Network physical layer transceiver with detection and response to single event effects - Patents.com

Abstract

A network node including a physical layer transceiver (106) and a physical layer transceiver. The transceiver includes a media independent interface (200), a converter circuit block (210) including circuit elements (214) configured to convert digital signals to analog signals for transmission over a network communication medium and to convert analog signals received over the medium to digital signals, and one or more processing blocks (202A, 202B, 202C) configured to process digital data communicated between the media independent interface and the converter circuit block in accordance with a network protocol. A management and control circuit element (220) including power management circuit elements and reset circuit elements is provided. The transceiver further includes at least one single event effect (SEE) monitor (240), such as an environmental monitor (242), a configuration register monitor (244), a state machine monitor (246), or a phase locked loop (PEL) lock monitor (250) configured to detect and respond to SEE events in the transceiver.

Description

[Technical field]

[0001] This application relates to network data communication equipment, and more particularly to physical layer transceivers. [Background technology]

[0002] In the field of network communications, a common reference model used to describe the architecture of communications protocols is the Open Systems Interconnection (OSI) layered reference model. This reference model includes a stack of abstraction layers, the "bottom layer" of which is commonly called the physical layer or "PHY." The OSI physical layer defines the electrical, timing, and other interfaces over which data bits are sent over a communications link, whether wired (e.g., Ethernet) or wireless (e.g., cellular telephone, wireless local area network, or WiFi). Communications elements such as electrical signals, signaling speeds, media and connector types, and network topology are contained within the PHY abstraction layer.

[0003] From a hardware perspective, the term "PHY" refers to an electronic circuit, usually implemented as an integrated circuit, that implements the physical layer functions of the OSI model in a network interface controller or other network node. For example, "PHY" is often used to refer to a transceiver circuit element in a network node that transmits and receives signals to and from another network node. Within a network node, a PHY connects a link layer device (often called "MAC," an acronym for Medium Access Control) to a physical medium, such as an optical fiber or copper cable. An exemplary PHY device includes both physical coding sublayer (PCS) and physical medium dependent (PMD) layer functions.

[0004] In the context of Ethernet, a PHY can refer to a physical layer transceiver device for transmitting and receiving Ethernet frames that implements the Ethernet physical layer portions of the 1000BASE-T (1000 Mbps), 100BASE-TX (100 Mbps over copper), and 10BASE-T (10 Mbps) standards according to the network in which it is implemented. In these implementations, the Ethernet PHY provides analog signal physical access to the link and interfaces with a Media Independent Interface (MII) to a MAC chip in a microcontroller or another system that performs higher layer functions, since the PHY generally does not handle MAC addressing.

[0005] In many network interface card (NIC) implementations, the Ethernet PHY is realized as an integrated circuit that implements the hardware transmission and reception of Ethernet frames and the interface between the Ethernet analog and digital domains of link layer packet signaling. A NIC may integrate the PHY, MAC, and other functionality in a single integrated circuit, or alternatively as separate integrated circuits. Examples of modern Ethernet transceivers include the DP838xx family of devices available from Texas Instruments Incorporated.

[0006] As integrated circuit features have become smaller over the years, modern integrated circuits have become more susceptible to malfunctions caused by the impact of energetic ions or atomic-scale particles on the integrated circuit. Malfunctions in integrated circuits due to this can result from even a single particle impact on the device. The effects of these ions and particles on integrated circuits are generally referred to as "single event effects" or "SEEs", reflecting the random and non-periodic nature of the underlying mechanism. While many errors due to SEEs are transient or "soft", in some cases, the effect of the event can be catastrophic malfunction or permanent damage to the device. For example, one type of "soft" or non-destructive SEE is called a Single Event Upset (SEU), which refers to a "bit flip" (change of state) in memory, registers, or other digital functions and signal paths. Another type of soft SEE is a Single Event Transient (SET), which appears as a transient pulse on an analog signal path. SEEs also include "hard" errors that can be potentially destructive to devices. One example of such a "hard" SEE is known as Single Event Latch-up (SEL), which can cause operating currents to exceed device specifications (thereby requiring a power off reset for recovery, or in the worst case permanently damaging the device). Other types of "hard" SEE errors include burnout of power MOSFETS, gate rupture of MOS transistors and capacitors, frozen bits, and excessive noise.

[0007] Another type of SEE that can appear in functional logic circuitry is called a Single Event Functional Interrupt (SEFI). For example, an ion strike can cause the logic circuitry to enter a different operating state, which may include an "off" state or possibly a disabled state. A SEFI in which a control or configuration register bit is flipped can change the configuration of the device. Also, a SEFI in a reset circuit can cause an unintended reset of the logic circuitry.

[0008] Integrated circuits deployed in the space environment are increasingly vulnerable to SEEs due to the enhanced presence of cosmic rays and high-energy protons in the environment. Cosmic rays can be galactic or solar in origin and often contain heavy ion components that have been observed to cause SEEs by direct ionization. This mechanism results from ion particles that deposit sufficient charge as they pass into the integrated circuit to cause memory bit flips or electrical transients. High-energy protons trapped in the Earth's radiation belts or emanating from solar flares can also cause direct ionization SEEs in highly sensitive devices. Another SEE mechanism is indirect ionization caused by nuclear reactions from high-energy protons occurring near sensitive device areas in the device.

[0009] In many cases, the effects of an SEE occurring in a complex integrated circuit such as an Ethernet PHY may only be manifested by complete failure of the device if, for example, the SEE causes the device to enter an invalid or undesirable operating mode, state, or condition, or, in the worst case, causes the device to draw excessive power supply current from a latch-up or similar condition.

[0010] It is within this context that the embodiments described herein occur. Summary of the Invention

[0011] According to one aspect, a physical layer transceiver includes a media independent interface, a digital-to-analog circuit block including circuit elements configured to convert digital signals to analog signals for transmission over a network communication medium and to convert analog signals received over the network communication medium to digital signals, and one or more processing blocks configured to process digital data communicated between the media independent interface and the digital-to-analog circuit block in accordance with a network protocol. Management and control circuitry is provided, including power management circuitry and reset circuitry. The transceiver includes at least one single event effect (SEE) monitor configured to detect and respond to SEE events in the transceiver.

[0012] According to one aspect, the at least one SEE monitor includes an environmental monitor that samples one or more of the power supply voltage and the power supply current, digitizes the sampled voltage or current, determines whether the digitized value differs from previous history for that parameter by more than a threshold value, and if so, issues a reset signal.

[0013] According to one aspect, the at least one SEE monitor includes a register monitor coupled to a configuration register in the processing block. The register monitor includes an error correction code (ECC) circuit element configured to read and decode a codeword from the configuration register according to an ECC code to determine whether any bits of the codeword are erroneous. In one example, the ECC circuit element can correct the erroneous bits and reload the corrected codeword into the configuration register.

[0014] According to one aspect, the at least one SEE monitor includes a state machine monitor coupled to sequential logic corresponding to a state machine having one or more states and one or more state variables. A state register stores a state code based on a one-hot encoding of the value of the state variable in a current state. The state machine monitor is configured to determine whether a state transition of the state machine is valid or whether the stored state code is valid. If not, the state machine monitor can issue a reset signal.

[0015] According to one aspect, the at least one SEE monitor includes a phase-locked loop (PLL) lock monitor circuit for monitoring for loss of phase lock of a PLL or other timing circuitry. Register updates in a data interface of the PHY device may be disabled in response to an out-of-lock condition.

[0016] According to one aspect, a transceiver according to these aspects is incorporated into a network node, which further includes a network node processor, a medium access control coupled to the transceiver and the network node processor, and an interface between the transceiver and the network communication processor.

[0017] Technical advantages enabled by one or more of these aspects include improved capabilities to detect SEE events in both the data and control paths of a physical layer transceiver, and to respond to those SEE events within the transceiver, thus avoiding catastrophic impairments, and in worst cases, permanent damage, to the transceiver. Implementation of these aspects may be particularly beneficial in space environments, where the likelihood of SEEs is particularly high.

[0018] Other technical advantages enabled by the described embodiments will become apparent to those skilled in the art upon review of the following specification together with its drawings. [Brief description of the drawings]

[0019] [Figure 1] 1 is an electrical diagram illustrating, in block form, a network node constructed in accordance with some examples.

[0020] [Diagram 2] 1 is an electrical schematic diagram illustrating, in block form, a physical layer transceiver (PHY) constructed in accordance with an example.

[0021] [Diagram 3] 3 is an electrical schematic diagram illustrating in block form an environmental monitor in combination with management and PHY control circuitry in the PHY of FIG. 2 according to an example.

[0022] [Figure 4] 4 is a flow chart illustrating operation of the environmental monitor of FIG. 3 according to an example.

[0023] [Figure 5A] 3 is an electrical diagram illustrating in block form a register monitor in the PHY of FIG. 2 according to an example.

[0024] [Figure 5B] FIG. 5B is an electrical diagram illustrating, in schematic form, storage bits in the configuration register of FIG. 5A, according to an example.

[0025] [Figure 6] 5B is a flow chart illustrating the operation of the environmental monitor of FIG. 5A according to an example.

[0026] [Figure 7] 3 is a schematic diagram illustrating in block form a state machine monitor in combination with an instance of sequential logic in the PHY of FIG. 2 according to an example.

[0027] [Figure 8] 8 is a flow chart illustrating the operation of the state machine monitor of FIG. 7 according to an example.

[0028] [Figure 9A] 3 is an electrical schematic diagram illustrating in block form the PLL and loss-of-lock detection circuitry in the PHY of FIG. 2 according to an example.

[0029] [Figure 9B] FIG. 9B is a timing diagram illustrating timing windows used by the loss-of-lock detection circuitry of FIG. 9A for phase lock and loss-of-lock detection, according to one example.

[0030] [Figure 10] 9C is a flow chart illustrating the operation of the PLL lock detection circuitry of FIGS. 9A and 9B according to an example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0031] In the drawings, the same reference numbers or other reference designators are used to denote the same or similar features (in function and / or structure).

