Remote programming system and method for programmable logic devices

Abstract

Systems and methods for managing remotely programmable logic devices (remote PLDs) are disclosed. An example system includes a remote PLD comprising multiple programmable logic blocks (PLBs) arranged within a PLD structure and programmable inputs / outputs (I / O) connected to the PLD structure. The remote PLD is configured to establish a communication link between the remote PLD and a remote PLD management system node via a communication module of a host device configured to interface with the remote PLD through programmable I / O. The remote PLD is configured to receive a protected configuration image from the remote PLD management system node via the communication link and program the PLD structure according to the protected configuration image.

Description

[0001] Cross Reference to Related Applications

[0002] This application claims the benefit of and priority to U.S. Provisional Patent Application No. 62 / 854,164, filed May 29, 2019, entitled “REMOTE PROGRAMMING SYSTEMS AND METHODS FOR PROGRAMMABLE LOGIC DEVICES,” which is incorporated by reference herein in its entirety. TECHNICAL FIELD

[0003] The present disclosure relates generally to programmable logic devices, and more particularly to remote management of memories, communication interfaces, and / or other assets of such devices. BACKGROUND

[0004] Programmable logic devices (PLDs) (e.g., field programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), field programmable systems on a chip (FPSCs), or other types of programmable devices) can be configured with various user designs to implement desired functionality. Typically, the user designs are synthesized and mapped to configurable resources (e.g., programmable logic gates, look-up tables (LUTs), embedded hardware, or other types of resources) and interconnects available in the particular PLD. Physical placement and routing for the synthesized and mapped user designs can then be determined to generate configuration data for the particular PLD.

[0005] Manufacturers of host devices that include PLDs typically invest significant resources to develop configurations for the type and / or capabilities of PLDs that they select, and typically benefit from perceived customer satisfaction by providing ongoing device support after the host devices are sold and / or deployed. Accordingly, there is a need in the art for systems and methods to remotely and securely manage PLD configurations, particularly in the context of computing applications and computing architectures that are difficult for users to manage manually. BRIEF DESCRIPTION OF DRAWINGS

[0006] Figure 1 A block diagram of a programmable logic device (PLD) is shown in accordance with an embodiment of the present disclosure.

[0007] Figure 2 A block diagram of a logic block for a PLD is shown in accordance with an embodiment of the present disclosure.

[0008] Figure 3 A design process for a PLD is shown in accordance with an embodiment of the present disclosure.

[0009] Figure 4 A block diagram of a host device including a remote PLD is shown in accordance with an embodiment of the present disclosure.

[0010] Figure 5 A block diagram of a remote PLD management system is shown in accordance with embodiments of the present disclosure.

[0011] Figure 6 A management process for a remote PLD integrated with a host device is shown in accordance with embodiments of the present disclosure.

[0012] Figure 7 A management process for a remote PLD integrated with a host device is shown in accordance with embodiments of the present disclosure.

[0013] Embodiments of the present disclosure and their advantages are best understood by referring to the detailed description of embodiments of the present disclosure which follows, taken in conjunction with the accompanying drawings. It should be understood that like reference numerals refer to like elements in the several figures, in which the figures are not necessarily drawn to scale, and in which: DETAILED DESCRIPTION

[0014] The present disclosure provides systems and methods for managing internal and external assets (e.g., fabric, bus, port, and / or memory sectors) of a remote programmable logic device (“remote PLD” or “remote programmable PLD,” as used interchangeably herein) for use in various host devices for computing applications and architectures, as described herein. For example, embodiments provide systems and methods for managing remote provisioning, re-provisioning (e.g., updating), and debugging of individual assets and / or grouped assets of a remote PLD by utilizing configuration images / configuration data to remotely program a remote PLD (e.g., over a wired and / or wireless network), which configuration images / configuration data itself can be protected according to publisher-defined configurations and / or operational contexts to help reduce or eliminate the risk of loss or extraction of the publisher’s data or reprogramming of such data.

[0015] In accordance with embodiments set forth herein, techniques are provided for managing implementation of a user design in a PLD, generally and more specifically in a remote PLD. In various embodiments, a user design can be converted into and / or represented by a set of PLD components (e.g., configured for logic, arithmetic, or other hardware functionality) and associated interconnections available in the PLD. For example, a PLD can include a plurality of programmable logic blocks (PLBs), each PLB including a plurality of logic cells, and various configurable routing resources that can be used to interconnect the PLBs and / or logic cells. In some embodiments, each PLB can be implemented with 2 to 16 or 2 to 32 logic cells.

[0016] Generally, a PLD fabric includes one or more routing structures and an array of similarly arranged logic cells disposed within programmable functional blocks (e.g., PFBs and / or PLBs). The purpose of the routing structures is to programmably interconnect the ports of the logic cells / PLBs in such a combination as is required to implement the intended functionality. The routing flexibility and configurable functionality can be used in synthesizing, mapping, placing, and / or routing a user design into a plurality of PLD components. As a result of various user design optimization processes, which can result in significant design time and cost, the user design can be implemented relatively efficiently, freeing up configurable PLD components that would otherwise be occupied by additional operational and routing resources. In some embodiments, the optimized user design can be represented by a netlist that identifies various types of components provided by the PLD and their associated signals. In embodiments in which a netlist of the transformed user design is produced, optimization processes can be performed on such a netlist. Once optimized, such configurations can be used to directly program a PLD, for example, or can be encrypted and signed and / or otherwise secured for distribution to a remote PLD, and such processes can include one or more key provisioning processes, as described herein. A “remote PLD” can differ from a more general purpose PLD by including various additional “hard” engines or modules that are configured to provide a range of remote management functionality that can be linked to operation of the PLD fabric to provide configurable computing functionality and / or architecture, as described herein.

[0017] Referring now to the drawings, Figure 1 A block diagram of a PLD 100 according to embodiments of the present disclosure is shown. The PLD 100 (e.g., a field programmable gate array (FPGA), a complex programmable logic device (CPLD), a field programmable system on chip (FPSC), or other type of programmable device) generally includes input / output (I / O) blocks 102 and logic blocks 104 (e.g., also referred to as programmable logic blocks (PLBs), programmable functional units (PFUs), or programmable logic cells (PLCs)). More generally, the individual elements of the PLD 100 can be referred to as a PLD fabric.

[0018] The I / O blocks 102 provide I / O functionality for the PLD 100 (e.g., to support one or more I / O and / or memory interface standards), while the programmable logic blocks 104 provide logic functionality (e.g., LUT-based logic or logic gate array-based logic) for the PLD 100. Additional I / O functionality can be provided by serializer / deserializer (SERDES) blocks 150 and physical coding sublayer (PCS) blocks 152. The PLD 100 can also include hard intellectual property core (IP) blocks 160 to provide additional functionality (e.g., substantially predetermined functionality provided in hardware that can be configured with less programming than the logic blocks 104).

[0019] PLD 100 can also include memory blocks 106 (e.g., EEPROM blocks, block SRAM, and / or flash memory), clock-related circuitry 108 (e.g., clock sources, PLL circuitry, and / or DLL circuitry), and / or various routing resources 180 (e.g., interconnects and appropriate switch logic to provide paths for routing signals throughout the PLD 100, such as for clock signals, data signals, or others, as appropriate). Generally, the various elements of the PLD 100 can be used to perform their intended functions for the desired application, as will be understood by those skilled in the art.

[0020] For example, certain I / O blocks 102 can be used to program the memory 106 or transfer information (e.g., various types of user data and / or control signals) to / from the PLD 100. Other I / O blocks 102 include a first programming port (which can represent a central processing unit (CPU) port, a peripheral data port, an SPI interface, and / or a sysCONFIG programming port) and / or a second programming port, such as a joint test action group (JTAG) port (e.g., by employing a standard such as the Institute of Electrical and Electronics Engineers (IEEE) 1149.1 or 1532 standard). In various embodiments, I / O blocks 102 can be included to receive configuration data and commands (e.g., over one or more connections 140) to configure the PLD 100 for its intended use, and to work with the SERDES blocks 150, the PCS blocks 152, the hard IP blocks 160, and / or the logic blocks 104 to support serial or parallel device configuration and information transfer, as appropriate.

