L0/04 — The operating envelope

Background

Chips can destroy themselves, and the ways they do it are the hypotheses of this chapter, so each deserves a plain description. Avalanche breakdown: in a strong enough electric field, a charge carrier gains enough energy between collisions to knock new carriers loose on impact, which are themselves accelerated — a chain reaction (impact ionisation) that multiplies current explosively. Thermal runaway: silicon's leakage current rises steeply with temperature, and leakage dissipates power, which raises temperature — a feedback loop that, past a tipping point, cooks the die. Electromigration: a sufficiently dense electron current physically drags metal atoms along with it, so a wire carrying too much current for too long literally erodes, thinning until it opens. Latch-up was introduced in L1/12's background — the parasitic thyristor lurking in every CMOS well structure. And crowbar current: during a gate's input transition, its pull-up and pull-down transistors are both momentarily partly conducting, forming a brief rail-to-rail short — harmless when transitions are sharp, a real dissipation term when they are slow.

None of these is exotic; the reason a working chip exhibits none of them is that its design keeps the operating point inside a safe operating area — a region of voltage, temperature, current density, and slew inside which every feedback loop above is starved. Datasheets draw this region as the "absolute maximum ratings" table; this chapter's job is to state it as mathematics — the disturbance bounds under which 06's invariance claims hold — and to observe that its enforcement mechanisms are, once again, humble design rules (current-density limits, slew limits, tap spacing) that are secretly the hypotheses of boundedness theorems nobody wrote. Those five are the chip's internal self-destruction modes; two environmental axes — mechanical stress and external electromagnetic forcing — round out the same envelope, and are taken up in their own section once the internal ones are stated.

One technical idea in the chapter needs advance introduction: mollification, the smoothing of a field by averaging over a small ball. It is forced by an awkward fact: at a perfectly sharp conductor corner, the idealised electric field is mathematically infinite (a mild power-law singularity), so a naive constraint "field below breakdown threshold everywhere" is violated by every geometry containing a right angle — the constraint would be unsatisfiable while real chips sit happily unbroken. The resolution is that physical corners are atomically rounded and every physical breakdown mechanism averages over a finite volume anyway, so the honest constraint bounds the field averaged at a stated physical scale. Choosing that scale is a modelling decision with real content — too small and the constraint is unsatisfiable, too large and it is vacuous — the kind of decision a formalisation must make explicitly where engineering practice makes it tacitly.

Statement

Collect the conditions under which every bound in L0 and L1 is valid, and establish that the design and its environment stay inside them.

These are the disturbance bounds of 06's robust invariance claim. Without them (I) and (P) are unconditional statements that are simply false: every one of these mechanisms does leave the invariant set, and the design's job is to make them unreachable.

The pattern

Each entry has the same shape, and it recurs enough to be worth naming:

A real physical instability, prevented by a design rule, which is therefore secretly a hypothesis of a well-posedness or boundedness claim rather than a manufacturing constraint.

This is the third time this pattern has appeared in the project. L1's min-width and min-spacing rules are the hypotheses of a topology-preservation theorem. Tap-coverage rules are the hypothesis that kills latch-up's second solution branch. And now the whole envelope. Several DRC and design rules are the side conditions of theorems nobody has written.

The envelope

Notes on the interesting ones

V1 is structural and cheap. Static CMOS is designed so that no conducting path from Vdd to GND exists in any steady state — that is what complementary logic means. So V1 is a property of the netlist, checkable by the same machinery L2 already needs. The failure modes are bus contention (two drivers fighting) and pass-gate paths, both of which are netlist properties, not physics.

V2 is why the transient version is separate. During switching both devices are momentarily partly on, so there genuinely is a Vdd→GND path — the crowbar or short-circuit current, a real and non-trivial fraction of dynamic power. It does not threaten the abstraction because it is brief and bounded, and what bounds it is the input slew. So max_transition is doing double duty: it keeps you inside the Liberty table's domain (L0/07) and it bounds crowbar current. A slow input violates both.

V3 and V4 are the genuine runaway mechanisms, and they are the reason the answer to "can the chip destroy itself" is yes-but-only-outside-the-envelope. Both are positive feedback loops:

V3:  field ↑ → impact ionisation ↑ → carriers ↑ → current ↑ → (field ↑)
V4:  power ↑ → temperature ↑ → leakage ↑ → power ↑

Neither is spontaneous. Both require the operating point to leave the envelope first, which is why they are side conditions rather than open problems. Note that adding impact-ionisation terms is exactly what can destroy the global-existence results in 00 — so V3 is not merely a device-reliability condition, it is what keeps the mathematics in the well-behaved regime.

V5 is uniqueness, wearing a layout rule's clothing. Latch-up is a second solution branch of the stationary device PDE (M1). Tap coverage destroys the parasitic thyristor, hence destroys the branch. So a rule normally filed under reliability is the side condition that makes "the transistor's I-V characteristic" well-defined at all.

