Secondary rate control sensor array for monitoring logical paths through integrated circuits

Abstract

Aspects relate to monitoring timing. In one example, an apparatus includes a first sensor array formed in an integrated circuit, sensors of the first sensor array having a path through the integrated circuit, and the sensors of the first sensor array configured to generate one or more first level indications of a condition of the integrated circuit. A second sensor array is formed in the integrated circuit. The sensors of the second sensor array have a path through the integrated circuit, and the sensors of the second sensor array are configured to generate one or more second level indications of the condition of the integrated circuit. A monitoring controller is coupled to the first sensor array and the second sensor array, and is configured to receive the one or more first stage indications and actuate the second sensor array in response to the one or more first stage indications.

Description

[0001] Cross Reference to Related Applications

[0002] This patent application claims priority to U.S. Provisional Patent Application No. 63 / 514,774, filed July 20, 2023, and U.S. Non-Provisional Application No. 18 / 482,681, filed October 6, 2023, U.S. Non-Provisional Application No. 18 / 482,703, filed October 6, 2023, and U.S. Non-Provisional Patent Application No. 18 / 482,749, filed October 6, 2023, which are assigned to the assignee of the present application and hereby expressly incorporated by reference herein as if fully set forth in their entirety and for all applicable purposes. TECHNICAL FIELD

[0003] Aspects of the present disclosure relate generally to monitoring logic paths of integrated circuits, and in particular, to monitoring using a two-level sensor array. BACKGROUND

[0004] Integrated circuits (ICs) are designed and manufactured to operate at a specified temperature range, minimum voltage, and clock speed. One approach to providing reliable operation at the target speed is sometimes referred to as timing closure. The minimum voltage and other parameters of an IC are selected considering variations in the manufacturing process and the expected operating environment. An IC intended to operate in an environment with tight temperature and voltage control can be able to operate at a higher speed and lower voltage than a similar IC intended to operate in an outdoor, industrial, or automotive environment.

[0005] The performance of an IC degrades over time and with use. As an IC ages, a higher minimum operating voltage and slower clock speed, or both, are needed to maintain reliable operation. However, higher voltages increase power consumption and heat, and increase the rate of degradation. Degradation can result in a random distribution of faults, often manifested as transient or intermittent faults. Since the faults are intermittent, it is difficult to pinpoint the cause. Exposure to higher temperatures can cause more pronounced effects of aging and degradation. The performance of the power delivery network (PDN) also degrades over time and with use, and contributes to further degradation of the performance of the IC.

[0006] Higher reliability and longer useful life increase the value of electronic systems. This is particularly important for safety and mission critical systems, such as in industrial, computing server, and automotive applications. These can be deployed in challenging and significantly varying conditions, can cause damage when they fail, and can not be easily replaced. SUMMARY

[0007] The following presents a simplified summary of one or more implementations in order to provide a basic understanding of such implementations. This summary is not an extensive overview of all contemplated implementations, and is intended to neither identify key or critical elements of all implementations nor delineate the scope of any or all implementations. Its sole purpose is to present some concepts of one or more implementations in a simplified form as a prelude to the more detailed description that is presented later.

[0008] In one example, an apparatus includes a first sensor array formed in an integrated circuit, sensors of the first sensor array having a path through the integrated circuit and configured to generate a first level indication of a condition of the integrated circuit. A second sensor array is formed in the integrated circuit. Sensors of the second sensor array have a path through the integrated circuit and are configured to generate a second level indication of the condition of the integrated circuit. A monitoring controller is coupled to the first and second sensor arrays and configured to receive the first level indications and actuate the second sensor array in response to the first level indications.

[0009] To the accomplishment of the foregoing and related ends, one or more implementations comprise the features hereinafter fully described and particularly pointed out in the claims. The following description and the appended drawings set forth in detail certain illustrative aspects of the one or more implementations. These aspects are indicative, however, of but a few of the various ways in which the principles of various implementations can be employed and the described implementations are intended to include all such aspects and their equivalents. BRIEF DESCRIPTION OF DRAWINGS

[0010] Figure 1 is a diagram of an IC including monitoring circuitry in accordance with aspects of the present disclosure.

[0011] Figure 2 is a diagram of a logic path and monitoring circuitry suitable for evaluating performance of the logic path in accordance with aspects of the present disclosure.

[0012] Figure 3 is a diagram of a second sensor array activated from a first sensor array during voltage decay in accordance with aspects of the present disclosure.

[0013] Figure 4 is a diagram of a single monitoring circuit suitable for evaluating performance of a logic path in accordance with aspects of the present disclosure.

[0014] Figure 5 is a diagram of a single monitoring circuit suitable for evaluating performance of a logic path in accordance with aspects of the present disclosure.

[0015] Figure 6 is a functional block diagram of a multi-tiered sensor system according to aspects of the present disclosure.

[0016] Figure 7 is a functional block diagram of a second multi-tiered sensor system according to aspects of the present disclosure.

[0017] Figure 8 is a flowchart of setting a dual-state thixotropy of a second sensor array to obtain a target dual-state thixotropy according to aspects of the present disclosure.

[0018] Figure 9 is an illustration of a two-tiered sensor array according to aspects of the present disclosure.

[0019] Figure 10 is a flowchart of monitoring aspects of a logic path of an integrated circuit according to aspects of the present disclosure.

[0020] Figure 11 is a flowchart of predictive maintenance of an integrated circuit according to aspects of the present disclosure.

[0021] Figure 12 is a flowchart of remedial action for an integrated circuit according to aspects of the present disclosure. DETAILED DESCRIPTION

[0022] The detailed description set forth below, in connection with the appended drawings, is intended as a description of various configurations and is not intended to represent the only configurations in which the concepts described herein can be practiced. The detailed description includes specific details for the purpose of providing a thorough understanding of various concepts. However, it will be apparent to those skilled in the art that these concepts can be practiced without these specific details. In some instances, well-known structures and components are shown in block diagram form in order to avoid obscuring such concepts.

[0023] Circuits for monitoring the health of electronics within a system on a chip (SoC), IC, or other electronic system can extend the useful life of a product. Voltage monitoring and clock speed monitoring can be used for this purpose, but can not be accurate enough for this purpose. Voltage and clock speed do not reflect the combined effects of voltage and frequency on health.

[0024] As described herein, monitoring circuits are deeply embedded within an integrated circuit (IC) to measure timing margins near logic paths in the IC and can operate at the same frequency, voltage, and temperature as the logic paths. The monitoring circuits can be constructed to resemble the characteristic circuits of the corresponding logic paths. The operation of the monitoring circuits mimics the actual circuit operation during the useful life of the IC. The behavior of the monitoring circuits resembles a full-path replica of a critical path (e.g., a data path consisting of a sequential start element, a combinational element, and a sequential end element) within the IC. In this way, each monitoring circuit acts as a timing margin sensor at its respective location of the integrated circuit.

[0025] The monitoring circuit provides measurement readings to determine a setup timing margin that can be used as an estimate of timing margin for other similarly constructed logic paths that are close to timing violation failure or have encountered timing violation failure. In some examples, the monitoring circuit generates diagnostic codes to indicate the condition of the corresponding logic path. In some examples, the diagnostic codes are aggregated and communicated to a monitoring controller. In some examples, the monitoring controller aggregates at least some of the diagnostic codes. The monitoring controller generates a health (e.g., margin depth) signal in response to the diagnostic codes. The health signal can be used as a notification for remedial action and / or for predictive analysis of the logic path.

[0026] Using the health signal, the IC can initially be provisioned to run at a lower voltage and / or faster clock speed. As the IC ages, the operating voltage can increase and / or the clock speed can decrease. The IC is initially more power efficient when it runs at the lower voltage, and also has a longer lifetime as the initial voltage and temperature decrease. The IC can be part of a larger system (e.g., a system on a chip (SoC), a system in a package (SiP), a multi-chip module, or other system) so that the entire system gets these benefits. The components described herein can be placed on multiple ICs or a single IC. The health signal can also be used to trigger checks, maintenance, repair, or various alerts to accommodate different situations. While aspects are presented in the context of a SoC or integrated circuit, the methods and apparatuses can be applied together to multiple SoCs as well as to other discrete ICs, including, for example, electronic control units (ECUs) for collision detection and avoidance, automotive advanced driver assistance systems (ADAS), and other components and systems.

[0027] The health signal provides error detectability and also enables predictive analysis of timing margin failure that can be used to develop a predictive maintenance framework, such as predictive maintenance or end-of-life. This predictive analysis enables prediction of failures that can occur as a device continues to age. This can bring great benefits to automotive, mission critical, and industrial applications. Failures can be predicted in advance in the field. Failure modes can also be identified so that changes can be made for future iterations of the device.