[0021] It should be understood that the number and placement of the various elements are not limiting and can depend on the desired application. For example, various elements can not be needed for the desired application or design specification (e.g., for the type of programmable device selected). Further, it should be understood that the elements are shown in block form for clarity, and the various elements will generally be distributed throughout the PLD 100, such as in or between the logic blocks 104, the hard IP blocks 160, and the routing resources (e.g., routing resources 180) to perform their regular functions (e.g., to store configuration data to configure the PLD 100 or to provide interconnect fabric within the PLD 100). It should also be understood that the various embodiments disclosed herein are not limited to programmable logic devices, such as the PLD 100, and can also be applied to various other types of programmable devices, as will be understood by those skilled in the art. Figure 2

[0022] ​External system 130 can be used to create a desired user configuration or design for PLD 100, and to generate corresponding configuration data to program (e.g., configure) PLD 100. For example, system 130 can provide such configuration data to one or more I / O blocks 102, SERDES blocks 150, and / or other portions of PLD 100. Programmable logic blocks 104, various routing resources, and any other appropriate components of PLD 100 can thus be configured to operate in accordance with a user-specified application.

[0023] In the illustrated embodiment, system 130 is implemented as a computer system. In this regard, system 130 includes, for example, one or more processors 132 that can be configured to execute instructions, such as software instructions, provided in one or more memories 134 and / or stored in non-transitory form on one or more non-transitory machine-readable media 136 (e.g., which can be internal or external to system 130). For example, in some embodiments, system 130 can run PLD configuration software, such as Lattice Diamond System Planner software available from Lattice Semiconductor Corporation, to allow a user to create a desired configuration and generate corresponding configuration data to program PLD 100.

[0024] System 130 also includes, for example, a user interface 135 (e.g., a screen or display) to display information to a user, and one or more user input devices 137 (e.g., a keyboard, mouse, trackball, touch screen, and / or other device) to receive user commands or design entries to prepare a desired configuration for PLD 100.

[0025] Figure 2 A block diagram of a logic block 104 of PLD 100 is shown in accordance with embodiments of the present disclosure. As discussed, PLD 100 includes a plurality of logic blocks 104 that include various components to provide logic and arithmetic functionality. In the illustrated embodiment, logic block 104 includes, for example, a plurality of programmable logic blocks 104A, a plurality of routing resources 104B, and a plurality of programmable routing resources 104C. Figure 2In the example embodiment shown, the logic block 104 includes a plurality of logic cells 200 that can be interconnected internally within the logic block 104 and / or externally using the routing resources 180. For example, each logic cell 200 can include various components such as a lookup table (LUT) 202, a mode logic circuit 204, registers 206 (e.g., flip-flops or latches), and various programmable multiplexers (e.g., programmable multiplexers 212 and 214) for selecting desired signal paths for and / or between logic cells 200. In this example, the LUT 202 accepts four inputs 220A-220D, which makes it a four-input LUT (which can be abbreviated as a “4-LUT” or “LUT4”) that can be programmed by configuration data for the PLD 100 to implement any suitable logic operation having four or fewer inputs. The mode logic 204 can include various logic elements and / or additional inputs, such as input 220E, to support various modes of functionality, as described herein. In other examples, the LUT 202 can be any other suitable size with any other suitable number of inputs for a particular implementation of a PLD. In some embodiments, different logic blocks 104 and / or different logic cells 200 can be provided with different sizes of LUTs.

[0026] In some embodiments, the output signals 222 from the LUT 202 and / or the mode logic 204 can be conveyed through the registers 206 to provide output signals 233 of the logic cell 200. In various embodiments, the output signals 223 from the LUT 202 and / or the mode logic 204 can be conveyed directly to the output 223, as shown. Depending on the configuration of the multiplexers 210-214 and / or the mode logic 204, the output signals 222 can be temporarily stored (e.g., latched) in the latches 206 according to control signals 230. In some embodiments, the configuration data for the PLD 100 can configure the output 223 and / or 233 of a logic cell 200 to be provided as one or more inputs to another logic cell 200 (e.g., in another logic block or the same logic block) in a hierarchical or cascaded arrangement (e.g., including multiple stages) to configure logic operations that cannot be implemented in a single logic cell 200 (e.g., logic operations having too many inputs to be implemented by a single LUT 202). Further, as described herein, the logic cells 200 can be implemented with multiple outputs and / or interconnections to facilitate selectable modes of operation.

[0027] Mode logic circuit 204 can be used in some configurations of PLD 100 to efficiently implement arithmetic operations, such as adders, subtracters, comparators, counters, or other operations, to efficiently form some extended logic operations (e.g., higher order LUTs, multi-bit data on operations), to efficiently implement relatively small RAMs, and / or to allow selection between logic, arithmetic, extended logic, and / or other selectable modes of operation. In this regard, mode logic circuit 204 across multiple logic cells 202 can be chained together to communicate carry-in signals 205 and carry-out signals 207 and / or other signals (e.g., output signals 222) between adjacent logic cells 202, as described herein. In Figure 2 In the example shown, carry-in signals 205 can be communicated to mode logic circuit 204 directly, for example, or can be communicated to mode logic circuit 204 by configuring one or more programmable multiplexers, as described herein. In some embodiments, mode logic circuit 204 can be chained across multiple logic blocks 104.

[0028] Figure 2 The logic cell 200 shown is merely an example, and logic cells 200 according to different embodiments can include different combinations and arrangements of PLD components. Moreover, while Figure 2 A logic block 104 is shown having eight logic cells 200, but logic blocks 104 according to other embodiments can include fewer logic cells 200 or more logic cells 200. Each of the logic cells 200 of a logic block 104 can be used to implement a portion of a user design implemented by PLD 100. In this regard, PLD 100 can include many logic blocks 104, each of which can include logic cells 200 and / or other components used to collectively implement a user design.

[0029] As described further herein, when PLD 100 is configured to implement a user design, portions of the user design can be adjusted to occupy fewer logic cells 200, fewer logic blocks 104, and / or have less of a burden on routing resources 180. Such adjustments according to various embodiments can identify certain logic, arithmetic, and / or extended logic operations to be implemented in a plurality of embodiments of arrangements of logic cells 200 and / or logic blocks 104 that are occupied. As described further herein, an optimization process can route various signal connections associated with arithmetic / logic operations described herein such that logic, ripple arithmetic, or extended logic operations can be implemented into one or more logic cells 200 and / or logic blocks 104 to be associated with the aforementioned arithmetic / logic operations.

[0030] Figure 3 A design process 300 for a PLD according to embodiments of the present disclosure is shown. For example, Figure 3The process of FIG. 3 can be performed by system 130 running the Lahice Diamond software to configure PLD 100. In some embodiments, Figure 3 The various files and information referenced in FIG. 3 can be stored, for example, in one or more databases and / or other data structures in memory 134, machine-readable medium 136, and / or other data constructs. In various embodiments, such files and / or information can be encrypted or otherwise secured when stored and / or transported to PLD 100 and / or other devices or systems.

[0031] In operation 310, system 130 receives a user design specifying desired functionality of PLD 100. For example, a user can interact with system 130 (e.g., through user input device 137 and hardware description language (HDL) code representing the design) to identify various features of the user design (e.g., high-level logic operations, hardware configurations, and / or other features). In some embodiments, the user design can be provided in a register transfer level (RTL) description (e.g., a gate-level description). System 130 can perform one or more rule checks to confirm that the user design describes a valid configuration of PLD 100. For example, system 130 can reject invalid configurations and / or request that the user provide new design information, as appropriate.

[0032] In operation 320, system 130 synthesizes the design to create a netlist (e.g., a synthesized RTL description) that identifies the abstract logic implementation of the user design as a plurality of logic components (e.g., also referred to as netlist components), which can include programmable components and hard IP components of PLD 100. In some embodiments, the netlist can be stored in a native generic database (NGD) file in electronic design interchange format (EDIF).

[0033] In some embodiments, synthesizing the design into a netlist in operation 320 can involve converting (e.g., translating) the high-level description of logic operations, hardware configurations, and / or other features in the user design into a set of PLD components (e.g., logic blocks 104, logic cells 200, and other components of PLD 100 configured for logic, arithmetic, or other hardware functionality to implement the logic of the user design) and their associated interconnections or signals. Depending on the embodiment, the converted user design can be represented as a netlist.

[0034] In some embodiments, synthesizing the design into a netlist in operation 320 can also involve performing an optimization process on the user design (e.g., the user design is converted / translated into a set of PLD components and their associated interconnections or signals) to reduce the consumption of propagation delay, PLD resources, and routing resources, and / or to otherwise optimize the performance of the PLD when configured to implement the user design. Depending on the embodiment, the optimization process can be performed on the netlist representing the converted / translated user design. Depending on the embodiment, the optimization process can represent the optimized user design in the netlist (e.g., to produce an optimized netlist).

