阅读说明：本技术 用于及时检测即将发生的电源故障以保护本地设计状态的方法 (Method for timely detection of impending power failure to protect local design state ) 是由 M·K·巴滕伯格 V·P·勒罗伊 P·K·奥里甘蒂 于 2018-04-16 设计创作，主要内容包括：在本公开的某些方面,一种芯片包括隔离器件,其中隔离器件被配置为：当隔离器件被禁用时,允许信号经由在第一电源域与第二电源域之间穿过的信号线从第一电源域中的第一电路传递到第二电源域中的第二电路,以及当隔离器件被启用时,将第二电源域中的信号线的一部分钳位到逻辑状态。该芯片还包括故障检测器,故障检测器被配置为：检测第一电源域或第二电源域中的至少一个电源域的即将发生的电源故障,并且响应于对即将发生的电源故障的检测而启用隔离器件。(In certain aspects of the present disclosure, a chip includes an isolation device, wherein the isolation device is configured to: when the isolation device is disabled, allowing a signal to pass from a first circuit in the first power domain to a second circuit in the second power domain via a signal line passing between the first power domain and the second power domain, and when the isolation device is enabled, clamping a portion of the signal line in the second power domain to a logic state. The chip further includes a fault detector configured to: an impending power failure of at least one of the first power domain or the second power domain is detected and the isolation device is enabled in response to the detection of the impending power failure.)

1. A chip, comprising:

An isolation device, wherein the isolation device is configured to: allowing a signal to pass from a first circuit in a first power domain to a second circuit in a second power domain via a signal line passing between the first power domain and the second power domain when the isolation device is disabled, and clamping a portion of the signal line in the second power domain to a logic state when the isolation device is enabled; and

A fault detector configured to: the method further includes detecting an impending power failure of at least one of the first power domain or the second power domain, and enabling the isolation device in response to the detection of the impending power failure.

2. The chip of claim 1, wherein the fault detector comprises a voltage comparator configured to: comparing a supply voltage to a threshold voltage, disabling the isolation device if the supply voltage is above the threshold voltage, and enabling the isolation device if the supply voltage is below the threshold voltage.

3. The chip of claim 2, in which the fault detector further comprises a voltage scaler configured to scale down a supply voltage of the second power domain to generate the threshold voltage.

4. the chip of claim 2, wherein the supply voltage is a supply voltage of the first power domain or a supply voltage of a third power domain.

5. The chip of claim 1, wherein the fault detector comprises a voltage comparator configured to: comparing a supply voltage to a first threshold voltage, disabling the isolation device if the supply voltage is above the first threshold voltage, enabling the isolation device if the supply voltage is below the first threshold voltage, and disabling the isolation device after the supply voltage is below the first threshold voltage if the supply voltage rises above a second threshold voltage, wherein the second threshold voltage is above the first threshold voltage.

6. The chip of claim 5, wherein the supply voltage is a supply voltage of the first power domain or a supply voltage of a third power domain.

7. The chip of claim 1, wherein the fault detector comprises a voltage comparator configured to: comparing a voltage on a power distribution network to a threshold voltage, disabling the isolation device if the voltage is above the threshold voltage, and enabling the isolation device if the voltage is below the threshold, wherein the power distribution network supplies power from a primary power source to the second power domain.

8. the chip of claim 7, wherein a backup power source is coupled to the power distribution network, the backup power source is configured to provide power to the second domain for a period of time after the primary power source is powered off, and the voltage on the power distribution network is upstream of the backup power source.

9. the chip of claim 7, in which the backup power supply comprises a storage capacitor.

10. The chip of claim 1, wherein the isolation device is configured to: latching a logic state on the signal line and clamping the portion of the signal in the second power supply domain to the latched logic state when the isolation device is enabled.

11. The chip of claim 1, wherein the isolation device is configured to: clamping the portion of the signal line in the second power domain to a logic state "1" or "0" when the isolation device is enabled.

12. The chip of claim 1, further comprising a triggering device configured to: triggering the second circuit to perform an operation in response to the detection of the impending power failure, wherein the operation comprises at least one of: storing a current logic state of the second circuit in a non-volatile memory or storing security information in the non-volatile memory.

13. The chip of claim 12, wherein the security information comprises a count value indicating a version of data stored in memory.

14. The chip of claim 12, wherein when a primary power source is restored after detection of the impending power failure, the failure detector is configured to wait until the operation is complete before disabling the isolation device.

15. The chip of claim 1, wherein the fault detector is configured to detect the impending power failure by: monitoring an error rate of communications from the first circuit to the second circuit, and detecting the impending power failure when the error rate exceeds an error rate threshold.

16. A method for power failure mitigation on a chip, the chip comprising a first circuit in a first power domain, a second circuit in a second power domain, and a signal line providing communication between the first circuit and the second circuit and passing between the first power domain and the second power domain, wherein the method comprises:

Detecting an impending power failure of at least one of the first power domain or the second power domain; and

Clamping a portion of the signal lines in the second power domain to a logic state in response to detection of the impending power failure.

17. The method of claim 16, wherein detecting the impending power failure comprises:

Comparing the supply voltage to a threshold voltage; and

Detecting the impending power failure if the power supply voltage is below the threshold voltage.

18. The method of claim 17, further comprising: scaling down a supply voltage of the second power domain to generate the threshold voltage.

19. The method of claim 17, wherein the supply voltage is a supply voltage of the first power domain or a supply voltage of a third power domain.

20. The method of claim 13, wherein detecting the impending power failure comprises:

Comparing a voltage on the power distribution network to a threshold voltage; and

Detecting the impending power failure if the voltage is below the threshold voltage;

wherein the power distribution network supplies power from a primary power source to the second power domain.

21. the method of claim 20, wherein a backup power source is coupled to the power distribution network, the backup power source is configured to provide power to the second domain for a period of time after the loss of the primary power source, and a voltage on the power distribution network is upstream of the backup power source.

22. The method of claim 21, wherein the backup power source comprises a storage capacitor.

23. The method of claim 16, further comprising: latching a logic state on the signal line, wherein clamping the portion of the signal in the second power supply domain comprises: clamping the portion of the signal line in the second power domain to the latched logic state.

24. The method of claim 16, further comprising: in response to detecting the impending power failure, storing a current logic state of the second circuit in a non-volatile memory.

