold comparison, to determine whether to activate the second sensor array. At 806, the threshold is decreased to make it closer to zero margin, which is a rarer situation. Therefore, the second sensor array is less frequently activated. If the total number of switches does not exceed the target rate during the time window, at 808, if the total number is less than the threshold, then at 810, the threshold is increased towards a larger margin, which is a more common situation. Therefore, the sensor array is activated for a longer time window duration. If the total number is neither greater than nor less than the target, then at 812, the threshold is not changed. The process returns to measure the total number of switches during the next time window.

[0085] Figure 9This is a diagram of a two-stage sensor array. The first sensor array 902 receives an enable signal 922 from the monitoring controller 910 via a first aggregator and enable circuit 904. Once enabled, the first sensor array 902 generates a margin indication to the first aggregator and enable circuit 904. For example, when a code exceeds a marginal threshold, the aggregation indication is transmitted to the monitoring controller 910, which stores the aggregation indication in a log 912. An external port 914 allows external components (not shown) to access this log. At the first aggregator and enable circuit 904, the aggregation margin indication for the first sensor array 902 is compared to a preset threshold. When the margin indication for the first sensor array 902 exceeds a threshold (e.g., a pre-configured activation threshold) for the second sensor array 906, the second sensor array is actuated via an enable signal 926 from the monitoring controller 910. When the margin indication for the first sensor array 902 returns below a threshold (e.g., a pre-configured activation threshold) for the second sensor array 906, the second sensor array is deactivated by disabling the enable signal 926, denying the enable signal 926, or using a different disable signal. The first aggregator and enable circuit 904 transmits the aggregated margin indication 920 to the monitoring controller 910. These margin indications can be transmitted as a sequence of diagnostic codes. Additional status information for the first sensor array 902 can also be transmitted from the first aggregator and enable circuit 904 to the monitoring controller 910. The second sensor array 906 can also be enabled via the logic of the conditional enable controller 642.

[0086] The monitoring controller 910 transmits an enable signal 926 to the second aggregator and enable circuit 908 of the second sensor array 906. This enable signal may also include a control rate signal. After being enabled, the second sensor array 906 transmits a margin indication to the second aggregator and enable circuit 908. The second aggregator and enable circuit 908 transmits an aggregated margin indication 924 to the monitoring controller 910. Additional status information of the second sensor array 906 may also be transmitted to the monitoring controller 910. The monitoring controller analyzes these aggregated margin indications and transmits a notification 916 or command to an external component, as described above. The second sensor array 906 may use the same monitoring circuitry as the first sensor array 902 or other monitoring circuitry with higher accuracy or greater depth. The second sensor array 906 may also use significantly more monitoring circuitry than the first sensor array 902. The margin indications for the first sensor array 902 and the second sensor array 906 may have one or more bits, as shown in... Figure 4 and Figure 5 As described in the context.

[0087] Figure 10This is a process flowchart illustrating an example of a two-level monitoring method as described herein. Method 1000 begins at block 1004, wherein one or more first-level indications of the condition of the integrated circuit are generated in a first sensor array formed in an integrated circuit. The sensors in the first sensor array may have paths through the integrated circuit.

[0088] The method further includes, at block 1006, actuating a second sensor array in response to the one or more first-level indications falling below a threshold, wherein the sensors in the second sensor array have paths through the integrated circuit. In some aspects, the second sensor array contains more sensors than the first sensor array. In some aspects, the sensors in the second sensor array are the same as those in the first sensor array. In some aspects, the sensors in the second sensor array are implemented with higher accuracy or reporting depth. The second array can provide full reporting accuracy or full reporting depth relative to the first sensor array in this manner.

[0089] In block 1008, upon actuation, one or more second-level indications of the condition of the integrated circuit are generated in the second sensor array.

[0090] Figure 11 This is a process flowchart illustrating an example of a method for predictive maintenance using a monitoring circuit as described herein. Method 1100 begins at block 1104, wherein the condition of a logic path formed in an integrated circuit is monitored at a monitoring circuit located near the logic path formed in the integrated circuit.

[0091] The method further includes: at block 1106, generating a diagnostic code sequence to indicate the condition of the logic path over time. In block 1108, performing a determination of the condition of the integrated circuit based on the diagnostic code sequence.

[0092] Figure 12 This is a process flowchart illustrating an example of a method for taking internal corrective action using a monitoring circuit as described herein. Method 1200 begins at block 1202, wherein the condition of a logic path formed in an integrated circuit is monitored at a monitoring circuit located near the logic path formed in the integrated circuit. At block 1204, a sequence of diagnostic codes is generated to indicate the condition of the logic path over time.

[0093] The method further includes: at box 1206, storing the diagnostic code sequence together with the corresponding timestamp in a log, and at box 1208, determining the condition of the integrated circuit based on the diagnostic code sequence.

[0094] In block 1210, a corrective action is initiated in response to the condition of the integrated circuit.