[0035] In some embodiments, the optimization process can include optimizing certain instances of logic function operations, ripple arithmetic operations, and / or spread logic function operations that would occupy multiple configurable PLD components (e.g., logic cells 200, logic blocks 104, and / or routing resources 180) when the PLD is configured to implement the user design. For example, the optimization process can include detecting multiple modes or configurable logic cells that implement logic function operations, ripple arithmetic operations, spread logic function operations, and / or corresponding routing resources of the user design, swapping the operational modes of the logic cells implementing the various operations to reduce the number of PLD components and / or routing resources used to implement the operations and / or to reduce the propagation delay associated with the operations, and / or reprogramming the corresponding LUTs and / or mode logic to account for the swapped operational modes.

[0036] In another example, the optimization process can include detecting spread logic function operations and / or corresponding routing resources in the user design, implementing the spread logic operation as a multi-mode or switchable logic cell having a single physical logic cell output, routing or coupling the logic cell output of a first set of logic cells to an input of a second set of logic cells to reduce the number of PLD components and / or routing resources used to implement the spread logic operation and / or to reduce the propagation delay associated with the spread logic operation, and / or programming the corresponding LUTs and / or mode logic to implement the spread logic function operation with at least the first set of logic cells and the second set of logic cells.

[0037] In another example, the optimization process can include detecting multiple modes or configurable logic cells that implement logic function operations, ripple arithmetic operations, spread logic function operations, and / or corresponding routing resources in the user design, swapping the operational modes of the logic cells implementing the various operations to provide programmable registers along signal paths within the PLD to reduce the propagation delay associated with the signal paths, and reprogramming the corresponding LUTs, mode logic, and / or other logic cell control bits / registers to account for the swapped operational modes and / or programming the programmable registers to store or latch signals on the signal paths.

[0038] In operation 330, system 130 performs a mapping process that identifies components of PLD 100 that can be used to implement the user design. In this regard, system 130 can map the optimized netlist (e.g., stored in operation 320 as a result of the optimization process) to various types of components (e.g., logic blocks 104, logic cells 200, embedded hardware, and / or other portions of PLD 100) and their associated signals (e.g., in a logical manner, but not yet assigned placement or routing) provided by PLD 100. In some embodiments, the mapping can be performed on one or more previously stored NGD files, with the mapping results stored as a physical design file (e.g., also referred to as an NCD file). In some embodiments, the mapping process can be performed as part of the synthesis process in operation 320 to produce a netlist mapped to PLD components.

[0039] In operation 340, system 130 performs a placement process to assign the mapped netlist components to specific physical components (e.g., to specific logic cells 200, logic blocks 104, routing resources 180, and / or other physical components of PLD 100) that reside at particular physical locations of PLD 100, and thus determine a layout for PLD 100. In some embodiments, the placement can be performed on one or more previously stored NCD files, with the placement results stored as another physical design file.

[0040] In operation 350, system 130 performs a routing process to route connections between components of PLD 100 (e.g., using routing resources 180) based on the placement layout determined in operation 340 to implement physical interconnections between the placed components. In some embodiments, the routing can be performed on one or more previously stored NCD files, with the routing results stored as another physical design file.

[0041] In various embodiments, routing connections in operation 350 can further involve performing an optimization process on the user design to reduce propagation delay, consumption of PLD resources and / or routing resources, and / or otherwise optimize performance of the PLD when configured to implement the user design. In some embodiments, the optimization process can be performed on the physical design file representing the translated user design, and the optimization process can represent the optimized user design in the physical design file (e.g., to produce an optimized physical design file).

[0042] In some embodiments, the optimization process can include optimizing certain instances of logic function operations, ripple arithmetic operations, and / or extended logic function operations that will occupy multiple configurable PLD components (e.g., logic cells 200, logic blocks 104, and / or routing resources 180) when the PLD is configured to implement the user design. For example, the optimization process can include detecting multiple modes or configurable logic cells that implement logic function operations, ripple arithmetic operations, extended logic function operations, and / or corresponding routing resources in the user design, interchanging the operational modes of the logic cells implementing the various operations to reduce the number of PLD components and / or routing resources used to implement the operations and / or reduce the propagation delay associated with the operations, and / or reprogramming the corresponding LUTs and / or mode logic to account for the interchanged operational modes.

[0043] In another example, the optimization process can include detecting an extended logic function operation and / or corresponding routing resources in the user design, implementing the extended logic operation as a multi-mode or switchable logic cell having a single physical logic cell output, routing or coupling the logic cell output of a first set of logic cells to an input of a second set of logic cells to reduce the number of PLD components and / or routing resources used to implement the extended logic operation and / or reduce the propagation delay associated with the extended logic operation, and / or programming the corresponding LUTs and / or mode logic to implement the extended logic function operation using at least the first set of logic cells and the second set of logic cells.

[0044] In another example, the optimization process can include detecting multiple modes or configurable logic cells that implement logic function operations, ripple arithmetic operations, extended logic function operations, and / or corresponding routing resources in the user design, interchanging the operational modes of the logic cells implementing the various operations to provide programmable registers along signal paths within the PLD to reduce the propagation delay associated with the signal paths, and reprogramming the corresponding LUTs, mode logic, and / or other logic cell control bits / registers to account for the interchanged operational modes and / or programming the programmable registers to store or latch signals on the signal paths.

[0045] Changes in the routing can be propagated back to previous operations, such as synthesis, mapping, and / or placement, to further optimize various aspects of the user design.

[0046] Accordingly, after operation 350, one or more physical design files can be provided that specify the user design after synthesis (e.g., conversion and optimization), mapping, placement, and routing (e.g., further optimization) have been performed for the PLD 100 (e.g., by combining the results of the corresponding previous operations). In operation 360, the system 130 generates configuration data for the user design after synthesis, mapping, placement, and routing. In various embodiments, such configuration data can be encrypted, signed, and / or otherwise protected as part of such generation process, as more fully described herein. In operation 370, the system 130 configures the PLD 100 with the configuration data by, for example, loading a configuration data bitstream (e.g., a "configuration" or "configuration image") into the PLD 100 through the connection 140. Such configuration can be provided in, for example, encrypted, signed, or unsecured / unauthenticated form, and the PLD 100 can be configured to treat secure and unsecure configurations differently, as described herein. Moreover, the PLD 100 can be implemented as a remote PLD and the connection 140 can include one or more wired and / or wireless networks and / or communication links disposed between the PLD 100 and the system 130, as described herein with respect to Figures 4-7 more fully described herein.

[0047] Figure 4 A block diagram of a host device 440 including a remote PLD 410 is shown, in accordance with embodiments of the present disclosure. In various embodiments, the remote PLD 410 can be implemented by elements similar to those described with respect to the PLD 100 in Figure 1 , but with additional configurable and / or hard IP elements configured to facilitate operation and / or remote programming of the remote PLD 410 within a special computing application and / or architecture, such as the host device 400, or communication therewith, as described herein.

[0048] For example, as shown by the embodiment illustrated in Figure 4 , the remote PLD 410 can include the PLD fabric 400, programmable I / O 404, and / or other integrated circuit (IC) modules 406 linked through various buses to a non-volatile memory (NVM) 420, all of which can be implemented on a monolithic IC, as shown. More generally, the PLD fabric 400 can be implemented by any of the various elements described with respect to the PLD 100, and can be configured using a design process similar to the design process 300 described with respect to Figure 3 the PLD 100 in Figure 4The various hard IP elements of the winning identity can receive, decrypt, authenticate, and / or validate the received configuration, or otherwise communicate with the management system for the remote PLD 410, as described herein.

[0049] In various embodiments, the host device 440 can include a communication module 450 and / or other host device modules 460, which can be employed by the remote PLD 410 and configured to, for example, facilitate remote management of the remote PLD 410, or facilitate special host device applications, as described herein. The host device 440 can be implemented as a smart phone, a laptop computer, a tablet computer, a desktop computer, a smart environmental sensor, a home automation device (e.g., a sensor and / or actuator), a deployed but otherwise unattended equipment controller module (e.g., for a mountaintop weather station, an unmanned farm equipment, a solar-powered / unmanned aerial vehicle, and a boat), and / or as various other host devices capable of interfacing with the remote PLD 410, as described herein.