25. the method of claim 16, further comprising: storing safety information in the non-volatile memory in response to detection of the impending power failure.

26. An apparatus for power failure mitigation on a chip, the chip comprising a first circuit in a first power domain, a second circuit in a second power domain, and a signal line providing communication between the first circuit and the second circuit and passing between the first power domain and the second power domain, wherein the apparatus comprises:

Means for detecting an impending power failure of at least one of the first power domain or the second power domain; and

Means for clamping a portion of the signal line in the second power domain to a logic state in response to detection of the impending power failure.

27. The device of claim 26, wherein the means for detecting the impending power failure comprises:

Means for comparing the supply voltage to a threshold voltage; and

Means for detecting the impending power failure when the power supply voltage is below the threshold voltage.

28. The apparatus of claim 27, wherein the supply voltage is a supply voltage of the first power domain or a supply voltage of a third power domain.

Technical Field

Aspects of the present disclosure relate generally to detecting power failures and, more particularly, to detecting impending power failures on a chip.

Background

A chip may include multiple power domains, where each power domain may be powered by a separate power rail. Power domains allow circuits in different power domains to be powered with different power supply voltages. The power domains may be independently power collapsed such that when one power domain is collapsed by power, another power domain may be powered.

Disclosure of Invention

The following presents a simplified summary of one or more embodiments in order to provide a basic understanding of such embodiments. This summary is not an extensive overview of all contemplated embodiments, and is intended to neither identify key or critical elements of all embodiments nor delineate the scope of any or all embodiments. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to the more detailed description that is presented later.

A first aspect relates to a chip. The chip includes an isolation device, wherein the isolation device is configured to: when the isolation device is disabled, allowing a signal to pass from a first circuit in the first power domain to a second circuit in the second power domain via a signal line passing between the first power domain and the second power domain, and when the isolation device is enabled, clamping a portion of the signal line in the second power domain to a logic state. The chip further includes a fault detector configured to: an impending power failure of at least one of the first power domain or the second power domain is detected and the isolation device is enabled in response to the detection of the impending power failure.

A second aspect relates to a method for on-chip power failure mitigation. The chip includes a first circuit in a first power domain, a second circuit in a second power domain, and a signal line providing communication between the first circuit and the second circuit and passing between the first power domain and the second power domain. The method comprises the following steps: detecting an impending power failure of at least one of the first power domain or the second power domain; and clamping a portion of the signal lines in the second power domain to a logic state in response to detection of an impending power failure.

A third aspect relates to an apparatus for on-chip power failure mitigation. The chip includes a first circuit in a first power domain, a second circuit in a second power domain, and a signal line providing communication between the first circuit and the second circuit and passing between the first power domain and the second power domain. The apparatus includes means for detecting an impending power failure of at least one of the first power domain or the second power domain, and means for clamping a portion of a signal line in the second power domain to a logic state in response to the detection of the impending power failure.

To the accomplishment of the foregoing and related ends, the one or more embodiments comprise the features hereinafter fully described and particularly pointed out in the claims. The following description and the annexed drawings set forth in detail certain illustrative aspects of the one or more embodiments. These aspects are indicative, however, of but a few of the various ways in which the principles of various embodiments may be employed and the described embodiments are intended to include all such aspects and their equivalents.

Drawings

Fig. 1A illustrates an example of a chip and a backup power supply in accordance with certain aspects of the present disclosure, where the chip includes a plurality of power domains and the backup power supply is configured to provide the backup power supply in the event of a power outage of a primary power supply.

Fig. 1B illustrates an example in which a backup power supply is implemented with a storage capacitor, according to certain aspects of the present disclosure.

Fig. 2 illustrates an example of an isolation device, circuit, and non-volatile memory, where the isolation device is used to isolate a circuit in one power domain from another power domain, in accordance with certain aspects of the present disclosure.

Fig. 3 shows an example of a fault detector for detecting an impending power failure of a power domain.

Fig. 4 illustrates an exemplary implementation of a fault detector including a voltage comparator according to certain aspects of the present disclosure.

Fig. 5 illustrates an example of a voltage scaler for scaling down a supply voltage to generate a threshold voltage for a voltage comparator, in accordance with certain aspects of the present disclosure.

Fig. 6 illustrates another exemplary implementation of a fault detector in accordance with certain aspects of the present disclosure.

Fig. 7 illustrates an example of an emergency trigger device for triggering an emergency operation in response to detection of an impending power collapse in accordance with certain aspects of the present disclosure.

Fig. 8 illustrates an example of a circuit configured to store security information in a non-volatile memory in response to detection of an impending power collapse in accordance with certain aspects of the present disclosure.

Fig. 9 illustrates another exemplary implementation of a fault detector in accordance with certain aspects of the present disclosure, wherein the fault detector monitors the voltage upstream of the storage capacitor.

Fig. 10 illustrates the example fault detector of fig. 9 further including a voltage sealer to generate a threshold voltage in accordance with certain aspects of the present disclosure.

Fig. 11 illustrates an exemplary implementation of an isolation device according to certain aspects of the present disclosure.

Fig. 12 illustrates an exemplary implementation of a keeper clamp device in accordance with certain aspects of the present disclosure.

Fig. 13A illustrates an exemplary implementation of a clamp device fixed to 1, where switches in the clamp device allow signals to pass through the clamp device when the clamp device is disabled, according to certain aspects of the present disclosure.

Fig. 13B illustrates a clamp device fixed at 1, wherein a switch in the clamp device clamps a portion of a signal line to a logic "1" when the clamp device is enabled, in accordance with certain aspects of the present disclosure.

Fig. 14A illustrates an exemplary implementation of a clamp device fixed to 0, wherein switches in the clamp device allow signals to pass through the clamp device when the clamp device is disabled, according to certain aspects of the present disclosure.

fig. 14B illustrates a clamp device fixed to 0, wherein a switch in the clamp device clamps a portion of a signal line to a logic "0" when the clamp device is enabled, in accordance with certain aspects of the present disclosure.

Fig. 15 is a flow diagram illustrating a method for power failure mitigation in accordance with certain aspects of the present disclosure.

Detailed Description

The detailed description set forth below in connection with the appended drawings is intended as a description of various configurations and is not intended to represent the only configurations in which the concepts described herein may be practiced. The detailed description includes specific details for the purpose of providing a thorough understanding of the various concepts. It will be apparent, however, to one skilled in the art that these concepts may be practiced without these specific details. In some instances, well-known structures and components are shown in block diagram form in order to avoid obscuring such concepts.