[0032] One or more embodiments described herein are implemented in a physical layer transceiver device in an Ethernet-type network, such as may be deployed in a space environment, as it is contemplated that such implementations are particularly advantageous in that context. However, it is also contemplated that aspects of these embodiments may be advantageously applied in other applications, such as in communications hardware for other types of networks, and in other environments in which devices may be vulnerable to particle-induced functional errors or failures. Accordingly, the following description is provided by way of example only.

[0033] 1 illustrates an example of a network node 100 in which some embodiments may be implemented. The network node 100 may be implemented as any of several network functions, such as a computing device in either or both roles of a network server or client, a peripheral device such as a printer or other input / output function, a sensor or controller (e.g., in the context of the Internet of Things, or IOT), a router, a switch, or another network function. The network node 100 is coupled to a network communication medium 102 through which data and control information is received and transmitted. In this particular example, in which the network communication is performed over an Ethernet network, the network communication medium 102 is implemented as CAT6 copper wiring or the like. In other implementations, the network communication medium 102 may be implemented as optical fiber or the like.

[0034] In the example of FIG. 1, the network node 100 includes an Ethernet physical layer transceiver (PHY) 106 constructed according to one embodiment. In the example where the network communication medium 102 is a hardwired Ethernet connection, the PHY 106 is coupled to the medium 102 by a magnetic coupling interface 104. The magnetic coupling interface 104 is provided to galvanically isolate the medium 102 from the PHY 106 while providing a signal path. For example, the magnetic coupling interface 104 may be implemented as a separate Ethernet magnetic module that is placed in the signal path between the PHY 106 with a connector jack for physically coupling to the network communication medium 102. Alternatively, the magnetic coupling interface 104 may be integrated within the same housing or package as the Ethernet connector jack. In either case, the interface 122 between the PHY 106 and the magnetic coupling interface 104 in this implementation is referred to as a medium dependent interface (MDI) in the Ethernet context, in that its specifications depend on the particular medium used for the network communication medium 102.

[0035] In this example, the Ethernet PHY 106 includes appropriate circuitry for transmitting and receiving data and control information between upstream functions and the network communication medium 102. In the context of Ethernet, the PHY 106 receives digital data in the form of Ethernet frames from a medium access controller (MAC) 108 and generates analog signals corresponding to those frames for transmission over the medium 102. In its receiving function, the PHY 106 processes the analog signals received over the medium 102, digitizing and formatting the digital data into Ethernet frames for consumption and processing by the MAC 108 and further by upstream functions for those signals representing data intended for the network node 100. Thus, the PHY 106 acts as an interface between the Ethernet analog domain of the medium 102 and the digital domain of link layer packet signaling for the network node 100 as implemented by the MAC 108. The configuration and operation of the PHY 106 according to several examples are described in more detail below.

[0036] According to this example, the PHY 106 is coupled to the MAC 108 by an interface 124, which in this implementation, in the context of Ethernet, is referred to as a Media Independent Interface (MII) or Reduced Gigabit Media Independent Interface (RGMII) in that the interface specification is independent of the physical implementation of the network communication medium 102. The Media Access Controller (MAC) 108 in the network node 100 includes appropriate circuitry for processing data received from the PHY 106 and to be communicated to the PHY 106 for transmission. This processing may include, for example, management frames buffering data in both the transmit and receive directions, packet formatting and recognition, timer functions, and other operations involved in the Data Link Layer or MAC Layer, part of the OSI model. The MAC 108 may be integrated into a processor, a field programmable gate array (FPGA), digital circuitry, memory, an application specific integrated circuit (ASIC), software, or a combination thereof. The MAC 108 may be implemented within the same integrated circuit as the PHY 106 and the MII interface 124 , or alternatively, as one or more integrated circuits separate from the PHY 106 .

[0037] In the example of FIG. 1, the network node processor 110 is coupled to the MAC 108 by an interface 126. The network node processor 110 provides data processing and control functions appropriate for implementing the functions of the network node 100 in the network. The network node processor 110 may be implemented as a microprocessor, microcontroller, FPGA, switch fabric, and / or other suitable circuit elements and / or for its functions. The network node processor 110 may be implemented within the same integrated circuit as the MAC 108, or alternatively as one or more separate integrated circuits. In one example of the latter case, the MAC 108, PHY 106, and magnetic coupling interface 104 may be implemented in a network interface card (NIC) to which the network node processor 110 is coupled via interface 126.

[0038] 2, according to one or more examples, PHY 106 is constructed and operative to include one or more mechanisms for monitoring and responding to errors in both the control and data paths due to SEE. Thus, PHY 106 may be beneficial when implemented in communications equipment deployed in a space environment, such as a satellite, spacecraft, or the like.

[0039] 2 illustrates the architecture of PHY 106 according to one example. As mentioned above, PHY 106 has the overall functionality of interface communication between the Ethernet analog domain and the digital domain of link layer packets in network communication medium 102, and signals emitted to network node 100 as performed by MAC 108. Thus, in this example, PHY 106 includes MII interface circuitry 200 through which digital signals processed or to be processed by PHY 106 are communicated to and received from MAC 108 over interface 124, respectively, in accordance with the appropriate RGMII or MII protocol, as the case may be.

[0040] For processing of digital data to be communicated to and received from the MAC 108, the PHY 106 includes one or more communication processing blocks 202 (e.g., including processing blocks 202A, 202B, 202C). In this example, where the PHY 106 is operable to process communications according to any of three Ethernet protocols, the PHY 106 includes a 100BASE-TX processing block 202A, a 10Base-Te processing block 202B, and a 1000BASE-T processing block 202C. Each block 202 is coupled on one side to the MII interface circuitry 200 and on the other side to a converter block 210 for communication with the network communication medium 102 via the magnetic coupling interface 104. Each of the processing blocks 202A, 202B, 202C includes digital logic circuitry (or other circuitry, memory, and / or software) configured and operable to process digital data appropriately for the particular protocol involved. For example, the digital logic circuitry included in the processing blocks 202A, 202B, 202C may be implemented at least partially as sequential logic in the form of one or more state machines. In this example, the processing blocks 202A, 202B, 202C may also include one or more configuration registers that may configure the processing blocks and the PHY 106 to operate in a selected one of multiple operating modes.

[0041] In the Ethernet context of this example, the digital logic circuit elements in each of the processing blocks 202A, 202B, 202C are arranged to implement one or more sublayers in the applicable Ethernet protocol. In this example, the 100BASE-TX processing block 202A implements (in order from the MII side to the Ethernet media side) the Physical Coding Sublayer (PCS), the Physical Medium Attachment (PMA) sublayer, and the Physical Medium Dependent (PMD) sublayer. Similarly, the 10BASE-Te block 202B and the 1000BASE-T block 202C implement the PCS and PMA sublayers, but in this example do not require the PMD sublayer for Ethernet communication over the copper media 102. As can be seen in FIG. 2, each of the 100BASE-TX block 202A, the 10Base-Te block 202B, and the 1000BASE-T block 202C is coupled to a converter block 210.

[0042] In this implementation, the converter block 210 is configured and operable to convert signals between the digital domain of the 100BASE-TX block 202A, the 10BASE-Te block 202B, and the 1000BASE-T block 202C and the analog domain (e.g., as used by the network communication medium 102). Thus, the converter block 210 includes a digital-to-analog and analog-to-digital (DAC / ADC) subsystem 214 coupled to each of the processing blocks 202A, 202B, 202C. The DAC / ADC subsystem 214 is also coupled to a driver / receiver circuitry 216, which is coupled to the network communication medium 102 via the magnetic coupling interface 104. For reception of signals from the network communication medium 102, the driver / receiver circuitry 216 includes appropriate analog filters, level shifters, and other circuitry suitable for communicating the received analog signals (e.g., in the form of differential signals) to ADC (analog-to-digital) circuitry in the DAC / ADC subsystem 214, which converts the processed received analog signals to digital symbols for communication to the appropriate processing block 202 under an operational protocol. For transmission of digital data to the network communication medium 102, the DAC / ADC subsystem 214 includes DAC (digital-to-analog) circuitry that converts the digital symbols to analog signals (e.g., differential signals) that are then driven by appropriate driver circuitry included within the driver / receiver circuitry 216 for application to the magnetic coupling interface 104. The converter block 210 includes a timing circuitry 218 constructed and operable to provide appropriate clock signals to the DAC / ADC subsystem 214 for conversion operations. Timing circuitry 218 may generate these clocks based on a master clock signal received (eg, from a crystal or bulk acoustics external to PHY 106 ) or generated within PHY 106 .

[0043] Certain additional functionality is also provided within PHY 106 in accordance with this example. As shown in FIG. 2, PHY 106 includes management and control circuitry 220 configured and operable to perform appropriate operations for control of PHY 106 as an integrated circuit device. For example, management and control circuitry 220 includes reset circuitry for performing a hardware reset of PHY 106, e.g., in response to an external reset signal. Management and control circuitry 220 may also include circuitry for generating interrupt signals that are communicated to processors elsewhere within network node 100, and may include circuitry for receiving and communicating status and control information to and from external circuitry. Management and control circuitry 220 may further include power management circuitry for receiving one or more power supply voltages, one example of which is received at terminal VDD, shown in FIG. 2, and for generating bias and reference voltages from those power supply voltages for distribution throughout PHY 106. Other functions not shown in FIG. 2 may also be provided within PHY 106, including "wake on LAN" circuitry, auto-negotiation circuitry, and the like.