[0050] The NVM 420 can be implemented as a hard IP resource configured to provide secure non-volatile storage of data for facilitating operation of the remote PLD 410. The NVM 420 can include a plurality of different sectors, such as one or more configuration image sectors, device key sectors (e.g., AES key sectors and separate public key / key pair sectors), user flash (UFM) sectors, and / or other defined storage sectors. For example, the configuration image sectors can each store a configuration for the PLD fabric 400 so as to allow them to be selected (e.g., based on version or date) and used to program the PLD fabric 400. Trim sectors can be used to store manufacturer trim, device identifier, device class identifier, and / or other data specific to a particular remote PLD 410, such as a modifiable customer-specific order part number and / or a generated customer ID number. The device key sectors can be used to store encryption / decryption keys, public / private keys, and / or other security keys specific to a particular remote PLD 410. The UFM sectors can be used to store user data generally accessible by the PLD fabric 400, such as configuration- or application-specific security keys, certificates, and / or other secure user data. Any one or more individual elements, portions, or sectors of the NVM 420 can be implemented as, for example, a configurable memory, or a one-time programmable (OTP) memory, as described herein.

[0051] Programmable I / O 404 can be implemented as at least partially configurable resources and / or hard IP resources configured to provide or support communication links between PLD fabric 400 and external controllers, memories, and / or other devices such as communication module 450, e.g., across bus 402 (e.g., an internal and / or integrated communication bus configured to link portions of PLD fabric 400 to programmable I / O 404, NVM 420, and / or other elements of remote PLD 410) and in accordance with one or more external bus interfaces and / or protocols 408. Programmable I / O 404 can also be configured to support communication between PLD fabric 400 and / or NVM 420 across bus 402 and / or external bus interface / protocol 408 with communication module 450 and / or other elements of host device 440 (e.g., in addition to or instead of external system 130 / machine-readable medium 136), as described herein. In some embodiments, bus 402 and / or programmable I / O 404 can be integrated with PLD fabric 400. More generally, one or more elements of remote PLD 410 shown as separate in Figure 4 one or more elements of remote PLD 410 can be integrated with and / or within one another.

[0052] Other IC modules 406 can be implemented as hard and / or configurable IP resources configured to facilitate operation of remote PLD 410. For example, other IC modules 406 can include a security engine implemented as a hard IP resource configured to provide various security functionality used by PLD fabric 400 and / or host device 440. Other IC modules 406 can also include a configuration engine implemented as a hard IP resource configured to manage configuration of and / or communication between various elements of remote PLD 410, including managing or controlling configuration of elements of remote PLD 410, boot-up of PLD fabric 400, and traffic control of the entire remote PLD 410. In some embodiments, other IC modules 406 can include one or more communication modules (e.g., similar to communication module 450 of host device 440) integrated with remote PLD 410 and can perform various operations or subsets of operations to form and / or manage communication links over wired and / or wireless networks, as described herein.

[0053] In further embodiments, other IC modules 406 may, for example, include one or more additional external access buses implemented in accordance with one or more of JTAG, I2C, SPI, and / or other external access buses or protocols configured to provide access to and / or from communication module 450 and / or other host device modules 460. For example, while Figure 4The NVM 420 or similar additional hard IP resource can be integrated with the host device 440 (e.g., as other host device modules 460) and accessible (e.g., through the PLD fabric 400 and / or other elements of the PLD fabric 400) through the internal bus 402, the external bus interface / protocol 408, and / or any one or combination of such external access buses or protocols.

[0054] In various embodiments, the communication module 450 can be implemented as a network communication IC configured to form a communication link to a remote external device (e.g., over one or more wired and / or wireless networks) for managing operation of the remote PLD 410. For example, in some embodiments, the communication module 450 can be implemented as a wireless communication module configured to support a wireless communication link to a communication network, and thus to a remote PLD management system or a PLD configuration agent of such a remote PLD management system communicatively coupled to such a communication network (e.g., formed in accordance with WiFi, Bluetooth, Zigbee, Zwave, near field communication (NFC), cellular, and / or other open and / or proprietary wireless communication protocols), as described herein. In such embodiments, the communication module 450 can be configured to manage various security features of such a wireless communication link (e.g., establish communication link credentials, employ communication link credentials to establish a wireless communication link, negotiate encryption keys for encrypted communication tunnels established over such a wireless communication link, such as transport layer security (TLS)), for example, and / or can be configured to be controlled by the remote PLD 410 and / or other host device modules 460 to manage such security features. In particular, the remote PLD 410 can be configured to control operation of the communication module 450 through the external bus interface / protocol 408 and / or other external bus interface / protocols implemented by the remote PLD 410 and / or the host device 440, in place of control that would otherwise be performed by the host device 440.

[0055] Other host device module 460 may include various computing, sensor, and / or actuator elements configured to implement specific host device applications, such as remote sensor applications, remote controller applications, and / or remote computing applications, as described herein. Other host device module 460 may also include various other communication buses, power storage and delivery elements, and user interfaces (e.g., buttons, keyboards, mice, touchpads, and / or displays / touchscreen displays) to support such host device applications. In one embodiment, other host device module 460 includes an electrical characteristic sensor configured to detect and / or measure the electrical state of a transducer element (e.g., also an element of other host device module 460) used to measure environmental conditions associated with host device 440. In another embodiment, other host device module 460 includes various electronic devices typically found in, for example, smartphones, laptops, tablets, and / or desktop computers and / or in smart environmental sensors, home automation devices (e.g., sensors and / or actuators), equipment controller modules, unmanned aerial vehicles or vessels, various types of industrial equipment, and / or other host devices, as described herein.

[0056] Figure 5 A block diagram of a remote PLD management system 500 according to an embodiment of the present disclosure is shown. For example, one or more elements of the management system 500 may be configured to perform actions related to... Figures 6-7 The description refers to at least a part of the management process. Figure 5 In the illustrated embodiment, the remote PLD management system 500 includes a PLD configuration publisher 510 and a PLD configuration agent 520, which are configured to communicate with each other via a communication link 512 and a communication network 514. Generally, the communication link 512 may be implemented by one or more wired and / or wireless communication links configured to support data communication to and from the communication network 514, and the communication network 514 may be implemented by one or more local area networks and / or wide area networks (e.g., internet service providers, cellular networks, and / or the internet) configured to typically support data communication. Each of the remaining elements or nodes of the remote PLD management system 500 may generally be implemented as a host device 440, each host device 440 having a scope similar to... Figure 4 The host device 440 includes a remote PLD 410 configured to communicate with the PLD management system 500 and / or one or more components of the PLD management system 500 (including the PLD configuration agent 520) across communication link 512 and communication network 514 or communication link 522.

[0057] In various embodiments, the remote PLD management system 500 can be configured to manage provisioning, re-provisioning, debugging, telemetry reporting, and / or other operational aspects of the host device 440 associated with a configuration image for the remote PLD 410 for the host device 440 and / or associated with various secure communication mechanisms for remote PLDs and / or host devices similar to the remote PLD 410 and / or the host device 440. For example, in some embodiments, the management system 500 can include an optional credential generator 530, which can be implemented as a user input device (e.g., a smartphone, a tablet computer, a laptop computer, a desktop computer) that is capable of forming an indirect communication link 516 and / or a direct communication link 524 to the host device 440 to provide a communication link credential to the host device 440 to enable the host device 440 to establish a communication link 512 to or through the communication network 514 and / or a communication link 522 to one or more elements or nodes of the remote PLD management system 500, such as to the PLD configuration agent 520 and / or the PLD configuration publisher 510. Such a communication link credential can include a wireless communication credential, a pre-shared TLS or other certificate, a URL or other proxy identifier associated with one or more elements or nodes of the remote PLD management system 500, a public or private key associated with a protected configuration image generated by the PLD configuration publisher 510 and secured (encrypted and / or signed) by the PLD configuration publisher 510 and / or the PLD configuration agent 520, and / or other communication link credentials as described herein.

[0058] The PLD configuration publisher 510 can be implemented as one or more servers each having one or more processors and / or memories, the servers configured to generate protected configuration images for the PLD fabric 400 of the remote PLD 410 and / or the PLD fabric 400 associated with the host device 440, similar to the design process 300 of Figure 3 The PLD configuration publisher 510 can also be configured to provide such protected configuration images, for example, directly to each host device 440 and / or remote PLD 410 or to the PLD configuration agent 520 for management of distribution to the host device 440. In some embodiments, the PLD configuration publisher 510 can be configured to generate a modified protected configuration image for the PLD fabric 400 that is designed to identify, correct, and / or mitigate operational anomalies detected in operation of the remote PLD 410 and / or the host device 440, as described herein.