[0028] Figure 1is a diagram of an electronic system 100 having an IC 102 that includes monitoring circuitry. The IC 102 is powered by a power management IC (PMIC) 104 over a plurality of voltage rails 126. The IC 102 controls the PMIC using a control link 124. The IC 102 has a plurality of safety monitoring subsystems 112, 114, 116, three of which are shown for simplicity. Each safety monitoring subsystem can be a processing core or a larger processor or a standalone processor, such as a digital signal processor (DSP), a graphics processing unit (GPU), a video processing unit (VPU), an artificial intelligence (AI) engine, a neural signal processing (NSP) engine, an application specific integrated circuit (ASIC), an inertial reference unit (IRU) sensor or sensor suite, or other electronic device.

[0029] In aspects described herein, the monitoring circuitry 142, 144, 146 can be used to monitor timing margins (also referred to as timing guard bands) throughout the IC 102. An array of monitoring circuitry 142, 144, 146 can be embedded in the safety monitoring subsystem 112 of the IC 102. While the present description is presented with respect to one or more of the safety monitoring subsystems coupled to the safety management subsystem 118, one or more of the safety monitoring subsystems can operate autonomously. In some applications, such a system can be referred to as a safety subsystem, which can be a compute block, like a central processing unit (CPU), a graphics processing unit (GPU), an artificial intelligence (AI) processing unit, a neural signal processing (NSP) unit, an input / output (I / O) interface, an infrastructure block such as a memory controller, and other components, whether discrete or within a SOC.

[0030] The safety monitoring subsystems can have physical characteristics and environments similar to the characteristics and environments of the logical paths 132, 134, 136 within the safety monitoring subsystem 112 being monitored. While only three logical paths and three monitoring circuits are shown, the safety monitoring subsystems can have thousands or millions of logical paths and thousands of monitoring circuits. The safety error aggregator 148 is coupled to the safety management subsystem 118 within the IC 102. In some aspects, the safety management subsystem 118 can be referred to as a safety island and have additional functionality associated with a safety island. While the safety management subsystem 118 is shown as being coupled to only one of the safety monitoring subsystems 112, a single safety management subsystem can be coupled to all of the safety monitoring subsystems, and additional safety management subsystems can be used to receive error information from different components of the IC 102. Error information from the safety error aggregator 148 is communicated to the safety management subsystem 118, which can be a monitoring controller for analysis. In some examples, the error aggregator 120 receives error information and stores the error information in a log 122. The safety management subsystem 118 can take action on the error information internally.

[0031] An external safety management control unit (SMCU) 106 (e.g., a functional safety system controller) can also have access to the error information through an external data port 166. While an SMCU is shown, any other suitable external controller can alternatively be used. The safety management subsystem 118 can communicate health messages and error information over a control interface 168 (e.g., a serial bus). The external SMCU 106 can be coupled to multiple ICs 102 and multiple safety management subsystems 118 in an entire system. The external SMCU 106 can also be coupled to external devices for reporting, diagnostic, and information purposes. In some examples, the external data port 166 provides a functional safety (FUSA) message to be communicated to the external SMCU 106. The safety error aggregator 148 can be configured to communicate FUSA-ERROR messages and FUSA-WARNING messages to the safety management subsystem 118. The safety management subsystem can then use the external data port 166 to communicate FUSA-ERROR and FUSA-WARNING or any other suitable messages to the external SMCU 106. The safety management subsystem can use the external data port to enable the external SMCU 106 to access data.

[0032] In some aspects, when the timing margin is within a maintenance range (e.g., timing is slightly beyond the expected timing), then a FUSA-WARNING message can be transmitted. When the timing margin is within a zero margin range (e.g., timing is without further margin to avoid an error or near error condition), then a FUSA-ERROR message can be transmitted. There can be additional messages to indicate which monitoring circuits or groups of monitoring circuits are running within or outside of the allowed margin and what the margin is. These messages can be configured to conform to external standards and provide diagnostic and maintenance information.

[0033] In aspects herein, the timing margin is expressed as a number of buffers or inverter circuits. Depending on the frequency, a typical processor circuit has 15 to 100 buffer equivalent delays in a logic path. The timing margin (also referred to as guard band) is set to normalize the buffer delay or inverter delay measured in units. In some implementations, the delay line is composed of inverters. The monitoring circuit measures the set timing margin. In order for the set time to be sufficient for normal functioning, the transition at the end point storage element is fully stable before the next active edge of the clock signal.

[0034] The maintenance level message can result in performing a maintenance operation. As an example, the safety management subsystem or CPU or other processing core can cause the PMIC 104 to provide a different, safer voltage to be supplied through the voltage rail 126 at the appropriate time (e.g., at the next start up, or at the next drive cycle, or immediately upon receiving the notification). The maintenance level message can be monitored over time so that a consistent maintenance level message can mature the error level and cause diagnostic codes to be generated to the external SMCU 106. This can cause the codes to be displayed on a user interface or transmitted to an external maintenance facility. When a zero margin message is generated, it can be treated as a potential safety or failure warning. When zero margin messages recur after a voltage adjustment or restart, the safety management subsystem can initiate a full or partial shutdown. The safety management subsystem can also notify the external SMCU to take necessary measures according to the safety policy included within the SMCU so that the system enters a safe state. The safe state can be a lower performance state, a lower functionality state, or a full shutdown of one or all systems of the IC 102. The safe state can also include issuing a notification to the driver or user about the error or about a new operating state indicating limited functionality. The log 122 can also be made available through the external data port 166 for testing, predictive maintenance, and research purposes to understand the behavior of the IC 102 over time.

[0035] The error aggregator 120 receives margin measurements from the safety error aggregator 148 of each of the safety monitoring subsystems 112, 114, 116. The margin measurements or safety errors are aggregated at the safety error aggregator 148 for storage in the log 122. The aggregated margin measurements can be stored in the log 122 as a diagnostic code sequence collected over time during operation of the IC 102. The diagnostic code sequence can be stored in the log 122 when the codes in the diagnostic code sequence exceed a preconfigured margin threshold. The diagnostic codes can be tested or analyzed for aging flags, for example, stored as a flag in the log 122 or another non-volatile memory of the IC 102 or an external system. As aging flags accumulate over the life of the IC 102, the IC can be configured to read the aging flags at any system boot and apply a remedial action, such as aging compensation. The reading and applying can be performed by the safety management subsystem 118 or any other suitable component of the IC 102 or external component. After applying the remedial action, if the monitoring circuit reports an error, warning, or similar problem in the IC, a new aging flag, for example, flag, can be stored. The log 122 can be used as a diagnostic track of the stored aging flags.

[0036] When any IC or portion of an IC within the IC 102 degrades or completely fails for various reasons, the monitoring circuit can be used to detect its timing margin. The monitoring circuit 142, 144, 146 communicates the detected margin level to the safety error aggregator 148. The margin measurement can be in the form of a diagnostic code with a single bit for positive margin or zero margin, or in the form of a diagnostic code with multiple bits, for example, 2 bits or 8 bits, to indicate the amount of margin. The monitoring circuit 142, 144, 146 can be formed to monitor a particular logic path 132, 134, 136, but the detected performance can also indicate the condition of many other paths (not shown for simplicity) of the IC. The operating condition of the monitoring circuit 142, 144, 146 can be representative of the condition of a larger area or particular section of the IC 102.

[0037] The minimum voltage (Vmin) required for reliable operation of the circuit degrades over time, such that the voltage supplied by the PMIC 104 can become too low for reliable operation of the circuit. This results in an undervoltage problem. Aging and degradation can require a higher voltage setpoint than the voltage setpoint set for the new system when the IC was manufactured and tested. The IC degradation can also have gone beyond the range of other compensations characterized at the factory. These compensations can include process variation compensation and temperature variation compensation.

[0038] The monitoring circuits 142, 144, 146 are used to determine which areas of the IC 102 and which types of logic paths 132, 134, 136 fail to meet the setup timing requirements for which they were designed to reliably operate. In some cases, timing failures in the IC logic paths can result in incorrect operation or complete loss of function. The voltage applied by the PMIC 104 to various parts of the IC 102 through the voltage rails 126 can be adjusted through the control link 124 between the PMIC 104 and the safety management subsystem 118. The voltage can be adjusted, for example, increased.

[0039] Deterioration over time can be caused in part by electromigration, which effectively increases the resistance of the metal conductors on the IC through the die and also through the conductors of the package and package connectors. Printed circuit board (PCB) metal traces are also subject to electromigration. Deterioration over time can also be caused by hot carrier injection (HCI) effects, which effectively cause gradual changes in transistor threshold voltage (Vt). Additional deterioration over time can be caused by negative bias temperature instability (NBTI) and positive bias temperature instability (PBTI) effects, which can also cause gradual shifts in transistor threshold voltage (Vt). These deterioration phenomena can cause random errors in the logic paths of the entire IC.

[0040] Aging and deterioration can also cause defects or glitches in the power delivery network (PDN) and power management integrated circuit (PMIC) that supply power to the voltage rails coupled to the IC. Deterioration can also cause excessive clock jitter or glitches in the phase-locked loop (PLL) and clock distribution within the IC. This short, temporary power and clock glitching or excessive clock jitter can be difficult to detect and can affect circuit operation. Like the IC to which it is coupled, the PMIC and PDN can require higher minimum voltages over time. Higher voltages can prevent random distribution of faults that often appear as transients or intermittent faults that occur momentarily during operation. These faults can stop for a period of time and then reappear in unpredictable patterns. Another error cause is caused by the deterioration of the capacitance used by the PDN and PMIC. These can no longer be able to respond adequately to changes in the IC load. Capacitors also deteriorate over time, causing greater voltage sag on the power rails. Some capacitors can lose as much as one-third of their original capacitance during the useful life of the system.