[0044] According to this example, PHY 106 includes monitoring and detection circuitry 240 configured and operable to monitor circuitry within PHY 106 to detect SEEs, SEUs, and SEFIs, such as may result from the impact of heavy ions and energetic protons on an integrated circuit incorporating PHY 106. As shown in FIG. 2, monitoring and detection circuitry 240 includes an environmental monitor 242, a register monitor 244, and a state machine monitor 246. As shown in FIG. 2, monitoring and detection circuitry 240 is coupled to each of processing blocks 202A, 202B, 202C, and also to management and PHY control circuitry 220, as appropriate. More specifically, one or more of environmental monitor 242, register monitor 244, and state machine monitor 246 are coupled to processing block 202 and management and PHY control circuitry 220, depending on the particular function or operation being monitored. The structure and operation of each of the environmental monitor 242, the register monitor 244, and the state machine monitor 246 are described in further detail below.

[0045] Also in this example, a phase-locked loop (PLL) lock monitor 250 is separately implemented as part of the converter block 210 to monitor for timing upsets in the DAC / ADC subsystem 214. The configuration and operation of the PLL lock monitor 250 is also described in further detail below.

[0046] 3, the configuration and operation of environmental monitor 242 is shown as implemented within PHY 106 according to one example. In this implementation, environmental monitor 242 monitors the operating conditions of the power supply to PHY 106, and also other environmental conditions, such as the operating temperature of the integrated circuit that includes PHY 106. By monitoring these conditions of PHY 106, environmental monitor 242 is able to detect SEFI events that may otherwise be undetectable by other SEE detection techniques.

[0047] In connection with monitoring power supply operating conditions, the environmental monitor 242 is coupled to power management circuitry 300 in the management and PHY control circuitry 220. In this example, the power management circuitry 300 includes appropriate circuitry and / or software for managing the distribution of power (e.g., supply voltage and / or supply current) through the PHY 106, and in that regard may include voltage regulation and reference voltage generation circuitry to generate other internal voltages, as necessary. The PHY 106 may utilize multiple power supply voltages to serve as VDD power supplies for various circuit blocks. For example, as shown in FIG. 3, the power management circuitry 300 is coupled to terminals VDD_1V, VDD_1.8V, and VDD_2.5V to receive power supply voltages at nominal voltages of 1.0V, 1.8V, and 2.5V, respectively. The voltages at terminals VDD_1V, VDD_1.8V, and VDD_2.5V are coupled to the environmental monitor 242 via lines VA, VB, and VC, respectively. Current sensors 312A, 312B, 312C are also provided within the power management circuitry 300 for sensing the supply current drawn by the PHY 106 from the power supply terminals VDD_1V, VDD_1.8V, and VDD_2.5V, respectively. The current sensors 312 may be implemented, for example, as small resistors across which a voltage is measured, inductive or Hall effect sensors, etc. The current sensors 312A, 312B, 312C are coupled to the environmental monitor 242 via lines 1A, 1B, 1C, respectively.

[0048] The environmental monitor 242 of the PHY 106 includes circuitry configured to monitor and analyze power supply voltages and currents to detect possible SEFT events. In this example, a multiplexer 320 in the environmental monitor 242 has inputs connected to lines VA, VB, VC (corresponding to the voltages at terminals VDD_1V, VDD_1.8V, and VDDcc_2.5V, respectively) and lines IA, IB, and IC (corresponding to the supply currents drawn by the PHY 106 from terminals VDD_1V, VDD_1.8V, and VDD_2.5V, respectively). A select signal TS from control circuitry within the environmental monitor 242, for example from a SEFI engine 330 as shown in FIG. 3, or from elsewhere within the PHY 106, operates to select one of the inputs of the multiplexer 320 for connection to its output. The output of the multiplexer 320 is coupled to an input of a sigma-delta ADC 322 (e.g., a one-bit converter) that samples the signal monitored at the selected output (e.g., via oversampling) and filters or otherwise modulates the sampled signal to provide a digital value corresponding to the corresponding voltage or current. In this example, the digital output of the sigma-delta ADC 322 is coupled to an input of a decimation filter 324 that decimates the digital output of the sigma-delta ADC 322 to fewer digital bits for efficiency. The decimation filter 324 may be implemented within the sigma-delta ADC 322 if desired. The decimated digitized voltage or current measurements are transferred from the decimation filter 324 to a history memory 326 and to the SEFI engine 330, as the case may be. The history memory 326 maintains a historical record of parameters measured by the environmental monitor 242 over time.

[0049] In this example, the operating temperature of the integrated circuit (e.g., the substrate temperature of the integrated circuit in or on which PHY 106 is fabricated) is also monitored by environmental monitor 242. This environmental chip temperature is an additional or optional parameter monitored by environmental monitor 242, and additional environmental conditions may also be monitored by environmental monitor 242 in addition to chip temperature, if desired. In this regard, management and PHY control circuitry 220 includes a temperature sensor 310 that provides an analog signal corresponding to the temperature on line TEMP to an additional input of a multiplexer 320 in environmental monitor 242. Thus, multiplexer 320 includes the signal on line TEMP as one of its inputs that connects to sigma-delta modulator 322 for digitization, and decimation filter 324 similarly decimates the sampled digital value, and the decimated digitized value of the analog signal on line TEMP is also connected to history memory 326 and SEFI engine 330 for storage and analysis, respectively.

[0050] SEFI engine 330 may be constructed as a digital logic circuit element, e.g., a dedicated logic circuit element, a programmable logic circuit element executing program instructions (e.g., stored in its memory, in a local memory in environmental monitor 242, or in a memory elsewhere in PHY 106, or some combination thereof) configured to perform its functions as exemplary described herein. Generally, SEFI engine 330 operates to analyze voltage, current, and (optionally) temperature measurements as monitored over time to detect possible SEFI events and issue signals to appropriate circuit elements in PHY 106 in response. In the example of FIG. 3, SEFI engine 330 generates a reset signal in response to its detection of a SEFI event and communicates the reset signal on line RST to reset circuit element 340 in management and PHY control circuitry 220.

[0051] 4 illustrates the operation of the environmental monitor 242 of FIG. 3 according to an example. In process 400, the SEFI engine 330 polls voltage, current, and (optionally) temperature measurements, for example, by cycling a control signal TS applied to a select input of the multiplexer 320 to select one of its inputs for forwarding to the sigma-delta ADC 322. In this example, the polling process 400 selects one of the inputs of the multiplexer 320 (e.g., one of VA, VB, VC, IA, IB, IC, TEMP) for forwarding to the sigma-delta ADC 322. Alternatively, more than one of the input signals applied to the multiplexer 320 may be acquired in process 400 prior to forwarding any of the signals to the sigma-delta ADC 322. However, in this description, the operation of the environmental monitor 242 is described as where the polling process 400 obtains one monitored parameter (e.g., voltage, supply current, or temperature) at the time of processing to determine whether its current value indicates a SEFI event.

[0052] In process 402, sigma delta ADC 322 converts the signal acquired in process 400 via multiplexer 320 from an analog signal to a digital data word, in this example using 1-bit sigma delta modulation. Also in process 402, decimation filter 324 decimates the digital data word output by sigma delta ADC 322, and the decimated digital value is stored in history memory 326, for example in association with a timestamp indicating the current time (e.g., acquisition time). This decimation of the digital value by decimation filter 324 reduces the size required for history memory 326 while still providing adequate accuracy for SEE detection. The decimated digital value output by decimation filter 324 is also forwarded to SEFI engine 330, shown in FIG. 3, for comparison to recent history for that measured parameter, as described below.

[0053] According to this example, the environmental monitor 242 operates to detect SEFI events that affect the power supply voltage and supply current. More specifically, it has been observed that an SEE, such as that resulting from the impact of an energetic proton or heavy ion on an integrated circuit, can manifest itself as an abrupt change in the current drawn from the external power supply, often as an abrupt drop in that supply current. An SEE can also manifest itself, for example, as an abrupt change in the power supply voltage along with an abrupt change in the supply current. In a complementary metal-oxide semiconductor (CMOS) integrated circuit, one type of SEE is the initiation of latch-up (e.g., the triggering of a parasitic thyristor in a CMOS structure) by a proton or heavy ion. Such a latch-up is referred to as a single-event latch-up (SEL). The excessive current drawn in a latch-up event is detectable as a sudden rise in device temperature, which can be sensed by a temperature sensor 310, as shown in FIG. 3, and communicated to the environmental monitor 242. SEEs that cause these abrupt changes in power supply voltage, supply current, or device temperature may not necessarily be reflected in other ways in the operation of the PHY 106 (e.g., by an SEU in stored logic levels or data states) and therefore may go undetected until the device fails catastrophically.

[0054] The operation of the SEFI engine 330 in the environmental monitor 242 according to this example takes these SEEs into account in its detection process. As previously described, the SEFI engine 330 performs a determination to compare a current decimated digital value corresponding to a monitored parameter (e.g., voltage, current, temperature) to a dynamic threshold value for the same parameter previously calculated by the SEFI from previous values ​​of that parameter over time. For SEE detection, the absolute value of the most recent measurement of the power supply voltage, current, or chip temperature is less important (if any) than the relative value of that most recent measurement compared to the recent history of that measured parameter. According to this example, a dynamic threshold value for a current decimated digital value of a monitored parameter may be calculated by the SEFI engine 330 as a percentage, proportional, or absolute change in that value from the average value of that parameter measured over a recent time interval. Determining a dynamic threshold value for a parameter from a relatively recent history according to this implementation allows for possible differences in power consumption in different available operating modes of the PHY 106. If the current or most recent decimated digital value of the measurement acquired in process 400 is within the dynamic threshold (e.g., does not represent an abrupt change with respect to the stored history for that parameter), decision 403 returns a "yes" result. SEFI engine 330 then updates the dynamic threshold for that parameter of interest based on this most recent measurement, and the parameter to be monitored is then selected via selection signal TS for acquisition and processing beginning with process 400.

[0055] On the other hand, if SEFI engine 330 determines that the most recent measurement acquired in process 400 and digitized and decimated in process 402 is outside the dynamic threshold for the recent history for that parameter (decision 403 is "no"), then SEFI engine 330 has detected a possible SEE and operates to take appropriate action in process 410. In this example, the action indicated for a possible SEE detected by SEFI engine 330 in environmental monitor 242 is a hardware reset of PHY 106. In this example, process 410 (performed by SEFI engine 330) includes issuing a reset signal on line RST to reset circuitry 340 in management and PHY control circuitry 220. Reset circuitry 340 then performs a reset of PHY 106 in an attempt to clarify the effects of the SEE.