A chip may include multiple power domains that are powered with respective power supply voltages. In this regard, fig. 1A illustrates an example of a chip 130 that includes multiple power domains. In the example shown in FIG. 1A, chip 130 includes three power domains (labeled "Power Domain A", "Power Domain B", and "Power Domain C"). However, it should be understood that chip 130 may include a different number of power domains. Power domain a includes a power rail 134 for supplying power to circuitry (not shown) in power domain a, power domain B includes a power rail 136 for supplying power to circuitry (not shown) in power domain B, and power domain C includes a power rail 138 for supplying power to circuitry (not shown) in power domain C. Although the power domains are shown in fig. 1A as having the same shape and size for simplicity, it should be understood that the power domains may have different shapes and sizes depending on the layout of the circuitry on chip 130, for example.

the power rails 134, 136 and 138 are coupled to a Power Management Integrated Circuit (PMIC)120, which PMIC 120 may be external to the chip or on the chip. The PMIC 120 includes a first voltage regulator 122, a second voltage regulator 124, a third voltage regulator 126, and a PMIC controller 128. The first voltage regulator 122 is configured to convert the voltage from the main power supply 110 to a supply voltage VddA for power domain a, the second voltage regulator 124 is configured to convert the voltage from the main power supply 110 to a supply voltage VddB for power domain B, and the third voltage regulator 126 is configured to convert the voltage from the main power supply 110 to a supply voltage VddC for power domain C. Each of the voltage regulators 122, 124, and 126 may be implemented with a switching regulator, a linear regulator (e.g., a low dropout regulator), or a combination of both. The primary power source 110 may include a battery (e.g., when the chip 130 is in a mobile device), and/or a power adapter that converts AC voltage from an AC power outlet to DC voltage that is input to the voltage regulators 122, 124, and 126.

The PMIC controller 128 may be configured to independently set the voltage levels of the supply voltages VddA, VddB, and VddC by varying one or more parameters of the respective voltage regulators 122, 124, and 126. For examples where the voltage regulator is implemented by a switching regulator, the PMIC controller 128 may regulate the respective supply voltages by adjusting a duty cycle of the switching regulator.

In the example shown in fig. 1A, backup power supply 140 is coupled to power rail 136 of power domain B. The backup power supply 140 is configured to: when PMIC 120 ceases to provide power to power domain B (e.g., due to an accidental removal of primary power source 110), power is provided to power domain B. In this manner, the supply voltage VddB of power domain B is maintained after power down at the PMIC 120. The backup power supply 140 may be external to the chip (as shown in the example in fig. 1A) or on-chip.

Backup power source 140 may be implemented using a rechargeable battery, a storage capacitor, or another type of energy storage device. For the example of a rechargeable battery, the PMIC 120 may charge the rechargeable battery when the PMIC 120 is turned on to store energy in the rechargeable battery. When power is lost at the PMIC 120 (e.g., due to accidental removal of the primary power source 110), the rechargeable battery powers power domain B.

Fig. 1B shows an example in which backup power supply 140 is implemented with a storage capacitor (labeled "Cs") coupled to power supply rail 136 of power domain B. When the PMIC 120 is open, the storage capacitor Cs stores charge from the PMIC 120. When the PMIC 120 stops supplying power to the power domain B (e.g., due to an accidental removal of the main power supply 110), the charge stored in the reservoir capacitor Cs continues to supply power to the power domain B for a short period of time. In this manner, the supply voltage VddB of power domain B is maintained for a short period of time after power down at the PMIC 120. The storage capacitor Cs may be external to the chip (as shown in the example in fig. 1B) or on-chip.

Chip 130 also includes a power manager 132 configured to manage power for chip 130. For example, the power manager 132 may collapse the power domain when circuitry in the power domain enters an idle state to save power. The power manager 132 may do this by sending a command to the PMIC controller 128 to turn off the corresponding voltage regulator. Alternatively, the power manager 132 may do this by opening a power switch (not shown) coupled between the respective voltage regulator and the respective power rail. In another example, the power manager 132 may dynamically scale the power domain's supply voltage based on performance requirements (e.g., processing requirements) of circuits (e.g., processors) in the power domain. In this example, the power manager 132 may determine a supply voltage for the power domain based on performance requirements of the circuit and send instructions to the PMIC controller 128 to set the supply voltage of the power domain to the determined supply voltage.

Fig. 2 shows an example in which power domain B includes circuitry 215, isolation device 220, and non-volatile memory 230. Power rail 136 (shown in fig. 1A) may provide power to circuitry 215, isolation device 220, and non-volatile memory 230 in power domain B. For ease of illustration, power rail 136 and backup power source 140 are not shown in fig. 2.

In operation, circuit 215 communicates with another circuit 210 located in power domain a through isolation device 220. For example, circuits 210 and 215 may exchange data and/or commands with each other via signal lines that pass between power domains a and B. If power domains a and B have different voltage levels, chip 130 may include a voltage level shifter (not shown) for converting a signal from the voltage level of one of the power domains to the voltage level of the other power domain. Circuitry 210 in power domain a may receive power from power rail 134 (shown in fig. 1A).

Isolation device 220 is configured to selectively isolate circuitry 215 in power domain B from power domain a based on an enable signal received from power manager 132 at an enable input (labeled "EN") of isolation device 220. When the enable signal is not asserted (e.g., the enable signal is a logic "0" or low), isolation device 220 is disabled and allows signals to pass between power domain a and power domain B via the signal lines. When the enable signal is asserted (e.g., the enable signal is a logic "1" or high), the isolation device 220 is enabled and isolates the circuit 215 from power domain a. Isolation device 220 may isolate circuit 215 from power domain a by clamping a portion 224 of a signal line in power domain B to a fixed logic state. In this manner, the logic state of portion 224 of the signal lines in power domain B may be fixed regardless of the logic state of portion 222 of the signal lines in power domain a.

The power manager 132 (shown in FIG. 1A) may handle the control of the isolation device 220. For example, when the power manager 132 is about to crash power domain a, the power manager 132 may enable the isolation device 220 via the enable input EN to isolate the circuit 215 from power domain a. This is done to prevent power domain a from corrupting circuitry 215 when power domain a is powered down.