[0041] The monitoring circuits 142, 144, 146 can be used to monitor timing effects of voltage related stress, temperature related stress, and activity related stress of the circuits of the IC, including the logic paths, PLLs, and clock distribution. In addition, the monitoring circuits 142, 144, 146 can be used to monitor timing effects as a path margin of voltage related stress, temperature related stress, and activity related stress of the circuits of the PMIC and the circuits of the PDN. In addition, the monitoring circuits 142, 144, 146 can be used to monitor timing effects of physical defects on the PCB, such as a capacitor losing proper electrical connection to the PCB. By using independent circuits with margin control, the circuits can be configured to fail first (e.g., provide an indication of depleted or reduced operating margin) and provide an indication of margin depth reflecting the overall effects of silicon performance, voltage, frequency, and temperature. The monitoring circuits fail first because the monitoring circuits can be configured to fail before the circuits being monitored. This enables an indication to be generated early for maintenance or to initiate an orderly shutdown. This construction is referred to herein as a worst case replica path because the monitoring circuits reflect the worst case scenario regarding manufacturing and operating conditions of failure.

[0042] The monitoring circuits 142, 144, 146 can take the form of a worst case path replica of the logic paths 132, 134, 136 within the safety monitoring subsystem with associated checker logic. Key circuits that exhibit worst case behavior can be selected for monitoring. The replica path can replicate the sequential elements of the logic circuit path and associated combinational logic path with respect to timing. This allows the timing margin of the sequential elements of the logic circuit path and associated combinational logic path to be replicated. The replica path can be formed in proximity to the logic paths 132, 134, 136 to be monitored. This can include a replica path that is deeply embedded in the safety critical circuit and runs at the same frequency, voltage, and temperature as the safety critical circuit. The monitoring circuits replicate the timing of the operation of the actual safety critical circuits being monitored during a mission mode or another mode. Mission mode is a concept of automotive functional safety. The IC including the safety monitoring and safety management subsystems can complete a startup and initialization process to enable path margin monitoring. The expected safety mechanisms are activated and the failure monitoring of the safety management subsystem is active. After these operations, the subsystem is then in mission mode when the safety monitoring subsystems 112, 114, 116 and the safety management subsystem are performing defined safety functions. The path replicas are monitored and their margin measurements can be used as inputs for health monitoring and data for predictive analysis. This analysis can predict failures that can later manifest as failures in the monitored paths as the monitored paths further degrade.

[0043] The output can be provided to higher level software systems for evaluation. The monitoring circuitry can be used to reduce costs in automotive safety, aging tracking, predictive maintenance, power optimization, and testing. Using the higher level software, events that flag IC aging can be logged and used to adjust the voltage, frequency, and effective functionality of the IC in the next boot or drive cycle. Aging tracking can be performed by storing the aging flags into non-volatile memory (e.g., a log) once per drive cycle. The flags are then read at the next system boot. Power management integrated circuit voltage settings can be increased based on the number of aging flags until a maximum voltage limit is reached. Once the maximum voltage limit is reached, a maintenance event can be declared.

[0044] Figure 2 is a generalized diagram of a logic path and monitoring circuitry suitable for evaluating the performance of the logic path. A portion of an IC 200 can have thousands or millions of transistor circuits that form a logic path that operates with a particular toggle rate. The toggle rate is determined by the switching activity of the respective transistor switches. For example, a logic path that changes state from 0 to 1 in one cycle and then back to 0 in the next cycle has the maximum toggle rate. A logic path that is rarely used (e.g., a square root circuit) will have a lower toggle rate than a frequently used logic path (e.g., an addition circuit). In addition to the nature of the circuit, the toggle rate varies depending on the input clock rate and duty cycle of each particular switching device (e.g., transistor, logic gate, etc.). Thus, different portions of an IC and different circuits within each portion can have different toggle rates. Input or feedback is received at a start storage element 202 (e.g., a set of flip-flops) and applied to a logic path 204 (e.g., a combinational logic path) for processing. The logic path 204 generates an output that is passed to an end storage element 206 (e.g., an additional set of flip-flops) to provide an output that is passed to other logic paths (not shown) for additional processing. From a set timing perspective, signal feedback 208, 210 represents the generalized structure of the monitored logic path within the IC 200.

[0045] The monitoring circuit 201 can be used as a sensor and has a start-up storage element 212 that can generate a deterministic or random value as an input to a replica logic path 214. The replica logic path 214 is not used to generate or process data, but is used to replicate timing aspects of the operations associated with the logic path 204 to be monitored. The replica logic path 214 can be formed to correspond to the manner in which the logic path 204 is formed, and can be formed using lower manufacturing margins, such that the replica logic path 214 can fail before the logic path 204. The replica logic path 214 is driven at the same voltage and experiences the same temperature as the logic path 204. The bi-stable metamorphic rate of the replica logic path 214 can be controlled, which results in a similar, slower, or faster degradation than the logic path 204, such as a slightly faster degradation. For some cases, the bi-stable metamorphic rate can be slightly faster than the bi-stable metamorphic rate of the logic path 204, but for other cases, the bi-stable metamorphic rate can be slightly slower. The replica logic path 214 can be run at worst case to ensure that an error is generated before the system fails. The replica logic path 214 can also be run with a known bi-stable metamorphic rate that has a predetermined relationship to the expected worst case bi-stable metamorphic scenario of the functional path.

[0046] In some examples, a simple bi-stable metamorphic rate control mechanism (not shown) can be implemented using a time window average. The bi-stable metamorphic rate mechanism can be coupled to the input of the start-up storage element 212 or to the clock input of a circuit (not shown). The bi-stable metamorphic rate mechanism will apply the input at an adjusted rate or provide the clock signal at an adjusted rate to obtain a particular bi-stable metamorphic rate. The number of bi-stable metamorphosis to the monitoring circuit is counted over a given period time window. If the observed bi-stable metamorphic rate is higher or lower than a preset threshold, the bi-stable metamorphic rate of the replica logic path 214 is changed up or down by a preset value for the next time window. In examples, as shown in, for example, FIGS. 1-3, the monitoring circuit 201 is a sensor of a first sensor array and a second sensor array. In some aspects, the sensors of the first sensor array and the second sensor array are the same but have different bi-stable metamorphic rates. In some aspects, the sensors of the second sensor array are configured and manufactured to more closely resemble the corresponding monitored circuit. The number of bi-stable metamorphosis to the second sensor array is counted over a periodic time window. As in Figure 6 、 Figure 7 and Figure 9 there are two path margin sensor arrays, and the monitoring circuit 201 is a representative example of a sensor of either of the first sensor array and the second sensor array. In some aspects, the sensors of the first sensor array and the second sensor array are the same but have different bi-stable metamorphic rates. In some aspects, the sensors of the second sensor array are configured and manufactured to more closely resemble the corresponding monitored circuit. The number of bi-stable metamorphosis to the second sensor array is counted over a periodic time window. As in Figure 3 、 Figure 6 and Figure 7In more detail, in the context of the second sensor array being activated, if the observed bistable flip-flop rate is above a preset threshold, then for the next time window, the replication path margin threshold for the first sensor array that activates the second sensor array can be adjusted to trigger a decrease in frequency by a preset value. When the time window includes both an active period and an inactive period in the same time window, then changing the threshold for activating the second sensor array changes the bistable flip-flop rate for the entire window towards a desired target. The second sensor array is effectively bistable flip-flopping at the system clock rate, but the duty cycle of the monitoring circuit is reduced. Similarly, if the observed bistable flip-flop rate is lower, then the opposite adjustment is made.

[0047] The impact of bistable flip-flop rate on aging degradation can be known due to characterization for a particular manufacturing process and circuit configuration, e.g., predetermined based on semiconductor process and operating voltage / temperature conditions. The worst case bistable flip-flop condition expressed as a bistable flip-flop rate can also be known. In some examples, the worst case bistable flip-flop rate condition can be selected as a target to be achieved by the replication logic path 214.

