Apparatus for autonomous security and functional safety of clocks and voltages

Abstract

To provide an apparatus for autonomous security and functional safety (FUSA) of clock and voltages.SOLUTION: An apparatus may include: a multiplexer having a first input communicatively coupled to a pin to receive a first clock external to a die, and a second input coupled to an output of a divider; an oscillator to provide a second clock; and a counter coupled to an output of the multiplexer and the oscillator, and operating with the second clock and determining a frequency of the first clock. The apparatus may further include a voltage monitor circuitry for monitoring voltage(s) for FUSA, a reference generator for FUSA, a duty cycle monitor for FUSA, a frequency degradation monitor for FUSA, and a phase error degradation monitor for FUSA.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] [Priority Claim] This application claims priority to U.S. Patent Application No. 16 / 020,918, filed June 27, 2018, entitled "Apparatus for Autonomous Security and Functional Safety of Clock and Voltages," which is incorporated by reference in its entirety. [Background technology]

[0002] Hardware and software security is paramount as computing devices (e.g., laptops, tablets, smartphones, computers, servers, the Internet of Things, etc.) become the fabric of everyday users. Signals on a processor's physical pins can be manipulated to cause the processor to perform unintended functions. For example, data stored in a processor's non-volatile memory for internal use can be retrieved by an unauthorized user using a different signal on the processor's pins. Similarly, software running on a processor can cause the processor's hardware to perform unauthorized functions (e.g., lowering a phase-locked loop's divider ratio). While much effort has been made to defuse and / or remove software viruses from computing devices, hardware remains largely unprotected against sophisticated hackers. [Brief explanation of the drawings]

[0003] Embodiments of the present disclosure will be more fully understood from the detailed description given below and from the accompanying drawings of various embodiments of the present disclosure, which should not be construed as limiting the disclosure to the particular embodiments but are merely for purposes of illustration and understanding.

[0004] [Figure 1]1 illustrates a high-level architecture of a clock and voltage monitor for providing functional safety (FUSA) to a processor, according to some embodiments of the present disclosure. [Figure 2] 1 shows a plot illustrating a timing diagram of a high-level architecture according to some embodiments. [Figure 3] 1 illustrates a narrow range single frequency oscillator for monitoring the frequency of a clock for a FUSA, according to some embodiments. [Figure 4] 1 illustrates a voltage monitor circuit for monitoring voltages for a FUSA, according to some embodiments. [Figure 5] 1 illustrates a reference generator for a FUSA, according to some embodiments. [Figure 6] 1 illustrates a clock architecture coupled to one or more performance monitoring circuits for monitoring a FUSA, according to some embodiments. [Figure 7] 1 illustrates a scalable comparator based on a parallel prefix tree architecture for providing a FUSA, according to some embodiments. [Figure 8] 1 illustrates a duty cycle monitor for a FUSA, according to some embodiments. [Figure 9A] 10A-10C show plots illustrating a frequency degradation monitor and aging effects for a FUSA, respectively, according to some embodiments. [Figure 9B] 10A-10C show plots illustrating a frequency degradation monitor and the effects of aging for a FUSA, respectively, according to some embodiments. [Figure 10A] 1 illustrates a circuit for comparing a reference clock to a feedback clock and generating an indicator of phase lock, according to some embodiments. [Figure 10B] 1 illustrates logic for determining phase error degradation for FUSA purposes, according to some embodiments. [Figure 11] 2 illustrates a power-up detector for the architecture of FIG. 1 according to some embodiments. [Figure 12]1 illustrates a smart device or computer system or SoC (System on Chip) having an apparatus for improving a FUSA, according to some embodiments of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0005] Various embodiments describe methods and apparatus for continuously and accurately monitoring all external and internal clock frequencies of interest to meet strict security and functional safety (FUSA) requirements. In some embodiments, an apparatus for FUSA autonomously monitors external voltage and clock parameters prior to boot or fuse down loads. For example, independent of trimming or calibration of various circuits, the apparatus monitors external voltage and clock parameters and identifies and flags unexpected changes to the external voltage and clock parameters. In some embodiments, a combined voltage / clock precision monitor is provided for security and functional safety in one integrated solution.

[0006] Some embodiments provide a monitor that continuously tracks clock frequencies and voltages of interest and reports errors to one or more function and security controllers if minimum and maximum thresholds are exceeded. These thresholds can be pre-programmed for each product or can be programmable at a later stage. In some embodiments, a very narrow frequency range oscillator (e.g., an inductor-capacitor (LC) high-frequency tank) is provided, which delivers a stable clock to accurately monitor and / or sample external and / or internal clocks. In some embodiments, a toggle monitor is provided that detects when an external clock toggles to engage the monitor. In some embodiments, a voltage reference generator (e.g., a bandgap (BG) circuit) and a voltage regulator (e.g., a low-dropout regulator) are provided to independently generate the internal voltages required by the FUSA monitor. In some embodiments, the voltage reference generator and voltage regulator support a wide input supply voltage range. An integrated power-on detector (POD) is also provided to enable power supply and reference voltage generation. In some embodiments, the voltage monitor constantly tracks the voltage and reports any changes from a set threshold. In one such embodiment, for security, hardware default values ​​are used before fuse-down loads, and trim or calibration codes for various circuits for functional safety can be applied before enabling trim or calibration procedures.

[0007] In some embodiments, some or all of the anomalies found by the monitor (e.g., overclocking, changes in the frequency of the external reference clock, changes in the supply voltage, etc.) can be mitigated by readjusting the circuit parameters of downstream circuits and logic. For example, if the frequency of the external clock changes, the corresponding phase-locked loop (PLL) may not generate the correct clock. To fix this, the external clock frequency is determined and appropriate changes are made to the PLL divider ratio so that the PLL output clock remains at its expected frequency.