The power manager 132 may also trigger the circuitry 215 to perform certain operations when the power manager 132 is about to crash power domain B. For example, the power manager 132 may instruct the circuit 215 to store the current logic state of the circuit 215 in the non-volatile memory 230 before the power domain B is powered down so that the current logic state of the circuit 215 may be restored later when the power to the circuit 215 is restored. In another example, the power manager 132 may instruct the circuitry 215 to store critical information (e.g., security information) in the non-volatile memory 230 prior to power domain B powering down. Although fig. 2 shows the non-volatile memory 230 as being located in power domain B, it should be understood that the non-volatile memory 230 may also be located in another power domain, or may be external to the chip 130.

As described above, when power domain A is about to crash, the power manager enables isolation device 220 to isolate circuitry 215 in power domain B from power domain A. This helps to ensure that power domain B is properly isolated when power domain a crashes. However, this approach works only if the power manager knows when a critical power event occurs, which is not always the case. For example, if a user accidentally removes the primary power source 110 (e.g., a battery), the power manager 132 may not be able to safely isolate the circuitry 215 in power domain B before power domain a powers down.

Furthermore, when the power manager 132 does not anticipate a power outage (e.g., due to an unexpected removal of the primary power source 110), the power manager 132 may not be able to properly trigger the circuit 215 to save the logic state and/or critical information of the circuit in the non-volatile memory 230 before the power domain B is powered down.

According to aspects of the present disclosure, a power failure detection mechanism is provided that may be used to protect a power domain from power outages of neighboring power domains and/or of itself, as discussed further below.

Fig. 3 shows an example in which power domain B further comprises a fault detector 310 according to an embodiment of the present disclosure. The fault detector 310 is configured to detect an impending power failure of power domain a and protect power domain B in response to detection of the impending power failure, as discussed further below.

In certain aspects, the fault detector 310 monitors the supply voltage VddA of power domain a. In these aspects, the fault detector 310 compares the monitored supply voltage VddA to a voltage threshold. The voltage threshold may be at or near the minimum supply voltage required for the circuits 210 in power domain a to function properly. When the monitored supply voltage VddA drops (falls) below the voltage threshold, the fault detector 310 enables the isolation device 220 to isolate the circuitry 215 in power domain B from power domain a. By isolating circuitry 215 from power domain A, fault detector 310 prevents power outages of power domain A from corrupting circuitry 215. As described above, isolation device 220 may isolate circuit 215 from power domain a by clamping portion 224 of the signal lines in power domain B to a fixed logic state. Fault detector 310 may receive power from power rail 136 (shown in fig. 1A).

In the example shown in fig. 3, power domain B also includes an or gate 315 that couples power manager 132 and fault detector 310 to an enable input EN of isolation device 220. Assuming that isolation device 220 is enabled when enable input EN is high (i.e., logic "1"), OR gate 315 allows power manager 132 or fault detector 310 to enable isolation device 220. This is because the output of or gate 315 (which is coupled to enable input EN) is high if the enable signal from power manager 132 or fault detector 310 is high, or the enable signals from both power manager 132 and fault detector 310 are high. Thus, in the event that the power manager 132 realizes that power domain A is about to be powered down, the power manager 132 is still able to enable the isolation device 220. In the event that the power manager 132 is unaware of an impending power outage (e.g., due to an unexpected power outage), the fault detector 310 may enable the isolation device 220.

Fig. 4 shows an exemplary implementation of the fault detector 310. In this example, fault detector 310 includes a voltage comparator 410 having a first input 412, a second input 414, and an output 416. The first input 412 may be coupled to the power rail 134 of power domain a (shown in fig. 1A) to monitor the supply voltage VddA of power domain a. The second input 414 receives a threshold voltage, which may be equal to or close to the minimum supply voltage required for the circuits 210 in power domain a to function properly, as described above. The output 416 of the voltage comparator 410 is coupled to the enable input EN of the isolation device 220 (e.g., via the or gate 315 or directly).

The voltage comparator 410 compares the supply voltage VddA with a threshold voltage and outputs a 1 or 0 to the enable input EN of the isolation device 220 based on the comparison. More specifically, if the power supply voltage VddA is higher than the threshold voltage, the voltage comparator 410 outputs 0. In this case, the fault detector 310 does not enable the isolation device 220. It should be appreciated that in this case, the power manager 132 may still enable the isolation device 220. If the supply voltage VddA is below the threshold voltage, the voltage comparator 410 outputs a 1. In this case, fault detector 310 enables isolation device 220 to isolate circuitry 215 in power domain B from power domain a.

Fig. 5 shows an example in which the fault detector 310 includes a voltage scaler 510 for generating a threshold voltage. In this example, the nominal (expected) voltage level of the supply voltage VddA of power domain a is lower than the nominal (expected) voltage level of the supply voltage VddB of power domain B. In operation, the voltage scaler 510 scales down the voltage level of the supply voltage VddB of the power domain B to generate the threshold voltage.

In the example shown in fig. 5, the voltage sealer 510 is implemented with a voltage divider including a first resistor R1 and a second resistor R2 coupled in series between the supply voltage VddB and ground. As shown in fig. 5, the threshold voltage is taken from the node 512 between the first resistor R1 and the second resistor R2. In this example, the threshold voltage is given by:

Where R1 and R2 in the equation are resistances of the first resistor R1 and the second resistor R2, respectively, and Vth is a threshold voltage. As can be seen from the equation, the threshold voltage can be set to a desired voltage level by setting the resistances of the first and second resistors R1 and R2 accordingly to generate the desired threshold voltage at the node 512.

it should be appreciated that the fault detector 310 is not limited to the above example, and may monitor another supply voltage that indicates an impending power collapse of power domain a. For example, a first input 412 of the voltage comparator 410 may be coupled to the power supply rail 138 of power domain C to monitor the supply voltage VddC of power domain C. In this example, the power supply voltage VddC of power domain C may decay faster and/or earlier than the power supply voltage of power domain a due to a power outage at the PMIC 120 (e.g., caused by an accidental removal of the primary power source 110). Thus, a drop in the supply voltage VddC of power domain C may indicate an impending power collapse of power domain a and may therefore be used to detect an impending power collapse of power domain a.