[0048] The output of the replicated logic path 214 is provided to a configurable delay chain 218 coupled to a terminal storage element 216. The configurable delay chain 218 produces multiple versions of the output of the replicated logic path 214 with different amounts of delay. The latched version of the output of the configurable delay chain 218 is transferred from the terminal storage element 216 to a check circuit 220. The path cycle time 230 between the start storage element 212 and the terminal storage element 216 with the delay chain 218 configured for the lowest delay can be considered the timing convergence of the worst case negative timing margin. The timing check can be adjusted using the configurable delay chain 218. The check circuit 220 compares the latched version captured by the terminal storage element 216 at the output of the configurable delay chain 218 to a reference value from a checkpoint storage element 224 that is not passed through the replicated logic path 214. Using this comparison, the timing margin of the sensor is determined at the check circuit 220. The timing margin between the output of the replicated logic path 214 and the input of the terminal storage element 216 is determined by the comparison at the check circuit 220. The checkpoint storage element 224 provides an expected value. The terminal storage element 216 provides a captured value after the delay caused by the replicated logic path 214 and the configurable delay chain 218. If the values from the terminal storage element 216 and the checkpoint storage element 224 are the same, then the timing margin to the terminal storage element 216 is at least the amount of the configurable delay chain 218. The check circuit 220 produces an error or margin code 222 for the replicated logic path 214 to reflect this comparison. The check circuit 220 generates the error or margin code 222 as a time domain margin status message. This message can be transferred to an aggregator or a monitor controller (not shown). In the illustrated example, no actual terminal is loaded into the check. The check is done based on the value received from the terminal storage element 216.

[0049] The storage elements 212, 216, and 224 are driven by a clock, and the check circuit 220 can be driven by the same clock to generate the error / margin status code. The monitor circuit 201 can also be run at a specific duty cycle using an enable signal (not shown). A monitor controller (not shown) can drive the enable signal (e.g., high or low, or on or off) to control the monitor circuit 201. There can be multiple redundant monitor circuits in any desired integrated circuit area. The monitor controller can be able to individually disable any monitor circuit using the enable signal. There can also be provisions to globally disable all monitor circuits using a common signal or a widely addressed scheme coupled to the enable signal.

[0050] Margin code can be generated even if a margin violation is encountered during a voltage and frequency change event due to the system's dynamic voltage and frequency scaling (DVFS) functionality. While separate clock and voltage monitors can introduce monitoring limitations and monitoring gaps when the DVFS system makes transitions, it is not necessary for this type of monitor. The described monitoring circuitry is capable of monitoring the IC at all times and does not rely on the operating, e.g., voltage and frequency state, of the circuit being monitored. A single monitoring circuit can be used for continuous coverage, or multiple monitoring circuits as a sensor array can be used for continuous coverage. The monitoring is continuous even when clock and voltage monitors are not available.

[0051] The dual-state thixotropy of the replicated logic path 214 can be controlled, and the entire path from the start storage element 212 to the end storage element 216, etc., can be shut down or disabled to reduce power consumption. In some examples, the margin code is continuously reported at the selected dual-state thixotropy. In some examples, a second sensor array of the monitoring circuitry is also dual-state thixotropic during worst-case system conditions. The additional monitoring of worst-case conditions can provide continuous margin depth reporting when needed by the system.

[0052] Figure 3 is a graph depicting sensor activation of two sensor arrays during voltage decay in a two-stage arrangement. The sensors of each sensor array can be formed by the monitoring circuitry 201, or as shown in Figure 4 and Figure 5 The first sensor array (LI) has a continuous running clock signal 302 that reflects the continuous monitoring function of the LI array. The clock signal on graph 300 is shown as high and low logic level transitions on the vertical axis relative to time on the horizontal axis. The voltage 304 applied to the IC is shown as having an amplitude on the vertical axis and time on the horizontal axis. The voltage 304 is affected by different conditions of loading, temperature, and aging that cause voltage variations. The voltage trigger level 306 is shown to depict the concept of two-stage monitoring. The voltage trigger level 306 is controlled by comparing a timing margin threshold to the margin indication from the LI sensor array.

[0053] At time 312, voltage 304 decays below voltage trigger level 306 triggering a margin violation indication 308 to transition from a low logic level to a high logic level at time 316. The margin violation indication 308 of the LI array can then be used to trigger an enable signal 310 of a second sensor array (L2) to transition from a low logic level to a high logic level at time 318. When this event occurs, the voltage trigger level 306 is correspondingly used to enable the L2 sensor array when the voltage 304 has moved into a region that requires more active monitoring. Similarly, at time 314, voltage 304 increases above voltage trigger level 306 causing the margin violation indication 308 to transition from a high logic level to a low logic level at time 320. This then causes the enable signal 310 to transition from a high logic level to a low logic level at time 322.

[0054] When the enable signal 310 is high, between time 318 and time 322, the L2 sensor array is clocked by a clock signal 332. The L2 clock signal has a flat region 330 (e.g., a disabled region) before the enable signal 310 becomes a high logic level at time 318, and a flat region 334 after the enable signal 310 returns to a low logic level after time 322. The L2 sensor array can provide a higher precision (also referred to as a greater depth or a greater reporting depth), an indication of timing margins of the monitored circuit of the IC, or can produce the same depth. In some embodiments, the L2 sensor array can provide a higher precision by using a greater number of monitoring circuits in the array, whether the monitoring circuits of the L2 sensor array are the same as or different from the monitoring circuits of the LI sensor array. In some embodiments, the L2 sensor array can provide a greater depth by using a greater number of delay elements in the configurable delay chain. In a two-stage (LI, L2) system, remedial action and health reporting can be based on the higher precision margin indication of the L2 sensor array. When the enable signal 310 is at a low logic level, the power consumption of the L2 sensor array is reduced or eliminated due to the cessation of operation. This also reduces the heat and aging of the rest of the IC. As shown, the dwell time of the enable signal 310 is monitored to infer the actual average bi-stable flip-flop rate of the L2 array.

[0055] Figure 4is a diagram of a single monitoring circuit 400 suitable for use as a sensor as described herein and provides a building block for larger arrays of monitoring circuits suitable for evaluating the performance of a logic path. A system clock 402 is supplied to a start storage element 424. A start timing signal 418 from the start storage element 424 is applied to a worst case replica path 416. The worst case replica path models the operation and wear that occurs to the logic circuit of the IC. Surrounding components control the metastability of the worst case replica path 416 and provide timing standards to compare against the timing of the worst case replica path 416. The timing standards come from checkpoint storage elements 428 that convey expected results on timing outputs 430. The expected results are the results that would be produced by a fully functional monitored circuit with robust timing margins. The difference between the timing standards and the worst case replica path is derived at match checks 432, 434 to determine timing margins. An output signal 414 of the worst case replica path 416 is applied to a delay chain 440 and an input of a zero margin point storage element 412. The worst case replica path 416 is run at a timing and metastability set by a monitoring controller (not shown) to best reflect the condition of the associated logic path.

[0056] The delay chain 440 generates a delayed version 442 of the output signal 414. In some aspects, there are multiple delayed versions 442 of the output signal 414 and these are all supplied to a multiplexer 446. The multiplexer 446 is controlled by an external margin configuration signal 448 that can be provided by, for example, a monitoring controller (not shown) to select one of the delayed versions 442 as the output 450 of the multiplexer 446 to the margin point storage element 452. The margin point storage element 452 generates an appropriate timing signal 454 using the system clock 402 to apply to the reduced margin match check 432. The timing signal 454 from the margin point storage element 452 is a registered version of the output signal 450 that represents the overall timing of the worst case replica path 416 with the additional delay 440. The amount of delay is controlled by the margin configuration signal 448 that controls the selection at the multiplexer 446. The reduced margin match check 432 then compares the timing signal 454 at the output of the margin point storage element 452 to the reference from the checkpoint storage elements 428 to determine a reduced margin indication 460.

[0057] The zero-margin point storage element 412 also receives the output signal 414 of the worst-case replication path 416 and the system clock 402 and generates a timing signal 436 to be applied to a zero-margin match check 434. The inputs to the zero-margin point storage element 412 do not have any delay from the delay chain 440 or the multiplexer 446. The zero-margin match check 434 then compares the timing signal 436, the zero-margin signal from the zero-margin point storage element 412, and the same reference from the checkpoint storage element 428 to determine a zero-margin indication 462. The timing signals 454, 436 provide the observed outputs to determine the margin and zero-margin conditions of the worst-case replication path circuit 416. The timing signals reflect the timing of the worst-case replication path 416. The timing output 430 provides a reference, such as an expected value, for the timing checks.

[0058] As mentioned above, the start timing signal 418 is driving the input of the worst-case replication path with the desired bi-stable thixotropy. To enable the sensor and adjust the bi-stable thixotropy of the start timing signal 418 of the start point storage element 424, the start timing signal is also provided to a NAND gate 420 that performs a NAND operation of the start timing signal 418 and an enable signal 422, such as from a monitoring controller, to generate a NAND output 426. The NAND output drives the operation of the start point storage element 424 based on the enable signal 422. The checkpoint storage element 428 receives the start timing signal 418. The NAND output 426 is coupled back to the start point storage element 424. As a result, the start point storage element 424 generates the start timing signal 418 that is bi-stable thixotropic when the enable signal 422 to the NAND gate 420 is active. The checkpoint storage element 428 generates a timing output 430 that reflects the timing of the start point storage element 424. When the worst-case replication path 416 is generating an output of reduced margin or maintenance level, the timing output 430 is applied to a reduced margin match check 432 to generate a reduced margin indication 460, as described above. When the worst-case replication path 416 is generating an output of zero margin or error level, the timing output 430 is also applied to a zero-margin match check 434 to generate a zero-margin indication 462, as described above. Thus, the monitoring circuit 400 generates at least one of two signals: the reduced margin indication 460 and the zero-margin indication 462. This allows for indicating the condition of the underlying IC in the region of the monitoring circuit. The two signals can be presented as diagnostic codes, and the outputs of many monitoring circuits can be aggregated or combined in any manner to generate diagnostic codes with higher precision or more bits. The monitoring circuit can be used in a first or second level sensor array, and there can be many such monitoring circuits 400 in each array. More multiplexer 446 outputs 450 can be used with more match checks to generate more indications.