[0056] In this manner, environmental monitor 242 operates to detect possible SEFIs that manifest as abrupt changes in the power supply voltage at PHY 106, the supply current drawn by PHY 106, and the chip operating temperature of PHY 106, and to initiate a response to those SEFIs, for example by resetting the device. This detection and response can thus be rapid to SEEs that might otherwise go undetected from the operation of digital logic in PHY 106.

[0057] 5A illustrates the architecture and operation of register monitor 244 as implemented within PHY 106, according to one example. In this implementation, register monitor 244 monitors the contents of various registers in PHY 106's functions and other circuit elements to detect and potentially correct bit errors caused by an SEU event. More specifically, in one example, register monitor 244 may operate to prevent PHY 106 from entering an invalid or otherwise undesirable operating mode or condition in the event of an SEU of a configuration register, as described hereinafter.

[0058] As shown in FIG. 5A, a number of configuration registers 502A, 502B, 502C, . . . , 502N (collectively and individually referred to as configuration registers 502) are used in the Ethernet PHY 106. For example, each of the processing blocks 202A, 202B, 202C may include one or more configuration registers 502. Support circuitry, such as the management and PHY control circuitry 220, the MII interface 200, the converter block 210, etc., may also include one or more configuration registers 502. Each configuration register 502 stores a digital word that can specify a particular operating mode for that functional circuitry from a set of available modes and a particular option for that mode from a set of available options in the selected operating mode. In some cases, the configuration registers 502 may further include one or more status bits that may be readable by the appropriate control circuitry or by circuitry external to the PHY 106.

[0059] The bit storage locations of the configuration register 502 may be constructed as memory cells, such as those used in random access memory (RAM) resources elsewhere in the PHY 106. For example, the bit storage locations of the configuration register 502 may be constructed as static RAM cells or flip-flop latches, each storing one data bit. Alternatively, some or all of the configuration register bit storage locations, such as the most important configuration registers or configuration bit storage locations, may be constructed as self-correcting flip-flops. Such self-correcting flip-flops may provide additional SEU tolerance, which may be particularly important for the most important configuration bits and registers in the PHY 106. An example of such a self-correcting flip-flop that may be used to construct some or all of the bit storage locations of the configuration register 502 is now described with reference to FIG. 5B.

[0060] 5B illustrates an example of a bit storage location 520 constructed as a self-correcting triple mode redundancy (TMR) flip-flop. In this example, bit storage location 520 includes three D-type flip-flops 522A, 522B, 522C, each clocked by a clock signal CLK. A D input of flip-flop 522A receives an input data value IN_VAL, such as may be provided by a functional circuit element within PHY 106 that loads configuration information into this configuration register 502. The input data value IN_VAL is also applied to an inverter 524, which has an output that presents an output signal IN_Δ1 to a D input of flip-flop 522B. Similarly, the input data value IN_VAL is applied to an input of inverter 526, which has an output that is coupled to an input of a second inverter 527, which has an output that applies an output signal IN_Δ2 to a D input of flip-flop 522C. Thus, the output signal IN_Δ1 received at flip-flop 522B is delayed from the input data value IN_VAL by the propagation delay of inverter 524, and the output signal IN_Δ2 received at flip-flop 522C is delayed from the input data value IN_VAL by two propagation delays (one for inverter 526 and the other for inverter 527).

[0061] Flip-flops 522A, 522B, 522C provide output signals Q_VAL, Q_Δ1, Q_Δ2, respectively, to corresponding inputs of majority logic 528. In the example of FIG. 5B, output signals Q_VAL, Q_Δ2 are driven from the Q outputs of flip-flops 522A, 522C, respectively, and output signal Q_Δ1 is driven from the Q output of flip-flop 522B to reflect an odd inversion of input value IN_VAL by inverter 524. TIFF2025504673000002.tif32 output. Majority logic 528 is constructed to generate output signal OUT_VAL at a logic level corresponding to that applied at two or more of its three input signals Q_VAL, Q_Δ1, Q_Δ2. In other words, an SEU having the effect of changing one of the bit values ​​of signals Q_VAL, Q_Δ1, Q_Δ2 will not affect the output value OUT_VAL, which is based on a "majority vote" of the three inputs, two of which are at unaffected logic levels. This construction of bit storage locations 520 can thus provide additional SEU tolerance to PHY 106, especially in critical locations such as configuration register 502. This additional SEU tolerance results from both the spatial separation provided by the physically separate flip-flops 522A, 522B, 522C in bit storage location 520 and the temporal separation provided by inverters 524, 526, 528 in applying input values ​​IN_VAL to flip-flops 522A, 522B, 522C.

[0062] For purposes of this description, configuration register 502A will be considered to be located within processing block 202A, configuration register 502B will be considered to be located within processing block 202B, configuration register 502C will be considered to be located within processing block 202C, and so on, and configuration register 502N will be considered to be located within management and PHY control circuitry 220. In this example, register monitor 244 is bidirectionally coupled to each of configuration registers 502A, 502B, 502C, ..., 502N, which are located throughout PHY 106. More specifically, register monitor 244 includes either or both of error correction code (ECC) circuitry 510 and cyclic redundancy check (CRC) circuitry 512. Each of ECC circuitry 510 and CRC circuitry 512 is capable of reading the contents of each of configuration registers 502 to detect one or more erroneous bits in their contents that may result from an SEE. The ECC circuitry 510 is also capable of rewriting one or more erroneous bits in their contents in the event of an SEE.

[0063] In this example, a systematic error correction code is used by the ECC circuitry 510 to detect and correct erroneous bits in one or more of the configuration registers 502. Thus, each configuration register 502 to be monitored by the ECC circuitry 510 includes both a configuration data portion and a parity data portion. For example, referring to FIG. 5A, the configuration register 502A includes a configuration data portion CONFIG_A and a parity data portion PARITY_A. As with ECC coding, the content of the parity data portion PARITY_A of the configuration register 502A depends on the content of its configuration data portion CONFIG_A, which dependency is determined by the particular ECC used. Also, the number of bits included in the parity data portion PARITY_A of the configuration register 502A depends on the number of bits in its configuration data portion CONFIG_A, which also depends on the particular ECC used. In the example of a 7,4 Hamming ECC code, a 32-bit configuration data portion CONFIG_A requires a 24-bit parity data portion PARITY_A. Those configuration registers 502 in PHY 106 that are monitored by ECC circuitry 510 may all be the same size and use the same ECC, or may vary in size and use different ECCs, or both, depending on the particular design. Also, in this example, both the configuration data portion and the parity data portion of a given configuration register 502 may be physically implemented in the same location in PHY 106, whether within the processing block 202 associated with that configuration register or within a separate register file (not shown) within PHY 106. Alternatively, one or more of the configuration registers 502 may have their parity data portion resident in register monitor 244, if desired.

[0064] Additionally, one or more of the configuration registers 502 may utilize non-systematic ECC coding, such that the resulting codeword stored in that configuration register 502 does not have distinct configuration data and parity data portions.

[0065] Alternatively or additionally to the ECC circuitry 510, the register monitor 244 may include a CRC circuitry 512 to perform error detection using a cyclic redundancy check on one or more of the configuration registers 502. The configuration registers 502 to be monitored by the CRC circuitry 512 also include both a configuration data portion and a CRC affix portion. In one example, the configuration register 502 of FIG. 5A is monitored by the CRC circuitry 512 and thus includes a configuration data portion CONFIG_C and a CRC affix portion CRC_C. As in the case of CRC coding, the contents of the CRC affix portion CRC_C of the configuration register 502C correspond to an affix calculated from application of a generator polynomial to the contents of the configuration data portion CONFIG_C. The generator polynomial and the operation of applying the polynomial to the payload data depend on the particular CRC used. In one example, one of CRC-8, CRC-16, and CRC-32 algorithms may be used, resulting in CRC appendages of 8, 16, and 32 bit sizes, respectively. Those configuration registers 502 in the PHY 106 monitored by the CRC circuitry 512 may all be the same size and use the same CRC, or may be of various sizes and use different CRCs, or both, depending on the particular design. Also, in this example, both the configuration data portion and the CRC appendage portion of a given configuration register 502 may be physically implemented in the same location in the PHY 106, whether in the processing block 202 associated with that configuration register or in a separate register file (not shown) in the PHY 106. Alternatively, one or more configuration registers 502 may have their CRC appendages present in the register monitor 244, if desired.

[0066] As mentioned above, register monitor 244 may include both ECC circuitry 510 and CRC circuitry 512, each monitoring one or more configuration registers 502. For example, some configuration registers 502 may be more critical to the operation of PHY 106 than others, in which case the error correction capabilities of ECC circuitry 510 may monitor those more critical configuration registers 502, while CRC circuitry 512 may monitor the less critical configuration registers 502. In the example implementation of FIG. 5A, configuration registers 502A, 502B may be the critical configuration registers and may be monitored by ECC circuitry 510 in register monitor 244, while the less critical configuration registers 502C, 502N are monitored by CRC circuitry 512.

[0067] In either case, the contents of each configuration register 502 are written upon configuration or reconfiguration of its associated functional circuit element. This configuration or reconfiguration may be done at power-on of the PHY 106, for example, using bootstrap code that loads one or more of the configuration registers 502 according to a configuration held in non-volatile memory in the PHY 106 or in a memory external to the PHY 106. In some implementations, the configuration or reconfiguration of the configuration registers 502 may be responsive to user input. In either case, writing the contents of a configuration register 502 involves encoding a codeword or CRC check from the configuration data itself according to the particular ECC coding or CRC used, and then the codeword or appendage is written into that configuration register 502. This encoding and writing may be done by control circuitry in the functional circuit element associated with the configuration register 502, or alternatively by the applicable ECC circuitry 510 or CRC circuitry 512 in the register monitor 244.