In this example, the voltage comparator 410 compares the supply voltage VddC with a threshold voltage and outputs a 1 or 0 to the enable input EN of the isolation device 220 based on the comparison. More specifically, if the power supply voltage VddC is higher than the threshold voltage, the voltage comparator 410 outputs 0. In this case, the fault detector 310 does not enable the isolation device 220. If the supply voltage VddC is lower than the threshold voltage, the voltage comparator 410 outputs 1. In this case, fault detector 310 enables isolation device 220 to isolate circuitry 215 in power domain B from power domain a. In this example, the threshold voltage may be generated by the voltage scaler 510 (shown in fig. 5), where the threshold voltage is a scaled down version of the supply voltage VddB. In fig. 4 and 5, the label "VddA or VddC" indicates that the first input 412 of the voltage comparator 410 may be coupled to VddA or VddC.

Fig. 6 shows an example in which the voltage comparator 410 has a third input 614 receiving a second threshold voltage. Note that the threshold voltages discussed above with reference to fig. 4 have been relabeled as "first threshold voltages" in fig. 6. The second threshold voltage may be slightly higher than the first threshold voltage. As discussed further below, the second threshold voltage is used to prevent glitches at the output 416 of the voltage comparator 410.

In this example, the voltage comparator 410 compares a supply voltage (e.g., VddA or VddC) to a first threshold voltage and outputs a 1 or 0 to the enable input EN of the isolation device 220 based on the comparison. More specifically, if the power supply voltage is higher than the first threshold voltage, the voltage comparator 410 outputs 0. When the supply voltage drops below the first threshold voltage, voltage comparator 410 outputs a 1, in which case voltage comparator 410 enables isolation device 220.

Once the supply voltage drops below the first threshold voltage, the voltage comparator 410 compares the supply voltage to a second threshold voltage. If the supply voltage is below the second threshold voltage, voltage comparator 410 outputs a 1 (keeping isolation device 220 enabled). If the supply voltage rises above the second threshold voltage, the voltage comparator 410 outputs a 0, in which case the isolation device 220 is disabled. As described above, after the isolation device 220 is disabled, the voltage comparator 410 returns to compare the supply voltage to the first threshold voltage. This prevents glitches at the output 416 of the voltage comparator 410 (e.g., prevents the output 416 from flipping between 0 and 1) when the voltage at the first input 412 crosses the first threshold voltage multiple times due to small fluctuations in voltage (e.g., caused by noise). In this regard, the second threshold voltage may be set to a voltage level sufficient to prevent unwanted glitches.

As described above, in the event of a power loss at the PMIC 120 (e.g., due to an accidental removal of the primary power source 110), the backup power source 140 coupled to the power rail 136 of power domain B continues to power domain B for a short period of time. As a result, the backup power supply 140 allows the circuitry 215 in power domain B to continue to operate after power domain a crashes due to a power outage at the PMIC 120. Thus, by isolating the circuit 215 from power domain a in the event of a power loss at the PMIC 120, the fault detector 310 allows the circuit 215 in power domain B to operate after power domain a has crashed without being damaged by the power collapse of power domain a.

In certain aspects, the circuitry 215 may perform emergency operations when the fault detector 310 detects an impending power collapse of power domain a. The emergency operation may be an operation that may be performed by the circuit 215 within a short period of time that the power domain B can be powered after a power down of the backup power supply at the PMIC 120 (e.g., due to an accidental removal of the primary power supply 110).

In this regard, fig. 7 shows an example in which the chip further includes an emergency triggering device 710. The emergency triggering device 710 is configured to trigger the circuit 215 to perform an emergency operation when the failure detector 310 detects an impending failure of power domain a. For example, emergency triggering device 710 may be coupled to the same output of fault detector 310 as isolation device 220. For an example in which fault detector 310 outputs a logic "1" to enable isolation device 220, emergency triggering device 710 may trigger (or initiate) an emergency operation when the output of fault detector 310 is high (i.e., a logic "1"). Trigger device 710 may receive power from power rail 136 (shown in fig. 1A).

The emergency operation may include storing the current logic state of the circuit 215 in the non-volatile memory 230. This allows the current logic state to be loaded back into circuit 215 when power to power domain B is later restored to restore the current logic state in circuit 215. In another example, the emergency operation may include storing critical information (e.g., safety information) in non-volatile memory 230. Thus, when power domain B crashes, critical information is not lost. Although fig. 7 shows the non-volatile memory 230 located in power domain B, it should be understood that the non-volatile memory may be located in another power domain or external to the chip 130.

Fig. 8 shows an example in which the circuit 215 holds safety information that may be saved in the non-volatile memory 230 as part of the emergency operation described above. In this example, circuitry 210 in power domain a includes a secure processor 810 and circuitry 215 in power domain B includes a counter 815. The security processor 810 is configured to perform security operations to prevent an attacker (e.g., hacker and/or malicious program) from tampering with the data stored in the memory. The memory (not shown) may be a non-volatile memory external to the chip 130. As used herein, the term "data" may also include code (e.g., firmware code).

In operation, when the secure processor 810 updates data, the secure processor 810 increments the count value in the counter 815 by sending a command to the circuit 215 to increment the count value. The secure processor 810 then uses the count value to generate a key, and uses the key to apply a key hashing algorithm to at least a portion of the data to generate (compute) a cryptographic signature (also referred to as a digital signature). The secure processor 810 then stores the data and cryptographic signature in memory (e.g., off-chip non-volatile memory). In this example, the count value in the counter 815 may indicate the current version of the data stored in memory.

When the secure processor 810 reads back data from memory, the secure processor 810 also reads back the cryptographic signature from memory. The secure processor 810 then uses the current count value in the counter 815 to generate a key, and uses the key to apply a key hashing algorithm to at least a portion of the read data to regenerate (recalculate) the cryptographic signature. The secure processor 810 then compares the read cryptographic signature with the regenerated cryptographic signature. If the signatures match, the security processor 810 determines that the read data is valid (e.g., has not been modified by an attacker). If the signatures do not match, the security processor 810 determines that the read data is invalid and prevents the data from being used (e.g., executed).

The security process described above prevents rollback attacks in which an attacker stores older versions of data and cryptographic signatures in memory. This is because the key used to generate the cryptographic signature for the older version of data is generated based on the older count value. As a result, when the secure processor generates a key using the current count value and regenerates (recalculates) the cryptographic signature using the key based on the current count value, the read cryptographic signature and the regenerated cryptographic signature will not match.