[0095] As used herein, “or” is intended to be interpreted as inclusive unless otherwise explicitly stated. For example, “a or b” could include only a, only b, or a combination of a and b. As used herein, the phrase “at least one of” or “one or more of” a list of items refers to any combination of those items, including a single member. For example, “at least one of a, b, or c” is intended to cover the following examples: only a, only b, only c, a combination of a and b, a combination of a and c, a combination of b and c, and a combination of a, b, and c.

[0096] The various exemplary components, logic components, logic blocks, modules, circuits, operations, and algorithmic processes described in conjunction with the specific embodiments disclosed herein can be implemented as electronic hardware, firmware, software, or a combination of hardware, firmware, or software, including the structures disclosed in this specification and their structural equivalents. This interchangeability of hardware, firmware, and software has been generally described in terms of its functionality and exemplified in the various exemplary components, blocks, modules, circuits, and processes described above. Whether this functionality is implemented in hardware, firmware, or software depends on the specific application and the design constraints imposed on the overall system.

[0097] The various exemplary logic blocks, modules, and circuits described in conjunction with the exemplary aspects disclosed herein can be implemented or executed using a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic component, discrete hardware component, or any combination thereof. The general-purpose processor may be a microprocessor, but in alternative embodiments, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration.

[0098] In one or more exemplary aspects, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality may be stored as one or more instructions or code stored on a computer-readable medium or transmitted as one or more instructions or code stored on a computer-readable medium. A computer-readable medium includes both computer storage media and communication media, including any medium that facilitates the transfer of a computer program from one place to another. A storage medium may be any available medium accessible to a computer. By way of example and not limitation, such computer-readable media may include RAM, ROM, EEPROM, CD-ROM, flash memory or other optical disc storage devices or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Combinations of the above should also be included within the scope of computer-readable media.

[0099] The following provides an overview of various embodiments of this disclosure.

[0100] Example 1: An apparatus comprising: an integrated circuit having a logic path formed therein; a monitoring circuit formed therein, the monitoring circuit being configured to monitor the condition of the logic path and generate a sequence of diagnostic codes to indicate the condition of the logic path over time; and a monitoring controller configured to receive diagnostic codes from the sequence of diagnostic codes, store the diagnostic codes in a log along with corresponding timestamps, and determine the condition of the integrated circuit based on the sequence of diagnostic codes.

[0101] Example 2: According to the apparatus of Example 1, wherein the monitoring controller is configured to store the diagnostic code in the log along with one or more of timing margin codes, timestamps, voltage, frequency, and use cases.

[0102] Example 3: The apparatus according to Example 1 or 2 includes a second monitoring circuit formed in the integrated circuit, the second monitoring circuit being configured to generate a second diagnostic code to indicate the condition of the logic path, and wherein the monitoring controller is configured to aggregate the first diagnostic code and the second diagnostic code.

[0103] Example 4: According to any one or more of the apparatuses described in the above embodiments, wherein the monitoring controller is configured to: receive the diagnostic code sequence and store the diagnostic code sequence in the log when the code in the diagnostic code sequence exceeds a marginal threshold.

[0104] Example 5: According to any one or more of the apparatuses described in the above embodiments, wherein the monitoring controller is configured to generate a status signal in response to the diagnostic code and transmit the status signal to a higher layer.

[0105] Example 6: According to the apparatus of Example 5, wherein the monitoring controller is configured to compare the operating status signal with an operating status threshold and transmit the operating status signal to the higher layer in response to the operating status signal exceeding the operating status threshold.

[0106] Example 7: The apparatus according to Example 6, wherein exceeding the operating condition threshold includes detecting a low timing margin.

[0107] Example 8: An apparatus according to any one or more of the above embodiments, the apparatus comprising: a log for storing the diagnostic code; and an external data port, wherein the log is accessible through the external data port.

[0108] Example 9: According to the apparatus of Example 8, wherein the monitoring controller is coupled to an external security management control unit via the external data port, and wherein the monitoring controller is configured to transmit the status of the integrated circuit to the external security management control unit via the external data port.

[0109] Example 10: The apparatus according to Example 8, wherein the monitoring controller is configured to receive a command to disable or reduce a function from the external security management control unit.

[0110] Example 11: The apparatus according to Example 8, wherein the external security management control unit includes a functional safety system controller coupled to the log via the external data port, wherein the external security management control unit is configured to analyze the diagnostic code sequence and predict maintenance.

[0111] Example 12: The apparatus according to any one or more of the above embodiments, wherein the monitoring controller is configured to generate a user notification in response to the diagnostic code sequence.

[0112] Example 13: The apparatus according to Example 12, wherein the user notification is an interruption.

[0113] Example 14: The apparatus according to Example 12, wherein the user notification is transmitted to an external display.

[0114] Example 15: The apparatus according to Example 12, wherein the user notification is transmitted to the maintenance facility via a radio interface.

[0115] Example 16: An apparatus according to any one or more of the above embodiments, wherein the monitoring controller is configured to determine the error condition of the integrated circuit, and wherein the user notification indicates that the system associated with the IC is not functioning properly.