[0008] In some embodiments, an apparatus is provided for monitoring a feedback clock of a phase-locked loop (PLL). In some embodiments, the feedback clock is divided in frequency by a divider before monitoring the clock to increase the accuracy of the monitor. While some embodiments are described in connection with monitoring a feedback clock for a PLL, any clock with a known frequency set by a known reference clock frequency can be monitored. In some embodiments, a FUSA controller is provided that rotates the clock to monitor among several clocks of interest while avoiding high-speed counter / logic duplication. In some embodiments, the monitor is used for HVM (High Volume Monitoring) with BIST (Built-In Self-Test) to internally change the PLL clock division ratio after a specified lock timer. For example, monitors of various embodiments are used to test HDMI® 300+ frequencies for accuracy, which significantly reduces test time.

[0009] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present disclosure. However, it will be apparent to those skilled in the art that the embodiments of the present disclosure may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring the embodiments of the present disclosure.

[0010] Note that in the corresponding drawings of the embodiments, signals are represented by lines. Some lines may be thicker to indicate more constituent signal paths and / or may have arrows at one or more ends to indicate the direction of primary information flow. Such indications are not intended to be limiting. Rather, lines are used in connection with one or more exemplary embodiments to facilitate easier understanding of a circuit or logic unit. Any represented signal, as dictated by design needs or preferences, may actually include one or more signals that can travel in either direction and may be implemented with any suitable type of signaling.

[0011] In the specification and claims, the term "connected" means a direct connection, such as an electrical, mechanical, or magnetic connection, between the things that are connected, without an intermediary device.

[0012] The term "coupled" means a direct or indirect connection, such as a direct electrical, mechanical, or magnetic connection between objects that are connected or indirectly connected, through one or more passive or active intermediary devices.

[0013] Here, the term "adjacent" generally refers to the location of an object next to (e.g., immediately adjacent to or in close proximity with one or more objects between them) or adjacent to (e.g., bordering) another object.

[0014] The term "circuit" or "module" may refer to one or more passive and / or active components configured to cooperate with each other to provide a desired functionality.

[0015] The term "signal" may refer to at least one current signal, voltage signal, magnetic signal, or data / clock signal. The meanings of "a," "an," and "the" include plural references. The meaning of "in" includes "in" and "on."

[0016] The term "scaling" generally refers to converting a design (schematic and layout) from one process technology to another, followed by reducing the layout area. The term "scaling" also generally refers to shrinking the layout and devices within the same technology node. The term "scaling" also refers to adjusting (e.g., slowing down or speeding up, i.e., reducing or expanding, respectively) signal frequency relative to other parameters such as power supply levels. The terms "substantially," "close," "nearby," and "about" generally mean within + / - 10% of a target value.

[0017] The use of ordinal adjectives such as "first," "second," and "third" to describe common objects, unless otherwise specified, merely indicates that different instances of similar objects are being referred to and does not imply that the objects so described must be in a given order, temporally, spatially, in ranking, or otherwise.

[0018] For purposes of this disclosure, the phrases "A and / or B" and "A or B" mean (A), (B), or (A and B). For purposes of this disclosure, the phrase "A, B, and / or C" means (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C).

[0019] In the specification and, if any, in the claims, terms such as "left," "right," "front," "rear," "top," "bottom," "upper," "lower," etc. are used for descriptive purposes and not necessarily to describe permanent relative positions.

[0020] It is pointed out that elements of a figure having the same reference number (or name) as elements of another figure can operate or function in a manner similar to that described, but is not limited to such.

[0021] For purposes of the embodiments, the transistors in the various circuit and logic blocks described herein are metal-oxide-semiconductor (MOS) transistors or their derivatives, with MOS transistors including drain, source, gate, and bulk terminals. Transistors and / or MOS transistor derivatives also include Tri-Gate and FinFET transistors, Gate-All-Around Cylindrical Transistors, Tunneling FETs (TFETs), Square Wire or Rectangular Ribbon Transistors, Ferroelectric FETs (FeFETs), or other devices that perform transistor functions, such as carbon nanotube or spintronic devices. The symmetric source and drain terminals of a MOSFET are, i.e., identical terminals, and are used interchangeably herein. TFET devices, on the other hand, have asymmetric source and drain terminals. Those skilled in the art will appreciate that other transistors, such as bipolar junction transistors (BJT PNP / NPN), BiCMOS, CMOS, etc., may be used without departing from the scope of the present disclosure.

[0022] 1 illustrates a high-level architecture 100 of a clock and voltage monitor for providing processor functional safety (FUSA) in accordance with some embodiments of the present disclosure. In some embodiments, the architecture 100 for a FUSA includes a bandgap (BG) circuit, a low dropout (LDO) regulator, a power-on detector (POD), and a voltage monitor (VM) packaged in a box 101; an oscillator (e.g., an LC tank oscillator) 102; and multiple counters and comparators 103. 1-n (where "n" is an integer greater than 1); toggle detector 104; divider 105; multiplexer 106; controller 107; multiplexer 108; and divider 109. In some embodiments, toggle detector 104, controller 107, and other circuitry that controls the process of providing the FUSA are part of a FUSA controller.

[0023] In some embodiments, the POD in block 101 detects the voltage on the VCCIN power rail (e.g., 1.2V to 2V) and compares the voltage to a minimum (Min) and maximum (Max) threshold. Referring back to FIG. 11 , in some embodiments, the bandgap (BG) circuit in block 101 generates a reference voltage used as a reference voltage for one or more voltage monitors and LDOs. In some embodiments, the voltage monitor(s) constantly track the VCCIN voltage and report any changes from the set threshold. For security, hardware default values ​​for the thresholds are used before fuse-down load. In some embodiments, a trimming code (trim) or calibration code for functional safety can be applied to the BG circuit before enabling it. In some embodiments, the voltage monitor (VM) in block 101 compares the supply voltage VCCIN to known minimum (min) and maximum (max) thresholds. If the VCCIN voltage level is outside the min / max thresholds, an error signal is generated (e.g., Error_0 is asserted). One possible architecture of a BG circuit with a voltage regulator is described with reference to FIG.