In order for the above-described security procedure to work, it is important that the current count value in the counter 815 be stored in the non-volatile memory 230 in the event of an accidental power outage (e.g., due to an accidental removal of the primary power source 110). This allows the current count value to be restored to the counter 815 when power is restored. In this regard, the emergency operation triggered by the emergency triggering device 710 may include the circuitry 215 storing the current count value in the counter 815 in the non-volatile memory 230.

In one example, the non-volatile memory 230 may include one-time programmable memory. The one-time programmable memory may include fuses, where each fuse is capable of storing one bit. In this example, the fuse may have a default bit value (e.g., 0), which may be changed to another bit value (e.g., 1) by blowing the fuse. Since the otp memory has a limited number of fuses, the circuit 215 can only store the count value in the otp memory in response to a trigger from the emergency device 710 to avoid exhausting the available space in the otp memory. During normal power down managed by the power manager 132, the circuit 215 may store the count value in another memory (e.g., a non-one-time programmable memory).

As described above, after the isolation device 220 is enabled, the fault detector 310 may disable the isolation device 220 (e.g., when the monitored supply voltage rises above the second threshold voltage). This may occur, for example, when a power outage at the PMIC 120 is temporary and power at the PMIC 120 is restored (e.g., when the main power supply 110 is restored). In one example, when power at the PMIC 120 is restored, the fault detector 310 may wait until the circuit 215 completes the emergency process before disabling the isolation device 220. For example, after the isolation device 220 is enabled and the emergency process is initiated, the fault detector 310 may require that the monitored supply voltage rise above the second threshold voltage and the emergency process be completed both before disabling the isolation device 220. For examples in which the emergency procedure includes writing safety information and/or status information in non-volatile memory 230 (e.g., by blowing a fuse in non-volatile memory 230), fault detector 310 may consider the emergency procedure to be completed at the end of the write operation. In this example, circuitry 215 may notify fault detector 310 at the end of the write operation.

As described above, the fault detector 310 detects an impending power collapse of the power domain a by monitoring the supply voltage VddA or the supply voltage VddC. In some aspects, an impending power collapse of power domain a may also be predictive of an impending power collapse of power domain B (e.g., due to accidental removal of primary power source 110). In these aspects, the collapse of power domain B may be delayed from the collapse of power domain a due to the backup power 140, which the backup power 140 may power up power domain B after a power down at the PMIC 120. This provides time for isolation device 220 to isolate circuitry 215 from power domain a and/or for circuitry 215 to perform emergency operations when fault detector 310 detects an impending power failure. Thus, the output of the fault detector 310 may also indicate an impending collapse of power domain B, which is delayed from the collapse of power domain a due to the backup power source 140, as described above.

In the discussion above, the detection of an impending crash of power domain a may provide sufficient time for isolation device 220 to isolate circuitry 215 in power domain B from power domain a to prevent the crash of power domain a from damaging circuitry 215. The detection of an impending crash of power domain B may provide sufficient time for circuitry 215 to complete an emergency operation prior to the crash of power domain B.

Fig. 9 illustrates an exemplary implementation of the fault detector 310, wherein the fault detector 310 is configured to detect an impending collapse of power domain B (e.g., due to a power outage at the PMIC 120). Figure 9 also shows a Power Distribution Network (PDN)910 that distributes power from the PMIC 120 to power domain B. PDN 910 includes interconnects from PMIC 120 to chip 130, metallization layers on chip 130 between the interconnects and power rail 136, and power rail 136. The interconnect may include parasitic inductance and resistance. Figure 9 also shows a reservoir capacitor Cs that powers the power domain B for a short period of time after a power down at the PMIC 120, as described above. Fig. 9 also shows a unidirectional device 915 configured to allow current flow in a direction from the PMIC 120 to the power rail 136 while preventing current flow in the opposite direction, as described below.

In this example, fault detector 310 includes a voltage comparator 410. The first input 412 of the voltage comparator 410 is coupled to the PDN 910 at a node 912 located upstream of the storage capacitor Cs. The node 912 is upstream of the reservoir capacitor Cs in the sense that the node 912 is located closer to the PMIC 120 on the PDN 910 than the reservoir capacitor Cs. A second input 412 of the voltage comparator 410 receives a threshold voltage. The output 416 of the voltage comparator 410 is coupled to the isolation device 220 and/or the emergency trigger device 710.

In this example, assume that with power down at PMIC 120, the voltage at node 912 decays faster and/or earlier than the supply voltage VddB at supply rail 136 of power domain B. This is because node 912 is located upstream of reservoir capacitor Cs, while power supply rail 136 of power domain B is located downstream of reservoir capacitor Cs, as shown in fig. 9. Thus, the voltage drop at node 912 may indicate an impending collapse of power domain B and may therefore be used to detect an impending collapse of power domain B.

The unidirectional device 915 blocks current flow from the storage capacitor Cs to the node 912 when a power down occurs at the PMIC 120. This prevents current from the storage capacitor Cs from leaking into the input 412 of the voltage comparator 410, which would prevent the voltage comparator 410 from detecting a power down. The unidirectional device 915 may be implemented using a diode, a switch, or another type of unidirectional device. For the diode example, the diode is coupled between node 912 and reservoir capacitor Cs and is oriented to allow current flow in a direction from PMIC 120 to power rail 136 and to prevent current flow in the opposite direction. For the example of a switch, the unidirectional device 915 may include a switch and a controller, where the switch is coupled between the node 912 and the storage capacitor Cs. In this example, the controller turns the switch on (closed) when the PMIC 120 is powered on and turns the switch off (open) when there is a power outage at the PMIC 120. The controller may detect a power outage by: the voltage at the PMIC 120 is monitored and a power down is detected when the monitored voltage drops below a certain voltage level.

in operation, voltage comparator 410 compares the voltage at node 912 to a threshold voltage and outputs a 1 or 0 based on the comparison. More specifically, if the voltage is higher than the threshold voltage, the voltage comparator 410 outputs 0. In this case, the fault detector 310 does not enable the isolation device 220 and/or the emergency triggering device 710. If the voltage is below the threshold voltage, voltage comparator 410 outputs a 1. In this case, the fault detector 310 enables the isolation device 220 and/or the emergency triggering device 710.