[0116] Example 17: A method comprising: monitoring the condition of a logic path formed in an integrated circuit at a monitoring circuit located near the logic path formed in the integrated circuit; generating a diagnostic code sequence to indicate the condition of the logic path over time; and determining the condition of the integrated circuit based on the diagnostic code sequence.

[0117] Example 18: According to the method of Example 17, the method further includes: generating a status signal in response to the diagnostic code; comparing the status signal with a status threshold; and transmitting the status signal to a higher layer in response to the status signal exceeding the status threshold.

[0118] Example 19: A computer-readable medium having instructions that, when executed by a machine, cause the machine to perform operations including: monitoring the condition of a logic path formed in an integrated circuit at a monitoring circuit located near the logic path formed in the integrated circuit; generating a diagnostic code sequence to indicate the condition of the logic path over time; and determining the condition of the integrated circuit based on the diagnostic code sequence.

[0119] Example 20: According to the medium described in Example 19, the operation further includes: receiving a shutdown command in response to the condition of the logical path; and initiating a complete shutdown of one or all systems of the IC.

Claims

1. An apparatus, the apparatus comprising: An integrated circuit having logic paths formed within it; A monitoring circuit, formed in the integrated circuit, is configured to monitor the condition of the logic path and generate a sequence of diagnostic codes to indicate the condition of the logic path over time. and A monitoring controller is configured to receive diagnostic codes from the diagnostic code sequence, store the diagnostic codes in a log along with corresponding timestamps, and determine the condition of the integrated circuit based on the diagnostic codes.

2. The apparatus of claim 1, wherein the monitoring controller is configured to store the diagnostic code in the log along with one or more of timing margin codes, timestamps, voltage, frequency, and use cases.

3. The apparatus of claim 1, the apparatus comprising a second monitoring circuit formed in the integrated circuit, the second monitoring circuit being configured to generate a second diagnostic code to indicate the condition of the logic path, and wherein the monitoring controller is configured to aggregate the first diagnostic code and the second diagnostic code.

4. The apparatus of claim 1, wherein the monitoring controller is configured to: receive the diagnostic code sequence and store the diagnostic code sequence in the log when the code in the diagnostic code sequence exceeds a marginal threshold.

5. The apparatus of claim 1, wherein the monitoring controller is configured to generate a status signal in response to the diagnostic code and transmit the status signal to a higher layer.

6. The apparatus of claim 5, wherein the monitoring controller is configured to compare the operating status signal with an operating status threshold and to transmit the operating status signal to the higher layer in response to the operating status signal exceeding the operating status threshold.

7. The apparatus of claim 6, wherein exceeding the operating condition threshold includes detecting a low timing margin.

8. The apparatus according to claim 1, wherein the apparatus comprises: The log used to store the diagnostic codes; and External data port The logs mentioned therein can be accessed through the external data port.

9. The apparatus of claim 8, wherein the monitoring controller is coupled to an external security management control unit via the external data port, and wherein the monitoring controller is configured to transmit the status of the integrated circuit to the external security management control unit via the external data port.

10. The apparatus of claim 8, wherein the monitoring controller is configured to receive a command to disable or reduce a function from the external security management control unit.

11. The apparatus of claim 8, wherein the external security management control unit includes a functional safety system controller coupled to the log via the external data port, wherein the external security management control unit is configured to analyze the diagnostic code sequence and predict maintenance.

12. The apparatus of claim 1, wherein the monitoring controller is configured to generate a user notification in response to the diagnostic code sequence.

13. The apparatus of claim 12, wherein the user notification is an interruption.

14. The apparatus of claim 12, wherein the user notification is transmitted to an external display.

15. The apparatus of claim 12, wherein the user notification is transmitted to the maintenance facility via a radio interface.

16. The apparatus of claim 1, wherein the monitoring controller is configured to determine an error condition of the integrated circuit, and wherein the user notification indicates that the system associated with the IC is not functioning properly.

17. A method, the method comprising: The monitoring circuit monitors the condition of the logic path formed in the integrated circuit, the monitoring circuit being located close to the logic path formed in the integrated circuit; Generate a sequence of diagnostic codes to indicate the condition of the logical path over time; as well as The condition of the integrated circuit is determined based on the diagnostic code sequence.

18. The method of claim 17, further comprising: A status signal is generated in response to the diagnostic code; The operating status signal is compared with the operating status threshold; as well as In response to the operation status signal exceeding the operation status threshold, the operation status signal is transmitted to a higher layer.

19. A computer-readable medium having instructions that, when executed by a machine, cause the machine to perform operations including: The monitoring circuit monitors the condition of the logic path formed in the integrated circuit, the monitoring circuit being located close to the logic path formed in the integrated circuit; Generate a sequence of diagnostic codes to indicate the condition of the logical path over time; and The condition of the integrated circuit is determined based on the diagnostic code sequence.

20. The medium according to claim 19, wherein the operation further comprises: Receive a shutdown command in response to the condition of the logical path; as well as Initiate a complete shutdown of one or all systems of the IC.

Images