[0024] 1, in some embodiments, a narrow range oscillator 102 is used to provide an oscillating clock OSC_Clk for various logic in the architecture 100. For example, the oscillating clock OSC_Clk may be used to clock a counter and / or comparator 103 to count edges seen within a particular (or programmable) time window. 1-n In some embodiments, the narrow range oscillator 102 comprises an LC-Tank with a default medium-coarse band and a fine code, both of which have a total range of, for example, less than + / - 400 MHz. One possible architecture of the LC-Tank is described with reference to FIG.

[0025] Referring back to FIG. 1, in some embodiments, counter 103 1-n is used to sample the input clock OSC_Clk for a time window determined by a predetermined number of cycles of the input clock (e.g., a version of XTAL, the selected feedback clock FB_Clk). The counter's first-order accuracy is set by the nominal frequency of the sampled clock and the metastability of its flip-flops, and is weakly sensitive to variations in the LC tank frequency OSC_Clk.

[0026] In some implementations, a toggle detector (or monitor) 104 detects when the external clock XTAL toggles and autonomously engages with the XTAL or other reference monitor. For example, the toggle detector 104 has an edge detection circuit that identifies when a transition (e.g., low to high or high to low) is observed for the XTAL clock. The XTAL clock can be, for example, an off-die clock generated by a crystal.

[0027] In various embodiments, the toggle detector 104 is on the die and communicatively coupled to a pin that receives the external clock XTAL. In some embodiments, when the toggle detector 104 identifies a transition in the XTAL clock, it generates an enable signal EN_XTAL. The enable signal EN_XTAL is used to enable a counter and comparator that begins counting the frequency of XTAL and comparing the counted frequency to a minimum (min) and / or maximum (max) threshold frequency number. Each counter and comparator block 103 1-n The output from indicates a count value (e.g., Count_1 from block 1031) and an error indicator (e.g., Error_1 from block 1031) that indicates that the frequency count value is outside of the minimum or maximum expected count value. Here, for security purposes, a fixed XTAL / reference is used for the FUSA. For example, if multiple XTAL / reference frequencies are supported, straps or fuses can be used to predefine the minimum / maximum thresholds.

[0028] Counter 103 1-n To increase the accuracy of the counter 1031, the input clock is divided in frequency. In some embodiments, a divider 105 is used to divide the frequency of the XTAL clock. The divided frequency is then fed to a multiplexer (Mux.) 106, which provides either the XTAL clock or the divided XTAL clock (according to a selected signal Sel1) for the counter 1031. In some embodiments, a controller (not shown) provides the Sel1 signal. This controller is also referred to as a FUSA controller. Mux 106 allows the flexibility to count the XTAL frequency directly or by dividing it down in other ways.

[0029] In some embodiments, one of the counters (e.g., 103 n) counts the frequency of one of several PLL feedback clocks (PLL_FB1 through PLL_FBn). The PLL feedback clocks PLL_FB1 through PLL_FBn have known or fixed frequencies derived from their respective division ratios. As with the XTAL clock, multiplexer 108 and divider 109 select one of the feedback clocks and divide its frequency to be counted more accurately by counter 103. n A counter 103 is provided to generate FB_Clk for PLL_FB1 through PLL_FBn. Generally, the higher the division ratio, the better the accuracy of the clock monitor. In some embodiments, a controller 107 (e.g., part of the FUSA controller) is provided that can alternate which clock between PLL_FB1 through PLL_FBn and sequentially monitor it with knowledge of the state transitions to mask errors during each clock and frequency transition. This solution to clock alternation may not require knowledge of the actual divider ratio, considering that the feedback clock of the PLL has a constant frequency regardless of the PLL divider ratio. n is enabled by ENn when FB_Clk is countable. In various embodiments, this enable signal ENn is asserted by controller 107 when controller 107 detects a toggle of FB_Clk or one, some, or all of the clocks PLL_FB1 through PLL_FBn.

[0030] 2 shows a plot 200 illustrating a timing diagram of a high-level architecture according to some embodiments. Plot 200 shows four waveforms, XTAL, OSC_Clk, EN, and Count_1, as an example illustrating the operation of architecture 100. When toggle detector 104 detects a transition of the XTAL clock, enable signal EN is asserted. Once EN is asserted, counter 1031 begins counting the frequency of OSC_Clk edges between its two rising edges. The counter value is represented by a multi-bit code, Count_1.

[0031] 3 illustrates a narrow range, single frequency oscillator 300 (also referred to as an LC tank oscillator) for monitoring the frequency of a clock for a FUSA, according to some embodiments. LC tank oscillator 300 includes inductors L1 and L2 coupled in series and together in parallel to capacitor banks 301 and 302. In some embodiments, capacitor bank 301 is a coarse bank including binary-weighted capacitors. In some embodiments, capacitor bank 302 is a fine bank including thermometer-weighted capacitors. Here, a coarse bank refers to a group of capacitors where each capacitor added to a capacitance network increases the capacitance by a much greater amount than if only capacitors from the fine bank were added to the capacitance network.

[0032] In some embodiments, n-type transistors MN0 and MN1 are cross-coupled and coupled to inductors L1 and L2 and capacitor banks 301 and 302 to induce oscillation and control the oscillation frequency. In various embodiments, the oscillation amplitude can be adjusted by switches controlled by IVCO[0] through IVCO[n], which adjust resistors R[0] through R[n] on the sources of transistors MN0 and MN1. In this manner, the bias current of the LC tank oscillator is modified. In some embodiments, the output VCOout of LC tank oscillator 300 is buffered by a post-VCO (voltage-controlled oscillator) buffer (PVB) 303. To balance LC tank oscillator 300, a replica or dummy PVB 304 is coupled to inductor L1 to provide the same rise and fall times for the VCOout clock. In various embodiments, VCOout (e.g., OSC_Clk) is a stable clock used to accurately monitor or sample external and / or internal clocks.