[0068] Register monitor 244 has an output that is coupled to reset circuitry 310 within management and PHY control circuitry 220 according to this example, which register monitor 244 uses to issue a reset or reconfigure signal on line RST / RECONFIG shown in FIG.

[0069] 6, the operation of register monitor 244 in detecting and responding to an SEU event affecting the contents of configuration registers 502A, 502B, 502C,..., 502N will be described with reference to an example. This operation may be performed by circuit elements (e.g., logic circuit elements, processors, and / or state machines) within register monitor 244 in conjunction with ECC circuitry 510, which may be implemented as custom logic, programmable logic circuitry, or a combination thereof. The operations of FIG. 6 are performed during functional operation of PHY 106 after configuration registers 502 have been loaded or written with the desired configuration and parity data in accordance with the ECC coding applied by ECC circuitry 510.

[0070] According to this example, the contents of the configuration register 502 are polled periodically by the register monitor 244, with the periodicity of the polling being set at a desired interval or performed repeatedly and continuously. In process 602, the register monitor 244 initializes an index to select one of the configuration registers 502A, 502B, 502C, . . . , 502N (e.g., configuration register 502A). In this example, the ECC circuitry 510 monitors some of the configuration registers (e.g., configuration registers 502A, 502B in FIG. 5A) and the CRC circuitry 512 monitors the others (e.g., configuration registers 502C, 502N). Thus, decision 603 determines whether the configuration register selected in process 602 is monitored by ECC or CRC.

[0071] For configuration registers 502 monitored by ECC circuitry 510 in this example, such as configuration registers 502A and 502B, decision 603 returns an "ECC" result. In this case, ECC circuitry 510 in register monitor 244 reads and decodes the contents of the selected configuration register 502A according to the applicable ECC code in process 604 to determine whether the current contents of configuration register 502A are erroneous. It is useful to note that this reading and decoding of configuration register 502A in process 604 is not performed in conjunction with or in response to the operation of PHY 106 or the functional circuitry associated with that configuration register 502A (e.g., functional block 202A), but rather is performed pursuant to periodic polling under the control of register monitor 244. Thus, register monitor 244 in this example detects a change in the data state of one or more bits of configuration register 502A that may occur as a result of an SEU. An SEU in a configuration register 502A, 502B, 502C, ..., 502N can cause serious impairment of the functionality of PHY 106 by unintentionally "reconfiguring" associated functional circuitry to a different operating mode than intended, or to an entirely invalid operating condition.

[0072] The error detection performed by ECC circuitry 510 in process 604, and the response to detected errors, depends on the particular ECC code used to encode and decode the configuration register contents. As is known in the art, some ECC codes may be capable of detecting one or more erroneous bits (and identifying which bits are erroneous) and may also be capable of correcting one or more of the detected erroneous bits. For example, a 7,4 Hamming code may be capable of detecting but not correcting two erroneous bits in a codeword and correcting one erroneous bit. Figure 6 illustrates the operation of register monitor 244 for a 7,4 Hamming code, as an example.

[0073] Thus, the ECC check performed by ECC circuitry 510 in process 604 can provide three possible outcomes: no erroneous bits, one erroneous bit, or two or more erroneous bits in configuration register 502A. If analysis of the results of process 604 by register monitor 244 determines that configuration register 502A has no erroneous bits, then register monitor 244 advances the register index to select the next one of the configuration registers 502 to be monitored in process 606 (e.g., configuration register 502B), which is read and decoded in the next instance of process 604.

[0074] If the register monitor 244 determines from process 604 that a single bit of the configuration register 502A is erroneous, then in process 608 the ECC circuitry 510 corrects the erroneous bit in the codeword and writes the corrected codeword into the currently selected configuration register 502A. The register monitor 244 then advances the register index in process 606 and the next configuration register 502B (for example) is ECC checked in process 604 to repeat the process. However, if the register monitor 244 determines from process 604 that two or more bits of the configuration register 502A are erroneous, then the register contents cannot be corrected using the 7,4 Hamming code. Thus, in this case, register monitor 244 performs process 610 to issue a reset or reconfiguration signal to reset circuit element 310 or such other appropriate circuit elements of PHY 106 (e.g., management and PHY control circuitry 220) to initiate a reconfiguration of the affected functional circuit elements, such as a reconfiguration to a default condition, or to initiate a reset of the entire PHY 106.

[0075] Of course, different ECC codes have different levels of detection and correction. The number of parity or additional code bits required increases with increasing error correction and detection capabilities. In general, a given code can correct fewer erroneous bits in a codeword than it is capable of detecting. Thus, the example of FIG. 6 may be applied to such other ECC codes as well, providing possible outcomes of no errors in the configuration register 502 contents, correction of a number of erroneous bits up to the correction limit, and initiating a reset (e.g., reset of PHY 106 or processing block 202, or reconfiguration of configuration register 502) upon detection of a number of erroneous bits greater than the correction limit.

[0076] For configuration registers 502 monitored by CRC circuitry 512 in this example, such as configuration registers 502C and 502N, decision 603 returns a "CRC" result. In this case, CRC circuitry 512 in register monitor 244 reads the contents of the selected configuration register 502 and checks them to determine whether they contain one or more erroneous bits, in process 612. As previously mentioned, CRC circuitry 512 is capable of detecting, but not correcting, the presence of errors in the evaluated data word due to the nature of the CRC algorithm. Thus, if the CRC check in process 612 detects an error in the contents of the selected configuration register 502 (process 612 returns an "error" result), register monitor 244 issues a reset or reconfiguration signal in process 610 to reset circuitry 310 or other appropriate circuitry of PHY 106 (e.g., management and PHY control circuitry 220) to initiate a reconfiguration of the erroneous configuration register and the affected functional circuitry, such as a reconfiguration to a default condition. In some cases, an error in the configuration register 502 detected in process 612 may require initiating a reset of the PHY 106 in its entirety in response to a reset signal issued in process 610 .

[0077] According to this example, by providing a register monitor 244 within monitoring and detection circuitry 240, an SEE that causes an upset in the functionality and configuration state or operating mode of other circuitry in PHY 106 can be detected and addressed quickly following the event, potentially avoiding dysfunction of PHY 106.

[0078] According to this example, monitoring and detection circuitry 240 in PHY 106 of Figure 2 further includes a state machine monitor 246. Now referring to Figures 7 and 8, state machine monitor 246 includes digital logic circuitry configured and operative to monitor the state of sequential logic functions, or state machines, in functional blocks 202A, 202B, 202C, in management and PHY control circuitry 220, and in other functions within PHY 106.

[0079] 7 illustrates an implementation of state machine monitor 246 in combination with an instance of sequential logic in PHY 106, according to one example. In this example, state machine 700 corresponds to an instance of sequential logic for reset control of functional blocks in PHY 106, and thus may be disposed as part of management and PHY control circuitry 220 of PHY 106 in FIG. 2. For example, state machine 700 may be constructed from programmable logic devices, programmable logic controllers, logic gates, and flip-flops, or other digital storage. More specifically, one possible hardware implementation of state machine 700 may include registers for storing state variables, a block of combinational logic that determines state transitions, and a block of combinational logic that determines an output of state machine 700, which may include new values ​​for the state variables.

[0080] As can be seen from FIG. 7, state machine 700 is a relatively simple sequential logic block in that it has three valid operating states and two state variables. The three states of state machine 700 are BLOCK_RESET state 702, CLK_EN state 704, and CLK_DIS state 706, which correspond to reset, clock enable, and clock disable conditions, respectively. The two state variables 712 of state machine 700 are block_reset and block_clk_en. In this instance, upon a main reset or restart signal of PHY 106 ("main_reset|restart" shown in FIG. 7), state machine 700 enters BLOCK_RESET state 702 and sets both state variables block_reset and block_clk_en to "1" (e.g., logic "1" or logic "high"). Two valid state transitions are available from BLOCK_RESET state 702.

[0081] The state machine 700 may transition from the BLOCK_RESET state 702 to the CLK_EN state 704 in response to a logical combination of a reset count value equal to a particular value (e.g., 7), an asserted block enable signal ("block_en"), and a deasserted restart signal ("~restart"). Upon entering the CLK_EN state 704, the state variable block_reset is reset to "0" (e.g., logic "0" or logic "low") and the state variable block_clk_en remains set ("1"). From a functional standpoint, the CLK_EN state 704 corresponds to an active condition for its corresponding functional circuit, e.g., by enabling application of a clock signal and reception by that functional circuit element. Only one valid state transition is available from the CLK_EN state 704: to the BLOCK_RESET state 702 in response to the logical combination of a deasserted block enable signal (e.g., “~block_en,” which refers to a signal reset to “0”) and an asserted restart signal (“restart”). Upon entering the BLOCK_RESET state 702 from the CLK_EN state 704, the state variable block_reset is set (“1”) and the state variable block_clk_en remains set (“1”).

[0082] The other valid transition from the BLOCK_RESET state 702 is to the CLK_DIS state 706, which is made in response to the logical combination of a reset count value not equal to a particular predefined value (e.g., 7) and a deasserted block enable signal ("~block_en"). Upon entering the CLK_DIS state 706, the state variable block_reset remains set ("1") and the state variable block_clk_en is reset ("0"). From a functional standpoint, the CLK_DIS state 704 corresponds to an inactive condition for its corresponding functional circuit, for example, by disabling application of a clock signal and reception by that functional circuit element. The single valid state transition from the CLK_DIS state 706 is to the BLOCK_RESET state 702, which is in response to the logical combination of an asserted block enable signal ("block_en") and an asserted restart signal ("restart"). Again, upon entering the BLOCK_RESET state 702 from the CLK_DIS state 706, the state variable block_reset remains set ("1") and the state variable block_clk_en is set ("1").