[0059] The PLD configuration agent 520 can be implemented as one or more servers, each with one or more processors and / or memory, configured to manage a group of remote PLDs 410 (e.g., embedded in host device 440 and / or integrated with host device 440), such as Figure 5 As shown. For example, PLD configuration agent 520 can be implemented as one or more agent instances running within a cloud computing infrastructure. In a particular embodiment, PLD configuration agent 520 can be configured to receive operational alarms from remote PLD 410 / host device 440, generate operational alarm reports based on such operational alarms, and provide the operational alarm reports to PLD configuration publisher 510. More generally, PLD configuration agent 520 can be configured to distribute a protected configuration image to remote PLD 410 / host device 440, for example, based on various communication link credentials (e.g., provided by one or more of PLD configuration publisher 510, host device 440, or credential generator 530).

[0060] In some embodiments, the PLD configuration agent 520 may be implemented as a Message Queuing Telemetry Transport (MQTT) agent implemented via communication links 512 and / or 522 and / or communication network 514. The MQTT agent is configured to perform various extended management operations according to publish-subscribe messaging protocols (e.g., forwarding and filtering). For example, the PLD configuration agent 520 may be configured to support hierarchical topics with corresponding hierarchical access control sanctions, such as those bound to specific device identifiers (e.g., specific remote PLDs and / or host devices) or device category identifiers (e.g., scopes or categories specific to remote PLDs and / or host devices, such as those associated with specific manufacturers, retailers, geographic regions, and / or other scopes or categories of devices). In some embodiments, the PLD configuration agent 520 may be configured to support the formation of encrypted communication tunnels (e.g., such as TLS tunneling and / or certificate processing) between, for example, the PLD configuration agent 520 and the PLD configuration publisher 510, and between the PLD configuration agent 520 and one or more host devices 440.

[0061] In additional embodiments, the PLD configuration broker 520 can be configured to provide compression and / or segmentation of the protected configuration image in order to provide protected configuration images greater than 128KB or 256KB to the host device 440 over the MQTT protocol (e.g., and including various message size limitations). For example, the PLD configuration broker 520 can be configured to provide message compression implemented as run-length encoding of the protected configuration image provided to the host device 440. In various embodiments, the remote PLD 410 and / or the host device 440 can be configured to receive such compressed and / or segmented protected configuration image messages and reconstruct the protected configuration image using appropriate decoding processes and / or by storing the protected configuration image in the NVM 420. In particular embodiments, the PLD configuration broker 520 can be configured to provide various quality of service (QoS) features.

[0062] In some embodiments, either or both of the PLD configuration publisher 510 and the PLD configuration broker 520 can be configured to provide a server-based user interface (SBUI) configured to facilitate discovery and reservation of the host device 440. For example, such an SBUI can be configured to generate a statistics database including detailed communication information associated with the host device 440 and / or the remote PLD 410, such as discovery logs (e.g., by device identifier, device class identifier, MAC address, time of communication, and / or other communication log information), downloads of protected configuration images, and / or other communication information associated with the management system 500. In various embodiments, the PLD configuration publisher 510 and the PLD configuration broker 520 can be integrated with one another.

[0063] More generally, the remote PLD management system 500 can omit the PLD configuration broker 520 and be configured to perform various management operations using the PLD configuration publisher 510 and / or other nodes of the remote PLD management system 500 without relying on a broker architecture. For example, the remote PLD management system 500 and / or various nodes of the remote PLD management system 500 can be configured to receive operational alerts from the remote PLD 410 / host device 440, generate operational alert reports based on such operational alerts, and / or provide the operational alert reports to any other element of the remote PLD management system 500. More generally, the remote PLD management system 500 can be configured to distribute protected configuration images to the remote PLD 410 / host device 440, e.g., according to various communication link credentials (e.g., provided by one or more of the PLD configuration publisher 510, the remote PLD 410, the host device 440, or the credential generator 530).

[0064] In some embodiments, the remote PLD management system 500 can be configured to perform various extended management operations in accordance with a variety of different message protocols and / or architectures, including Hypertext Transfer Protocol (HTTP), Hypertext Transfer Protocol Secure (HTTPS), MQTT, Advanced Message Queuing Protocol (AMQP), Constrained Application Protocol (CoAP), Extensible Messaging and Presence Protocol (XMPP), Representational State Transfer (REST), RabbitMQ, Google Cloud, Kafka, ZeroMQ, gRPC, Simple Queue Service (SQS), and / or a variety of different publish-subscribe message protocols (e.g., forwarding and filtering), each of which can or can not include or require the implementation of a message broker or instance, and each of which can be implemented over the communication links 512 and / or 522 and / or the communication network 514. For example, the remote PLD management system 500 can be configured to support hierarchical topics with corresponding hierarchical access restrictions, e.g., which can be bound to special device identifiers (e.g., specific to a special remote PLD and / or host device) or device class identifiers (e.g., specific to a range or class of remote PLDs and / or host devices, such as those associated with a special manufacturer, retailer, geographic region, and / or other range or class of devices). In some embodiments, the remote PLD management system 500 can be configured to support the formation of encrypted communication tunnels (e.g., such as TLS tunnels and / or certificate handling) between any element of the remote PLD management system 500 and one or more host devices 440.

[0065] In additional embodiments, the remote PLD management system 500 can be configured to provide compression and / or segmentation of protected configuration images in order to provide protected configuration images greater than 128KB or 256KB to the host devices 440 over any selected one or more protocols (e.g., and including a variety of message size limitations). For example, the remote PLD management system 500 can be configured to provide message compression implemented as run-length encoding of protected configuration images provided to the host devices 440. In various embodiments, the remote PLDs 410 and / or host devices 440 can be configured to receive such compressed and / or segmented protected configuration image messages and reconstruct the protected configuration images using appropriate decoding processes and / or by storing the protected configuration images in NVM (e.g., NYM 420) within the remote PLDs 410 and / or host devices 440. In special embodiments, the remote PLD management system 500 can be configured to provide various Quality of Service (QoS) features.

[0066] In some embodiments, the remote PLD management system 500 may be configured to provide a server-based user interface (SBUI) configured to facilitate the discovery and retention of the host device 440. For example, such an SBUI may be configured to generate a statistical database including detailed communication information associated with the host device 440 and / or the remote PLD 410, such as discovery logs (e.g., via device identifier, device class identifier, MAC address, communication time and / or other communication log information), downloads of protected configuration images, and / or other communication information associated with the remote PLD management system 500.

[0067] Figure 6 The management process of a remote PLD integrated with a host device according to embodiments of the present disclosure is illustrated. In some embodiments, Figure 6 The operation can be implemented by and Figures 1-5 The software instructions executed by the corresponding electronic device, module, and / or associated logic device described herein. More generally, Figure 6 The operation can be implemented using any combination of software instructions and / or electronic hardware (e.g., inductors, capacitors, amplifiers, actuators, or other analog and / or digital components). It should be understood that any step, substep, subprocess, or block of process 600 can be implemented in a manner different from... Figure 6 The illustrated embodiments are performed in the order or arrangement shown. For example, in other embodiments, one or more blocks may be omitted from process 600, and other blocks may be included. Furthermore, block inputs, block outputs, various sensor signals, sensor information, calibration parameters, and / or other operating parameters may be stored in one or more memories before moving to the next part of process 600. While process 600 is a reference... Figures 1-5 The system, devices, and components described herein may be used for process 600, but process 600 may be performed by other systems, devices, and components, and includes different choices of electronic systems, devices, components, assemblies, and / or arrangements. At the start of process 600, various system parameters may be populated, for example, by previous execution of a process similar to process 600, or may be initialized to zero and / or one or more values ​​corresponding to typical, stored, and / or learned values ​​derived from past operations of process 600, as described herein.

[0068] In block 610, the logic device generates a protected configuration for the remote PLD. For example, the PLD configuration publisher 510 and / or the external system 130 can be configured to generate a protected configuration image for the remote PLD 410 of the user interface 440. In various embodiments, such a configuration image can be generated based at least in part on a device identifier and / or a device class identifier corresponding to the remote PLD 410 that resides in the PLD configuration publisher 510 or the external system 130, the NVM 420 of the remote PLD 410, the PLD configuration agent 520, and / or other nodes of the remote PLD management system 500. In some embodiments, such a configuration image can be protected by being encrypted and / or signed using public key encryption techniques, e.g., where an appropriate private / public key pair resides in the PLD configuration publisher 510 or the external system 130, and in the NVM 420 of the remote PLD 410, and where the public key is stored prior to deployment of the host device 440 prior to deployment or exchange of the remote PLD 410 over the communication link 512 or 514 and / or the communication network 514. In other embodiments, such a configuration image can be protected by encrypting the configuration image with a symmetric key that is stored / resides in both the PLD configuration publisher 510 or the external system 130, and in the NVM 420 of the remote PLD 410. In various embodiments, such encryption and / or signing can be performed at least in part by the PLD configuration agent 520 and / or other nodes of the remote PLD management system 500.