[0033] 4 illustrates a voltage monitor (VM) circuit 400 for monitoring the voltage of a FUSA, according to some embodiments. In some embodiments, the VM circuit 400 includes a first comparator 401 and a second comparator 402. In some embodiments, the outputs VmaxCmpOut and VminCmpOut from the first comparator 401 and the second comparator 402, respectively, are sticky outputs. For example, when the node signals VmaxCmpOut and VminCmpOut change, the signals are latched and remain in their logic states. In some embodiments, the first comparator 401 and the second comparator 402 are clocked comparators. Any suitable clocked comparators can be used to implement the first comparator 401 and the second comparator 402.

[0034] In various embodiments, the power supply VccRef to the comparators 401 / 402 is provided by a low dropout (LDO) regulator circuit as described with reference to FIG. 5. Referring back to FIG. 4, here the first comparator 401 compares a divided version Vp of the power supply VccX with a high or maximum threshold Vmax_thresh. The second comparator 402 compares the divided version Vp of the power supply VccX with a low or minimum threshold Vmin_thresh. Thus, the first comparator 401 monitors VccX with reference to a high threshold, and the second comparator 402 monitors VccX with reference to a low threshold. In some embodiments, the divided version Vp of the power supply VccX is provided by a resistor device R CM1 and R CM2 In some embodiments, the resistor device R CM1 and R CM2 has an adjustable resistance.

[0035] In some embodiments, the maximum threshold Vmax_thresh and the minimum threshold Vmin_thresh are generated by a resistor divider. In this example, R TH1 From R TH3 A stack of up to three adjustable resistive devices is used. The resistive devices may be implemented in any suitable manner. For example, the resistive devices may be implemented using discrete resistors, transistors operating in their linear region, etc. These resistive devices may have adjustable resistance. By indicating when VccX rises above or falls below an expected threshold, the processor can detect a functional safety issue and take action to mitigate it.

[0036] FIG. 5 illustrates a reference generator architecture 500 for a FUSA, according to some embodiments. In some embodiments, the reference voltage supply VccVref for the first comparator 401 and the second comparator 402 can be provided by an architecture 500 having a finite state machine (FSM) 501, a BG reference generator 502, and a low voltage regulator (VR) 503. In some embodiments, depending on the voltage value of BGref, the FSM 501 calibrates the BG reference generator 502 by trimming one or more devices of the BG reference generator 502 (e.g., by adjusting the current / voltage drive strength of the devices) to bring the level of BGref to an expected level. In some embodiments, the VR 503 is a low dropout (LDO) regulator powered by VCCIN. Any suitable LDO regulator design can be used to implement the VR 503. In some embodiments, the VR 503 can be a unity gain buffer. Any suitable unity gain buffer design can be used to implement the VR 503.

[0037] 6 illustrates a clock architecture 600 coupled to one or more performance monitoring circuits for monitoring a FUSA, according to some embodiments. The architecture 600 includes a phase frequency detector (PFD) 601, a charge pump (CP) 602, a loop filter or low-pass filter (LPF) 603, a voltage-controlled oscillator (VCO) 604, a post-VCO buffer (PVB) 605, a multiplexer 606, a divider 607, a duty cycle adjustment (DCA) circuit 608, a clock distribution buffer 609, a duty cycle state machine 610, and a delta-sigma modulator (DSM) 611. In some embodiments, the various circuits of the clock architecture 600 operate from different power supplies, indicated by domains 613, 614, and 615. In some embodiments, the VCO receives a separate power supply from an LDO 612. In some embodiments, one or more of CPs 602, loop filter 603, VCO 604, PVB 605, feedback divider 607, and other devices / circuits along the clock propagation path receive separate power supplies from LDO 612. The clock architecture receives a reference clock (RefClk), such as an XTAL or its derivative, which is received by PFD 601, which includes an FBClk (e.g., one of PLL_FB1 to PLL_FBn). The output of PFD 601 is an up / down (Dn) signal that instructs CP 602 to sink or source charge on a control node. The voltage on the control node is then filtered by LPF 603 to generate Vcntl, which controls the oscillation frequency of VCO 604. The VCO's output, Vclk, is buffered by 605 and provided to DCA circuit 608. In some embodiments, one of ClkGrid or PLLClk is selected by Mux 606 as the clock for input to divider 607. In some embodiments, divider 607 receives integer or fractional division ratios from DSM 611. In various embodiments, the performance of the functional safety of clock architecture 600 is monitored by checking signals such as the duty cycle of Up, Dn, and ClkGrid.Variations in the duty cycle characteristics of Up, Dn, and ClkGrid from their expected characteristics provide insight into functional safety hazards for clock architecture 600. Here, clock architecture 600 is a phase-locked loop and is shown as an example architecture for FUSA monitoring, although the techniques for FUSA monitoring are applicable to any clock architecture.

[0038] FIG. 7 illustrates a scalable comparator based on a parallel prefix tree architecture 700 for providing a FUSA, according to some embodiments. In some embodiments, the first and second comparators 401 / 402 are implemented using architecture 700. In some embodiments, comparator architecture 700 is a multi-bit comparator tree having stages including a NAND gate 701 and a NOR gate 704 for comparing inputs a[i] and b[i], followed by composite logic 702 and an AND gate 705, composite logic 703 and an AND gate 706, etc. The first few stages of the multi-bit comparison tree are shown here, where the first stage calculates whether a single bit of binary word "a" is greater than (G[i]) or equal to (E[i]) the corresponding bit of "b". The remaining stages logarithmically combine the G and E bits of significance[i,ij] with bits of [ij-1,ik] to produce significance[i,ik]. This fanin-2 depiction is an example; fanin-3+ trees are possible, and alternative comparison encodings are also possible (eg, less than instead of equal).

[0039] FIG. 8 illustrates a duty cycle monitor 800 for a FUSA, according to some embodiments. In some embodiments, the duty cycle monitor includes a comparator 802 (e.g., based on architecture 700) that compares a duty cycle code from a DCC (duty cycle corrector) 610 with a predetermined code 801. The DCC senses the duty cycle of the clock grid, according to some embodiments. In some embodiments, the DCC updates the DCA code to minimize DCD. The output of the comparator 802 is then fed to the FUSA controller. The FUSA controller can provide a report or indicator on the health of the duty cycle and indicate when the duty cycle of the PLLClk is outside its expected range. For example, the duty cycle monitor 800 can provide insight into duty cycle distortion (DCD) due to asymmetric aging of p-type versus n-type devices. DCD can cause phase path timing violations and even pulse width evaporation.