[0059] Figure 5is another illustration of a single monitoring circuit 500 that can form an array suitable for evaluating the performance of a logic path. The worst-case replica path 506 operates with a start timing signal 530 and a bi-stable hysteresis set by a monitoring controller (not shown) to best reflect the condition of the associated logic path. The worst-case replica path 506 generates an output signal 504 that is applied directly to the margin point storage element bank 502 and the delay chain 508.

[0060] The system clock signal 520 (clk) is also supplied to the margin point storage element bank 502, for example, generating a set of flip-flops that each apply to a plurality of timing outputs 512, 514, 516 of respective match checks 522, 524, 526. The delay chain 508 receives the output signal 504 from the worst-case replica path and generates a delayed version 510 of the output signal 504. The delayed version allows the margin point storage element bank 502 to form the basis of the timing outputs 512, 514, 516 in a plurality of timing versions and have a more simple circuit than Figure 4 a margin code. While three timing outputs are shown, there can be more timing outputs, for example, six or eight timing outputs for a six or eight bit margin code. In some aspects, there can be only one or two timing outputs for a one or two bit margin indication.

[0061] The start timing signal 530 is generated by a start storage element 536 in response to the system clock 520 and the NAND output 534. As with the example of Figure 4 the start timing signal 530 is bi-stable when the NAND gate 532 is enabled by the enable signal. The start timing signal 530 is provided to a checkpoint storage element 538. The checkpoint storage element 538 is also coupled to the system clock 520 (clk) to generate a timing output 518 that reflects the state of the start storage element 536. The timing output 518 is applied to each of the match checks 522, 524, 526 to collectively generate a plurality of bit diagnostic codes, for example, a margin code. Each match check 522, 524, 526 receives the same checkpoint storage element 538 timing output 518 and compares that timing output to different timing outputs 512, 514, 516 from the margin point storage element bank 502 to make different timing comparisons and generate different portions of the margin code. The output of each match check 522, 524, 526 is combined to create a margin code that can be used as a diagnostic code or an indication of the condition of the IC in the monitored region. The code can be aggregated with the codes of other monitoring circuits.

[0062] Figure 6is a functional block diagram of a multi-level sensor system. SoC 602 includes a logical path 604 of the processor and memory of the SoC that is monitored by a two-level LI and L2 monitoring circuit. The logical path and monitoring circuit are distributed throughout the SoC, but are shown isolated in the figure for better illustration of the function and connections. A first sensor array 606 represents the first level (LI), and a second sensor array 608 represents the second level (L2). Both the first sensor array 606 and the second sensor array 608 are coupled to a monitoring controller 610 through a control channel 611. The sensor arrays can be formed using any one or more of the monitoring circuits described in Figures 2 to 5 The two-level monitoring circuit allows the second sensor array 608 to be enabled by the condition enable controller 642 in response to a margin indication from the first sensor array 606.

[0063] In some examples, the second sensor array 608 is enabled less often, which allows more accurate tracking of the aging of the logical path and memory of the SoC by matching the worst-case bi-stable snap rate of the SoC. In any real circuit, the duty cycle or bi-stable snap rate of each sub-system is less than 100% because not all circuits are in use at all times. Depending on the manufacturing technology, circuits will age and deteriorate at different rates depending on the duty cycle or bi-stable snap rate at which they are operated. In many very large scale integration technologies, transistor switches age faster at lower bi-stable snap rates. Therefore, a sensor operating at a 100% bi-stable snap rate will not age at the same rate as the logical path of the monitored path in normal operation of the system. Therefore, reducing the bi-stable snap rate of the sensor allows the sensor to more accurately track the aging of the monitored circuit.

[0064] Additionally, the second sensor array 608 can be turned off or operated at a low duty cycle to reduce power consumption while still providing monitoring coverage during voltage decay. The margin state 644 from the first sensor array 606 is applied to a condition enable controller 642, which can be implemented as part of the monitoring controller 610 or implemented as a separate component. When more accurate margin tracking is appropriate, for example, at a voltage decay event, the condition enable controller 642 generates an enable signal 646 to enable the second sensor array 608. The sensors are configured near the logical path 604 of the processor and memory and operated to replicate the worst-case operation of the respective logical path.

[0065] In this example, a first sensor array 606 is formed in an integrated circuit of the SoC 602. The sensors of the first sensor array 606 have a path through the integrated circuit and are configured to generate a first level indication of a condition of the integrated circuit. Similarly, a second sensor array 608 is formed in the integrated circuit. The sensors of the second sensor array 608 have a path through the integrated circuit and are configured to generate a second level indication of the condition of the integrated circuit. In this description, a path through the integrated circuit is a path fabricated as part of the integrated circuit using the same or similar technology as the monitored circuit. Multiple sensors can provide distributed coverage through the IC to observe the impact of local variations and deploy different kinds of replicas to reflect more kinds of paths through the IC. The first level indication and the second level indication can be multiple bit diagnostic codes or have some other format. In some aspects, the second level indication can provide full reporting precision or full reporting depth relative to the first level indication. In some aspects, the sensors of the first sensor array and the sensors of the second sensor array have the same accuracy, resolution, reporting depth, and operating range. The sensors between the first sensor array and the second sensor array can be similar or identical. The accuracy in terms of resolution and measurement error can also be the same. In some aspects, the sensors of the first sensor array have lower accuracy, lower resolution, or a smaller operating range, and are used to enable the second sensor array as discussed below. In such aspects, the first sensor array determines some degradation of timing margin, and then the second sensor array is able to report the timing margin with full reporting precision or full reporting depth of the timing margin.

[0066] A monitoring controller 610 is coupled to the first sensor array 606 and the second sensor array 608 and is configured to receive the first level and second level margin indications. The monitoring controller 610 or a conditional enable controller 642 can actuate the second sensor array 608 in response to the margin depth of the first level indication falling below a threshold. A control channel 611 is coupled to the monitoring controller 610, the first sensor array 606, and the second sensor array 608. The second sensor array can be actuated by an enable signal from the monitoring controller 610 on the control channel 611 and deactivated by a disable signal from the monitoring controller 610 on the control channel 611. In another implementation, the second sensor array can be actuated by an enable signal 646 from the conditional enable controller 642.

[0067] The monitor controller 610 includes a bistate thixotropy controller 612 coupled to the first sensor array 606 (Ll array) and the second sensor array 608 (L2 array) to control the bistate thixotropy of the second sensor array 608. In some examples, the bistate thixotropy of the first sensor array 606 is closely related to the clock rate of the system. In some examples, the bistate thixotropy controller 612 controls the bistate thixotropy of the first sensor array 606 and the second sensor array 608. In some examples, the bistate thixotropy controller 612 is configured to observe the enable signal 646 of the second sensor array 608 and infer the bistate thixotropy of the second sensor array 608, compare the bistate thixotropy of the second sensor array 608 to the worst case bistate thixotropy of the system, and adjust the bistate thixotropy of the second sensor array 608 by adjusting the margin threshold of the first sensor array 606 from which the second sensor array 608 is actuated in response to the comparison. The bistate thixotropy controller can adjust the bistate thixotropy of the second sensor array 608 to increase or decrease the degradation of the second sensor array 608 compared to the logic path 604. The bistate thixotropy controller can observe the bistate thixotropy of the second sensor array 608 by counting the number of enable events of the second sensor array 608 within a preconfigured window of time. In some examples, the number of enable events of the second sensor array 608 is counted by observing the enable signal 646. The second sensor array 608 is activated by the enable signal 646. The enable signal 646 when enabled can enable a clock, or allow for an internal bistate thixotropy to occur within the second sensor array 608. The bistate thixotropy controller 612 operates such that the enable signal 646 follows a target bistate thixotropy.

[0068] The first sensor array 606 includes a first aggregator 632 to aggregate first level indications to sensors of the first sensor array 606 (e.g., aggregate first diagnostic codes) and generate a margin code from the first sensor array 606. Similarly, the second sensor array 608 includes a second aggregator 634 to aggregate second level indications to sensors of the second sensor array (e.g., aggregate second diagnostic codes) and generate a margin code for the second sensor array 608. The monitoring controller 610 receives the margin codes from the first aggregator 632 and the second aggregator 634 over a control channel 611. When a first or second level indication suggests a warning or error, an interrupt logic 636 of the SoC 602 can be activated to notify the system or the event can be logged in a sticky flag of a log 614 for later reading by the monitoring controller 610 or an external SMCU 630. The system can take appropriate remedial action or provide a trigger or maintenance condition according to a safety policy. The interrupt logic can be configured to initiate a shutdown procedure of at least a portion of the integrated circuit in response to the margin code. The interrupt logic 636 can be integrated with the monitoring controller 610 or other components of the SoC 602.

