EP4616316A1

EP4616316A1 - Protection of integrated circuit devices

Info

Publication number: EP4616316A1
Application number: EP23806196.4A
Authority: EP
Inventors: Frode Pedersen
Original assignee: Nordic Semiconductor ASA
Current assignee: Nordic Semiconductor ASA
Priority date: 2022-11-11
Filing date: 2023-11-10
Publication date: 2025-09-17
Also published as: CN120188161A; GB202216894D0; WO2024100291A1

Abstract

An integrated circuit comprises an oscillator arranged to output a periodic clock signal, a logic circuit portion, and a detection circuit portion for detecting a low logic speed relative to a clock signal frequency. The detection circuit portion comprises a latch circuit portion that outputs a first signal that changes state once per clock cycle, a delay circuit portion arranged to receive said first signal and output a second signal subject to a propagation delay, and a comparison circuit portion arranged to compare the first signal and the second signal and output an error signal if the signals are indicative of low logic speed relative to the clock signal frequency. The delay circuit portion comprises a replica delay path that includes a plurality of logic elements, each of said logic elements being type-matched to a respective logic element included in a critical path of the logic circuit portion.

Description

Protection of integrated circuit devices

BACKGROUND

This invention relates to integrated circuits (ICs) and more particularly to the provision of measures which may help protect against unauthorised access to certain parts of such devices.

As ICs have become more complex and powerful, an increasing amount of attention has been paid to the risks posed by unauthorised access to certain parts - e.g. those which contain sensitive data or software or which can be used to exercise unauthorised control of a device incorporating the IC. Manufacturers therefore now routinely employ measures to discourage or prevent such access by hackers.

In recent years, hackers have started employing a type of physical attack on integrated circuits known as a glitch attack. A glitch attack involves forcing an integrated circuit to operate at a low logic speed relative to its internal clock frequency, either by applying a short duration pulse in order to rapidly drop supply voltage or by increasing the clock frequency. In doing this, it becomes possible that logic signals will not reach an intended destination within an integrated circuit before a clock cycle is completed, thus allowing branches of code to be skipped - e.g. skipping part of an ‘if’ block to jump to an outcome.

The Applicant has recognised that glitch attacks pose a security threat to integrated circuits, and thus defence measures are desirable. Known defence designs utilise analogue devices to monitor the supply voltage directly in order to detect drops in supply voltage indicative of glitch attacks, or to monitor temperature in order to detect illegal temperature conditions indicative of glitch attacks. Alternatively, other known defence designs utilise analogue devices to monitor the clock frequency directly in order to detect frequency spikes indicative of glitch attacks. The Applicant has recognised some shortcomings with known, analogue defence designs, namely that in order to detect very short duration low voltage pulses, like those used in glitch attacks, they require a lot of power. Additionally, traditional designs can be expensive to produce and need to be tailored specifically to the integrated circuits they are designed to protect.

The present invention aims to at least partly address the issues set out above.

SUMMARY OF THE INVENTION

When viewed from a first aspect, the present invention provides an integrated circuit comprising: an oscillator arranged to output a periodic clock signal; a logic circuit portion; and a detection circuit portion for detecting a low logic speed relative to a clock signal frequency, the detection circuit portion comprising: a latch circuit portion arranged to output a first signal that changes state once per clock cycle of said periodic clock signal; a delay circuit portion arranged to receive said first signal and output a second signal subject to a propagation delay; and a comparison circuit portion arranged to compare the first signal and the second signal and output an error signal if the signals are indicative of low logic speed relative to the clock signal frequency; wherein: the delay circuit portion comprises a replica circuit portion that comprises a replica delay path that comprises a plurality of logic elements, each of said logic elements being type-matched to a respective logic element included in a critical path of the logic circuit portion.

Thus it will be seen by those skilled in the art that as the signal output by the latch circuit portion changes state once per clock signal, the present invention provides the ability to compare the overall propagation delay introduced by the delay circuit portion to the period of the clock signal. If the first and second signals are in the same state at the inputs of the comparison circuit portion, this means that sufficient time has passed since the most recent state switch of the first signal for the first signal to propagate through the delay circuit portion and then arrive (in the form of the second, delayed signal) at the comparison circuit portion before the state changes again. If the first and second signals are in different states at the inputs of the comparison circuit portion, this means that not enough time has passed since the most recent state switch of the first signal for the first signal to propagate through the delay circuit portion and then arrive (in the form of the second, delayed signal) at the comparison circuit portion.

Under normal operating conditions, the overall propagation delay introduced by the delay circuit portion is smaller than the period of the clock signal, and thus the comparison circuit portion does not output an error signal. When a glitch attack occurs, however, the overall propagation delay introduced by the delay circuit portion may increase, or the period of the clock signal may decrease, such that this is no longer the case, and thus the comparison circuit portion outputs an error signal to indicate this. This can arise for one of two reasons, namely that the supply voltage has decreased or the clock frequency has increased, both of which are methods used in glitch attacks. Low supply voltage diminishes the ability for logic elements in a circuit to draw power in order to drive an input voltage to a desired output voltage, thus lowering logic speed. In accordance with the invention, the lower logic speed affects the overall propagation delay introduced by the delay circuit portion, thus potentially triggering the error signal.

Thus it will be understood by those skilled in the art that the present invention provides a circuit portion which may detect glitch attacks, or simply low logic speed relative to clock signal frequency. Advantageously, the circuit portion may be able to detect even short glitch attacks - e.g. those lasting only a single clock cycle. The integrated circuit (IC) may be able to detect the presence of a glitch attack before problems occur in the logic circuitry of the rest of the IC, and respond appropriately. The IC may, for example, cease or pause operation in response to the error signal as output by the detection circuit portion in order to protect from a glitch attack. The IC could also, by way of example, respond to the error signal by lowering the clock frequency (should that functionality be available) in order to allow more time for signals to propagate through logic circuitry between clock cycles.

Preferably the delay circuit portion is arranged to introduce an overall propagation delay under normal operating conditions that is greater than an inherent propagation delay introduced by the critical path under normal operating conditions. In doing so, the present invention may provide the ability to protect the logic circuit portion from a glitch attack by detecting a low logic speed relative to clock frequency and outputting an error signal before the logic circuit portion is affected.

In a set of embodiments, the delay circuit portion is arranged to introduce an overall propagation delay that is equal to the inherent propagation delay introduced by the critical path plus an error margin, e.g. 1%, 5%, 10%, 20%, etc., under normal operating conditions. If the propagation delay introduced by the delay circuit portion is arranged to be overly large compared to the inherent delay of the critical path, then there may be a possibility of false detection where the detection circuit portion outputs e.g. an error signal when there is no risk of the critical path being affected by a low logic speed relative to clock frequency. Thus, by ensuring that the propagation delay is greater than, but close to, the inherent delay of the critical path in this manner, the present invention may help reduce the probability of false detections.

It has been proposed to introduce a propagation delay to a signal by feeding the signal through a plurality of standard logic elements (e.g. inverters) that together introduce a propagation delay that is close to, but greater than, the inherent propagation delay of the critical path. However, the Applicant has appreciated that the propagation delay introduced by a given logic element is highly sensitive to the threshold voltages of transistors included therein, particularly at low supply voltages. The Applicant has therefore recognised that such solutions may therefore not accurately track the inherent propagation delay of the critical path across all supply voltages, as the standard logic elements may exhibit differing scaling characteristics with voltage compared to the logic elements included in the critical path. Thus, by including a replica delay path in accordance with the invention including logic elements that are type-matched to logic elements included in the critical path, the propagation delay introduced by the delay circuit portion advantageously closely tracks the inherent propagation delay of the critical path as supply voltage varies, particularly at low supply voltages.