V4 also couples layers unpleasantly. Thermal behaviour depends on power, which depends on switching activity, which depends on the workload — so strictly the envelope is workload-dependent. At 130 nm with a small core this is comfortable; it is one of the things that gets much worse at advanced nodes, where self-heating enters the functional path.

The environment: mechanical stress and exogenous forcing

The envelope so far is a box in (V, I, T, slew) with two combinatorial side conditions. Two more environmental axes belong in it — mechanical stress and exogenous electromagnetic forcing — and the reason they earn a section is that neither adds an open problem or a seam. Each is a new coordinate of a box a stated problem already quantifies over, or a new source term in the disturbance budget a stated contract already carries — the L0 README's step 3, "guaranteed output class given input classes, load, and a bounded local disturbance budget." Writing them down is honesty about what that budget and that box already range over.

Interference is a second claimant on the disturbance budget. 06's invariance is robust — it holds under any disturbance below a budget — and that budget's discharge was already called nonlocal, because L1's screening is what bounds the internal coupling (crosstalk, Miller feedthrough). External EM interference is simply a second claimant on the same budget, sourced from the environment rather than from neighbours, and rejected by the same restoration (L1/06) that rejects crosstalk — provided the environment keeps the boundary disturbance below the budget. That proviso is V10, and it is stated where the tower already cuts: at the pins. The die is a poor antenna at these scales; the coupling that matters is into cables, board, and package, then conducted in through the pins — a system property. So the provable chip statement is conducted (a bound on pin-referred disturbance); a radiated level (V/m, or a documented HEMP waveform) maps into it only through a board-dependent coupling model, which is X4-class environment data, not a die theorem. This is the honest, well-posed form of "survives interference below a documented level": bound the pin-referred forcing, and let the board own the field-to-pin factor.

Stress comes in three kinds, and each has an existing home (V9). Static stress is already inside the characterised model: silicon is deliberately strained (mobility engineering since ~90 nm), and layout-dependent effects — STI-edge stress, well proximity — make a cell's parameters depend on its neighbours' geometry, the mechanical analogue of crosstalk, a static nonlocality discharged the same way: characterise the cell in a representative stress context, or carry the effect as a parameter of the device box E1 ranges over. Gross stress — fracture, delamination, bond-wire lift — is not something the tower survives; it is a d ∈ Envelope hypothesis, the mechanical twin of "the chip can destroy itself, but only outside the envelope" (V3/V4), established by package qualification rather than proved. Cyclic stress — CTE-mismatch fatigue under thermal cycling — is a wearout over a trajectory, type D beside electromigration (V6): in the envelope at every instant, while the envelope's validity is bounded to a rated cycle count.

The enclosure statement generalises, without a new problem. Exogenous forcing enters L0/07's per-cell DAE as a source term, so "bound the terminal behaviour over the operating range" becomes "bound it over the operating range and over every admissible forcing below the budget" — a disturbance-reachability enclosure (a reachable tube under a bounded input) rather than a parameter/quasi-static-input one. This is the same interval-DAE integrator (07's Open Problem 1), strictly harder but not a new obligation, and it decomposes the way the rest of the tower does: the nonlinearity that matters is at the boundary — the ESD/pad structures, where the large excursions live and where the clamp must be shown to bound the excursion below its thermal limit (the CW-power limit, not the transient ESD rating) — while the interior is a linear victim, its induced excursion bounded by a peak-gain times the budget and composed per-cone. Boundary-nonlinear, interior-linear: the same "die is not the antenna" fact, now as proof architecture. Because the linear and energy bounds are monotone in the forcing magnitude, "survives level L" gives "survives everything weaker than L" for free; the nonlinear upset part needs an explicit monotonicity lemma, a sibling of the corner-monotonicity the enclosure already leans on.

So the ledger is entirely modifications: E1's box gains a stress coordinate and an EM-forcing budget, its residue absorbed as calibration (D5); L0/07's enclosure statement gains a forcing quantifier; L1/06's disturbance budget gains an environmental share that L1 consumes exactly as it already consumes the internal one; and the envelope gains V9/V10 with one more type-D wearout. No new open problem, no new seam — the environment was always a hypothesis of design + environment ∈ envelope; this only names two coordinates it always had.

The shape of the boundary

Worth working out, because the constraints are not all the same kind of object and a naive "bound the field and its derivatives" formulation is not satisfiable.

What is free and what is not

|φ| ≤ Vdd everywhere is free — it is the maximum principle (00), a theorem rather than a constraint.

|∇φ| is not free, and is genuinely unbounded: the r^(−1/3) singularity at reentrant conductor corners. Note however that the total energy is finite — energy density goes as r^(−2/3), and near an edge ∫ r^(−2/3)·r dr converges. So:

The solution lives in H¹ automatically. The safe region needs W^{1,∞}-type control, which the idealised geometry does not provide.

Consequence: every constraint below must be stated on a mollified quantity. Pointwise field values at geometric singularities are not physical — real corners are rounded at the atomic scale, and every breakdown criterion involves a finite volume and time scale anyway. So the right form is

‖ G_δ * ∇φ ‖_∞  <  E_crit

with δ a physical length (oxide thickness, mean free path). Mollified constraints are satisfiable; the idealised pointwise ones are not. This is a modelling decision that has to be made explicitly, and getting δ wrong is the difference between a vacuous constraint and a false one.