[0069] The monitoring controller 610 is also coupled to or includes a log 614 to store diagnostic codes from the first sensor array 606 and the second sensor array 608. The monitoring controller 610 receives margin codes over time as a diagnostic code sequence. The monitoring controller can form a diagnostic code sequence that the monitoring controller 610 stores in the log along with a corresponding timestamp and other contemporaneous information such as temperature, frequency, or an indication of current usage or notifies a processor to store in the log along with a corresponding timestamp and other contemporaneous information such as temperature, frequency, or an indication of current usage. The monitoring controller 610 can be configured to store a diagnostic code sequence in the log 614 when a code of the diagnostic code sequence exceeds a preconfigured marginal threshold. The monitoring controller 610 is able to use the diagnostic code sequence to determine a condition of the integrated circuit. The monitoring controller can then generate a health signal and communicate the health signal to a higher layer, such as the external safety MCU 630. In some examples, the monitoring controller 610 compares the health signal to a threshold and communicates the health signal to the higher layer in response to the health signal exceeding the threshold.

[0070] The log 614 can also be used to store aging flags. The aging flags can be, for example, applied to the analysis of the diagnostic code sequence using a marginal threshold. As an example, the aging flags can be used to mark aging events, such as maintenance events, for example, speed degradation of the logical path 604 of the processor and memory. The aging flags can include an indication that a maintenance event occurred and indicate additional diagnostic information, such as the applied voltage setpoint, the applied clock frequency, temperature, time stamp, and other information, for example, use case, system lifetime, etc. The aging flags can be used at system startup to indicate that the voltage should be increased next time the system is started. The number of aging flags and the last voltage setpoint can be used to predict when the voltage can no longer be increased and, thus, predict the end of life of the system.

[0071] The external SMCU 630 can take different remedial actions upon receiving the health signal. In some examples, the external SMCU accesses the log 614 through a monitoring controller 610 or an external data port of the SoC 602 to interpret the diagnostic code sequence. In some examples, the external SMCU 630 transmits a shutdown command to the SoC 602. In some cases, the SMCU transmits the shutdown command to a safety island (not shown). In some cases, the SMCU transmits the shutdown command to a central processing subsystem of the logical path 604 of the SoC 602. The shutdown command can be received in the form of an interrupt, a software message, or a hardware reset signal.

[0072] The external SMCU 630 can also be coupled to other external components, for example, an external display 620 and a maintenance facility 622, to transmit, for example, maintenance events to the external display 620 and / or the maintenance facility 622. The monitoring controller 610 or the external SMCU 630 can generate a user notification in response to analyzing the diagnostic code sequence. The user notification can be transmitted to the external display 620. The user notification can be transmitted to the maintenance facility 622 through a radio interface or a wired interface. The radio interface can include wireless internet, Wi-Fi, cellular, unlicensed bands, or other wireless communication systems and protocols. The monitoring controller 610 or the external safety MCU can also determine an error condition of the integrated circuit, and the user notification can indicate that the system associated with the IC is inoperable. The notification can be transmitted to the external display 620, the maintenance facility 622, or another system.

[0073] In addition to external notification, the monitoring controller 610 can initiate various remedial actions. Depending on the particular implementation, the remedial actions are described as being initiated by the monitoring controller 610, but alternatively any one or more of these remedial actions can be taken by the external SMCU 630, a different security management subsystem (not shown) of the SoC 602, the logical path 604 of processors and memories of the SoC 602, another component. The monitoring controller 610 receives the diagnostic code and determines the condition of the integrated circuit, as mentioned above. The remedial action can be, for example, modifying the power supply voltage of the logical path 604 by a power management circuit 618 coupled to the monitoring controller 610. The power management circuit 618 can be a PMIC as described above, or any other appropriate power management circuit. The monitoring controller 610 initiates the voltage remedial action by transmitting a command to the power management circuit 618 to modify the power supply voltage. The monitoring controller 610 can modify the power supply voltage by transmitting a command to the power management circuit 618, which in turn supplies the voltage to the IC through the power delivery network 616. In some aspects, a maintenance event is determined when there is no more room for additional remedial actions, i.e., a maximum number of aging compensation steps have been taken such that a particular compensation is exhausted. As an example, the power supply voltage of the power management circuit cannot be raised beyond a predetermined threshold value. Upon reaching this value, the next remedial action is not to raise the voltage again, but to determine a maintenance event.

[0074] The monitoring controller 610 can determine the timing margin of the integrated circuit and increase the power supply voltage to increase the timing margin. The monitoring controller can set a flag in a configuration register 638 of the power management circuit 618 to trigger a speed test of the logical path 604 upon a restart of the integrated circuit. Depending on the implementation, the test can be another type of test. In some aspects, if the margin deteriorates, a built-in self-test (BIST) of the SoC or a component of the SoC can be performed to ensure that the SoC is functioning correctly. In some aspects, the remedial action can be to reduce the functionality of the system, for example, by deactivating some portions or features of the system. In some aspects, the system can take remedial measures at the next drive cycle or next system boot by using an aging flag in non-volatile memory.

[0075] The monitoring controller 610 can be configured to store a flag in the monitoring controller's log 614 to modify the power supply voltage after an integrated circuit restart. The results from the first and second aggregators 632, 634 or just the second aggregator can be used to determine an aging flag for the logical path 604 of the processor and memory. The aging flag can be stored in the log 614 as a diagnostic code sequence that changes over time. The monitoring controller can be configured to read the aging flag at any system startup and apply a remedial action, such as aging compensation, increase voltage supply, limit system functionality, and / or report the condition to a user, and / or prevent the system or a portion of the system from starting.

[0076] In some examples, the log 614 or another memory can be used as a sticky register to accumulate events regarding margin indications. As an example, if the sensor array detects a reduced margin indication within one cycle, the sticky register will store this condition until the register is explicitly cleared. The monitoring controller 610, external SMCU 630, or other device or software can periodically read the sticky register at the end of a drive cycle or at a restart and take a remedial action based on the margin indication events stored therein. The remedial action can be the same or similar to the remedial action taken in response to an interrupt from the interrupt logic 636.

[0077] In one example, an interrupt is taken by storing the event log in a sticky register, which is a non-volatile register. A zero margin indication can require immediate action, but a reduced margin indication can be stored in a log or other non-volatile location. At the end of a drive cycle, any margin indication events are stored for future use. At system startup, the event log in the sticky register is read and any voltage adjustments to the IC are made in accordance with the indications in the event log.

[0078] Figure 7 is a functional block diagram of a second multi-level sensor system. The SoC 702 includes multiple logical paths 704 of the SoC's processor and memory monitored by two-level L1 and L2 monitoring circuitry. The logical paths and monitoring circuitry can be similar to those shown Figure 6 The first sensor array 706 represents the first level (L1) and the second sensor array 708 represents the second level (L2). Both the first sensor array 706 and the second sensor array 708 are coupled to the monitoring controller 710 through a control channel 711. The second sensor array 708 can be actuated by an enable signal from the monitoring controller 710 on the control channel.

[0079] The monitoring controller 710 is coupled to the first sensor array 706 and the second sensor array 708 and is configured to receive the respective first and second level margin indications. The margin indications can be indications of a set timing margin condition. The monitoring controller 710 can actuate the second sensor array 708 in response to one or more of the first level indications, e.g., one or more of the first level indications falling below a threshold. The second sensor array can be configured to replicate a worst case operating instance of the respective logic path. The second sensor array can also have substantially more sensors than the first sensor array.

[0080] The monitoring controller 710 includes a bistate thixotropy controller 712 coupled to the first sensor array 706 (LI array) and the second sensor array 708 (L2 array) to control the bistate thixotropy of the second sensor array 708 through a control channel 711. The first sensor array 706 includes a first aggregator 732 coupled to the control channel 711 to aggregate the first level indications to the sensors of the first sensor array 706 and generate a margin code from the first sensor array 706. Similarly, the second sensor array 708 includes a second aggregator 734 coupled to the control channel 711 to aggregate the second level indications to the sensors of the second sensor array and generate a margin code for the second sensor array 708. The monitoring controller 710 receives the margin codes from the first aggregator 732 and the second aggregator 734 through the control channel 711. The monitoring controller can combine the margin code from the first aggregator 732 with the margin code from the second aggregator 734 to generate a final margin code. When the margin code from either the second aggregator or both the first and second aggregators suggests a warning or error, an interrupt logic 736 of the SoC 702 can be activated to notify the system.

[0081] The monitoring controller 710 is also coupled to or includes a log 714 to store diagnostic codes from the first sensor array 706 and the second sensor array 708. The log can store a series of diagnostic codes, aging flags, and other events. The log can also store additional diagnostic information such as applied voltage set points, applied clock frequencies, temperatures, time stamps, and other information, e.g., use cases, system age, etc. The monitoring controller can generate a health signal and communicate the health signal to a higher layer, e.g., an external SMCU 730.