In a set of embodiments, the integrated circuit is configured to vary a supply voltage provided to the logic circuit portion, and to the detection circuit portion, in dependence on operations being performed by the logic circuit portion. The IC may be configured to provide the same supply voltage to both the logic circuit portion and the detection circuit portion. In particular, the integrated circuit may be configured to provide a lower supply voltage when the logic circuit portion is performing operations with lower processing requirements, and provide a higher supply voltage when it is performing operations with higher processing requirements. This also is referred to herein as voltage-scaled operation. Such configuration may advantageously reduce overall energy consumption. The integrated circuit may be configured for voltage-scaled operation. The integrated circuit is therefore preferably configured to vary the supply voltage within a permissible range of operating voltages.

The provision of the replica circuit portion in accordance with the present invention may be particularly advantageous in such embodiments, as it may ensure that the overall propagation delay introduced by the delay circuit portion closely tracks the inherent delay introduced by the critical path across all permissible supply voltages in such a voltage-scaled system. In a set of embodiments, the overall propagation delay introduced by the delay circuit portion is arranged to be equal to the inherent propagation delay introduced by the critical path plus an error margin, e.g. 1%, 5%, 10%, 20%, etc., across all permissible supply voltages.

As used herein, the term ‘type-matched’ is used to describe one logic element being of the same type as another logic element (e.g. both NAND2, NOR3, etc. logic elements) or where one transistor is of the same type as another transistor (e.g. both PMOS, NMOS, etc.).

In a set of embodiments, each logic element included in the replica delay path comprises one or more transistors, each of said transistors being type-matched to a respective transistor included in the corresponding respective logic element of the critical path.

In a set of embodiments, the logic circuit portion comprises a plurality of logic elements, wherein one or more of said logic elements has a different threshold voltage to one or more other of said logic elements. The term “cell” may also be used interchangeably with the term “logic element” herein. One or more of the logic elements may be from a different standard library to one or more other of the logic elements. One or more of the logic elements may comprise High Threshold Voltage (HVT) cells, one or more other of the logic elements may comprise Regular Threshold Voltage (RVT) cells, and one or more other of the logic elements may comprise Low Threshold Voltage (LVT) cells.

Each logic element of the logic circuit portion typically comprises one or more transistors. The transistors included in a given logic element are typically of the same type, and thus typically have the same threshold voltage. Thus the logic circuit portion may comprise a plurality of transistors, wherein one or more of said transistors has a different threshold voltage to one or more other of said transistors. One or more of the transistors may be from a different standard library to one or more other of the logic elements. The critical path may comprise one or more logic elements or transistors with different threshold voltages to one or more other logic elements or transistors. Such a configuration may also be referred to herein as utilising multi-VT synthesis. Such multi-VT synthesis may advantageously provide a good balance between current leakage and logic speed, as higher threshold voltage cells may provide faster logic speed but with greater current leakage, whereas lower threshold voltage cells may provide slower logic speed but with lower current leakage. Thus, mixing cells with different threshold voltages may ensure overall logic speed is sufficiently high while keeping overall current leakage sufficiently small.

The voltage scaling characteristics of a logic element or transistor (i.e. how the propagation delay introduced by that logic element is affected by the supply voltage provided thereto) is highly dependent on its threshold voltage. This is particularly the case at low supply voltages. Thus, in a set of embodiments, each logic element included in the replica delay path has a nominal respective threshold voltage that is equal to a nominal threshold voltage of the corresponding respective logic element of the critical path. In a set of embodiments, each logic element included in the replica delay path comprises one or more transistors, each of said transistors having a nominal threshold voltage that is equal to a nominal threshold voltage of a respective transistor included in the corresponding respective logic element of the critical path. The term ‘nominal threshold voltage’ is used herein to refer to the intended threshold voltage of a respective logic element at manufacture. It will be appreciated by those skilled in the art, however, that due to manufacturing limitations the actual threshold voltage of a respective logic element may differ from its nominal threshold voltage by e.g. 1%, 5%, 10%, 20%, etc.

It will be seen that such embodiments may be particularly advantageous in applications that utilise multi-VT synthesis, as the propagation delay introduced by each logic element or transistor included in the replica circuit portion may closely track that of the corresponding respective logic element or transistor included in the critical path with the same respective nominal threshold voltage. This may be particularly advantageous in applications that utilize both voltage-scaled operation and multi-VT synthesis, particularly due to the increased dependency of propagation delay on threshold voltage at low supply voltages which are permissible in such voltage-scaled systems.

The replica delay path may comprise a greater number of logic elements than a number of logic elements included in the critical path, thus ensuring that the propagation delay of the replica delay path, and therefore the overall delay of the delay circuit portion, is greater than the inherent delay of the critical path as discussed above

However, in a set of embodiments, the replica delay path comprises fewer logic elements than a number of logic elements included in the critical path. Thus, in a set of embodiments, the replica delay path is arranged to introduce a propagation delay to the first signal that is truncated compared to an inherent propagation delay of the critical path. In such embodiments, the delay circuit portion may further comprise one or more further logic elements connected in series with the replica delay path, arranged such that the overall delay introduced by the delay circuit portion is greater than the inherent delay of the critical path. The further logic elements may comprise standard logic elements e.g. inverters.

In a set of embodiments, the delay circuit portion further comprises a tuning circuit portion comprising a plurality of delay elements, wherein each delay element can be employed or bypassed such that the tuning circuit portion provides a configurable propagation delay. Each delay element may comprise one or more standard logic elements or cells - e.g. inverters or NOT gates. The tuning circuit portion may be connected in series with the replica circuit portion, and therefore in series with the replica delay path. Thus, the overall propagation delay introduced by the delay circuit portion to the first signal may be equal to the sum of the propagation delay introduced by the replica circuit portion and the propagation delay introduced by the tuning circuit portion. The provision of the tuning circuit portion may be particularly advantageous where the delay introduced by the replica delay path is truncated as it may be used to ensure that the overall delay introduced by the delay circuit portion is greater than the inherent delay of the critical path.

Each of the delay elements included in the tuning circuit portion may introduce a unique propagation delay to a signal passing therethrough. In a set of embodiments for example, the propagation delay introduced by one of the delay elements is a unit delay, and the delays introduced by the other delay elements comprise increasing power of two multiples of the unit delay. This may enable the total delay introduced by the tuning circuit portion to be programmed to be any multiple of the unit delay up to a maximum where all the delay elements are employed. This could be achieved for example using a select register coupled with multiplexers, wherein each bit of the select register determines whether or not the corresponding delay element is bypassed or not. This allows a binary programmable delay proportional to the value of the select register.

This programmable delay of the tuning circuit portion may allow the overall propagation delay introduced by the delay circuit portion (i.e. the sum of the propagation delays introduced by the replica circuit portion and the tuning circuit portion) to be tuned to be close to, but greater than, the inherent propagation delay introduced by the critical path. The programmable delay of the tuning circuit portion may allow the overall propagation delay introduced by the delay circuit portion to be tuned to be close to, but greater than, the inherent propagation delay introduced by the critical path across all permissible supply voltages in embodiments where the integrated circuit is configured for voltage-scaled operation.

The propagation delay introduced by the tuning circuit portion may be configured by the integrated circuit (e.g. using a select register) in order to tune the overall propagation delay of the delay circuit portion to be close to, but greater than, the inherent propagation delay of the critical path. It may be configured statically e.g. at boot, or at manufacture. It may be configured dynamically e.g. in dependence on one or more operational conditions such as temperature or current supply voltage.