[0083] As mentioned above, the current values ​​of the state variables for a state machine may be stored in a state register associated with the corresponding state machine. For state machine 700, a state table may be constructed from the possible values ​​of these two state variables 712, block_reset and block_clk_en, as follows: [Table 1] As shown in Table 1, the current state of state machine 700 can be determined by reading its state variables 712. However, if the values ​​of state variables 712, i.e., block_reset and block_clk_en, were encoded into a two-bit codeword and stored as a state register, an SEU that flips the state of one of those two bits in the state register (e.g., by flipping a single "1" bit to either the BLOCK_RESET or CLK_EN state) could place state machine 700 in a state that is undefined and therefore different from the operation that PHY 106 may intend, including an invalid state. In this arrangement, PHY 106 assumes that other functional circuit elements in PHY 106, as well as the supported communication links, depend on state machine 700 operating in an intended state, making it vulnerable to catastrophic malfunction in the event of an SEU to one of configuration registers 502. Recovery from such malfunction may be lengthy and cumbersome, if possible at all, depending on the particular conditions.

[0084] According to this example, the values ​​of the state variables 712 for the state machine 700 are communicated to a state variable encoder 714 for encoding according to a "one-hot" encoding. More specifically, the state variable encoder 714 encodes the values ​​of the state variables 712 into a codeword that is longer than necessary to represent the states of the state machine 700 by creating a codeword in which only one bit has a "1" value and all others are "0". In this encoding, each possible state of the state machine 700 corresponds to one bit position in the codeword, rather than each of the state variables 712 corresponding to one bit position. Also, the codeword may be over-specified, using more bit positions than there are possible states. In this example of a simple state machine 700 with two state variables 712 and three possible states, an example of an encoding produced by the state variable encoder 714 according to this example is as follows: [Table 2] All other status codes are undefined.

[0085] The sparse one-hot encoding shown in Table 2 improves the likelihood of detecting an SEU of one of the codeword bits compared to the encoding of Table 1. For example, an SEU of any of the state variables 712 in the CLK_EN state encoded according to Table 1 would simply cause an unintended transition to either the BLOCK_RESET or CLK_DIS state. The effect of this SEU could result in erroneous operation of the PHY 106 in its communications operations, resulting in data loss or other catastrophic results. In contrast, an SEU in a codeword according to the encoding of Table 2 would appear as an invalid or undefined state (e.g., more than one "1" bit, or all "0" bits), and would be easily detectable.

[0086] The state variable encoder 714 is coupled to a state register 720 in this example. The state register 720 may store a codeword encoded by the state variable encoder 714 and is coupled to the state register monitoring logic 730. The bit storage locations of the state register 720 may be structured as memory cells such as may be used in RAM and other register locations within the PHY 106. Alternatively, the self-modifying TMR structure described with respect to FIG. 5B for the bit storage locations 520 in the configuration register 502 may also be applied to other storage locations within the PHY 106, including one or more instances of the state register 720.

[0087] In this example, the state variable encoder 714 and the state register 720 may be physically implemented in or near the sequential logic implementing the state machine 700, for example in its corresponding functional block, such as the management and PHY control circuitry 220 in the example of FIG. 7, and the state register monitoring logic 730 may be implemented as part of the state machine monitor 246 in the monitoring and detection circuitry 240, as suggested in FIG. 7. Alternatively, some or all of the state variable encoder 714 and the state register 720 may be physically implemented separately from the state machine 700, for example in the state machine monitor 246. The state register monitoring logic 730 has an output for presenting a reset or restart signal to appropriate circuit elements in the PHY 106 in the event that it detects an error in the operation of the state machine 700. In this example, since the state machine 700 is the reset controlled state machine in the PHY 106, the state register monitoring logic 730 communicates the reset or restart signal to the state machine 700 itself via lines RST / RESTRT shown in FIG.

[0088] The state register monitoring logic 730 in this example also receives control information on one or more signal lines XITION from the state machine 700. As described below, the control information communicated by the state machine 700 enables the state register monitoring logic 730 to monitor the validity of state transitions of the state machine 700.

[0089] In operation, the cooperative combination of state variable encoder 714 and state register 720 with state register monitoring logic 230 provides the ability to quickly detect and quickly recover from an SEU in the sequential logic of PHY 106, as will now be described with reference to Figure 8 for an example of state machine 700 reset control. In process 800, state machine 700 is instantiated to begin its operation upon its receipt of, for example, either a main reset or restart signal ("main_reset|restart") of PHY 106. Once instantiated, state machine 700 will transition between its enabled states 702, 704, 706 as previously described.

[0090] As the state machine 700 operates in this manner, the values ​​of its state variables (e.g., block_reset and block_clk_en) are encoded by the state variable encoder 714 into code words for storage in the state register 720 in process 802. As previously mentioned, the encoding applied by the state variable encoder 714 is one-hot encoding, such that only one bit position in the state register 720 (e.g., the bit position corresponding to the current state) is a "1" and all other bit positions are "0". Also, the code words generated by the state variable encoder 714 may be over-specified, such that the state register 720 for the state machine 700 has a width greater than the number of valid states. Such encoding continues throughout the operation of the instantiated state machine 700.

[0091] According to the example of Figures 7 and 8, the state register monitoring logic 730 receives control information from the state machine 700 via the control line XITION and analyzes each state transition of the state machine 700 to detect transition errors such as those that may result from a SEE. In this example, the state register monitoring logic 730 performs a decision 803 to detect the occurrence of a state transition of the state machine 700. In the event of a state transition (decision 803 is "yes"), the state information (e.g., values ​​of state variables) from a previous state of the state machine 700 is compared with the state information in the new state to determine whether the transition from the previous state to the new state is valid. The comparison of the previous state information to the new state information may be performed by the state register monitoring logic 730 by comparing the encoded code words in the state register 720 for the two states in decision 805. For the example of the state machine 700 in Figure 7, the only valid transition from state 704 is to state 702, and the only valid transition from state 706 is to state 702. Thus, in the event that the SEE causes an apparent transition from state 704 directly to state 706 (decision 805 is "no"), the state register monitoring logic 730 detects this invalid transition and issues a reset or restart signal on lines RST / RESTRT to the state machine 700 in process 808. In this example, re-instantiating the state machine is performed in process 800, if necessary.

[0092] If no state transition is detected (decision 803 is "no") or if the detected state transition is a valid transition (decision 805 is "no"), the state register monitoring logic 730 operates in process 810 to poll the codeword in the state register 720 in order to determine whether its contents are valid in decision 811. Due to the sparse one-hot encoding of the codeword stored by the state register 720, the state register monitoring logic 730 can easily detect in decision 811 whether an SEU has flipped the state of one of the bits of the state register 720, for example, by detecting two bits, either of which has a "1" state, indicating an invalid state, or by detecting that all bits of the state register 720 are "0". If such an error is detected in the contents of the state register 720 (decision 811 is "yes"), the state register monitoring logic 730 issues a reset or restart signal to the state machine 700 on line RST / RESTRT in process 808.

[0093] If the contents of state machine 720 read in polling process 810 are valid (decision 811 is "no"), state register monitoring logic 730 continues to monitor the operation of state machine 720 for state transitions (decision 803) and also periodically polls state register 720 to check the validity of its contents (decision 811) during operation of state machine 700.

[0094] Thus, according to this example, the sparse one-hot encoding of the values ​​of the state variables 712 for storage in the state register 720 increases the probability that the state register monitoring logic 730 can detect if a SEE occurs in the state register 720. Also, the monitoring of state transitions by the state register monitoring logic 730 allows for early detection of invalid or unintended state transitions, such as those that may be caused by a SEE. The combination of these two approaches enables the monitoring and detection circuitry 240 in the PHY 106 to initiate appropriate corrective action in a timely manner to avoid catastrophic errors in the communications link supported by the PHY 106 in its network application.

[0095] 9A, 9B, and 10, the configuration and operation of the PLL lock monitor 250 when disposed within the converter block 210 according to one example will be described. As shown in FIG. 2, the converter block 210 in this example includes a timing circuit element 218 configured to generate various internal clocks based on a master clock signal received from a source external to the PHY 106 or generated within the PHY 106. These internal clocks generated by the timing circuit element 218 include appropriate clock signals suitable for transmitting and receiving data signals via the media dependent interface (MDI) 122. A common circuit for generating such clock signals for data transmission via the MDI 122 is a phase-locked loop (PLL), an example of which is shown as PLL 900 in FIG. 9A.

[0096] 9A is constructed in a configuration that includes a phase detector 902 having one input coupled to receive a reference clock signal REFCLK, which may be generated by a clock reference circuit (not shown) in the timing circuitry 218 or elsewhere in the PHY 106. The phase detector 902 operates to compare the phase of the reference clock signal REFCLK to a feedback signal received at another input, and forwards a signal from its output to a charge pump and filter circuitry 904 that corresponds to the phase difference. The charge pump and filter circuitry 904 generates a voltage level in response to the phase difference signal from the phase detector 902 and in accordance with the desired loop filter characteristics, and applies the voltage level to a control input of a voltage controlled oscillator (VCO) 906. The VCO 906 generates an output clock signal OUTCLK at a frequency that corresponds to the voltage level at its input from the charge pump and filter circuitry 904. The output clock signal OUTCLK may serve as a clock used to synchronize data transfers through the MDI 122, in this example.

[0097] The output clock signal OUTCLK also serves as the feedback clock signal FBCLK. In this example, the output clock signal OUTCLK is at a higher frequency than the reference clock signal applied to phase detector 902. Thus, frequency divider 908 divides the frequency of the feedback clock signal FBCLK and applies the divided feedback clock to phase detector 902 for comparison with the reference clock REFCLK.

