Who’s Watching The Supply Chain?

Every company developing chips at the most advanced process nodes these days is using different architectures and heterogeneous processing and memory elements. There simply is no other way to get the kind of power/performance improvements needed to justify the expense of moving to a new process node. So while they will reap the benefits of traditional scaling, that alone is no longer enough.

In some cases, this is happening on a single die. In others, it involves multiple die in a package. But in all cases, there are a lot of different components—IP, accelerators, memories, possibly even chiplets—not all of which are made by any single vendor. The question now is who is going to be watching over all of those components to make sure they are what they’re supposed to be, that they will perform as expected throughout the designated lifetime, and that no suspicious code is added into these devices.

So far, this hasn’t been a problem because many of these devices are highly customized designs at the very high end of the design spectrum. They are being used in expensive smartphones and in servers developed by big systems companies and chipmakers. But as packaging technology begins to benefit from economies of scale and the costs start falling, the potential for counterfeit or substandard parts rises significantly, and the need for end-to-end security across the supply chain increases proportionately.

There are several things that need to be done to minimize this risk. First of all, hard IP needs to be tracked and accounted for throughout the supply chain. This currently is done by all of the major system houses today, and by many of the major fabless vendors, but it needs to be part of the sourcing process.

There are multiple ways to handle this. The least intrusive is single-device tracking using blockchain technology, which is a way of ensuring that inventory manufactured matches inventory received by comparing ledgers across multiple sites. Another approach is to physically watch shipments from manufacturing to delivery, which is what has been done in security chips for some time. A third approach is to actually etch specific part numbers into the silicon using e-beam technology.

All of these approaches work, but they were considered unnecessary when IDMs were developing one chip with a single processor and memory on board. Today that is no longer the case, and the potential long-term cost of counterfeit or substandard chips entering into the supply chain — particularly in devices that are supposed to function for a decade or more in safety-critical applications — is much higher than at any time in the past.

Second, silos that exist across the supply chain need to be readjusted for a completely different kind of assembly model. Advanced packaging generally means that not all of the components will be made in one place, and they may not even be assembled in one place. A chain of accountability needs to be established so that companies whose brand name is on these devices can be assured the individual pieces are everything they expected, but nothing more.

And third, the entire supply chain needs to be qualified by some industry group capable of implementing the same kind of controls as the ISO 26262 standard in automotive or DO-254 in aerospace. This becomes particularly important as chips developed in one application area are used in another simply because the design has been proven in silicon. In those cases, the integrity of the supply chain may not have been proven beyond the market in which it was originally used.

The “More than Moore” is absolutely essential for improving performance, reducing power, and speeding time to market. But the risk equation now needs to incorporate all of the components in a package, and this is something the entire chip industry needs to embrace for it to work properly.