The inclusion of the tuning circuit portion and the programmable delay introduced thereby may be particularly advantageous as it may enable the use of the same tuning circuit portion design for different clock domains. It may also enable the use of the same delay circuit portion design for different logic circuits of the same design. This is because, due to manufacturing limitations, even logic elements/cells/transistors that are type-matched and have the same nominal threshold voltages can introduce different propagation delays e.g. because their actual threshold voltages may differ slightly from their nominal threshold voltages. Thus, if the replica delay path were to nominally replicate the critical path exactly (i.e. not be truncated), and no tuning circuit portion were to be provided, it would be random which of these would introduce the larger propagation delay due to these manufacturing limitations. Thus, the tuning circuit portion may advantageously enable the propagation delay introduced by the delay circuit portion to be reliably configured to a value close to, but greater than, the inherent delay of the critical path across circuits of similar designs, in spite of manufacturing tolerances.

In a set of embodiments, the integrated circuit comprises a plurality of clock domains and a detection circuit portion for each clock domain. Each clock domain may comprise a respective oscillator and a respective logic circuit portion. It will be appreciated therefore that different clock domains may have different clock frequencies and/or their logic circuit portions may have different critical paths, and that each clock domain may thus require a respective detection circuit portion tailored to it.

An input of the replica circuit portion may be coupled to an output of the latch circuit portion, an input of the tuning circuit portion may be coupled to an output of the replica circuit portion, and an output of the tuning circuit portion may be coupled to an input of the comparison circuit portion. In such embodiments, the replica circuit portion may be arranged to receive the first signal output by the latch circuit portion and output an intermediate signal to the tuning circuit portion which may then be arranged to output the second signal to the comparison circuit portion. Equally, an input of the tuning circuit portion may be coupled to an output of the latch circuit portion, an input of the replica circuit portion may be coupled to an output of the replica circuit portion, and an output of the replica circuit portion may be coupled to an input of the comparison circuit portion. In such embodiments, the tuning circuit portion may be arranged to receive the first signal output by the latch circuit portion and output an intermediate signal to the replica circuit portion which may then be arranged to output the second signal to the comparison circuit portion.

As mentioned previously, due to manufacturing limitations, it may not be possible to ensure that every logic element/transistor included in the replica delay path has the same actual threshold voltage as the corresponding respective logic element/transistor included in the critical path. As a result, it is possible that the propagation delay introduced by the replica delay path may be smaller than the intended delay thereof, distancing it further from the inherent delay of the critical path, particularly at low supply voltages. While this could be compensated for using a tuning circuit portion (where provided), e.g. by bypassing fewer of the delay elements included therein using one or more multiplexers and a select register, this may result in the overall propagation delay of the delay circuit portion being unnecessarily large at higher supply voltages where the threshold voltage differences between the first replica delay path and the critical path produce less pronounced voltage scaling differences. This may reduce energy efficiency at higher supply voltages as an unnecessarily large number of power-drawing delay elements may be employed in the tuning circuit portion at these higher supply voltages in order to compensate for the delay difference at lower supply voltages.

In a set of embodiments, the replica circuit portion further comprises a second replica delay path connected in parallel with the aforementioned (hereinafter ’’first”) replica delay path. In a set of embodiments, the second replica delay path comprises a plurality of logic elements, each of said logic elements being type- matched to a respective logic element included in the critical path, wherein: at least one of said logic elements has a nominal threshold voltage that is greater than a nominal threshold voltage of the corresponding respective logic element of the critical path; and/or each of said logic elements comprises one or more transistors, each of said transistors being type-matched to a respective transistor included in the corresponding respective logic element of the critical path, and at least one of the transistors included in the second replica delay path has a nominal threshold voltage that is greater than the corresponding respective transistor of the critical path.

Each logic element/transistor included in the second replica delay path may be type-matched to a respective logic element/transistor included in the first replica delay path. At least one of the logic elements/transistors included in the second replica delay path may have a nominal threshold voltage that is greater than a nominal threshold voltage of the corresponding respective logic element/transistor in the first replica delay path. The second replica delay path may include the same number of logic elements/transistors as the first replica delay path.

It will be seen that, in such embodiments, the second replica delay path features a higher proportion of higher threshold voltage logic elements and/or transistors than the first replica delay path. This may cause the delay introduced by the second replica delay path to increase by greater margins at lower supply voltages than the first replica delay path, and thus provide a safer delay margin over the inherent delay of the critical path at lower supply voltages. Thus, using the second replica delay path may improve energy efficiency at higher-supply voltages as fewer power-drawing delay elements within the tuning circuit portion may need to be employed in order to ensure the overall delay introduced by the delay circuit portion is greater than the inherent delay of the critical path across all permissible supply voltages, at a trade-off of decreased energy efficiency at lower supply voltages due to the higher proportion of higher threshold voltage logic elements and/or transistors in the second replica delay path compared to the first.

In other words, using the second replica delay path may increase the voltage margin required at lower supply voltages, and decrease the voltage margin required at higher supply voltages, relative to using the first replica delay path. As used herein, the term voltage margin is used to describe the difference between the lowest guaranteed safe operating voltage and the voltage at which the critical path fails. Since it is not possible for a user to know whether it is safe to run at a lower voltage than the lowest guaranteed safe operating voltage, the voltage margin is typically added to the voltage supply in order to ensure safe operation. Thus, the increased voltage margin required at lower supply voltages for the second replica delay path may decrease energy efficiency at lower supply voltages, and the decreased voltage margin required at higher supply voltages for the second replica path delay may increase energy efficiency at higher supply voltages, relative to the first replica delay path. This is why, in order to improve overall energy efficiency, the first replica delay path may be more desirable for use at lower supply voltages, and the second replica delay path may be more desirable for use at higher supply voltages.

Thus, in a set of embodiments, the integrated circuit is configured to select whether to use the first replica delay path or the second replica delay path in dependence on supply voltage. This selection may be made based on previous supply voltages, the current supply voltage, a predicted supply voltage for use in the immediate future, the operations being carried out by the logic circuit portion, etc. In particular, the integrated circuit may select the first replica delay path in order to optimise energy efficiency at higher supply voltages e.g. if supply voltage has been, or is predicted to be, higher. It may select the second replica delay path in order to optimise energy efficiency at lower supply voltages e.g. if supply voltage has been, or is predicted to be, lower. The integrated circuit may determine whether to use the first or second replica delay path on boot or start-up, or dynamically depending on a current supply voltage.

The general terms “higher supply voltage” and “lower supply voltage” are used throughout the present disclosure as it will be appreciated that their specific definitions or ranges will depend highly on the application - e.g. the permissible voltage operating ranges configured for use in an IC configured for voltage-scaled operation. For example, a “lower” supply voltage could be considered to be any supply voltage that is less than (or equal to) a median permissible supply voltage for a given IC, and a “higher” supply voltage could be considered to be any supply voltage that is greater than (or equal to) that median permissible supply voltage.

In a set of embodiments, a signal output by the replica circuit portion (which may be an intermediate signal or the second signal depending on configuration) comprises a selectable one of an output of the first replica delay path and an output of the second replica delay path. This may be implemented for example by including a multiplexer in the replica circuit portion, wherein one input of the multiplexer is connected to the output of the first replica delay path and another input of the multiplexer is connected to the output of the second replica delay path. A control input of the multiplexer may be coupled to a or the select register, thereby enabling selection between the first and second replica delay paths to be controlled using one or more bits of said select register.

In a set of embodiments, the comparison circuit portion is arranged to compare the first and second signals once per clock cycle, at the same time as the latch circuit portion is arranged to switch the state of its output signal (which may in some embodiments be a rising edge of the clock signal).

In a set of embodiments, the replica circuit portion is arranged to output a noninverted signal at its output relative to its input. The first and second replica delay paths may be arranged to output non-inverted signals at their outputs relative to their inputs. In a set of embodiments, each delay element of the tuning circuit portion is arranged to output a non-inverted signal at its output relative to its input. Thus, in a set of embodiments, the second signal output by the delay circuit portion is arranged to be non-inverted relative to the first signal at its input, taking into account the propagation delay introduced by the delay circuit portion.