[0082] The external SMCU 730 can take action in response to a health signal from the monitoring controller, or in some examples, the external SMCU accesses the log 714 through the monitoring controller 710 or an external data port of the SoC 702. The external SMCU 730 can also be coupled to other external components, such as a maintenance facility 722. In addition to external notification, the monitoring controller 710 can initiate various remedial actions, such as increasing the power supply voltage, to increase timing margins. In some aspects, remedial measures are taken at the next drive cycle or next system startup, using an aging flag in non-volatile memory.

[0083] Figure 8 The operation of the bistate thixotropy controller 612 is described in more detail. The target bistate thixotropy can be established based on the characteristics of the circuit being monitored under worst case conditions or in any other manner. In many ICs, a bistate thixotropy rate that is less than repeating the bistate thixotropy at the system clock rate is common for many subsystems and shortens the life, i.e., increases wear of the circuit, compared to running continuously at the clock rate, e.g., the system clock rate. The target rate can be selected that will age the monitoring circuit faster than the expected normal operation of the circuit within the IC. The increased amount of aging can be selected according to the expected use of the IC and the monitoring circuit of the second sensor array 608. The bistate thixotropy controller 612 varies the activity level or duty cycle of the sensor array to meet the target rate. While the monitoring circuit can run at the system clock rate when enabled, the same approach can be used when the clock rate of the sensor array is less than the system clock rate.

[0084] At 802, the total number of bistate thixotropies of the sensor array is measured during a time window. The time window includes time when the sensor array is not enabled and time when the sensor array is enabled. The total number is then tested against the target rate. At 804, if the total exceeds the target, the threshold is decreased at 806. The threshold is the threshold at which the second sensor array is activated. In an example, the first sensor array 606 produces a margin state 644 that is analyzed in the conditional activation controller 642, e.g., by a threshold comparison, to determine whether to activate the second sensor array. At 806, the threshold is decreased to make it closer to zero margin, a less common condition. Thus, the second sensor array is activated less often. If the total number of bistate thixotropies during the window duration does not exceed the target rate, at 808, if the total is less than the threshold, at 810, the threshold is increased toward a greater margin, a more common condition. Thus, the sensor array is activated for a longer time window duration. If the total is neither greater than the target nor less than the target, at 812, the threshold is not changed. The process returns to measure the total number of bistate thixotropies during the next time window.

[0085] Figure 9is a diagram of a two-level sensor array. The first sensor array 902 receives an enable signal 922 from the monitoring controller 910 through the first aggregator and enable circuit 904. Once enabled, the first sensor array 902 generates margin indications to the first aggregator and enable circuit 904. For example, when the code exceeds a marginal threshold, the aggregated indications are passed to the monitoring controller 910 and the monitoring controller stores the aggregated indications in the log 912. The external port 914 allows external components (not shown) to access the log. At the first aggregator and enable circuit 904, the aggregated margin indications of the first sensor array 902 are compared to a preset threshold. When the margin indications of the first sensor array 902 cross a threshold (e.g., a preconfigured trip threshold) of the second sensor array 906, the second sensor array is actuated by an enable signal 926 from the monitoring controller 910. When the margin indications of the first sensor array 902 cross back below the threshold (e.g., a preconfigured trip threshold) of the second sensor array 906, the second sensor array is de-actuated by deactivating the enable signal 926, negating the enable signal 926, or using a different deactivation signal. The first aggregator and enable circuit 904 passes the aggregated margin indications 920 to the monitoring controller 910. These can be passed as diagnostic code sequences. Additional status information of the first sensor array 902 can also be passed from the first aggregator and enable circuit 904 to the monitoring controller 910. The second sensor array 906 can also be enabled by the logic of the conditional enable controller 642.

[0086] The monitoring controller 910 passes an enable signal 926 that can also include a control rate signal to the second aggregator and enable circuit 908 of the second sensor array 906. The second sensor array 906 passes margin indications to the second aggregator and enable circuit 908 after being enabled. The second aggregator and enable circuit 908 passes the aggregated margin indications 924 to the monitoring controller 910. Additional status information of the second sensor array 906 can also be passed to the monitoring controller 910. The monitoring controller analyzes the aggregated margin indications and passes notifications 916 or commands to external components as discussed above. The second sensor array 906 can use the same monitoring circuitry as the first sensor array 902 or other monitoring circuitry with higher precision or with greater depth. The second sensor array 906 can also use much more monitoring circuitry than the first sensor array 902. The margin indications of the first sensor array 902 and the second sensor array 906 can have one or more bits as described in the context of Figure 4 and Figure 5 .

[0087] Figure 10is a process flow diagram illustrating an example of a method for secondary monitoring as described herein. The method 1000 begins at block 1004, where one or more first-level indications of a condition of an integrated circuit are generated in a first sensor array formed in the integrated circuit. The sensors of the first sensor array can have a path through the integrated circuit.

[0088] The method further includes, at block 1006, actuating a second sensor array in response to the one or more first-level indications falling below a threshold, the sensors of the second sensor array having a path through the integrated circuit; in some aspects, the sensors of the second sensor array are more numerous than the sensors of the first sensor array. In some aspects, the sensors of the second sensor array are the same as the sensors of the first sensor array. In some aspects, the sensors of the second sensor array are implemented with a higher precision or reporting depth. The second array can provide full reporting precision or full reporting depth in this way relative to the first sensor array.

[0089] At block 1008, one or more second-level indications of the condition of the integrated circuit are generated in the second sensor array upon actuation.

[0090] Figure 11 is a process flow diagram illustrating an example of a method for using a monitoring circuit for predictive maintenance as described herein. The method 1100 begins at block 1104, where a condition of a logic path is monitored at a monitoring circuit, the logic path being formed in an integrated circuit, the monitoring circuit being formed in the integrated circuit proximate to the logic path.

[0091] The method further includes, at block 1106, generating a diagnostic code sequence to indicate the condition of the logic path over time. At block 1108, determining a condition of the integrated circuit based on the diagnostic code sequence is performed.

[0092] Figure 12 is a process flow diagram illustrating an example of a method for using a monitoring circuit for predictive maintenance as described herein. The method 1100 begins at block 1104, where a condition of a logic path is monitored at a monitoring circuit, the logic path being formed in an integrated circuit, the monitoring circuit being formed in the integrated circuit proximate to the logic path.

[0093] The method further includes, at block 1206, storing the diagnostic code sequence in a log along with a corresponding timestamp, and at block 1208, determining a condition of the integrated circuit based on the diagnostic code sequence is performed.

[0094] In block 1210, a remedial action is initiated in response to the condition of the integrated circuit.

[0095] As used herein, "or" is intended to mean an inclusive or statement such that "a or b" means "one of a, one of b, or both a and b." As used herein, the phrase "at least one of a, b, or c" or "one or more of a, b, or c" means "a, b, or c, or any combination thereof." As used herein, the phrase "at least one of a, b, or c" or "one or more of a, b, or c" means "a, b, or c, or any combination thereof."

[0096] The various illustrative components, logic elements, and / or circuitry elements described herein can be implemented as hardware, software, firmware, or combinations thereof, including one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), field programmable gate arrays (FPGAs), logic circuits, processors, controllers, micro-controllers, or any other design or combination thereof. In one example, the various illustrative components, logic elements, and / or circuitry elements described herein can be implemented as a machine or

[0097] The various illustrative logics, logical components, modules, and circuits described herein can be implemented or performed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field

[0098] In one or more exemplary aspects, the functions described can be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions can be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. Storage media can be any available media that can be accessed by a computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. Combinations of the above should also be included within the scope of computer-readable media.

[0099] An overview of embodiments of the present disclosure is provided below.

[0100] Embodiment 1 : An apparatus comprising: a first sensor array formed in an integrated circuit, sensors of the first sensor array having a path through the integrated circuit and configured to generate one or more first-level indications of a condition of the integrated circuit; a second sensor array formed in the integrated circuit, sensors of the second sensor array having a path through the integrated circuit and configured to generate one or more second-level indications of the condition of the integrated circuit; and a monitoring controller coupled to the first sensor array and the second sensor array and configured to receive the one or more first-level indications and actuate the second sensor array in response to the one or more first-level indications.

[0101] Embodiment 2: The apparatus of embodiment 1, wherein the indications include indications of a set timing margin condition.

[0102] Embodiment 3: The apparatus of any one or more of the above embodiments, wherein the integrated circuit has a plurality of logic paths, wherein the sensors of the first sensor array are configured to replicate operation of a respective logic path.

[0103] Embodiment 4: The apparatus of any one or more of the above embodiments, wherein the sensors of the second sensor array are configured to replicate a worst-case instance of operation of the respective logic path.

[0104] Embodiment 5: The apparatus of any one or more of the preceding embodiments, wherein the monitoring controller comprises a bi-state thixotropy controller coupled to the first sensor array, the bi-state thixotropy controller configured to control a bi-state thixotropy of sensors of the second sensor array.