Five shapes

Three observations:

Avalanche is not a pointwise field bound. The ionisation coefficient is exponential in 1/E, and the criterion is that the integral along a field line reaches unity. Sharper and weaker than |∇φ| < E_crit: a brief high-field region is tolerable, a sustained moderate one may not be.

Thermal is not local. The temperature is a nonlocal response — the power density σ|∇φ|² convolved with a thermal Green's function. So a small hot spot is tolerable while a diffuse but large dissipation is not. The constraint is on a smoothed quantity, and the smoothing length is set by the thermal diffusion length, not by anything electrical.

D and E are not state constraints at all. Electromigration is a wearout criterion over a trajectory; latch-up and contention are properties of the operator (does a second solution branch exist, is there a conducting rail-to-rail path). Neither can be phrased as "the field is in this set", which is why they need combinatorial rather than analytic treatment.

So your conjecture — field bounded, derivatives bounded, energy density bounded — captures A and C. Energy density bounded is equivalent to |∇φ| bounded, so it is A restated. B, D and E are genuinely different.

Structural properties of the safe set

Two facts that make it tractable:

It is star-shaped about the unpowered state. Scale φ → λφ for λ ∈ [0,1]: the field scales by λ, power density by λ², and the ionisation integral decreases monotonically. Every constraint is preserved. So you can always retreat to safety by lowering the supply — which is exactly what thermal throttling and dynamic voltage scaling do, and it means the safe set is connected and contains a path to the origin from any interior point.

Convexity is inherited through the linear map, for A and C. For the electrostatic part the map from applied boundary voltages to the field is linear, so a convex constraint in field space pulls back to a convex constraint in input space. A and C are convex; hence the safe operating region in applied-voltage space is convex apart from the avalanche term.

That matches engineering practice — safe operating areas are specified as boxes and trapezoids in (V, I, T) space — and it explains why: the box is a conservative inner approximation of a convex set, and the corner cuts are the non-convex avalanche term.

Both structural facts share the same caveat: the star-shapedness argument scales the field configuration, and the retreat-to-safety reading ("lower the supply") transfers to applied-voltage space only through linearity of the input-to-field map. For the nonlinear device problem that map is not linear, so there both convexity and the supply-scaling argument degrade from theorem to physically-motivated heuristic (lowering Vdd does shrink the fields, but not proportionally, and the safe set in supply space inherits neither property automatically). So the clean statement holds for interconnect and degrades at devices.

What this means for verification

The envelope should be stated as an intersection of mollified sublevel sets, with δ explicit for each, plus two combinatorial side conditions (E) that live outside the analytic framework entirely. Star-shapedness gives a cheap sufficient check — verify at the worst corner of the operating box and scale down — and convexity means the A and C constraints can be checked at box vertices rather than swept.

What this buys

With the envelope in hand, the chain of statements is honest:

design + environment ∈ envelope          [this document]
  ⟹ single solution branch, bounded fields, no runaway     [00, 02]
  ⟹ robust invariance (I) and progress (P) hold            [05]
  ⟹ the Boolean/Mealy abstraction is sound                 [05, L1]

Without it, 06's claims are false as stated, because the disturbance set is unbounded.

Open problems

1. Formalise V1 as a netlist property and prove static CMOS satisfies it. Should be easy, and it is a genuine precondition rather than an assumption.
2. Turn V5 into a proved sufficient condition for single-branch operation, rather than an empirical distance rule. This is the concrete form of attacking M1 from the engineering side rather than the analysis side.
3. Bound crowbar current from the slew limit (V2), and check the shipped design's max_transition violations (finding F2) do not breach it — currently these are treated as a timing issue only.
4. A workload-independent thermal bound, or an explicit statement that the envelope is workload-conditional.

First experiments

• Check V1 structurally on the shipped netlist. Enumerate every net with more than one driver and every pass-gate/tri-state structure. Cheap, mechanical, and it either confirms the assumption or finds something interesting. L2 needs the same analysis for one-driver-per-net well-formedness, so it is shared work.
• Confirm the design's operating voltage sits comfortably below the process's avalanche rating, and record the margin.
• Check whether any net violating max_transition (F2) is in a high-activity region, where the crowbar-current consequence would actually matter.

Effort

The structural checks: days each (V1 shared with L2). The mollified-constraint formalisation: weeks.

Reading

Sze & Ng, Physics of Semiconductor Devices — avalanche breakdown, the ionisation-integral criterion, and Chynoweth's α(E) = A·exp(−B/E); also second breakdown. Troutman, Latchup in CMOS Technology: The Problem and Its Cure (1986) — the standard monograph on the thyristor structure and the role of taps and guard rings. Black (1969) for the electromigration law behind V6. Note that these are normally presented as reliability engineering, and the reframing as side conditions of well-posedness is this project's angle rather than the field's.