[0098] As previously mentioned, a phase-locked loop (PLL) lock monitor 250 is provided to detect timing upsets in the DAC / ADC subsystem 214 that may result from an SEE, and therefore to monitor the integrity of the data path in the PHY 106 when placed in an environment that is conductive to an SEE. For example, a SEE collision timing circuit element 218 may cause the PLL 900 to lose phase lock. Thus, in this example, an instance of the PLL lock monitor 250 operates to monitor the operation of the PLL 900 to detect an out-of-lock condition. As shown in FIG. 9A, the out-of-lock detection circuit 920 has an input that receives a reference clock REFCLK and an input that receives a feedback clock FBCLK (which in this example is the output clock signal OUTCLK). The out-of-lock detection circuit 920 compares the phase of the reference clock REFCLK with the pulses of the feedback clock FBCLK to determine whether the PLL 900 is in phase lock, and outputs a signal to the MDI register enable logic 922 at a logic level indicative of the result. Published on TIFF2025504673000005.tif417. The loss of lock detection circuit 920 may be constructed according to any of a number of known circuits having this functionality.

[0099] In this example, the feedback clock signal FBCLK generated by the VCO 906 is at a higher frequency than the reference clock REFCLK. Due to this higher frequency of the feedback clock signal FBCLK, the out-of-lock detection circuit 920 determines whether the PLL 900 is in phase lock by measuring the phase of the reference clock REFCLK relative to a "window" of pulses of the feedback clock signal FBCLK. FIG. 9B illustrates an example of a comparison performed by an example out-of-lock detection circuit 920. As shown in FIG. 9B, a timing window ±twindow is defined to span five periods of the feedback clock FBCLK on either side of the central pulse where the reference clock REFCLK is aligned in phase lock. If a rising edge of the reference clock REFCLK occurs outside of the timing window ±twindow, the out-of-lock detection circuit 920 detects a signal line TIFF2025504673000006.tif417 will issue a low logic level to the MDI register enable logic 922, and conversely, a rising edge of the reference clock REFCLK within the timing window ±twindow will issue a low logic level to the out-of-lock detection circuit 920. 9B, by providing a timing window ±twindow, the out-of-lock detection 920 distinguishes upsets due to SEEs that are likely to cause severe phase misalignment in the PLL 900 from jitter or other small variations in the clock phase that may be encountered in normal PLL operation.

[0100] MDI register enable logic 922 drives line line by asserting a high logic level at its output on TIFF2025504673000008.tif38. TIFF2025504673000009.tif417, thereby effecting data transfer over MDI interface 122. Conversely, In response to a low logic level indicating a loss of phase lock on line TIFF2025504673000010.tif38, the MDI register enable logic 922 Disable MDI register updates by asserting a low logic level at its output on TIFF2025504673000011.tif417.

[0101] Figure 10 illustrates a generalized method of monitoring the data path of PHY 106 for errors caused by SEE and responding accordingly. The method of Figure 10 begins with normal operation of the data path, with PLL 900 in phase-locked state and therefore generating its output clock signal with stable phase and frequency, and MDI register updates enabled. During this time, phase-lock monitoring is performed by loss-of-lock detection circuit 920. As shown in Figure 9B, as long as PLL 900 remains in phase-locked state within the limits of timing window ±twindow (decision 1001 is "no"), MDI register updates remain enabled.

[0102] However, if the out-of-lock detection circuit 920 detects that the PLL is out of phase lock (decision 1001 is "yes") and notifies the MDI register enable logic 922 accordingly, the MDI register enable logic 922 will, in process 1002, disable the signal line TIFF2025504673000012.tif38 to further disable MDI register updates. MDI register updates remain disabled by MDI register enable logic 922 until PLL 900 regains phase lock. In this example, the phase lock condition must be for n cycles of reference clock REFCLK, where n>1. For example, n=5 cycles of reference clock REFCLK with PLL 900 in phase lock may be required to re-enable MDI register updates. Until that time (decision 1003 is "no"), MDI register updates are disabled and data flow through MDI interface 122 of PHY 106 is prevented. Once phase lock is achieved for n cycles (decision 1003 is “yes”), the MDI register enable logic 922 re-enables MDI register updates in process 1004 and the PLL 900 continues operation with monitoring by the loss of lock detection circuit 920 as previously described.

[0103] The examples described herein provide an architecture for a PHY transceiver device that is particularly suitable for harsh environments, such as the space environment, in terms of SEE. PHY devices according to these examples provide robust detection of SEE and rapid response to these events, in some cases without requiring a full reset of the PHY device, but in any case without forcing a failure of the communication link to perform the necessary reset and reboot. Thus, errors in communication can be reduced.

[0104] As used herein, the terms "terminal," "node," "interconnect," and "pin" are used interchangeably. Unless otherwise noted, these terms are used generally to mean an interconnection between, or a termination of, a device element, a circuit element, an integrated circuit, a device, or other electronic or semiconductor component.

[0105] Unless specifically stated otherwise, "about," "approximately," or "approximately" preceding a value means + / - 10 percent of the stated value. Variations in the described examples are possible and other examples are possible within the scope of the claims.

[0106] A device that is "configured to" perform a certain task or function may be configured (e.g., programmed and / or hardwired) to perform that function at the time of manufacture by a manufacturer and / or may be configurable (or reconfigurable) by a user after manufacture to perform that function and / or other additional or alternative functions. Such configuration may be through firmware and / or software programming of the device, through the configuration and / or layout of the hardware components and interconnections of the device, or through a combination thereof.

[0107] A circuit or device described herein as including certain components may instead be adapted to be coupled to those components to form the described circuit element or device. For example, a structure described as including one or more semiconductor elements (such as transistors), one or more passive elements (such as resistors, capacitors, and / or inductors), and / or one or more sources (such as voltage and / or current sources) may instead include only the semiconductor elements in a single physical device (e.g., a semiconductor die and / or integrated circuit (IC) package) and may be adapted to be coupled to at least some of the passive elements and / or sources to form the described structure, either during or after manufacture, e.g., by an end user and / or a third party. While certain elements of some embodiments are included in an integrated circuit, other elements are external to the integrated circuit, and in other examples, additional or fewer features may be incorporated into the integrated circuit. Also, some or all of the features shown as being external to the integrated circuit may be included within the integrated circuit, and / or some features shown as being internal to the integrated circuit may be incorporated external to the integrated circuit. As used herein, the term "integrated circuit" means one or more circuits (1) integrated in or via a semiconductor substrate, (2) integrated in a single semiconductor package, (3) integrated in the same module, and / or (4) integrated on or in the same printed circuit board.

[0108] The circuits described herein are reconfigurable to include replaced components to provide functionality at least partially similar to that available prior to the component replacement. A component depicted as a resistor generally represents any of one or more elements coupled in series and / or parallel to provide the amount of impedance represented by the depicted resistor, unless otherwise noted. For example, a resistor or capacitor depicted and described herein as a single component may instead be multiple resistors or capacitors, respectively, coupled in parallel between the same nodes. For example, a resistor or capacitor depicted and described herein as a single component may instead be multiple resistors or capacitors, respectively, coupled in series between the same two nodes as a single resistor or capacitor.

[0109] Use of the term "ground" in the foregoing includes chassis ground, earth, floating ground, virtual ground, digital ground, common ground, and / or any other form of ground connection applicable or suitable to the teachings of the present description.

[0110] Modifications are possible in the described embodiments and other embodiments are possible within the scope of the claims.

Claims

1. A transceiver, a media independent interface; a converter circuit block including circuit elements configured to convert digital signals to analog signals for transmission over a network communication medium and to convert analog signals received over the network communication medium to digital signals; a processing block coupled to the converter circuit block, the processing block including circuit elements configured to process data communicated between the media independent interface and the converter circuit block in accordance with a network protocol; management and control circuitry coupled to the processing block, the management and control circuitry including power management circuitry and reset circuitry for the transceiver; 1. A single event effects (SEE) monitor including an environmental monitor, comprising: Detecting and responding to SEE effects; sampling and digitizing values ​​of one or more power supply voltages or one or more power supply currents applied to said transceiver to generate digital values; comparing said digital value with a previous digital value of said one or more power supply voltages or said one or more power supply currents; the SEE monitor configured to: , a transceiver.

2. 2. The transceiver of claim 1, a transceiver, wherein the SEE monitor is selected from the group including: an environmental monitor coupled to the management and control circuitry; a register monitor coupled to a configuration register in the processing block; a state machine monitor coupled to sequential logic in the processing block or the management and control circuitry; and a phase-locked loop (PLL) loss-of-lock monitor coupled to the converter circuit block.

3. 3. The transceiver of claim 2, The environmental monitor modulation circuitry configured to sample first values ​​of the one or more power supply voltages or the one or more power supply currents applied to the transceiver and digitize the sampled first values ​​to generate first digital values; a history memory coupled to the modulation circuit element, the history memory storing the first digital value along with previous digital values ​​of the one or more power supply voltages or the one or more power supply currents; a single event functional interrupt (SEFI) engine coupled to the modulation circuitry and the history memory, the SEFI engine configured to determine whether the first digital value differs from a previous digital value of the one or more power supply voltages or the one or more power supply currents by more than a threshold value, and to issue a reset signal to the management and control circuitry in response to the first digital value differing from a previous digital value by more than the threshold value; , a transceiver.

4. 4. The transceiver of claim 3, the SEFI engine is further configured to update the threshold value according to the first digital value in response to the first digital value not differing from a previous digital value by more than the threshold value.

5. 4. The transceiver of claim 3, a plurality of power supply terminals each receiving a power supply voltage; a plurality of current sensors, each current sensor coupled to sense a power supply current from one of the power supply voltages; Further comprising: the modulation circuitry a multiplexer having a plurality of inputs, each coupled to one of the plurality of power supply terminals or one of the plurality of current sensors, and a selection input for receiving a selection signal; a modulator configured to sample the analog signal at the output of the multiplexer and digitize the sampled analog signal; a decimation filter configured to filter the digitized analog signal to generate the digital values ​​for the history memory and the SEFI engine; , a transceiver.

6. 6. The transceiver of claim 5, further comprising a device temperature sensor; the multiplexer further having an input coupled to the device temperature sensor; the modulation circuitry is further configured to sample and digitize an analog signal from the device temperature sensor to generate a digital value for a device temperature; the SEFT engine is further configured to determine whether the digital value for device temperature differs from a previous digital value for device temperature by more than a threshold value, and to issue a reset signal to the management and control circuitry in response to the digital value for device temperature differing from a previous digital value by more than the threshold value.

