Processing system, related integrated circuit, device and method

Abstract

Various embodiments of the present disclosure relate to processing systems, related integrated circuits, devices and methods. A hardware configuration circuit reads and decodes encoded life cycle data and provides the decoded life cycle data to the hardware circuit. The reset circuit monitors an external reset signal received via a reset terminal, and in response to determining that the external reset signal has a first logic level, performs reset, configuration and waiting phases. The reset circuit waits until the external reset signal has a second logic level. The communication interface is activated during the waiting phase and is configured to receive a request. When the request includes a given reference password and the reset circuit is in the waiting phase, the hardware verification circuit generates a life cycle advance request signal. When the life cycle advance request signal is set, the write circuit writes the bits of the encoded life cycle data stored in the non-volatile memory, thereby advancing the life cycle to a given predetermined life cycle phase.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of Italian Patent Application No. 102021000007475 filed on March 26, 2021, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure relates generally to fault analysis and, in particular embodiments, to fault analysis of a microcontroller. Background Art

[0004] Figure 1 A typical electronic system, such as that of a vehicle, is shown with a processing system 10. The processing system 10 may be an embedded system or an integrated circuit (e.g., a field programmable gate array (FPGA), a digital signal processor (DSP)) or a microcontroller (e.g., dedicated to the automotive market).

[0005] exist Figure 1 , three processing systems 101, 102, and 103 are shown connected via a suitable communication system 20. The communication system may include a vehicle control bus, such as a controller area network (CAN) bus, and may include a multimedia bus, such as a media oriented systems transport (MOST) bus, connected to the vehicle control bus via a gateway.

[0006] Typically, the processing system 10 is located at different locations in the vehicle and may include, for example, an engine control unit, a transmission control unit (TCU), an anti-lock braking system (ABS), a body control module (BCM), a navigation or multimedia audio system. Thus, one or more processing systems 10 may also implement real-time control and regulation functions. These processing systems are generally identified as electronic control units.

[0007] Figure 2 Shows that it can be used as Figure 1 A circuit diagram of a digital processing system 10 such as a microcontroller, for example, any one of the processing systems 10 of FIG.

[0008] In the example considered, the processing system 10 includes a microprocessor 102, typically a central processing unit (CPU), which is programmed via software instructions. Typically, the software executed by the microprocessor 102 is stored in a non-volatile program memory 104 such as a flash memory or an EEPROM. Thus, the memory 104 is configured to store firmware for the processor 102. The firmware includes software instructions to be executed by the microprocessor 102. Typically, the non-volatile memory 104 can also be used to store other data, such as configuration data (e.g., calibration data).

[0009] The microprocessor 102 also typically has associated volatile memory 104b, such as random access memory (RAM). For example, the memory 104b may be used to store temporary data.

[0010] like Figure 2 As shown, typically, communication with the memory 104 or memory 104b is performed via one or more memory controllers 100. The memory controller 100 may be integrated into the microprocessor 102 or connected to the microprocessor 102 via a communication channel such as a system bus of the processing system 10. Likewise, the memory 104 or memory 104b may be integrated with the microprocessor 102 in a single integrated circuit, or the memory 104 or memory 104b may take the form of a separate integrated circuit and be connected to the microprocessor 102 (e.g., via traces of a printed circuit board).

[0011] In the example considered, the microprocessor 102 may have associated thereto one or more (hardware) resources / peripherals 106 selected from the group of one or more communication interfaces IF (e.g. for exchanging data) via the communication system 20, such as a Universal Asynchronous Receiver / Transmitter (UART), a Serial Peripheral Interface Bus (SPI), an Inter-Integrated Circuit (I2C), a Controller Area Network (CAN) bus, or an Ethernet interface, or a debug interface; one or more analog-to-digital converters AD or digital-to-analog converters DA; one or more dedicated digital components DC, such as a hardware timer or counter, or a cryptographic coprocessor; one or more analog components AC, such as a comparator, a sensor, such as a temperature sensor, etc.; or one or more mixed-signal components MSC, such as a PWM (pulse width modulation) driver.

[0012] Typically, the dedicated digital component DC may also correspond to an FPGA integrated into the processing system 10. In this case, for example, the memory 104 may also include programming data for such an FPGA.

[0013] Thus, the digital processing system 10 can support different functions. For example, the behavior of the microprocessor 102 is determined by firmware (e.g., software instructions to be executed by the microprocessor 102 of the microcontroller 10) stored in the memory 104. Therefore, by installing different firmware, the same hardware (microcontroller) can be used for different applications.

[0014] In this regard, future generations of such processing systems 10 (e.g., microcontrollers suitable for automotive applications) are expected to show an increase in complexity, mainly due to the increase in the number of requested functionalities (new protocols, new functions, etc.) and the strict constraints on execution conditions (e.g., lower power consumption, higher computing power and speed, etc.).

[0015] For example, more recently, more complex multi-core processing systems 10 have been proposed. For example, such multi-core processing systems can be used to (parallel) execute Figure 1 The processing systems 10 shown are several of the processing systems 10 , such as several processing systems of a vehicle.

[0016] Figure 3 An example of a multi-core processing system 10 is shown. In particular, in the example considered, the processing system 10 comprises a plurality (n) of processing cores 102 1 . . . 102 n connected to an (on-chip) communication system 114 .

[0017] For example, in the context of a real-time control system, the processing cores 1021...102n may be ARM Typically, the communication system 114 may include one or more bus systems (eg, based on an Advanced eXtensible Interface (AXI) bus architecture or a Network-on-Chip (NoC)).