[0069] In block 620, the logic device receives the protected configuration from the PLD configuration publisher. For example, the PLD configuration agent 520 can be configured to receive the protected configuration image for the remote PLD 410 of the host device 440 from the PLD configuration publisher 510. In some embodiments, the PLD configuration publisher 510 and / or the PLD configuration agent 520 can be configured to establish a communication link 512 between one another, e.g., over the communication network 514, and communicate the protected configuration image over such communication link (e.g., the PLD configuration publisher 510 can provide the protected configuration image to the PLD configuration agent 520). In particular embodiments, the communication link 512 can be implemented as a secure communication link, such as a TLS communication link or other encrypted communication tunnel established via a key exchange, e.g., over the communication link 512. In alternative embodiments, the PLD configuration agent 520 can be configured to receive an unprotected configuration image and protect the configuration using one or more of the protection techniques described with respect to block 610. In embodiments in which the remote PLD management system 500 lacks a PLD configuration agent 520, for example, the process 600 can omit block 620, or the PLD configuration publisher 510 and / or other nodes of the remote PLD management system 500 can be configured to receive the configuration and protect the configuration using one or more of the protection techniques described with respect to block 610 (which can layer on top of the protection provided in block 610).

[0070] In block 630, the logic device provides the protected configuration to the remote PLD. For example, the PLD configuration agent 520 can be configured to provide the protected configuration image received and / or received and protected in block 620 to the remote PLD 410 of the host device 440 via the communication module 450. In some embodiments, the host device 440 and / or the remote PLD 410 can be configured to form a communication link 512 and / or 522 with the PLD configuration agent 520 via the communication module 450 of the host device 440 over the communication network 514. For example, forming such a communication link can include the remote PLD 410 controlling the communication module (e.g., the communication module 450) via the programmable I / O 404 and / or the bus 402 and / or 408 into a hotspot mode to allow the credential generator 530 to provide a communication link credential (e.g., over the indirect communication link 516 and / or the direct communication link 524) to form the communication link 512 and / or 522 over or to the communication network 514 and thus to the PLD configuration agent 520. Forming such a communication link can include the remote PLD 410 controlling the communication module 450 to establish an encrypted communication tunnel over such a communication link. After forming such a communication link, the remote PLD 410 of the host device 440 can be configured to receive the protected configuration image from the PLD configuration agent 520 as described herein. In embodiments where the remote PLD management system 500 lacks a PLD configuration agent 520, the PLD configuration publisher 510 and / or other nodes of the remote PLD management system 500 can be configured to provide the protected configuration to the remote PLD 410 of the host device 440 via a communication module accessible by the remote PLD 410 and / or according to a communication link formation protocol described herein.

[0071] In block 640, the logic device programs the remote PLD according to the protected configuration. For example, the remote PLD 410 can be configured to program the PLD fabric 400 and / or the NVM 420 of the remote PLD 410 according to the protected configuration image provided by elements of the remote PLD management system 500 (including the PLD configuration agent 520) and received by the remote PLD 410 in block 630 (e.g., generated by the PLD configuration publisher 510 in block 610), similar to the programming process described with respect to the design process 300. In various embodiments, the host device 440 and / or the remote PLD 410 can be configured to store the protected configuration image in the NVM 420 of the remote PLD 410 and / or couple the protected configuration image provided by the communication module 520 to the PLD fabric 400 through the programmable I / O 404 of the remote PLD 410 (e.g., via the bus 408 and / or 402) as described herein. Figure 3

[0072] ​In some embodiments, host device 440 and / or remote PLD 410 may be configured to authenticate such protected configuration images before programming PLD structure 400. In one embodiment, where the protected configuration image is signed using a private key associated with PLD configuration publisher 510 (e.g., signed by PLD configuration publisher 510, PLD configuration agent 520, and / or some other component of remote PLD management system 500), the corresponding public key may be stored in NVM 420 of remote PLD 410, and authentication may include using the public key to verify that the protected configuration image was signed using the private key associated with PLD configuration publisher 510. In another embodiment, where the protected configuration image includes device identifier and / or device class identifier 410 associated with a remote PLD, the device identifier and / or device class identifier may be stored in NVM 420 of remote PLD 410, and authentication may include comparing the device identifier and / or device class identifier of the protected configuration image with the device identifier and / or device class identifier stored in NVM 420. Symmetric or asymmetric decryption can also be performed after such authentication occurs.

[0073] Figure 7 A management process for a remote PLD integrated with a host device is illustrated according to embodiments of the present disclosure. In some embodiments, Figure 7 The operation can be implemented by and Figures 1-5 The software instructions executed by the corresponding electronic device, module, and / or associated logic device described herein. More generally, Figure 7 The operation can be implemented using any combination of software instructions and / or electronic hardware (e.g., inductors, capacitors, amplifiers, actuators, or other analog and / or digital components). It should be understood that any step, substep, subprocess, or block of process 700 can be implemented in a manner different from... Figure 7 The illustrated embodiments are performed in the order or arrangement shown. For example, in other embodiments, one or more blocks may be omitted from process 700, and other blocks may be included. Furthermore, block inputs, block outputs, various sensor signals, sensor information, calibration parameters, and / or other operating parameters may be stored in one or more memories before moving to the next part of process 700. While process 700 is a reference... Figures 1-5The process 700 can be performed by other systems, devices, and elements than those described, and different selections of electronic systems, devices, elements, components, and / or arrangements are included. At the start of the process 700, various system parameters can be populated, for example, by a previous execution of a process similar to the process 700, or can be initialized to zero and / or one or more values corresponding to typical, stored, and / or learned values derived from past operation of the process 700, as described herein.

[0074] In block 710, the logic device receives an operational alert from the remote PLD. For example, the PLD configuration publisher 410, the PLD configuration agent 520, and / or other nodes of the remote PLD management system 500 can be configured to receive, from the remote PLD 410 (e.g., via the communication module 450), an operational alert corresponding to an operational anomaly associated with the PLD fabric 400. In some embodiments, the remote PLD 410 and / or the host device 440 can be configured to detect an operational anomaly associated with the PLD fabric 400 (e.g., using one or more other IC modules 406 and / or other host device modules 460), generate an operational alert based at least in part on the detected operational anomaly and / or telemetry data associated with operation of the remote PLD 410 and / or the detected operational anomaly, and provide the operational alert to the PLD configuration publisher 410, the PLD configuration agent 520, and / or other nodes of the remote PLD management system 500, for example, via a communication link 512 and / or 514 established using the communication module 450, as described herein. Such operational anomalies can include, for example, unexpected reboots, unexpected data from sensor elements, computed-generated unexpected data, and / or other operational anomalies associated with operation of the remote PLD 410 and / or the host device 440. In various embodiments, the operational alert can include debug information associated with such detected operational anomalies, which can be generated by the PLD fabric 400 configured according to a special configuration image and stored in the NVM 420, for example.

[0075] In alternative embodiments, the PLD configuration publisher 410, the PLD configuration broker 520, and / or other nodes of the remote PLD management system 500 can be configured to issue a check status command to the remote PLD 410, e.g., such as prior to receiving an operational alert, or prior to receiving an operational confirmation from the remote PLD 410. Such operational confirmations can be configured to convey a lack of operational anomalies via the communication links 512 and / or 514 established using the communication module 450 to the PLD configuration publisher 410, the PLD configuration broker 520, and / or other nodes of the remote PLD management system 500, such as telemetry data indicative of a normal or expected operational state for the remote PLD 410, as described herein. In various embodiments, the PLD configuration publisher 410, the PLD configuration broker 520, and / or other nodes of the remote PLD management system 500 can be configured to periodically poll one or more remote PLDs 410 and / or include a log of operational alerts and / or operational confirmations (e.g., cross-referenced by date and time / time stamp of such alerts / anomalies / confirmations) in an operational alert report.