Fig. 10 shows an example in which the fault detector 310 includes a voltage sealer 1016 for generating the threshold voltage shown in fig. 9. In this example, the voltage sealer 1016 is coupled to the supply voltage VddB at a node 1014 on the supply rail 136, the node 1014 being located downstream of the reservoir capacitor Cs. The voltage scaler 1016 scales the supply voltage VddB to generate a threshold voltage that is input to the second input 414 of the voltage comparator. The voltage sealer 1016 may be implemented using the exemplary voltage sealer 510 shown in fig. 5, where the threshold voltage is given by equation (1).

It should be understood that the voltage comparator 410 shown in fig. 9 and 10 may be implemented using the voltage comparator 410 shown in fig. 6, wherein the voltage comparator 410 also receives a second threshold voltage. As described above, in this implementation, once the voltage drops below the first threshold voltage, the voltage comparator 410 compares the voltage at the first input 412 to the second threshold voltage to prevent glitches at the output 416.

fig. 11 illustrates an example implementation of an isolation device 220 in accordance with certain aspects of the present disclosure. In this example, isolation device 220 includes a plurality of clamping devices 1110-1 through 1110-6, where each clamping device corresponds to a respective signal line passing between power domain a and power domain B. Each clamping device is configured to pass a signal on a respective signal line when an enable signal is not asserted (e.g., the enable signal is a logic "0" or low). Each clamping device is configured to clamp a portion 224 of a respective signal line in power domain B to a fixed logic state when an enable signal is asserted (e.g., the enable signal is a logic "1" or high). Each clamp device may be one of three types of clamp devices as discussed further below.

The first type of clamping device is a keeper clamping device. When the enable signal is not asserted (e.g., the enable signal is a logic "0" or low), the keeper clamp device passes a signal on the corresponding signal line. When the enable signal is asserted, the keeper clamp device latches the logic state on the corresponding signal line and fixes the portion 224 of the corresponding signal line in power domain B to the latched logic state. For example, the keeper clamp device may latch the logic state when the enable signal transitions from 0 to 1 (i.e., on a rising edge of the enable signal).

Fig. 12 illustrates an exemplary implementation of a keeper clamp device 1210 in accordance with certain aspects of the present disclosure. In this example, the keeper clamp device 1210 includes a multiplexer 1225 and a latch 1230. A multiplexer 1225 has a first input 1214 coupled to the input 1212 of the keeper clamp device 1210, a second input 1216 coupled to the latch 1230, and an output 1218 coupled to the output 1220 of the keeper clamp device 1210. Latch 1230 is coupled between an input 1212 of holder clamp device 1210 and a second input 1216 of multiplexer 1225. The input 1212 of the keeper clamp device 1210 is coupled to the portion 222 of the corresponding signal line in power domain a, and the output 1220 of the keeper clamp device 1210 is coupled to the portion 224 of the corresponding signal line in power domain B.

Multiplexer 1225 is configured to selectively couple either first input 1214 or second input 1216 of multiplexer 1225 to output 1220 of keeper clamp device 1210 under control of an enable signal. More specifically, the multiplexer 1225 is configured to couple the first input 1214 to the output 1220 of the keeper clamp device 1210 when the enable signal is not asserted (e.g., the enable signal is a logic "0" or low), and to couple the second input 1214 to the output 1220 of the keeper clamp device 1210 when the enable signal is asserted (e.g., the enable signal is a logic "1" or high). The latch 1230 is configured to latch the logic state at the input 1212 of the keeper clamp device when the enable signal is asserted, and to output the latched logic state to the second input 1216 of the multiplexer 1225. For example, the latch may latch the logic state when the enable signal transitions from 0 to 1 (i.e., on a rising edge of the enable signal).

In operation, when the enable signal is not asserted (e.g., the enable signal is a logic "0" or low), the multiplexers 1225 couple the portions 222 of the respective signal lines in power domain A to the portions 224 of the respective signal lines in power domain B. This allows signals to pass from power domain a to power domain B via the respective signal lines. When the enable signal is asserted, the latch 1230 latches the logic state on the corresponding signal line, and the multiplexer 1225 outputs the latched logic state on the portion 224 of the corresponding signal line in power domain B. Thus, the keeper clamp device 1210 fixes the portion 224 of the corresponding signal line in power domain B to the latched logic state.

The second type of clamp device is a fixed-1 clamp device. When the enable signal is not asserted (e.g., the enable signal is a logic "0" or low), the clamped device fixed to 1 passes the signal on the corresponding signal line. When the enable signal is asserted (e.g., the enable signal is a logic "1" or high), the fixed-to-1 clamping device fixes the portion 224 of the corresponding signal line in power domain B to a logic "1" (high logic state).

Fig. 13A illustrates an exemplary implementation of a fixed-to-1 clamping device 1310 according to certain aspects of the present disclosure. In this example, clamp device 1310 fixed to 1 includes a first switching device 1316, a second switching device 1318, and a driver 1320. The first switching device 1316 is located between the input 1312 and the output 1314 of the clamping device 1310, and the second switching device 1318 is located between the output 1314 of the clamping device 1310 and the supply voltage VddB. Driver 1320 is configured to receive an enable signal and control the on/off state of switches 1316 and 1318 based on the received enable signal, as discussed further below. The input 1312 of the clamping device 1310 is coupled to the portion 222 of the corresponding signal line in power domain a, and the output 1314 of the clamping device 1310 is coupled to the portion 224 of the corresponding signal line in power domain B.

In operation, when the enable signal is not asserted (e.g., the enable signal is a logic "0" or low), the driver 1320 turns on (closes) the first switching device 1316 and turns off (opens) the second switching device 1318. This allows signals on the corresponding signal line to pass from power domain a to power domain B through first switching device 1316. Fig. 13A shows an example in which the first switching device 1316 is closed and the second switching device 1318 is open.

When the enable signal is asserted (e.g., the enable signal is a logic "1" or high), the driver 1320 turns off (opens) the first switching device 1316 and turns on (closes) the second switching device 1318. This fixes the portion 224 of the corresponding signal line in power domain B to a logic "1". Fig. 13B shows an example in which the first switching device 1316 is open and the second switching device 1318 is closed.

It should be understood that the switching device may be directly driven by the enable signal, in which case driver 1320 may be omitted.