7. 3. The transceiver of claim 2, the SEE monitor further includes a register monitor including error correction code (ECC) circuitry coupled to configuration registers in the processing block; The transceiver, wherein the ECC circuitry is configured to read a codeword from the configuration register and determine whether the codeword read from the configuration register contains an error bit according to an ECC code.

8. 8. The transceiver of claim 7, the ECC circuitry reloading the configuration register with a corrected codeword in response to detecting a number of erroneous bits in the codeword up to a correction limit according to the ECC code; issuing a reset in response to detecting a number of erroneous bits in the codeword that is greater than the correction limit according to the ECC code; The transceiver is further configured to:

9. 3. The transceiver of claim 2, the SEE monitor further comprises the state machine monitor; at least one of the processing block and management and control circuitry includes sequential logic corresponding to a state machine having one or more states and one or more state variables; The transceiver is a state register that stores a state code corresponding to the current state of the state machine; a state variable encoder configured to encode the value of the state variable into a one-hot encoding for storage as the state code for the current state of the state machine; Including, the state machine monitor: status register monitoring logic coupled to the status register and the state machine, Responsive to a state transition of the state machine, determining whether the state transition is valid; periodically polling the status register to determine if the stored status code is valid; issuing a reset signal to reset circuitry within said transceiver in response to detecting either an invalid state transition or an invalid state code; a status register monitoring logic configured to:

10. 3. The transceiver of claim 2, the SEE monitor further includes the PLL loss-of-lock monitor; The PLL lockout monitor Detecting whether a reference clock applied to an input of a phase-locked loop is out of phase with respect to a feedback clock outside a timing window; disabling register updates in the transceiver interface in response to detecting that the phase-locked loop is out of phase with respect to the feedback clock outside the timing window; The transceiver is configured to:

11. a network node, a network node processor; a medium access control coupled to the network node processor; 1. A physical layer transceiver comprising: a media independent interface coupled to the media access control; a medium dependent interface adapted to couple to a network communication medium; a converter circuit block coupled to the medium dependent interface, the converter circuit block including circuit elements configured to convert digital signals to analog signals for transmission over the network communication medium and to convert analog signals received over the network communication medium to digital signals; a processing block coupled to the converter circuit block, the processing block including circuit elements configured to process data communicated between the media independent interface and the converter circuit block in accordance with a network protocol; management and control circuitry coupled to the processing block, the management and control circuitry including power management and reset circuitry for the physical layer transceiver; 1. A single event effects (SEE) monitor including an environmental monitor, comprising: Detecting and responding to SEE effects; sampling and digitizing values ​​of one or more power supply voltages or one or more power supply currents applied to the physical layer transceiver to generate digital values; comparing said digital value with a previous digital value of said one or more power supply voltages or said one or more power supply currents; the SEE monitor configured to: the physical layer transceiver including: A network node including:

12. A network node according to claim 11, A network node wherein the SEE monitor is selected from the group including: an environmental monitor coupled to the management and control circuitry; a register monitor coupled to a configuration register in the processing block; a state machine monitor coupled to sequential logic in the processing block or the management and control circuitry; and a phase-locked loop (PLL) loss-of-lock monitor coupled to the converter circuit block.

13. 13. A network node according to claim 12, comprising: The environmental monitor modulation circuitry configured to sample first values ​​of one or more power supply voltages or one or more power supply currents applied to the physical layer transceiver and digitize the sampled first values ​​to generate first digital values; a history memory coupled to the modulation circuit element, the history memory storing the first digital value along with previous digital values ​​of the one or more power supply voltages or the one or more power supply currents; a single event functional interrupt (SEFI) engine coupled to the modulation circuitry and the history memory, the SEFI engine configured to determine whether the first digital value differs from the one or more power supply voltages or the one or more power supply currents by more than a threshold value, and to issue a reset signal to management and control circuitry in response to the first digital value differing from a previous digital value by more than the threshold value; A network node including:

14. A network node according to claim 13, The network node, wherein the SEFI engine is further configured to, in response to the first digital value not differing from a previous digital value by more than the threshold, update the threshold according to the first digital value.

15. A network node according to claim 13, a plurality of power supply terminals each receiving the power supply voltage; a plurality of current sensors, each supply current sensor coupled to sense a power supply current from one of the power supply voltages; Further comprising: the modulation circuitry a multiplexer having a plurality of inputs, each coupled to one of the plurality of power supply terminals or one of the plurality of current sensors, and a selection input for receiving a selection signal; a modulator configured to sample an analog signal at the output of the multiplexer and digitize the sampled analog signal; a decimation filter configured to filter the digitized analog signal to generate the digital values ​​for the history memory and the SEFI engine; Including, a network node.

16. 16. A network node according to claim 15, further comprising a device temperature sensor; the multiplexer further having an input coupled to the device temperature sensor; the modulation circuitry is further configured to sample and digitize an analog signal from the device temperature sensor to generate a digital value for a device temperature; The network node is further configured such that the SEFT engine determines whether the digital value for the device temperature differs from a previous digital value for the device temperature by more than a threshold value, and issues a reset signal to the management and control circuitry in response to the digital value for the device temperature differing from a previous digital value by more than the threshold value.

17. 13. A network node according to claim 12, comprising: the SEE monitor includes a register monitor including error correction code (ECC) circuitry coupled to configuration registers in the processing block; The network node, wherein the ECC circuitry is configured to read a codeword from the configuration register and determine whether the codeword read from the configuration register contains an erroneous bit according to an ECC code.

18. 18. A network node according to claim 17, the ECC circuitry reloading the configuration register with a corrected codeword in response to detecting a number of erroneous bits in the codeword according to the ECC code up to a correction limit; issuing a reset in response to detecting a number of erroneous bits in the codeword that is greater than the correction limit according to the ECC code; The network node is further configured as follows:

19. 13. A network node according to claim 12, comprising: the SEE monitor includes the state machine monitor; at least one of the processing block and management and control circuitry includes sequential logic corresponding to a state machine having one or more states and one or more state variables; the physical layer transceiver: a state register that stores a state code corresponding to the current state of the state machine; a state variable encoder configured to encode the value of the state variable into a one-hot encoding for storage as the state code for the current state of the state machine; Including, the state machine monitor: status register monitoring logic coupled to the status register and the state machine, Responsive to a state transition of the state machine, determining whether the state transition is valid; periodically polling the status register to determine if the stored status code is valid; issuing a reset signal to reset circuitry within said physical layer transceiver in response to detecting either an invalid state transition or an invalid status code; The network node further comprises the status register monitoring logic configured to:

20. 13. A network node according to claim 12, comprising: the SEE monitor further includes the PLL loss-of-lock monitor; The PLL lockout monitor Detecting whether a reference clock applied to an input of a phase-locked loop is out of phase with respect to a feedback clock outside a timing window; disabling register updates in the media dependent interface in response to detecting that the phase locked loop is out of phase with respect to the feedback clock outside the timing window; A network node configured to:

21. 1. A method comprising: operating a processing block within the physical layer transceiver in the network node processor to process data communicated at a media independent interface of the physical layer transceiver; converting digital signals from the processing block to analog signals for transmission over a medium dependent interface adapted to couple to a network communications medium, and converting analog signals received over the network communications medium to digital signals; Detecting a single event effect (SEE) occurring in the physical layer transceiver with a SEE monitor, the SEE monitor being selected from the group consisting of an environmental monitor, a register monitor, a state machine monitor, and a phase-locked loop (PLL) loss-of-lock monitor; resetting the physical layer transceiver in response to detecting the SEE; Including, the SEE monitor includes the environmental monitor; The environmental monitor sampling and digitizing values ​​of one or more power supply voltages or one or more power supply currents applied to the physical layer transceiver to generate digital values; comparing said digital value with a previous digital value of said one or more power supply voltages or said one or more power supply currents; A method configured to:

22. 22. The method of claim 21, detecting the SEE, sampling and digitizing first values ​​of the one or more power supply voltages or the one or more power supply currents applied to the physical layer transceiver to generate a first digital value; storing the first digital value together with previous digital values ​​of the one or more power supply voltages or the one or more power supply currents in a history memory; determining whether the first digital value differs from the one or more power supply voltages or the one or more power supply currents by more than a threshold value; issuing a reset signal to reset circuitry within the physical layer transceiver in response to the first digital value differing from a previous digital value by more than the threshold value; A method comprising:

23. 22. The method of claim 21, detecting the SEE, monitoring the contents of a configuration register associated with the processing block by reading an error correction code (ECC) codeword stored in the configuration register; determining whether the codeword read from the configuration register contains one or more erroneous bits; reloading the configuration register with a corrected codeword in response to determining that the codeword read from the configuration register contains a number of erroneous bits up to a correction limit within the codeword; issuing a reset signal to reset circuitry within the transceiver in response to determining that the codeword read from the configuration register contains a number of erroneous bits in the codeword that is greater than the correction limit; A method comprising:

24. 22. The method of claim 21, detecting the SEE, monitoring a state machine within said processing block or within management and control circuitry of said physical layer transceiver, said state machine operable on one or more state variables in accordance with one or more state variables, said state machine comprising: Responsive to a state transition of the state machine, determining whether the state transition is valid; periodically polling the status register to determine if the stored status code is valid; issuing a reset signal to reset circuitry within the physical layer transceiver in response to detecting either an invalid state transition or an invalid status code; wherein said monitoring includes a state register storing a state code corresponding to a current state of said state machine.

25. 22. The method of claim 21, detecting the SEE, detecting whether a reference clock applied to an input of a phase-locked loop in circuitry performing said converting is out of phase with respect to a feedback clock outside a timing window; disabling register updates in the media dependent interface in response to detecting that the phase locked loop is out of phase with respect to the feedback clock outside the timing window; A method comprising:

Images