In a set of embodiments, the comparison circuit portion comprises an XOR gate, the output of which is coupled to a first flip-flop, wherein the XOR gate takes the first signal as one of its inputs and the second signal as the other of its inputs. The XOR gate is therefore arranged to output a signal whereby the state of the output signal is dependent on whether the first and second signals are in the same state or in different states. The first flip-flop takes the output of the XOR gate as its input, and is arranged to output the error signal if the output of the XOR gate indicates that the first and second signals are in different states when it is clocked - e.g. on a rising clock edge.

In some embodiments, the comparison circuit portion further comprises a second flip-flop, with the output of the first flip-flop being coupled to the input of the second flip-flop. The second flip-flop may mirror the output of the first flip-flop with a delay of one clock cycle. The Applicant has recognised that it is possible for a signal output by the XOR gate to arrive at the first flip-flop at exactly the same time as a rising clock edge, resulting in the first flip-flop entering a meta-stable state that may cause the output of the first flip-flop to be undefined. The second flip-flop may therefore be arranged to stabilise the output of the first flip-flop by capturing undefined signals output by the first flip-flop, as the output of the second flip-flop may settle to a defined state even if the output of the first flip-flop is undefined. This may help reduce the frequency of false detections by the detection circuit portion, and may prevent undefined signals from the first flip-flop propagating to further logic.

Features of any aspect or embodiment described herein may, wherever appropriate, be applied to any other aspect or embodiment described herein. Where reference is made to different embodiments or sets of embodiments, it should be understood that these are not necessarily distinct but may overlap.

BRIEF DESCRIPTION OF THE DRAWINGS

One or more embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings in which:

Fig. 1 is a schematic block diagram of an integrated circuit comprising one or more clock domains and one or more detection circuit portions in accordance with an embodiment of the present invention; and

Fig. 2 is a more detailed schematic circuit diagram of a detection circuit portion of the embodiment of Fig. 1.

DETAILED DESCRIPTION OF THE DRAWINGS

Fig. 1 is a schematic block diagram of an integrated circuit 102, comprising a power supply 104 and three clock domains 106a-c. It will be understood by those skilled in the art that the number of clock domains is not limited to three, but may be any number. Each clock domain 106a-c comprises an oscillator 110a-c, a logic circuit portion 108a-c, and a detection circuit portion 112a-c. The oscillators 110a-c are coupled to the respective logic circuit portions 108a-c and detection circuit portions 112a-c. The logic circuit portions 108a-c are also coupled to the respective detection circuit portions 112a-c.

Each oscillator 110a-c outputs a periodic clock signal 114a-c to the respective logic circuit portion 108a-c and detection circuit portion 112a-c, each of which use the clock signal 114a-c for timing purposes. It will be understood by those skilled in the art that the oscillators 110a-c may comprise any electronic oscillators arranged to output a periodic clock signal, including but not limited to a crystal oscillator, a CMOS ring oscillator, etc.

In this example, each detection circuit portion 112a-c outputs an error signal 116a-c to the respective logic circuit portion 108a-c if a low logic speed relative to the clock frequency is detected. The error signals 116a-c need not be transmitted to the respective logic circuit portions 108a-c, but may be transmitted to an external device or a different module within the integrated circuit 102. The error signals 116a-c are fed to the corresponding logic circuits 108a-c in order to instruct them to, for example, cease or pause operation. Alternatively, the error signals 116a-c may be fed to a module external to corresponding logic circuits 108a-c in order to, for example, make a record of the event and/or switch off the power supply, although switching off the power supply may be undesirable as this may require other powered logic to be kept alive in order to restore power when it is deemed safe.

Each logic circuit 108a-c comprises a plurality of logic elements, which in turn may comprise any module found on an integrated circuit. Typically, each logic circuit 108a-c contains a plurality of different signal paths, passing through different logic elements, that signals may propagate along depending on their purpose, destination, etc. Each different signal path included in each logic circuit 108a-c may introduce differing propagation delays, particularly due to each path including different types of, and numbers of, logic elements. The signal path that introduces the largest propagation delay in each of the logic circuits 108a-c is referred to herein as the critical path of that logic circuit 108a-c. The critical path therefore gives a worst-case-scenario measure of the propagation delay within a logic circuit 108a-c, and is therefore a useful consideration for detecting low logic speed relative to clock frequency (e.g. due to glitch attacks). In this example, the logic circuit portions 108a-c are coupled to each other so as to allow communication between clock domains. These couplings may further comprise a number of standard components used to transmit signals between clock domains of different frequencies, as is known in the art, but the description of these is omitted for the sake of brevity.

Some operations performed by the logic circuit portions 108a-c - e.g. simple, non- time-sensitive operations - have lower performance requirements than other more intensive operations. It has therefore been recognised that the voltage supplied to the logic circuit portions 108a-c can be reduced for such operations without compromising the performance of the integrated circuit 102. As such, the integrated circuit 102 is configured for voltage-scaled operation - i.e. it is configured to scale the voltage supplied by the power supply 104 in dependence on the operations being performed by the logic circuit portions 108a-c. Since the energy consumed per operation scales with the square of the supply voltage, this voltage-scaled operation enables the overall energy consumption of the integrated circuit 102 to be substantially reduced. This is particularly advantageous in battery-powered applications.

The propagation delays introduce by the critical paths of the logic circuit portions 108a-c, particularly at low supply voltages, are sensitive to the types of logic elements used therein (e.g. NOR gates, NAND gates, etc.), especially where combinations of NMOS and PMOS transistors are used. Furthermore, in this example, the logic circuit portions 108a-c utilize multi-VT synthesis whereby logic elements from different standard libraries and with different threshold voltages are mixed with each logic circuit 108a-c, with a goal of balancing current leakage and logic speed. At low supply voltages, the propagation delay introduced by a given logic element is very sensitive to its threshold voltage - in particular, the propagation delay introduced by high threshold voltage logic elements increases by greater amounts at low supply voltages than that introduced by low threshold voltage logic elements. As a result of these factors, the propagation delays introduced by the critical paths of the logic circuit portions 108a-c can vary by over one order of magnitude over permitted operating supply voltages of the integrated circuit 102 (which is configured for voltage-scaled operation). Fig. 2 is a schematic diagram illustrating an example of the detection circuit portion 112a in more detail. The detection circuit portion 112a comprises a latch circuit portion 202, a delay circuit portion 203 that includes a replica circuit portion 204, a tuning circuit portion 206 and a select register 207, and a comparison circuit portion 208. The detection circuit portions 112b, 112c (not shown in detail) each comprise substantially the same circuitry to that shown in Fig. 2, though the replica circuit portion 204 may differ as described in more detail hereinbelow. The output of the latch circuit portion 202 is coupled to the input of the delay circuit portion 203 - i.e. to the input of the replica circuit portion 204 - and to one of the inputs of the comparison circuit portion 208. The output of the replica circuit portion 204 is coupled to the input of the tuning circuit portion 206. The output of the tuning circuit portion 206 - i.e. the output of the delay circuit portion 203 - is coupled to the other input of the comparison circuit portion 208. The signal at the output of the latch circuit portion 202 is hereinafter referred to as the non-delayed signal 210, and the signal at the output of the delay circuit portion 203 (i.e. the output of the tuning circuit portion 206) is hereinafter referred to as the delayed signal 212.

The latch circuit portion 202 comprises a latch flip-flop 214 and a feedback inverter 216. The clock input of the latch flip-flop 214 is coupled to the oscillator 110a (see Fig. 1), and thus the latch flip-flop 214 is clocked by the clock signal 114a. The feedback inverter 216 acts as a feedback loop between the input and output of the latch flip-flop 214, causing the non-delayed signal 210 output by the latch flip-flop 214 to alternate state once every clock cycle. In this example, the signal 210 output by the latch flip-flop 214 alternates state on every rising edge of the clock signal 114a. The non-delayed signal 210 at the output of the latch flip-flop 214 thus takes the form of a square wave with a frequency equal to half the frequency of the clock 114a.