The third type of clamp device is a clamp device fixed to 0. When the enable signal is not asserted (e.g., the enable signal is a logic "0" or low), the clamped device fixed to 0 passes the signal on the corresponding signal line. When the enable signal is asserted (e.g., the enable signal is a logic "1" or high), the fixed-to-1 clamping device fixes the portion 224 of the corresponding signal line in power domain B to a logic "0" (low logic state).

Fig. 14A illustrates an exemplary implementation of a fixed-0 clamp device 1410 according to certain aspects of the present disclosure. In this example, the clamping device 1410 fixed to 0 includes a first switching device 1416, a second switching device 1418, and a driver 1420. A first switching device 1416 is located between the input 1412 and the output 1414 of the clamping device 1410, and a second switching device 1418 is located between the output 1414 of the clamping device 1410 and ground. The driver 1420 is configured to receive an enable signal and control the on/off state of the switches 1416 and 1418 based on the received enable signal, as discussed further below. The input 1412 of the clamping device 1410 is coupled to the portion 222 of the corresponding signal line in power domain a, and the output 1414 of the clamping device 1410 is coupled to the portion 224 of the corresponding signal line in power domain B.

In operation, when the enable signal is not asserted (e.g., the enable signal is a logic "0" or low), the driver 1420 turns on (closes) the first switching device 1416 and turns off (opens) the second switching device 1418. This allows the signal on the corresponding signal line to pass from power domain a to power domain B through first switching device 1416. Fig. 14A shows an example in which the first switching device 1416 is closed and the second switching device 1418 is open.

When the enable signal is asserted (e.g., the enable signal is a logic "1" or high), the driver 1420 turns off (opens) the first switching device 1416 and turns on (closes) the second switching device 1318. This fixes the portion 224 of the corresponding signal line in power domain B to a logic "0". Fig. 14B shows an example in which the first switching device 1416 is open and the second switching device 1418 is closed.

It should be understood that the switching device may be directly driven by the enable signal, in which case the driver 1420 may be omitted.

The clamp devices 1110-1 to 1110-6 in the isolation device 220 may all be of the same type. Alternatively, clamp devices 1110-1 through 1110-6 may be a mix of different types. For example, one of the clamp devices 1110-1 to 1110-6 may be a keeper clamp device, while another one of the clamp devices 1110-1 to 1110-6 may be a fixed-1 clamp device or a fixed-0 clamp device.

Fig. 15 illustrates a flow chart showing a method 1500 for on-chip power failure mitigation in accordance with certain aspects of the present disclosure. The chip includes a first circuit (e.g., circuit 210) in a first power domain (e.g., power domain a), a second circuit (e.g., circuit 215) in a second power domain (e.g., power domain B), and signal lines that provide communication between and pass between the first and second circuits.

At step 1510, an impending power failure of at least one of the first power domain or the second power domain is detected. For example, an impending power failure may be detected by: the power supply voltage of the first power domain (e.g., power domain a) or the third power domain (e.g., power domain C) is compared to a threshold voltage and an impending power failure is detected if the power supply voltage is below the threshold voltage.

At step 1520, in response to the detection of the impending power failure, a portion of the signal lines in the second power domain are clamped to a logic state. For example, a portion of the signal line in the second power domain may be clamped to 1 or 0. In another example, the logic state of the signal line may be latched and a portion of the signal line in the second power domain may be clamped to the latched logic state.

In the above example, fault detector 310 may detect an impending power collapse by comparing the monitored voltage to a voltage threshold using a voltage comparator. However, it should be understood that the present disclosure is not limited to these examples. For example, the fault detector 310 may detect an impending power collapse by detecting symptoms of a voltage drop. For example, a drop in the supply voltage VddA of power domain a may result in an increase in the error rate of signals from circuitry 210 in power domain a. In this example, fault detector 310 may monitor the error rate of signals from circuitry 210 in power domain a and detect an impending power collapse of power domain a when the error rate rises above an error threshold. Thus, fault detector 310 may indirectly detect a voltage drop by detecting a symptom of the voltage drop.

In the above example, fault detector 310 outputs a 1 to enable isolation device 220 and/or emergency trigger device 710 and a 0 to disable isolation device 220 and/or emergency trigger device 710. It should be understood that the logic may be reversed, with fault detector 310 outputting a 0 to enable isolation device 220 and/or emergency trigger device 710 and outputting a 1 to disable isolation device 220 and/or emergency trigger device 710. In this case, the keeper clamp device may latch the logic state on the corresponding signal line when the enable signal transitions from a 1 to a 0.

It should be understood that the enable signal may be a multi-bit signal. For example, when the enable signal is asserted, the enable signal may also specify which of the clamping devices in the isolation devices 220 are to be enabled (bonded).

It is to be understood that this disclosure is not limited to the terminology used above to describe the disclosure. For example, a power domain may also be referred to as a power island, a voltage domain, and the like.

In this disclosure, the word "exemplary" is used to mean "serving as an example, instance, or illustration. Any implementation or aspect described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other aspects of the disclosure. Likewise, the term "aspect" does not require that all aspects of the disclosure include the discussed feature, advantage or mode of operation. The term "coupled" is used herein to refer to a direct or indirect coupling between two components. The term "circuitry" is used broadly and is intended to cover hardware implementations of electrical devices and conductors that when connected and configured enable the functions described in this disclosure to be performed. The term "circuitry" is also intended to encompass a software implementation in which a processor performs the functions described herein by executing software, including code for performing the functions. The software may be stored on computer readable storage media such as RAM, ROM, EEPROM, optical and/or magnetic disks, and the like.

It should be understood that the present disclosure is not limited to the particular order or hierarchy of steps in the methods disclosed herein. It should be understood that the specific order or hierarchy of steps in the methods may be rearranged based on design preferences. The accompanying method claims present elements of the various steps in a sample order, and are not meant to be limited to the specific order or hierarchy presented unless specifically recited therein.

The fault detectors discussed above may be implemented with a general purpose processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other programmable logic device, discrete hardware components (e.g., logic gates), or any combination thereof designed to perform the functions described herein. The processor may perform the functions described herein by executing software including code for performing the functions. The software may be stored on computer readable storage media such as RAM, ROM, EEPROM, optical and/or magnetic disks, and the like.

The previous description of the disclosure is provided to enable any person skilled in the art to make or use the disclosure. Various modifications to the disclosure will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other variations without departing from the spirit or scope of the disclosure. Thus, the present disclosure is not intended to be limited to the examples described herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.