[0105] Embodiment 6: The apparatus of Embodiment 5, wherein the bi-state thixotropy controller is configured to observe the one or more first-level indications, compare the one or more first-level indications to a threshold, and enable the second sensor array in response to the comparison.

[0106] Embodiment 7: The apparatus of Embodiment 6, wherein the bi-state thixotropy controller is configured to observe a bi-state thixotropy of the second sensor array, compare the bi-state thixotropy of the second sensor array to a target bi-state thixotropy, adjust the bi-state thixotropy of the second sensor array by adjusting a threshold in response to the comparison, and enable the second sensor array based on a margin indication from the first sensor array.

[0107] Embodiment 8: The apparatus of Embodiment 7, wherein the bi-state thixotropy controller is configured to adjust the bi-state thixotropy of the second sensor array to increase a degradation of the second sensor array compared to the logical path.

[0108] Embodiment 9: The apparatus of Embodiment 7 or 8, wherein the bi-state thixotropy controller is configured to observe the bi-state thixotropy of the second sensor array by counting a number of bi-state thixotropies over a time window.

[0109] Embodiment 10: The apparatus of any one or more of the preceding embodiments, wherein the monitoring controller is configured to enable the second sensor array in response to a margin depth of the one or more first-level indications crossing a threshold toward a lower margin.

[0110] Embodiment 11: The apparatus of any one or more of the preceding embodiments, wherein the second sensor array comprises an aggregator configured to aggregate the one or more second-level indications for the sensors of the second sensor array and generate a margin code, and wherein the monitoring controller receives the margin code.

[0111] Embodiment 12: The apparatus of any one or more of the preceding embodiments, wherein the first sensor array comprises an aggregator configured to aggregate the one or more second-level indications for the sensors of the first sensor array and generate a margin code, and wherein the monitoring controller receives the margin code to actuate the second sensor array in response to the margin code.

[0112] Embodiment 13: The apparatus of embodiment 12, including interrupt logic configured to initiate a shutdown procedure of at least a portion of the integrated circuit in response to the margin code.

[0113] Embodiment 14: The apparatus of embodiment 12 or 13, including interrupt logic configured to take a remedial action in response to the margin code, the remedial action including one or more of: shutting down at least a portion of a system, increasing an operating voltage of the integrated circuit, and storing the margin code as an event in a non-volatile memory for future remedial action.

[0114] Embodiment 15: The apparatus of any one or more of the above embodiments, including a control channel coupled to the monitoring controller and the second sensor array, and wherein the second sensor array is actuated by an enable signal from the monitoring controller on the control channel.

[0115] Embodiment 16. The method of claim 15, wherein the second sensor array is deactivated by de-asserting the enable signal from the monitoring controller on the control channel.

[0116] Embodiment 17: The apparatus of any one or more of the above embodiments, wherein the one or more second-level indications include a plurality of bit diagnostic codes.

[0117] Embodiment 18: A method, comprising: generating one or more first-level indications of a condition of an integrated circuit in a first sensor array formed in the integrated circuit, sensors of the first sensor array having a path through the integrated circuit; actuating a second sensor array in response to the one or more first-level indications falling below a threshold, sensors of the second sensor array having a path through the integrated circuit and being more numerous than the sensors of the first sensor array; and generating one or more second-level indications of the condition of the integrated circuit in the second sensor array.

[0118] Embodiment 19: A method, comprising: generating one or more first-level indications of a condition of an integrated circuit in a first sensor array formed in the integrated circuit, sensors of the first sensor array having a path through the integrated circuit; actuating a second sensor array in response to the one or more first-level indications falling below a threshold, sensors of the second sensor array having a path through the integrated circuit; and generating one or more second-level indications of the condition of the integrated circuit in the second sensor array upon actuation.

[0119] Example 20: A computer-readable medium having instructions, which when executed by a machine, cause the machine to perform operations comprising: generating one or more first-level indications of a condition of an integrated circuit in a first sensor array formed in the integrated circuit, sensors of the first sensor array having a path through the integrated circuit; actuating a second sensor array in response to the one or more first-level indications falling below a threshold, sensors of the second sensor array having a path through the integrated circuit; and generating one or more second-level indications of the condition of the integrated circuit in the second sensor array upon actuation.

Claims

1. An apparatus comprising: a first sensor array formed in an integrated circuit, sensors of the first sensor array having a path through the integrated circuit and configured to generate one or more first level indications of a condition of the integrated circuit; a second sensor array formed in the integrated circuit, sensors of the second sensor array having a path through the integrated circuit and configured to generate one or more second level indications of the condition of the integrated circuit; and a monitoring controller coupled to the first sensor array and the second sensor array and configured to receive the one or more first level indications and actuate the second sensor array in response to the one or more first level indications.

2. The apparatus of claim 1, wherein the indications include indications of a setup timing margin condition.

3. The apparatus of claim 1, wherein the integrated circuit has a plurality of logic paths, wherein the sensors of the first sensor array are configured to replicate operation of a respective logic path.

4. The apparatus of claim 1, wherein the sensors of the second sensor array are configured to replicate a worst case instance of operation of the respective logic path.

5. The apparatus of claim 1, wherein the monitoring controller includes a bistate metastability controller coupled to the first sensor array, the bistate metastability controller configured to control a bistate metastability of sensors of the second sensor array.

6. The apparatus of claim 5, wherein the bistate metastability controller is configured to observe the one or more first level indications, compare the one or more first level indications to a threshold, and enable the second sensor array in response to the comparison.

7. The apparatus of claim 6, wherein the bistate metastability controller is configured to observe a bistate metastability of the second sensor array, compare the bistate metastability of the second sensor array to a target bistate metastability, adjust the bistate metastability of the second sensor array by adjusting a threshold in response to the comparison, enable the second sensor array based on a margin indication from the first sensor array.

8. The apparatus of claim 7, wherein the bistate metastability controller is configured to adjust the bistate metastability of the second sensor array to increase degradation of the second sensor array compared to the logic path.

9. The apparatus of claim 7, wherein the bistate metastability controller is configured to observe the bistate metastability of the second sensor array by counting a number of bistate metastabilities over a window of time.

10. The apparatus of claim 1, wherein the monitoring controller is configured to enable the second sensor array in response to a margin depth of the one or more first level indications crossing a lower margin threshold. ​ 11. The apparatus of claim 1, wherein the second sensor array includes an aggregator configured to aggregate the one or more second-level indications of the sensors of the second sensor array and generate a margin code, and wherein the monitoring controller receives the margin code.

12. The apparatus of claim 1, wherein the first sensor array includes an aggregator configured to aggregate the one or more second-level indications of the sensors of the first sensor array and generate a margin code, and wherein the monitoring controller receives the margin code to actuate the second sensor array in response to the margin code.

13. The apparatus of claim 12, including an interrupt logic configured to initiate a shutdown process of at least a portion of the integrated circuit in response to the margin code.

14. The apparatus of claim 12, including an interrupt logic configured to take a remedial action in response to the margin code, the remedial action including one or more of shutting down at least a portion of a system, increasing an operating voltage of the integrated circuit, and storing the margin code as an event in a non-volatile memory for future remedial action.

15. The apparatus of claim 1, including a control channel coupled to the monitoring controller and the second sensor array, and wherein the second sensor array is actuated by an enable signal from the monitoring controller on the control channel.

16. The method of claim 15, wherein the second sensor array is deactivated by de-asserting the enable signal from the monitoring controller on the control channel.

17. The apparatus of claim 1, wherein the one or more second-level indications include a plurality of bit diagnostic codes.

18. A method comprising: generating one or more first-level indications of a condition of an integrated circuit in a first sensor array formed in the integrated circuit, sensors of the first sensor array having a path through the integrated circuit; actuating a second sensor array in response to the one or more first-level indications falling below a threshold, sensors of the second sensor array having a path through the integrated circuit and being more numerous than the sensors of the first sensor array; and generating one or more second-level indications of the condition of the integrated circuit in the second sensor array.

19. A method comprising: generating one or more first-level indications of a condition of an integrated circuit in a first sensor array formed in the integrated circuit, sensors of the first sensor array having a path through the integrated circuit; actuating a second sensor array in response to the one or more first-level indications falling below a threshold, sensors of the second sensor array having a path through the integrated circuit; and Upon actuation, one or more second-level indications of the condition of the integrated circuit are generated in the second sensor array.

20. A computer-readable medium having instructions, which, when executed by a machine, cause the machine to perform operations comprising: generating one or more first-level indications of a condition of an integrated circuit in a first sensor array formed in the integrated circuit, sensors of the first sensor array having a path through the integrated circuit; actuating a second sensor array in response to the one or more first-level indications falling below a threshold, sensors of the second sensor array having a path through the integrated circuit; and upon actuation, one or more second-level indications of the condition of the integrated circuit are generated in the second sensor array.

21. The method of claim 20, wherein the one or more second-level indications are generated in response to a change in a characteristic of the integrated circuit.

Images