[0040] 9A-9B illustrate a frequency degradation monitor 900 for a FUSA and a plot 920 illustrating the effects of aging, respectively, according to some embodiments. In some embodiments, the frequency degradation monitor 900 includes an analog-to-digital converter (ADC) that converts the VCO input control voltage Vctrl into a digital representation V1 (e.g., a 10-bit digital code V1[9:0]). In some embodiments, the original value of Vctrl in the digital code (Vc fresh ) is stored in memory 902. This original value is the value of Vctrl for a given division ratio when the product / die was manufactured and first used. fresh The original value V2 corresponding to V1(Vc aged ) to determine how aging has affected the performance of the PLL 613 and therefore the FUSA. In some embodiments, to be able to determine the shift in the control voltage Vctrl for the same target frequency Ftgt, freshis generated and is provided to the FUSA controller, which compares the target frequency division ratio to the output of comparator 902. For example, the output of comparator 902 is ANDed with the output of XNOR gate 905 before the FUSA controller is notified about the degradation of Vcntl over time.

[0041] FIG. 10A shows a circuit 1000 for comparing a reference clock to a feedback clock and generating an indicator of phase lock, according to some embodiments. In some embodiments, circuit 1000 includes an XOR gate 1001 followed by a series of delay buffers 1002, multiplexers 1003 and 1004, and AND gates 1005 and 1006 coupled together as shown. The inputs to XOR gate 1001 are a reference clock (clkref) and a feedback clock (clkfb). These clocks are compared, and the output of the comparison (e.g., XOR gate 1001) is converted to pulses RawUnlock and FUSAUnlock, where RawUnlock and FUSAUnlock provide an initial indication of separation in the phases of clkref and clkfb. In some embodiments, multiplexer 1003 is used to modify a threshold for indicating when the phases of clkfb and clkref are sufficiently separated to invoke the RawUnlock indication. This threshold can be changed by RawThresh. In some embodiments, multiplexer 1004 is used to modify the threshold for indicating when the phases of clkfb and clkref are sufficiently separated to invoke the FUSAUnlock indication. This threshold can be changed by FUSAThresh.

[0042] FIG. 10B illustrates logic 1020 for determining phase error degradation for FUSA purposes, according to some embodiments. As clock source (e.g., PLL) devices age, they become slower than when newly manufactured, and the clock source may lose phase or frequency lock sooner. In some embodiments, logic 1020 is provided to monitor and alert for lock degradation by indicating an early lock failure of the clock source's phase or frequency lock. This early indication (e.g., FUSA lock) is provided to a FUSA controller, which can modify the lock window of the lock detector associated with the clock source so that the clock source does not declare its system unlocked. The FUSA controller can further request a power or frequency management system to reduce the clock frequency requirements so that logic within the processor can relax timing margins.

[0043] In some embodiments, logic 1020 includes a down counter 1021, a lock detector 1022, and a FUSA lock detector 1023. Here, lock detector 1022 and FUSA lock detector 1023 are replicas of the actual lock detector of the clock source. Down counter 1021 counts down from a maximum lock threshold (also called an initial lock threshold) until lock is de-asserted (e.g., there is no lock). In some embodiments, down counter 1021 also operates on OSC_Clk (e.g., counter clock CntrClk is the same as OSC_Clk or a divided version thereof). When lock is de-asserted, the true PLL phase error at time 0 is determined. Here, lock detector 1021 is any suitable lock detector circuit that monitors up and down pulses generated from a phase frequency detector (which compares reference clock RefClk and feedback FBClk). The Lock signal is asserted as long as the difference between the up and down pulses is within the PLL_LockThreshold (lock threshold) for a predetermined time. When the pulse difference between the up and down pulses becomes greater than the PLL_LockThreshold, the Lock signal is deasserted, indicating a loss of lock on the clock source.

[0044] As the down counter 1021 counts down and reduces the PLL_LockThreshold value, the lock detector 1022 window for justifying lock is narrowed until the lock detector declares a loss of lock. When lock deasserts (e.g., when the lock signal indicates a loss of lock), the reference or true PLL phase error at time zero is determined. In some embodiments, the value of PLL_LockThreshold that results in lock deassertion for a particular process, voltage, and temperature condition is recorded in non-volatile memory. Now that the reference PLL_LockThreshold has been determined, an aging guard band (GB) is added to the true PLL_LockThreshold value to account for degradation due to aging. In this way, a modified lock threshold FUSA_LockThresh is calculated, which provides an early lock failure to the FUSA controller through the FUSA_Lock signal. The FUSA controller can then take appropriate steps to mitigate the phase error degradation (e.g., the phase error between Clkref and Clkfb). Examples of suitable steps include reducing the power supply voltage level, reducing the operating frequency by changing the division ratio of a phase locked loop, and the like.

[0045] FIG. 11 illustrates a power-on detector (POD) 1100 used for FIG. 1 , according to some embodiments. In some embodiments, POD 1100 has a bandgap reference circuit including resistors R1, R2, R3, R4, and R5, diodes 1101 and 1102, a Schmitt trigger buffer 1104, and a digital filter 1105 coupled together as shown. Here, VCCIN is the input power supply being monitored to see if it is “good” for use. The indicator PowerUp, when asserted, indicates that VCCIN is high enough to be used by other logic and circuitry. For example, PowerUp is used to enable or disable functional safety or security test operations.

[0046] Because diode 1102 is N times larger than diode 1101, the current through R2 is N times larger than the current through R1 (minus the current through R5). The voltages V1 and V2 associated with the two resistors R1 and R2 are compared by comparator 1103. The output of comparator 1103 is converted to a signal operating on VCCIN / 2 (e.g., half of VCCIN) and provided to Schmitt trigger 1104. When the power supply VCCIN exceeds a threshold, the output of Schmitt trigger 1104 switches, indicating that available power is good. The output of Schmitt trigger 1104 is filtered by digital filter 1105 to ensure a correct PowerUp indication. The PowerUp indicator then allows other FUSA circuits to monitor various characteristics (e.g., clock frequency, voltage, duty cycle, phase error, etc.) using the FUSA controller.