The replica circuit portion 204 comprises a first replica delay path 218, a second replica delay path 220 connected in parallel with the first replica delay path 218, and a first two-input multiplexer 222. The input of the first replica delay path 218, and the input of the second replica delay path 220, are connected to the noninverting output of the latch flip-flop 214. The output of the first replica delay path 218 is connected to one input of the first multiplexer 222, and the output of the second replica delay path 220 is connected to the other input of the first multiplexer 222.

The tuning circuit portion 206 comprises three delay elements 224, 226 and 228 and three two-input multiplexers 230, 232 and 234. The first of the delay elements 224 comprises eight inverters 236-243 connected in series; the second delay element 226 comprises four inverters 244-247 connected in series; and the third delay element 228 comprises two inverters 248 and 249 connected in series. The number of delay elements, and therefore the number of multiplexers, is not limited to three as in this example, but may be any number. It will also be understood that the number of inverters in each of the delay elements 224, 226 and 228 is not limited to that given in this example, but may be any number. Additionally, the delay elements 224, 226 and 228 are not limited to the order shown in Fig. 2, but could be arranged in any convenient order.

The input of the first delay element 224 (i.e. the input of the first inverter 236) is connected to the output of the first multiplexer 222 included in the replica circuit portion 204. One input of the second multiplexer 230 is also connected to the output of the first multiplexer 222 (and thus also connected to the input of the first delay element 224). The other input of the second multiplexer 230 is connected to the output of the first delay element 224 (i.e. to the output of the eighth inverter 243). The input of the second delay element 226 (i.e. the input of the ninth inverter 244) is connected to the output of the second multiplexer 230. One input of the third multiplexer 232 is also connected to the output of the second multiplexer 230 (and thus also connected to the input of the second delay element 226). The other input of the third multiplexer 232 is connected to the output of the second delay element 226 (i.e. to the output of the twelfth inverter 247). The input of the third delay element 228 (i.e. the input of the thirteenth inverter 248) is connected to the output of the third multiplexer 232. One input of the fourth multiplexer 234 is also connected to the output of the third multiplexer 232 (and thus also connected to the input of the third delay element 228). The other input of the fourth multiplexer 234 is connected to the output of the third delay element 228 (i.e. to the output of the fourteenth inverter 249). In this example, the select register 207 comprises a four-bit select register, as there are four multiplexers 222, 230, 232 and 234 included in the detection circuit portion 112a in this particular example. However, it will be appreciated that the number of bits of the select register 207 is not limited to four, but may be any number depending on the number of multiplexers included in the detection circuit portion 112a. Each bit of the select register 207 is respectively connected to the control input of one of the multiplexers 222, 230, 232, 234.

The arrangement of the first multiplexer 222 and the select register 207 enables selection between the first replica delay path 218 and the second replica delay path 220 within the replica circuit portion 204 depending on the state of the corresponding bit of the select register 207. The arrangement of the multiplexers 230, 232, 234 in the tuning circuit portion 206, and the select register 207, enables each of the delay elements 224, 226, 228 to be individually bypassed depending on the state of the bit of the select register 207 that is coupled to the respective control input of each of the multiplexers 230, 232, 234.

In this example, the first replica delay path 218 and the second replica delay path 220 are arranged such that the signals at their respective outputs are non-inverted relative to the signals at their respective inputs. Thus, the signal at the output of the replica delay circuit portion 204 is non-inverted, though delayed, relative to the signal 210 at its input.

Also, in this example, the number of inverters in each of the delay elements 224, 226 and 228 is even, meaning that the delayed signal 212 is non-inverted, though delayed, relative to the signal at the input of the tuning circuit portion 206. Thus it will be seen that the delayed signal 212 is non-inverted, but delayed, relative to the non-delayed signal 210, as the delay circuit portion 203 as a whole outputs a noninverted, but delayed, signal relative to the signal at its input.

It will be appreciated by those skilled in the art that the first replica delay path 218, the second replica delay path 220, and/or the tuning circuit portion 206 could be adjusted such that the signal output by the delay circuit portion 203 is inverted relative to the signal at its input (i.e. causing the delayed signal 212 to be inverted and delayed relative to the signal 210), provided appropriate modifications are also made to the comparison circuit portion 208.

The comparison circuit portion 208 comprises an XOR gate 250, a detection flipflop 252 and a stabilising flip-flop 254 connected in series. One input of the XOR gate 250 is coupled to the output 210 of the latch circuit portion 202 (i.e. the output of the latch flip-flop 214) and the other input is coupled to the output 212 of the tuning circuit portion 206 (i.e. the output of the fourth multiplexer 234). The XOR gate 250 is therefore arranged to compare the signal 210 output by the latch circuit portion 202 and the delayed version of the signal 212 output by the tuning circuit portion 206. The XOR gate 250 therefore outputs a logic ‘0’ if the signal 210 and delayed version of the signal 212 are in the same state, and a logic T if the signal 210 and delayed version of the signal 212 are in different states.

The output of the XOR gate 250 is coupled to the input of the detection flip-flop 252. The clock input of the detection flip-flop 252 is clocked by the clock signal 114a, as output by the oscillator 110a (see Fig. 1). The output of the detection flip-flop 252 is coupled to the input of the stabilisation flip-flop 254 which is also clocked by the common clock signal 114a output by the oscillator 110a.

Operation of the detection circuit portion 111a will now be described in detail. As described previously, the signal 210 output by the latch circuit portion 202 alternates state once per clock cycle. As the output of the latch circuit portion 202 is directly coupled to an input of the comparison circuit portion 208, the comparison circuit portion 208 receives the signal 210 at one of its inputs substantially without delay. The delay circuit portion 203 - i.e. the replica circuit portion 204 - similarly receives the signal 210 at its input substantially without delay.

Depending on the state of the multiplexer 222, which depends on the corresponding control bit of the select register 207, the signal 210 then passes through either the first replica delay path 218 or the second replica delay path 220, which introduces a propagation delay to the signal 210 that is dependent on supply voltage. This delayed version of the signal 210 is output by the replica circuit portion 204 and received at the input of the tuning circuit portion 206. The replica circuit portion 204 is described in greater detail hereinbelow.

The signal 210 output by the replica circuit portion 204 propagates through the first inverter 236 of the first delay element 224. When this happens, the inverter 236 drives the signal at its output to the opposite state of the signal 210 at its input, drawing power from the power supply 104 to do so (see Fig. 1). The speed at which the inverter 236 is able to drive the signal 210 at its input to the opposite state at its output is dependent upon the supply voltage. The inverter 236 therefore introduces a propagation delay to the signal 210, the magnitude of the propagation delay introduced being dependent on the supply voltage. The next inverter 237 then receives the signal output by the first inverter 236 at its input, and the process is repeated. Each of the subsequent inverters 238-243 then repeat the same process. It will be understood by those skilled in the art that, as there are eight inverters 236- 243 (i.e. an even number) within the first delay element 224, the signal output by the last inverter 243 is non-inverted relative to the signal 210 at the input of the first inverter 236, and delayed with a propagation delay that is dependent on supply voltage, the propagation delay being introduced as a result of the signal 210 propagating through the inverters 236-243.