[0076] In block 720, the logic device generates an operational alert report based on the received operational alerts. For example, the PLD configuration publisher 410, the PLD configuration broker 520, and / or other nodes of the remote PLD management system 500 can be configured to generate an operational alert report based at least in part on the operational alerts and / or operational confirmations provided by the remote PLD 410 and received by the PLD configuration publisher 410, the PLD configuration broker 520, and / or other nodes of the remote PLD management system 500 in block 710. In some embodiments, such an operational alert report can include any or all of the information (e.g., debug information) included in the received operational alerts and / or operational confirmations. In other embodiments, the PLD configuration publisher 410, the PLD configuration broker 520, and / or other nodes of the remote PLD management system 500 can be configured to aggregate multiple operational alerts provided by one or more remote PLDs 410 and / or host devices 440 into a single operational alert report. In further embodiments, the PLD configuration publisher 410, the PLD configuration broker 520, and / or other nodes of the remote PLD management system 500 can be configured to include additional management data associated with such operational alerts and / or operational confirmations, such as a time of receipt, a device identifier or device class identifier, a subject and / or sub- subject associated with each operational alert and / or operational confirmation, a list of all subjects and / or sub- subjects subscribed to by the remote PLD providing the operational alert and / or operational confirmation and / or provided by the PLD configuration publisher 410, the PLD configuration broker 520, and / or other nodes of the remote PLD management system 500, and / or additional management data, as described herein.

[0077] In block 730, the logic device provides the operational alert report to a PLD configuration publisher. For example, the PLD configuration agent 520 and / or other nodes of the remote PLD management system 500 can be configured to provide the operational alert report generated in block 720 to the PLD configuration publisher 510 over the communication link 512 and / or the communication network 514.

[0078] In block 740, the logic device generates a modified protected configuration for the remote PLD. For example, the PLD configuration publisher 510 can be configured to receive the operational alert report provided by the PLD configuration publisher 410, the PLD configuration agent 520, and / or other nodes of the remote PLD management system 500 in block 730 and generate a modified protected configuration image for the PLD fabric 400 based at least in part on the operational alert report and the device identifier and / or device class identifier corresponding to the remote PLD 410 (e.g., for authentication and verification purposes). In various embodiments, the modified protected configuration image can be configured to identify, correct, and / or mitigate the operational anomaly detected by the remote PLD 410 in block 710. For example, in some embodiments, the modified protected configuration image can be configured to generate additional or targeted debug information associated with the detected operational anomaly and stored in the NVM 420, to enable or disable functionality of the remote PLD 410 and / or the host device 440, and / or to generate a visible or audible alert to a user (e.g., via the other host device module 460) to notify the user to replace the remote PLD 410 and / or the host device 440 or to otherwise manually mitigate the detected operational anomaly. Once such a modified protected configuration image is generated, the PLD configuration publisher 510 can be configured to provide the modified protected configuration image to the PLD configuration agent 520 and / or other nodes of the remote PLD management system 500. More generally, block 740 can include any of the operations described with respect to block 610 of the process 600 in Figure 6

[0079] In block 750, the logic device receives the modified protected configuration from the PLD configuration publisher. For example, the PLD configuration agent 520 and / or other nodes of the remote PLD management system 500 can be configured to receive the modified protected configuration image generated in block 740 from the PLD configuration publisher 510. In various embodiments, the modified protected configuration image can be based at least in part on the operational alert report generated in block 720. More generally, block 750 can include any of the operations described with respect to block 620 of the process 600 in Figure 6

[0080] ​​In block 760, the logic device provides the modified protected configuration to the remote PLD. For example, the PLD configuration publisher 410, the PLD configuration broker 520, and / or other nodes of the remote PLD management system 500 can be configured to provide the modified protected configuration received in block 750 to the remote PLD 410 and / or the host device 440 via the communication module 450. More generally, block 760 can include any of the operations described with respect to block 630 of the process 600 in Figure 6

[0081] In block 770, the logic device programs the remote PLD according to the modified protected configuration. For example, the remote PLD 410 and / or the host device 440 can be configured to receive the modified protected configuration provided by the PLD configuration publisher 410, the PLD configuration broker 520, and / or other nodes of the remote PLD management system 500 in block 760, and program the PLD fabric 400 according to the modified protected configuration image. In various embodiments, the modified protected configuration image can be configured to identify, correct, and / or mitigate operational anomalies detected in block 710, as described herein. In some embodiments, the modified protected configuration image can be stored in the NVM 420 of the remote PLD 410 and / or coupled to the PLD fabric 400 through the programmable I / O 408 of the remote PLD 410. More generally, block 770 can include any of the operations described with respect to block 640 of the process 600 in Figure 6 Upon completion of such programming, the remote PLD 410 can be rebooted and / or operated according to the modified protected configuration.

[0082] Accordingly, by employing the systems and methods described herein, embodiments of the present disclosure are able to provide flexible and secure management of remote PLDs. Remote PLDs of a host device can be securely updated, debugged, and / or otherwise managed without risk of exposing customer data and with minimal need for user intervention. Furthermore, remote PLDs can be securely re-provisioned according to, for example, updated customer data or according to new customer applications without the need to return the remote PLD to the manufacturer.

[0083] ​Where applicable, various embodiments provided by the present disclosure can be implemented using hardware, software, or combinations of hardware and software. Also, where applicable, the various hardware components and / or software components set forth herein can be combined into composite components comprising software, hardware, and / or both without departing from the spirit of the present disclosure. Where applicable, the various hardware components and / or software components set forth herein can be divided into sub-components comprising software, hardware, and / or both without departing from the spirit of the present disclosure. Also, where applicable, the various hardware components and / or software components set forth herein can implement an ordered combination of acts to provide the features described herein without departing from the spirit of the present disclosure.

[0084] Software, in accordance with the present disclosure, such as non-transitory instructions, program code, and / or data, can be stored on one or more non-transitory machine-readable media. It is also contemplated that software identified herein can be implemented using one or more general purpose or special purpose computing systems, with or without coupled input and output devices that are selective ly activated and / or deactivated depending upon whether the computing system is on, off, sleeping, hibernating, etc.

[0085] The foregoing embodiments are illustrative rather than limiting in nature. It will be readily apparent to those skilled in the art that numerous modifications and adaptations can be made in accordance with the principles of the present disclosure without departing from its spirit. Accordingly, the scope of the present disclosure is not to be limited by the foregoing description only, but is to be understood broadly enough by the following claims.

Claims

1. A remote PLD management system, the system comprising: a remote PLD comprising a plurality of programmable logic blocks, PLBs, arranged in a PLD fabric and a programmable I / O coupled to the PLD fabric, wherein the remote PLD is configured to perform a computer-implemented method, the method comprising: forming, via a communication module of the remote PLD or a host device configured to interface with the remote PLD through the programmable I / O, a communication link between the remote PLD and a remote PLD management system node over a communication network, wherein the remote PLD is configured to form the communication link by subscribing, using a PLD configuration agent, to receive messages regarding one or more first topics through a publish-subscribe messaging protocol, wherein the one or more first topics are hierarchical topics corresponding to hierarchical access sanctions that are bound to a protected configuration image, wherein the hierarchical access sanctions are based on a device identifier or a device class identifier; receiving, through the PLD configuration agent, the protected configuration image associated with one of the one or more first topics from the remote PLD management system node over the communication link through the publish-subscribe messaging protocol; and programming the PLD fabric according to the protected configuration image, wherein the protected configuration image is stored in and / or retrieved from a non-volatile memory, NVM, of the remote PLD or the host device, and / or coupled to the PLD fabric through the programmable I / O and / or an external interface of the remote PLD.

2. The remote PLD management system of claim 1, wherein the remote PLD management system node comprises the PLD configuration agent, the PLD configuration agent configured to: receive, from a PLD configuration publisher of the remote PLD management system, the protected configuration image for the PLD fabric through the publish-subscribe messaging protocol; and provide the protected configuration image to the remote PLD and / or the host device via the communication link through the publish-subscribe messaging protocol, wherein the one or more first topics are associated with one or more identifiers, each identifier identifying at least one of the following related to the remote PLD management system: the host device; the remote PLD; a device class comprising the host device; and / or a remote PLD class comprising the remote PLD.

3. The remote PLD management system of claim 2, further comprising the PLD configuration publisher, wherein the PLD configuration publisher is configured to: generate the protected configuration image for the PLD fabric; and provide the protected configuration image to the PLD configuration agent, wherein the publish-subscribe messaging protocol comprises a Message Queue Telemetry Transport, MQTT, protocol, and wherein the one or more first topics are associated with at least one of: an identifier of the host device; a device class comprising the host device; and / or a remote PLD class comprising the remote PLD. an identifier of the device class, wherein the identifier of the device class is associated with a manufacturer, a retailer, and / or a geographic region; and / or an identifier of the remote PLD class, wherein the identifier of the remote PLD class is associated with a manufacturer, a retailer, and / or a geographic region.