[0047] The various clock and voltage monitors of various embodiments are fundamental components of hardware security and secure products. The various security monitors provide near real-time or real-time autonomous response. The FUSA tracks clock and voltage changes over time.

[0048] 12 illustrates a smart device or computer system or SoC (system-on-chip) having an apparatus for improving a FUSA according to some embodiments of the present disclosure. FIG. 12 illustrates a block diagram of one embodiment of a mobile device that can use a planar interface connector. In some embodiments, computing device 1600 represents a mobile computing device such as a computing tablet, a mobile phone or smartphone, a wireless-enabled e-reader, or other wireless mobile device. It will be understood that certain components are shown generally, and that not all components of such a device are shown in computing device 1600.

[0049] In some embodiments, computing device 1600 includes a first processor 1610 having apparatus for improving the FUSA according to some embodiments discussed. According to some embodiments, other blocks of computing device 1600 may also include apparatus for improving the FUSA. Various embodiments of the present disclosure may also have a network interface in 1670, such as a wireless interface, such that system embodiments may be incorporated into wireless devices, e.g., mobile phones or personal digital assistants.

[0050] In some embodiments, processor 1610 (and / or processor 1690) may include one or more physical devices, such as a microprocessor, application processor, microcontroller, programmable logic device, or other processing means. The processing operations performed by processor 1610 include the execution of an operating platform or operating system on which applications and / or device functions execute. The processing operations include operations related to I / O (input / output) with a human user or other devices, operations related to power management, and / or operations related to connecting computing device 1600 to another device. The processing operations may also include operations related to audio I / O and / or display I / O.

[0051] In some embodiments, computing device 1600 includes an audio subsystem 1620 that represents hardware (e.g., audio hardware and audio circuitry) and software (e.g., drivers, codecs) components associated with providing audio functionality to the computing device. Audio functionality may include speaker and / or headphone output, as well as microphone input. Devices for such functionality may be integrated into computing device 1600 or connected to computing device 1600. In one embodiment, a user interacts with computing device 1600 by providing audio commands that are received and processed by processor 1610.

[0052] In some embodiments, computing device 1600 has a display subsystem 1630. Display subsystem 1630 represents hardware (e.g., display devices) and software (e.g., drivers) components that provide a visual and / or tactile display for a user to interact with computing device 1600. Display subsystem 1630 includes a display interface 1632 that includes the particular screen or hardware device used to provide a display to the user. In one embodiment, display interface 1632 includes logic separate from processor 1610 to perform at least some processing related to the display. In one embodiment, display subsystem 1630 includes a touchscreen (or touchpad) device that provides both output and input to the user.

[0053] In some embodiments, computing device 1600 includes an I / O controller 1640. I / O controller 1640 represents hardware devices and software components related to interaction with a user. I / O controller 1640 is operable to manage hardware that is part of audio subsystem 1620 and / or display subsystem 1630. In addition, I / O controller 1640 represents connection points for additional devices that connect to computing device 1600 through which a user can interact with the system. For example, devices that may be attached to computing device 1600 may include a microphone device, a speaker or stereo system, a video system or other display device, a keyboard or keypad device, or other I / O devices for use with particular applications, such as a card reader or other device.

[0054] As mentioned above, I / O controller 1640 can interact with audio subsystem 1620 and / or display subsystem 1630. For example, input via a microphone or other audio device can provide input or commands for one or more applications or functions of computing device 1600. Furthermore, audio output can be provided instead of, or in addition to, a display output. In another example, if display subsystem 1630 includes a touchscreen, the display device also serves as an input device that can be at least partially managed by I / O controller 1640. There can also be additional buttons or switches on computing device 1600 to provide I / O functions managed by I / O controller 1640.

[0055] In some embodiments, I / O controller 1640 manages devices such as accelerometers, cameras, light sensors, or other environmental sensors, or other hardware that may be included in computing device 1600. The input may be part of direct user interaction, or may provide environmental input to the system to affect the operation of the system (e.g., filtering noise, adjusting the display for brightness detection, applying a flash for a camera, or other features).

[0056] In some embodiments, computing device 1600 includes power management 1650 that manages functions related to battery power usage, battery charging, and power-saving operations. Memory subsystem 1660 includes memory devices for storing information in computing device 1600. Memory may include non-volatile (state does not change when power to the memory device is interrupted) and / or volatile (state is indeterminate when power to the memory device is interrupted) memory devices. Memory subsystem 1660 may store application data, user data, music, photos, documents, or other data, as well as system data (long-term or temporary) related to the execution of applications and functions of computing device 1600.

[0057] Elements of the embodiments may also be provided as a machine-readable medium (e.g., memory 1660) for storing computer-executable instructions (e.g., instructions for implementing any other process described herein). The machine-readable medium (e.g., memory 1660) may include, but is not limited to, flash memory, optical disks, CD-ROMs, DVD-ROMs, RAM, EPROMs, EEPROMs, magnetic or optical cards, phase-change memory (PCM), or other types of machine-readable media suitable for storing electronic or computer-executable instructions. For example, embodiments of the present disclosure may be downloaded as a computer program (e.g., BIOS), which may be transferred by data signal from a remote computer (e.g., server) to a requesting computer (e.g., client) over a communications link (e.g., modem or network connection).

[0058] In some embodiments, computing device 1600 has connectivity 1670. Connectivity 1670 includes hardware devices (e.g., wireless and / or wired connectors and communications hardware) and software components (e.g., drivers, protocol stacks) that allow computing device 1600 to communicate with external devices. Computing device 1600 can be a separate device such as another computing device, a wireless access point or base station, as well as a peripheral such as a headset, printer, or other device.