In the same way that the inverters 236-243 introduce a propagation delay to the signals at their output relative to the signals at their input, the logic elements within the logic circuit 108a also introduce a propagation delay to the signals at their output relative to the signals at their inputs. The propagation delays introduced by the logic elements within the logic circuit 108a are similarly dependent on supply voltage, in the same way that the propagation delays introduced by the inverters 236-243 are dependent on supply voltage. As a result, it will be seen by those skilled in the art that the propagation delay introduced by the inverters 236-243 is therefore dependent on logic speed, wherein the term ‘logic speed’ is used to describe the rate at which a signal propagates through the logic elements within the logic circuit 108a. As the supply voltage provided by the power supply 104 decreases, the logic speed of the logic circuit 108a decreases accordingly. At the same time, as the supply voltage provided by the power supply 104 decreases, the propagation delay introduced by each inverter 236-243 of the first delay element 224 increases accordingly. As described previously, the control input of the second multiplexer 230 is coupled to one of the bits of the select register 207. In this example, if the value held in the associated bit is a logic ‘O’, the second multiplexer 230 outputs the signal at the input of the first delay element 224 (i.e. the signal 210 with a propagation delay introduced by the replica circuit portion 204); if the value held in the associated bit is a logic T, the second multiplexer 230 outputs the signal at the output of the first delay element 224 (i.e. the signal 210 with a propagation delay introduced by the replica circuit portion 204 and by the first delay element 224). It will therefore be appreciated by those skilled in the art that the associated bit within the select register 207 may be used to select whether or not the first delay element 224 is bypassed during the propagation of the signal 210 through the delay circuit portion 206.

The signal output by the second multiplexer 230 is then input to the first inverter 244 of the second delay element 226, as well as to one of the inputs of the third multiplexer 232. The first inverter 244 and subsequent inverters 245-247 of the second delay element 226 then invert and introduce propagation delay to the signals at their inputs in the same way as that described with reference to the first inverter 236 of the first delay element 224. As there are four inverters 244-247 (i.e. an even number) within the second delay element 226, the signal output by the last inverter 247 is non-inverted relative to the signal at the input of the first inverter 244 and delayed by a propagation delay that is dependent on supply voltage, the propagation delay being introduced as a result of the signal propagating through the inverters 244-247. It will also be understood by those skilled in the art that the propagation delay introduced by the second delay element 226 is half of that introduced by the first delay element 224, as the second delay element 226 comprises half as many inverters as the first delay element 224.

As described previously, the control input of the third multiplexer 232 is coupled to one of the bits of the select register 207. It will therefore be appreciated that, in much the same way as described previously with reference to the second multiplexer 230, the bit of the select register 207 connected to the control input of the third multiplexer 232 may be used to select whether or not the second delay element 226 is bypassed during the propagation of the signal 210 through the tuning circuit portion 206. The signal output by the third multiplexer 232 is then input to the first inverter 248 of the third delay element 228, as well as to one of the inputs of the third multiplexer 234. The first inverter 248 and subsequent inverter 249 of the third delay element 228 then invert and introduce propagation delay to the signals at their inputs in the same way as that described with reference to the first inverter 236 of the first delay element 224. Again, as there are two inverters 248-249 within the third delay element 228, the signal output by the last inverter 249 is non-inverted relative to the signal at the input of the first inverter 248, and the propagation delay introduced by the third delay element 228 is half of that introduced by the second delay element 226.

As described previously, the control input of the fourth multiplexer 234 is coupled to the remaining bit of the select register 207 to allow the third delay element 228 to be bypassed, or not, depending on the value of that bit.

The arrangement of the tuning circuit portion 206 shown in Fig. 2 therefore provides a binary programmable propagation delay that is proportional to the value stored in the bits of the select register 207 corresponding to the multiplexers 230, 232, 234, but that is dependent on supply voltage.

The inverters 236-249 included in the tuning circuit portion are standard cells from the same library as the cells included in the critical path of the corresponding logic circuit portion 108a shown in Fig. 1. Thus, the propagation delay introduced by each inverter 236-249 scales similarly with supply voltage to the inherent propagation delay of said critical path. Were the replica delay circuit portion 204 to be omitted from the delay circuit portion 203, then the values stored in these bits of the select register 207 could be selected such that the propagation delay introduced by the delay circuit portion 203 - i.e. by only the tuning circuit portion 206 - is representative of the propagation delay introduced by the critical path of the corresponding logic circuit portion 108a plus some safety margin, e.g. 10%. In doing so, the tuning circuit portion 206 would introduce a delay representative of, but greater than, the critical path of the corresponding logic circuit 108a, and thus a signal would fail to propagate through the tuning circuit portion 206 within a designated time period before a signal would fail to propagate through the critical path of the corresponding logic circuit 108a within the same time period when the supply voltage is decreasing. This would mean that a glitch attack on the integrated circuit would affect the detection portion 111a before it affects any of the functional logic 108a.

However, while the propagation delay introduced by only the tuning circuit portion 206 could be adjusted using the select register 207 in order to match that introduced by the critical path, in some circumstances its propagation delay may not match that of the critical path across all supply voltages - particularly low supply voltages - as the voltage scaling of the standard cell inverters 236-249 may differ from the actual cells included in the critical path at low voltages. This means that such a delay circuit portion 203 where the replica circuit portion 204 is omitted may not be optimal for voltage-scaled systems like the integrated circuit 102 shown in Fig. 1 , as this delay scaling mismatch at low supply voltages would need to be compensated in a manner that ensures the propagation delay introduced by the tuning circuit portion 206 remains greater than that of the critical path across all permitted supply voltages - generally by lengthening the propagation delay of the tuning circuit portion 206 by including additional/bypassing fewer delay elements therein.

However, this would cause the overall propagation delay of the tuning circuit portion 206 to be overly large at some supply voltages (e.g. higher supply voltages). In order to compensate for this lengthened propagation delay of the tuning circuit portion 206 (again, considering a circuit where the replica circuit portion 204 is omitted from the delay circuit portion 203), the integrated circuit 102 would need to raise the supply voltage in order to ensure that the propagation delay introduced by the tuning circuit portion 206 is not greater than the clock period, as this could result in false positive detections by the detection circuit portion 112a. This might counteract the energy consumption benefits of the voltage-scaled integrated circuit 102, as the supply voltage provided by the power supply 104 might need to be greater than that required for the operations performed by the logic circuit portions 108a-c, in order to provide sufficient supply voltage for the detection circuit portions 112a-c to function properly.

The detection circuit portion 112a is however better suited for the voltage-scaled integrated circuit 102 shown in Fig. 1, as the delay circuit portion 203 includes the replica circuit portion 204, in series, with the tuning circuit portion 206. As previously described, the replica circuit portion provides two replica delay paths 218, 220 which are selectable using the multiplexer 222 and the corresponding bit of the select register 207.

The first replica delay path 218 is a replica of the critical path of the corresponding logic circuit portion 108a and includes a plurality of logic elements or cells that each replicate a respective logic element or cell included in the critical path. Each logic element in the replica delay path includes one or more transistors that are each type-matched to, and have the same nominal threshold voltage as, a respective transistor included in the corresponding respective logic element of the critical path. As a result, the propagation delay of the first replica delay path 118 scales with voltage substantially proportionally or identically to the inherent propagation delay introduced by the critical path itself.

In some embodiments, the tuning circuit portion 206, the second replica delay path 220 and multiplexer 222 could be omitted, making the first replica delay path 218 the only introducer of propagation delay in the delay circuit portion 203. However, due to unavoidable, random process variations during manufacture, it may not be possible to guarantee that the first replica delay path 218 introduces a propagation delay that is longer than that of the critical path, even where the cells included in the first replica delay path 218 match those included the critical path exactly. This may be undesirable, as the functionality of the detection circuit portion 112a relies on its overall propagation delay of the delay circuit portion 203 being greater than the inherent delay of the critical path in order to ensure low logic speed relative to clock frequency is detected before it adversely affects the logic circuit portion 108a.