4. The remote PLD management system of claim 1, wherein the remote PLD is further configured to perform operations comprising: detecting an operational anomaly associated with the remote PLD and / or the host device; generating an operational alert based at least in part on the detected operational anomaly; providing the operational alert to the remote PLD management system node; receiving a modified protected configuration image from the remote PLD management system node, wherein the modified protected configuration image is configured to identify, correct, and / or mitigate the detected operational anomaly; and programming the PLD fabric according to the modified protected configuration image, wherein the modified protected configuration image is stored in an NVM of the remote PLD or the host device, and / or coupled to the PLD fabric through the programmable I / O and / or an external interface of the remote PLD.

5. The remote PLD management system of claim 4, wherein the remote PLD management system node comprises the PLD configuration agent, the PLD configuration agent configured to: receive the operational alert from the remote PLD via the communication module; generate an operational alert report based at least in part on the received operational alert; provide the operational alert report to a PLD configuration publisher; receive the modified protected configuration image for the remote PLD from the PLD configuration publisher, wherein the modified protected configuration image is based at least in part on the operational alert report; and provide the modified protected configuration image to the remote PLD and / or the host device via the communication module.

6. The remote PLD management system of claim 5, further comprising the PLD configuration publisher, wherein the PLD configuration publisher is configured to: receive the operational alert report from the PLD configuration agent; generate the modified protected configuration image for the PLD fabric based at least in part on the operational alert report and a device identifier and / or a device class identifier corresponding to the remote PLD; and provide the modified protected configuration image to the PLD configuration agent.

7. The remote PLD management system of claim 1, wherein the remote PLD is further configured to perform operations comprising: generating an operational alert based at least in part on telemetry data associated with an operation of the remote PLD and / or the host device; and providing the operational alert to the remote PLD management system node.

8. The remote PLD management system of claim 7, wherein the remote PLD is further configured to perform operations comprising: generating an operational alert, wherein the operational alert includes an operational confirmation configured to indicate a lack of an operational anomaly associated with the remote PLD and / or the host device.

9. A method for managing a remote PLD, the method comprising: forming, via a communication module of the remote PLD or a host device configured to interface with the remote PLD through programmable I / O of the remote PLD, a communication link between the remote PLD and a remote PLD management system node of a remote PLD management system over a communication network; receiving, from the remote PLD management system node over the communication link, a protected configuration image, wherein the forming a communication link includes subscribing, using a PLD configuration agent, to receive messages regarding one or more first topics over a publish-subscribe message protocol, wherein the one or more first topics are hierarchical topics corresponding to hierarchical access permission sanctions bound to the protected configuration image, wherein the hierarchical access permission sanctions are based on a device identifier or a device class identifier; and programming a PLD fabric of the remote PLD according to the protected configuration image, wherein the protected configuration image is stored in and / or retrieved from a non-volatile memory (NVM) of the remote PLD or the host device, and / or coupled to the PLD fabric through the programmable I / O and / or an external interface of the remote PLD.

10. The method of claim 9, wherein the remote PLD management system node includes the PLD configuration agent, the method further comprising: receiving, by the PLD configuration agent from a PLD configuration publisher of the remote PLD management system, the protected configuration image for the PLD fabric over the publish-subscribe message protocol; and providing the protected configuration image to the remote PLD and / or the host device via the communication link over the publish-subscribe message protocol, wherein the one or more first topics are associated with one or more identifiers each identifying at least one of the following related to the remote PLD management system: the host device; the remote PLD; a device class including the host device; and / or a remote PLD class including the remote PLD.

11. The method of claim 10, further comprising: generating, by the PLD configuration publisher, the protected configuration image for the PLD fabric; and providing the protected configuration image to the PLD configuration agent, wherein the publish-subscribe message protocol includes a Message Queue Telemetry Transport (MQTT) protocol, and wherein the one or more first topics are associated with at least one of: an identifier of the host device; an identifier of the device class, wherein the identifier of the device class is associated with a manufacturer, a retailer, and / or a geographic region; and / or an identifier of the remote PLD class, wherein the identifier of the remote PLD class is associated with a manufacturer, a retailer, and / or a geographic region. ​ 12. The method of claim 9, further comprising: detecting an operational anomaly associated with the remote PLD and / or the host device; generating an operational alert based at least in part on the detected operational anomaly; providing the operational alert to the remote PLD management system node; receiving a modified protected configuration image from the remote PLD management system node, wherein the modified protected configuration image is configured to identify, correct, and / or mitigate the detected operational anomaly; and programming the PLD fabric in accordance with the modified protected configuration image, wherein the modified protected configuration image is stored in an NVM of the remote PLD or the host device, and / or is coupled to the PLD fabric through the programmable I / O and / or the external interface of the remote PLD.

13. The method of claim 12, wherein the remote PLD management system node comprises the PLD configuration agent, the method further comprising: issuing, by a PLD configuration publisher and / or the PLD configuration agent, a check status command for the remote PLD and / or receiving, by the PLD configuration agent from the remote PLD via the communication module, the operational alert; generating an operational alert report based at least in part on the received operational alert; providing the operational alert report to a PLD configuration publisher; receiving, from the PLD configuration publisher, a modified protected configuration image for the remote PLD, wherein the modified protected configuration image is based at least in part on the operational alert report; and providing the modified protected configuration image to the remote PLD and / or the host device via the communication module.

14. The method of claim 13, further comprising: receiving, by the PLD configuration publisher from the PLD configuration agent, the operational alert report; generating the modified protected configuration image for the PLD fabric based at least in part on the operational alert report and a device identifier and / or a device class identifier corresponding to the remote PLD; and providing the modified protected configuration image to the PLD configuration agent.

15. The method of claim 9, further comprising: after the forming a communication link, receiving a check status command from the remote PLD management system node; generating an operational alert based at least in part on telemetry data associated with an operation of the remote PLD and / or the host device; and prior to the receiving a protected configuration image, providing the operational alert to the remote PLD management system node through the communication link.

16. The method of claim 9, further comprising: authenticating the received protected configuration image prior to the programming of the PLD fabric, wherein the protected configuration image is signed using a private key associated with a PLD configuration publisher, a corresponding public key is stored in the NVM of the remote PLD, and the authenticating includes verifying that the protected configuration image is signed using the private key associated with the PLD configuration publisher using the public key.

17. The method of claim 9, further comprising: authenticating the received protected configuration image prior to the programming of the PLD fabric, wherein the protected configuration image includes a device identifier and / or a device class identifier associated with the remote PLD, the device identifier and / or the device class identifier is stored in the NVM of the remote PLD, and the authenticating includes comparing the device identifier and / or the device class identifier of the protected configuration image to the device identifier and / or the device class identifier stored in the NVM of the remote PLD.

18. A method for managing a remote PLD, the method comprising: generating, by the remote PLD, an operational alert based at least in part on an operational anomaly associated with the remote PLD and / or a host device configured to interface with the remote PLD through programmable I / O of the remote PLD, and / or based on telemetry data associated with operation of the remote PLD and / or the host device; forming, via a communication module of the remote PLD or the host device, a communication link between the remote PLD and a remote PLD management system node of a remote PLD management system over a communication network, wherein the forming the communication link includes subscribing, using a PLD configuration agent, to receive messages regarding one or more first topics over a publish-subscribe messaging protocol, wherein the one or more first topics are hierarchical topics corresponding to hierarchical access privilege sanctions that are bound to a protected configuration image, wherein the hierarchical access privilege sanctions are based on a device identifier or a device class identifier; and providing the operational alert to the remote PLD management system node over the formed communication link.

19. The method of claim 18, wherein the publish-subscribe messaging protocol includes a Message Queue Telemetry Transport (MQTT) protocol, and wherein the operational alert is based at least in part on the operational anomaly associated with the remote PLD and / or the host device, the method further comprising: detecting the operational anomaly associated with the remote PLD and / or the host device prior to the generating the operational alert; receiving a protected configuration image from the remote PLD management system node, wherein the protected configuration image is configured to identify, correct, and / or mitigate the detected operational anomaly; and programming a PLD fabric of the remote PLD according to the protected configuration image, wherein the protected configuration image is stored in and / or retrieved from a non-volatile memory (NVM) of the remote PLD or the host device, and / or coupled to the PLD fabric through the programmable I / O and / or an external interface of the remote PLD.

20. The method of claim 18, wherein the operational alert is based at least in part on telemetry data associated with operation of the remote PLD and / or the host device, the method further comprising: receiving a check status command from the remote PLD management system node prior to the generating the operational alert, wherein the receiving the check status command triggers the generating the operational alert.

Images