[0059] Connectivity 1670 can include multiple different types of connectivity. For generalization, computing device 1600 is shown with cellular connectivity 1672 and wireless connectivity 1674. Cellular connectivity 1672 generally refers to cellular network connectivity provided by a wireless carrier, such as that provided by GSM (Global System for Mobile Communications) or variants or derivatives, CDMA (Code Division Multiple Access) or variants or derivatives, TDM (Time Division Multiplexing) or variants or derivatives, or other cellular service standards. Wireless connectivity (or air interface) 1674 refers to wireless connectivity that is not cellular and may include personal area networks (e.g., Bluetooth, Near Field, etc.), local area networks (e.g., Wi-Fi), and / or wide area networks (e.g., WiMax), or other wireless communications.

[0060] In some embodiments, computing device 1600 comprises peripheral connections 1680. Peripheral connections 1680 include hardware interfaces and connectors as well as software components (e.g., drivers, protocol stacks) for making the peripheral connections. It will be understood that computing device 1600 can both be a peripheral to other computing devices (“to” 1682) and have peripherals connected to it (“from” 1684). Computing device 1600 typically has a “docking” connector for connecting to other computing devices for purposes such as managing (e.g., downloading and / or uploading, modifying, synchronizing) content on computing device 1600. Additionally, docking connectors can enable computing device 1600 to connect to certain peripherals that allow computing device 1600 to control content output to, for example, audiovisual or other systems.

[0061] In addition to proprietary docking connectors or other proprietary connection hardware, computing device 1600 may make peripheral connections 1680 through common or standards-based connectors. Common types include Universal Serial Bus (USB) connectors (which can include any of several different hardware interfaces), DisplayPort, including Mini DisplayPort (MDP), High-Definition Multimedia Interface (HDMI), Firewire, or other types.

[0062] In the specification, references to "an embodiment," "one embodiment," "an embodiment," or "an other embodiment" mean that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least some embodiments, but not necessarily in all embodiments. Various appearances of "an embodiment," "an embodiment," or "an embodiment" do not necessarily refer to the same embodiment. When the specification states that a component, feature, structure, or characteristic "may" include, "may include," or "may include," that particular component, feature, structure, or characteristic need not be included. When the specification or claims refer to "a" or "an" element, it does not mean that there is only one of the element. When the specification or claims refer to "additional" elements, it does not preclude there being more than one of the additional elements.

[0063] Furthermore, particular features, structures, functions, or characteristics may be combined in any suitable manner in one or more embodiments. For example, a first embodiment may be combined with a second embodiment, provided that the particular features, structures, functions, or characteristics associated with the two embodiments are not mutually exclusive.

[0064] While the present disclosure has been described in connection with specific embodiments thereof, many alternatives, modifications, and variations of such embodiments will be apparent to those skilled in the art in light of the foregoing description. It is intended that the embodiments of the present disclosure embrace all such alternatives, modifications, and variations as fall within the broad scope of the appended claims.

[0065] Additionally, well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the presented drawings for simplicity of illustration and discussion, and so as not to obscure the disclosure. Furthermore, configurations may be shown in block diagram form to avoid obscuring the disclosure and in recognition of the fact that details regarding the implementation of such block diagram configurations are highly dependent on the platform on which the present disclosure is implemented (i.e., such details should be well within the purview of one skilled in the art). Where specific details (e.g., circuits) are described to illustrate exemplary embodiments of the present disclosure, it should be apparent to one skilled in the art that the present disclosure can be practiced without these specific details or with variations thereof. The present description is therefore to be regarded as illustrative and not limiting.

[0066] An Abstract is provided to allow the reader to ascertain the nature and gist of the technical disclosure. The Abstract is submitted with the understanding that it will not be used to limit the scope or meaning of the claims. The following claims are incorporated into the Detailed Description, with each claim standing on its own as a separate embodiment.

[0067] The following additional note is added: (Supplementary Note 1) a multiplexer having a first input communicatively coupled to a pin for receiving a first clock external to the die, and a second input coupled to an output of the divider; an oscillator providing a second clock; a counter coupled to the output of the multiplexer and to the oscillator, the counter operating on the second clock and determining the frequency of the first clock; having Device. (Supplementary Note 2) A comparator is provided to compare the output of the counter with a reference. 10. The apparatus described in Appendix 1. (Supplementary Note 3) The oscillator includes an inductor-capacitor tank. 10. The apparatus described in Appendix 1. (Supplementary Note 4) A power-up detector coupled to a power rail, the power-up detector detecting when a power supply on the power rail exceeds a threshold, and an output of the power-up detector enabling or disabling a functional safety or security test. 4. The device of any one of claims 1 to 3. (Supplementary Note 5) A bandgap reference circuit for generating a reference voltage for the inductor-capacitor tank. 10. The apparatus described in Appendix 3. (Supplementary Note 6) A low-dropout regulator receives a reference voltage and generates a regulated power supply. 10. The apparatus described in Appendix 5. (Supplementary Note 7) A circuit for monitoring the rising or falling edge of the first clock and then enabling the counter to start counting. 4. The device of any one of claims 1 to 3. (Supplementary Note 8) The counter is a first counter, the multiplexer is a first multiplexer, and the device: a second counter operating on the second clock; a second multiplexer receiving a plurality of clocks from a plurality of clock sources, the multiplexer providing an output that is one of the clocks, the output of the multiplexer being provided directly or indirectly to the second counter; having 4. The device of any one of claims 1 to 3. (Supplementary Note 9) A duty cycle monitor is provided to monitor the duty cycles of the outputs of the plurality of individual phase-locked loops. 10. The apparatus described in Appendix 8. (Supplementary Note 10) A frequency degradation monitor that monitors the frequency of the output of each of the phase-locked loops. 10. The apparatus described in Appendix 9. (Supplementary Note 11) A phase error detector is provided to detect a phase error of each of the phase-locked loops relative to a reference phase error. 10. The apparatus described in Appendix 9. (Supplementary Note 12) A voltage monitor for monitoring the voltage level of the power supply is provided. 10. The apparatus described in Appendix 9. (Supplementary Note 13) a frequency divider communicatively coupled to the pin for receiving a first clock external to the die; a multiplexer having a first input communicatively coupled to the pin and a second input coupled to the output of the frequency divider; an inductor-capacitor tank providing a second clock; a counter coupled to the output of the multiplexer and to the inductor-capacitor tank, the counter operating on the second clock and determining the frequency of the first clock; having Device. (Supplementary Note 14) A circuit for monitoring the rising or falling edge of the first clock and then enabling the counter to start counting. 14. The apparatus of claim 13. (Supplementary Note 15) a first comparator that compares the output of the counter with a first reference; a second comparator that compares the output of the counter with a second reference; having 14. The apparatus of claim 13. (Appendix 16) Memory and; a clock generator that generates a first clock; a processor coupled to the memory and the clock generator, the processor comprising the apparatus of any one of claims 1 to 12; an antenna that enables the processor to communicate with other devices; having system. (Appendix 17) Memory and; a clock generator that generates a first clock; a processor coupled to the memory and the clock generator, the processor comprising the apparatus of any one of clauses 13 to 15; an antenna that enables the processor to communicate with other devices; having system. (Supplementary Note 18) receiving a first clock external to the die at a pin, a frequency divider communicatively coupled to the pin; receiving the first clock at a first input of a multiplexer; receiving the output of the frequency divider at a second input of the multiplexer; providing a second clock; determining the frequency of the first clock using the second clock; Including, method. (Supplementary Note 19) Monitoring the rising or falling edge of the first clock; enabling a counter to begin counting to determine the frequency of the first clock; Including, 18. The method described in Appendix 18. (Supplementary Note 20) Comparing the output of the counter with a first reference; comparing the output of the counter to a second reference; Including, 19. The method described in Appendix 19.