Thus, in this embodiment, the delay circuit portion 203 includes the tuning circuit portion 206, and the first replica delay path 118 is truncated slightly when compared to the critical path of the logic circuit portion 108a - i.e. it contains marginally fewer cells/logic elements and/or connections than the critical path - such that the overall propagation delay introduced by the first replica delay path 118 is marginally smaller than the inherent delay introduced by the critical path across all supply voltages. The binary programmable propagation delay introduced by the tuning circuit portion 206 is then used to fine-tune the overall propagation delay of the delay circuit portion 203 to be closely aligned with, but greater than, that of the critical path. Thus it will be seen that such embodiments including the first replica delay path 218 and the tuning circuit portion 208 provide an improved detection circuit portion 112a for voltage-scaled systems like the integrated circuit 102, where the overall propagation delay of the delay circuit portion 203 closely tracks, but remains greater than, the inherent delay of the critical path over a wide range of supply voltages.

Due to manufacturing limitations - particularly random process variations - it is not possible to ensure that every similar transistor on the same die has exactly the same threshold voltage (as the actual threshold voltage of a transistor may differ from its nominal threshold voltage), and thus it is possible that the cells used in the first replica delay path 218 may not exactly match those used in the critical path of the corresponding logic circuit portion 108a. It is therefore possible that the delay introduced by the first replica delay path 218 may be too small at low supply voltages when compared to the critical path, due to these random process variations. In embodiments where the delay circuit portion includes the tuning circuit portion 206, but the second replica delay path 220 and the multiplexer 222 are omitted, this could be compensated for by increasing the delay introduced by the tuning circuit portion 206 using the select register 207 to ensure the overall delay of the delay circuit portion 203 is close to, but greater than, the inherent delay of the critical path at low supply voltages. However, compensating for process variations using the tuning circuit portion 206 in this manner can lead the overall propagation delay introduced by the delay circuit portion 203 at higher supply voltages to be unnecessarily large, thus reducing the overall energy efficiency of the integrated- circuity 102 at higher supply voltages (due to the unnecessarily large number of power-drawing delay elements being utilized in the tuning circuit portion 206).

Thus, in the embodiment shown in Fig. 2, the delay circuit portion 203 includes the second replica delay path 220 and the multiplexer 222 in order to help compensate for these process variations between similar cells. The second replica delay path 220 includes the same types and numbers of logic elements or cells as those included in the first replica delay path 218, but with a greater proportion of higher threshold voltage transistors. This causes the propagation delay introduced by the second replica delay path 220 to increase by greater margins at low supply voltages than the first replica delay path 218. This automatically provides a safer propagation delay margin over that of the critical path at low supply voltages, without requiring the delay of the tuning circuit portion 206 to be adjusted using the select register 207. This increases the voltage margin required at lower supply voltages, but decreases the voltage margin required at higher supply voltages, relative to the first replica delay path 218.

As used herein, the term voltage margin is used to describe the difference between the lowest guaranteed safe operating voltage (i.e. the voltage below which the delay circuit portion 203 becomes too slow and the detection circuit portion 112a triggers an error signal) and the voltage at which the design functionality fails (i.e. the voltage below which the critical path in the logic circuit 108a is too slow). Since it is not possible for a user of the integrated circuit 102 to know whether it is safe to run at a voltage lower than the lowest guaranteed safe operating voltage, the voltage margin is automatically added to the voltage provided by the power supply 104 to ensure safe operation. This reduces the overall power efficiency of the integrated circuit 102. It is therefore desirable to try to minimise this voltage margin in order to maximise power efficiency. Thus, using the first replica delay path 218 is more power-efficient at lower supply voltages relative to the second replica path delay 220 (which increases the voltage margin required at low supply voltages), whereas using the second replica delay path 220 is more power-efficient at higher supply voltages relative to the first replica path delay 218 (as the second replica path delay 220 decreases the voltage margin required at high voltages).

The provision of the first multiplexer 222 in the replica circuit portion 204 enables the integrated circuit 102 to select whether to utilise the first replica delay path 218 or the second replica delay path 220 by configuring the corresponding bit of the select register 207. This selection may be performed when the integrated circuit 102 is booted, or when a particular application is booted on the logic circuit portion 108a. This allows the integrated circuit 102 to determine whether to optimize power efficiency at lower supply voltages by selecting the first replica delay path 218, or to optimize power efficiency at higher supply voltages by selecting the second replica delay path 220. It will also be seen that by including the replica circuit portion 204 in the delay circuit portion 203, fewer delay elements or inverters need to be included in the tuning circuit portion 206 (compared to a conceivable delay circuit portion 203 where the replica circuit portion 204 is omitted) are required, as the majority of the overall propagation delay of the delay circuit portion 203 is provided by the replica circuit portion 204, rather than the tuning circuit portion 206. This may help reduce the overall area of silicon required.

The XOR gate 250 of the comparison circuit portion 208 receives the non-delayed signal 210 at one of its inputs and receives the delayed signal 212 output by the delay circuit portion 203 - i.e. that output by the tuning circuit portion 206 - at the other of its inputs. As described previously, the XOR gate 250 outputs a logic ‘0’ if the signal 210 and delayed signal 212 are in the same state, and a logic T if the signal 210 and delayed signal 212 are in different states.

The signal output by the XOR gate 250 is input to the detection flip-flop 252. In this example, the detection flip-flop 252 captures the signal output by the XOR gate 250 on each rising edge of the clock signal 114a. Thus, the detection flip-flop 252 outputs a logic T only if the non-delayed signal 210 and delayed signal 212 are in different states on a rising clock edge of the clock signal 114a.

If the non-delayed signal 210 and delayed signal 212 are in the same state at the inputs of the XOR gate 250, this means that sufficient time has elapsed since the last change of the signal 210 for it fully to propagate through the delay circuit portion 203. If the non-delayed signal 210 and delayed signal 212 are in different states at the inputs of the XOR gate 250, this means that insufficient time has elapsed since the last change of the signal 210 for it fully to propagate through the delay circuit portion 203. As the detection flip-flop 252 captures the signal output by the XOR gate 250 on each rising clock edge, and the signal 210 alternates once per clock cycle (as described with reference to the latch circuit portion 202), this means that the detection flip-flop 252 outputs a logic T on a rising clock edge if the signal 210 did not fully propagate through the delay circuit portion 203 within a single clock cycle. If, however, the signal 210 successfully propagates through the delay circuit portion 203 within a single clock cycle, as should be the case during normal operation of the integrated circuit 102, then the detection flip-flop 252 outputs a logic ‘0’ on a rising clock edge. It will be appreciated by those skilled in the art that the detection flip-flop 252 may, in other examples, capture the signal output by the XOR gate 250 on a falling clock edge if appropriate changes are made to the latch circuit portion 202.

The signal 210 not being able to fully propagate through the delay circuit portion 203 within a single clock cycle indicates that the logic speed of the logic circuit portion 108a is too slow relative to the clock frequency of the first oscillator 110a (as signals propagating through the logic circuit portion 108a may not reach their intended destinations within the space of a single clock cycle). This may occur as a result of a glitch attack. The output of the detection flip-flop 252 indicates whether or not this is the case. If a logic ‘0’ is output by the detection flip-flop 252, then this indicates normal operation: the signal 210 was able to fully propagate through the delay circuit portion 203. If a logic T is output by the detection flip-flop 252, then this indicates a slow logic speed relative to the clock frequency (as the signal 120 was not able to fully propagate through the delay circuit portion 203), which may occur as a result of a glitch attack.

The signal output by the detection flip-flop 252 is received at the input of the stabilising flip-flop 254. The stabilising flip-flop 254 counteracts the effect of metastability in the detection flip-flop 252, e.g. if an edge of a signal output by the XOR gate 250 arrives at the detection flip-flop 252 at exactly the same time as a rising clock edge, which can cause the detection flip-flop 252 to enter a meta-stable state. The term ‘meta-stable state’, as used herein, is used to describe the state of the detection flip-flop 252 when edges of the input and clock signals arrive at substantially the same time such that it becomes possible for the detection flip-flop 252 to output an undefined signal (i.e. neither a logic T nor a logic ‘0’).