Claims

1. a first multiplexer having a first input communicatively coupled to a pin for receiving a first clock external to the die and a second input coupled to an output of a frequency divider, the first multiplexer configured to receive both the first clock and the output of the frequency divider; an oscillator providing a second clock; a first counter coupled to the output of the first multiplexer and to the oscillator, the first counter operating on the second clock and determining the frequency of the first clock; a second counter operating on the second clock; a second multiplexer that receives a plurality of clocks from a PLL feedback clock, the second multiplexer being configured by a controller to alternately provide an output that is one of the plurality of clocks to a second frequency divider, the output of which is provided directly to the second counter; and the second counter outputs an error indicator based on a result of comparing the output of the second frequency divider with a threshold frequency; Device.

2. a comparator for comparing the output of the first counter with a reference; 10. The apparatus of claim 1.

3. the oscillator having an inductor-capacitor tank; 10. The apparatus of claim 1.

4. a power-up detector coupled to a power rail, the power-up detector detecting when a power supply on the power rail crosses a threshold, the output of the power-up detector enabling or disabling a functional safety or security test; 4. An apparatus according to any one of claims 1 to 3.

5. a bandgap reference circuit for generating a reference voltage for the inductor-capacitor tank; 4. The apparatus of claim 3.

6. a low dropout regulator receiving a reference voltage and generating a regulated power supply; 6. The apparatus of claim 5.

7. a circuit for monitoring a rising or falling edge of the first clock and then enabling the first counter to begin counting; 4. An apparatus according to any one of claims 1 to 3.

8. a duty cycle monitor for monitoring the duty cycle of the outputs of the plurality of individual phase locked loops; 10. The apparatus of claim 1.

9. a frequency degradation monitor for monitoring the frequency of the output of each of the phase locked loops; 9. The apparatus of claim 8.

10. a phase error detector for detecting a phase error of each of the phase locked loops relative to a reference phase error; 9. The apparatus of claim 8.

11. a voltage monitor for monitoring the voltage level of the power supply; 9. The apparatus of claim 8.

12. a frequency divider communicatively coupled to the pin for receiving a first clock external to the die; a first multiplexer having a first input communicatively coupled to the pin and a second input coupled to an output of the frequency divider, the first multiplexer configured to receive both the first clock and the output of the frequency divider; an inductor-capacitor tank providing a second clock; a first counter coupled to the output of the first multiplexer and to the inductor-capacitor tank, the first counter operating on the second clock and determining the frequency of the first clock; a second counter operating on the second clock; a second multiplexer that receives a plurality of clocks from a PLL feedback clock, the second multiplexer being configured by a controller to alternately provide an output that is one of the plurality of clocks to a second frequency divider, the output of which is provided directly to the second counter; and the second counter outputs an error indicator based on a result of comparing the output of the second frequency divider with a threshold frequency. Device.

13. a circuit for monitoring a rising or falling edge of the first clock and then enabling the first counter to begin counting; 13. The apparatus of claim 12.

14. a first comparator that compares the output of the first counter with a first reference; a second comparator that compares the output of the first counter with a second reference; having 13. The apparatus of claim 12.

15. memory and; a clock generator that generates a first clock; a processor coupled to the memory and the clock generator, the processor comprising the apparatus of any one of claims 1 to 11; an antenna that enables the processor to communicate with other devices; having system.

16. memory and; a clock generator that generates a first clock; a processor coupled to the memory and the clock generator, the processor comprising the apparatus of any one of claims 12 to 14; an antenna that enables the processor to communicate with other devices; having system.

17. A method performed on an apparatus according to any one of claims 1 to 12, comprising the steps of: receiving a first clock external to the die at the pin, the divider being communicatively coupled to the pin; receiving the first clock at the first input of the first multiplexer; receiving an output of the frequency divider at the second input of the first multiplexer, the first multiplexer configured to receive both the first clock and the output of the frequency divider; providing a second clock; determining the frequency of the first clock using the second clock; Including, method.

18. monitoring a rising or falling edge of the first clock; enabling a counter to begin counting to determine the frequency of the first clock; Including, 18. The method of claim 17.

19. comparing the output of the counter to a first criterion; comparing the output of the counter to a second reference; Including, 20. The method of claim 18.

Images