The stabilising flip-flop 254 is provided in order to prevent meta-stability in the detection flip-flop 252 causing an undefined signal from propagating through any subsequent logic. The stabilising flip-flop 254 mirrors the signal output by detection flip-flop 252, one clock cycle later. For example, if the detection flip-flop 252 outputs a logic T on a rising clock edge, the stabilising flip-flop 254 will output a logic T one clock cycle later. If the detection flip-flop 252 then changes its output to a logic ‘O’, the stabilising flip-flop 254 changes its output to a logic ‘0’ one clock cycle later. If the detection flip-flop 252 outputs an undefined signal as a result of meta-stability, the stabilising flip-flop 254 will prevent the undefined signal from propagating any further - the stabilising flip-flop 254 will output either a logic ‘1’ or a logic ‘O’, dependent on the undefined signal at its input, but will not output an undefined signal itself. As the output of the stabilising flip-flop 254 is the error signal 116a output of the detection circuit portion 112a, this therefore prevents the error signal 116a from being undefined. If the output of the stabilising flip-flop 254 is high for even a single cycle, it can be inferred that a glitch must have occurred.

Thus it will be understood that the detection circuit 112a outputs an error signal 116a if the signal 210 does not fully propagate through the delay circuit portion 203 within a single clock cycle. As the total propagation delay introduced by the replica delay circuit portion 203 is representative of the inherent propagation delay introduced by the critical path of the corresponding logic circuit 108a, plus some error margin, this means that the error signal 116a will be output at the same time as, or before, a signal is not able to propagate fully along the critical path of the corresponding logic circuit 108a within a single clock cycle e.g. as a result of a decreased supply voltage from the power supply 104 due to a glitch attack. Hence, the detection circuit 112a is able to detect a low logic speed relative to the clock frequency, which may arise as a result of a glitch attack which may be as short as a single cycle, at the same time as or before failure occurs in the corresponding logic circuit 108a.

As previously mentioned, the error signal may be reported to the logic 108a, or another module, to allow appropriate action to be taken such as recording a suspicious event, pausing operation, power cycling the circuit, preventing operation etc.

It will be appreciated by those skilled in the art that the invention has been illustrated by describing one or more specific embodiments thereof, but is not limited to these embodiments; many variations and modifications are possible, within the scope of the accompanying claims.

Claims

1. An integrated circuit comprising: an oscillator arranged to output a periodic clock signal; a logic circuit portion; and a detection circuit portion for detecting a low logic speed relative to a clock signal frequency, the detection circuit portion comprising: a latch circuit portion arranged to output a first signal that changes state once per clock cycle of said periodic clock signal; a delay circuit portion arranged to receive said first signal and output a second signal subject to a propagation delay; and a comparison circuit portion arranged to compare the first signal and the second signal and output an error signal if the signals are indicative of low logic speed relative to the clock signal frequency; wherein: the delay circuit portion comprises a replica circuit portion that comprises a first replica delay path that comprises a plurality of logic elements, each of said logic elements being type-matched to a respective logic element included in a critical path of the logic circuit portion.

2. The integrated circuit as claimed in claim 1, wherein: the logic circuit portion comprises a plurality of logic elements; and one or more of said logic elements has a different threshold voltage to one or more other of said logic elements.

3. The integrated circuit as claimed in claim 1 or 2, configured to vary a supply voltage provided to the logic circuit portion, and to the detection circuit portion, within a permissible range of supply voltages, in dependence on operations being performed by the logic circuit portion.

4. The integrated circuit as claimed in any preceding claim, wherein each logic element included in the first replica delay path has a nominal respective threshold voltage that is equal to a nominal threshold voltage of the corresponding respective logic element of the critical path.

5. The integrated circuit as claimed in any preceding claim, wherein each logic element included in the first replica delay path comprises one or more transistors, each of said transistors being type-matched to a respective transistor included in the corresponding respective logic element of the critical path and having a nominal threshold voltage that is equal to a nominal threshold voltage of said respective transistor.

6. The integrated circuit as claimed in any preceding claim, wherein the first replica delay path is arranged to output a non-inverted signal at its output relative to its input.

7. The integrated circuit as claimed in claim any preceding claim, wherein the first replica delay path comprises fewer logic elements than a number of logic elements included in the critical path.

8. The integrated circuit as claimed in any preceding claim, wherein: the replica circuit portion further comprises a second replica delay path connected in parallel with the first replica delay path; the second replica delay path comprises a plurality of logic elements; each of said logic elements are type-matched to a respective logic element included in the critical path; and at least one of said logic elements has a nominal threshold voltage that is greater than a nominal threshold voltage of the corresponding respective logic element of the critical path.

9. The integrated circuit as claimed in claim 8, wherein: each of the logic elements included in the second replica delay path comprises one or more transistors; each of said transistors is type-matched to a respective transistor included in the corresponding respective logic element of the critical path; and at least one of the transistors included in the second replica delay path has a nominal threshold voltage that is greater than a nominal threshold voltage of the corresponding respective transistor of the critical path.

10. The integrated circuit as claimed in claim 8 or 9, wherein: the second replica delay path comprises the same number of logic elements as the first replica delay path; each of the logic elements included in the second replica delay path are type-matched to a corresponding respective logic element included in the first replica delay path; and at least one of the logic elements included in the second replica delay path has a nominal threshold voltage that is greater than a nominal threshold voltage of the corresponding respective logic element included in the first replica delay path.

11. The integrated circuit as claimed in any of claims 8 to 10, wherein the second replica delay path is arranged to output a non-inverted signal at its output relative to its input.

12. The integrated circuit as claimed in any of claims 8 to 11 , wherein: a signal output by the replica circuit portion comprises a selectable one of an output of the first replica delay path and an output of the second replica delay path; and the integrated circuit is configured to select whether to use the first replica delay path or the second replica delay path in dependence on a previous, current or predicted supply voltage.

13. The integrated circuit as claimed in claim 12, configured to select whether to use the first replica delay path or the second replica delay path when the integrated circuit is powered on based on a predicted supply voltage.

14. The integrated circuit as claimed in any preceding claim, wherein the delay circuit portion further comprises a tuning circuit portion connected in series with the replica circuit portion, the tuning circuit portion comprising a plurality of delay elements, wherein each delay element is selectively bypassable such that the tuning circuit portion provides a configurable propagation delay.

15. The integrated circuit as claimed in claim 14, wherein each of the delay elements included in the tuning circuit portion introduces a propagation delay to a signal passing therethrough that is different from each of the other delay elements.

16. The integrated circuit as claimed in claim 14 or 15, wherein the propagation delay introduced by one of the delay elements is a unit delay, and the delays introduced by the other delay elements comprise increasing power of two multiples of the unit delay.

17. The integrated circuit as claimed in any of claims 14 to 16, wherein each delay element of the tuning circuit portion is arranged to output a non-inverted signal at its output relative to its input.

18. The integrated circuit as claimed in any of claims 14 to 18, wherein the tuning circuit portion is configured such that the overall propagation delay introduced by the delay circuit portion is greater than the inherent propagation delay introduced by the critical path across all permissible supply voltages.

19. The integrated circuit as claimed in any preceding claim, wherein the comparison circuit portion is arranged to compare the first and second signals once per clock cycle, at the same time as the latch circuit portion is arranged to switch the state of its output signal.

20. The integrated circuit as claimed in any preceding claim, wherein: the comparison circuit portion comprises a logic gate, the output of which is coupled to a first flip-flop clocked by the periodic clock signal; and the logic gate takes the first signal as one of its inputs and the second signal as the other of its inputs.

21. The integrated circuit as claimed in claim 20, wherein: the comparison circuit portion further comprises a second flip-flop clocked by the periodic clock signal, an output of the first flip-flop being coupled to an input of the second flip-flop; and the second flip-flop is arranged to mirror the output of the first flip-flop with a delay of one clock cycle and output the error signal.