[0018] For example, as shown in the example of processing core 1021, each processing core 102 may include a microprocessor 1020 and a communication interface 1022 configured to manage communications between the microprocessor 1020 and the communication system 114. Typically, the interface 1022 is a master interface configured to forward a given (read or write) request from the microprocessor 1020 to the communication system 114, and to forward an optional response from the communication system 114 to the microprocessor 1020. However, the communication interface 1022 may also include a slave interface. For example, in this way, the first microprocessor 1020 may send a request to the second microprocessor 1020 (via the communication interface 1022 of the first microprocessor, the communication system 114, and the communication interface 1022 of the second microprocessor).

[0019] Typically, each processing core 102 1 . . . 102 n may also include other local resources, such as one or more local memories 1026 , generally identified as tightly coupled memories (TCMs).

[0020] As mentioned before, typically, the processing cores 1021 ... 102n are arranged to exchange data with the non-volatile memory 104 or the volatile memory 104b. In the multi-core processing system 10, these memories are typically system memories (i.e., shared by the processing cores 1021 ... 102n). However, as mentioned before, each processing core 1021 ... 102n may include one or more additional local memories 1026.

[0021] For example, Figure 3As shown, the processing system 10 may include one or more memory controllers 100 configured to connect at least one non-volatile memory 104 and at least one volatile memory 104b to the communication system 114. As mentioned previously, the memory 104 or one or more of the memories 104b may be integrated into an integrated circuit of the processing system 10 or externally connected to the integrated circuit.

[0022] For example, the processing system 10 may include a first volatile memory 104 b that is integrated into an integrated circuit of the processing system 10 and connected to the communication system 114 via the first memory controller 100; and a second volatile memory 104 b that is located externally with respect to the integrated circuit of the processing system 10 and connected to the communication system 114 via the second memory controller 100.

[0023] As mentioned previously, the processing system 10 may include one or more resources 106, such as one or more communication interfaces or coprocessors (eg, cryptographic coprocessors). The resources 106 are typically connected to the communication system 114 via respective communication interfaces 1062. Generally, the communication interface 1062 includes at least one slave interface.

[0024] For example, in this way, the processing core 102 can send a request to the resource 106, and the resource returns a given data. Generally, one or more of the communication interfaces 1062 may also include a corresponding host interface.

[0025] Such a host interface 1064 may be useful, for example, if the resource has to initiate communication to exchange data via a (read or write) request with another circuit connected to the communication system 114 (such as the resource 106 or the processing core 102 ).

[0026] For example, to this end, the communication system 114 may include an Advanced Microcontroller Bus Architecture (AMBA) high-performance bus (AHB) and an advanced peripheral bus (APB) for connecting the resources / peripherals 106 to the AMBA AHB bus.

[0027] Typically, such a processing system 10 also includes one or more direct memory access (DMA) controllers 110. For example, Figure 3As shown, the DMA controller 110 can be used to directly exchange data with a memory (e.g., memory 104b) based on a request received from the resource 106. For example, in this way, the communication interface IF can read data directly from the memory 104b (via the DMA controller 110) and send the data without exchanging other data with the processor 102. In general, the DMA controller 110 can communicate with one or more memories via the communication system 114 or via one or more dedicated communication channels.

[0028] In this regard, regardless of the complexity of the processing system 10 (e.g., with respect to the number of processing cores 102 or the number and type of resources 106), typical product development involves several entities, such as a producer of integrated circuits that include the processing system 10, one or more hardware developers who implement more complex electronic circuits, and one or more software developers who write firmware for the processing system 10.

[0029] On the one hand, this implies that verifying the various hardware or software functionalities of each processing system 10 during the respective development phase may involve a significant portion of the total development costs: this applies both to the company producing the processing system 10 and to the client developing the application.

[0030] On the other hand, the hardware modules implementing security functions within the processing system 10 are becoming more and more important.

[0031] This may apply, for example, to a debug interface or access to a given memory location in the non-volatile memory 104 or the volatile memory 104b.

[0032] For example, various processing systems 10 provide the possibility to configure whether access to internal resources of the processing system 10 via a debug interface is looped or granted (possibly specifying whether data can only be read or can also be written).

[0033] For example, typically, during the development phase, it should be possible to control the resources of the processing system 10 with given degrees of freedom, while the processing system 10 should be configured to activate certain safety features (which may not be changed) when the processing system 10 is "in the field" (i.e., running in the final application).

[0034] For example, the solution used by most modern microcontrollers is to enable the security features by programming the on / off states in a non-volatile memory. These configuration data are then read during the reset phase to enable or disable the relevant protection (e.g., to disable the debug interface of the microcontroller). Therefore, after the corresponding configuration information has been programmed into the non-volatile memory, the relevant parts of the security configuration cannot be changed anymore (e.g., because once the debug interface is disabled, it is also impossible to rewrite the configuration data). As a result, most security configurations cannot be changed once implemented, and the protection is always active. Unfortunately, this also makes it difficult to analyze possible failures of the processing system 10 that only occur in the field.

[0035] Thus, as also described in European Patent Application No. EP 3 413 194 A1, the entire content of which is incorporated herein by reference, various modern processing systems permit activation of safety functions of the processing system 10 based on a so-called lifecycle data LCD.

[0036] For example, as disclosed in EP 3 413 194 A1, the bit sequence LCD can indicate one of the following stages: "Production" (LC1), when the processing system 10 (e.g., a microcontroller) is in chip structure; "Customer Delivery" (LC2), when the processing system 10 has been shipped to a first-tier customer (e.g., a producer of an engine control unit); "OEM Production" (LC3), when the device has been shipped to a next-tier customer (e.g., a car manufacturer); and "Field" (LC4), when the device is installed in a final product (e.g., in a car sold on the market).

[0037] Typically, the life cycle data LCD is written so that once a certain stage is reached, it is not possible to restore it back to a previous stage, i.e., the life cycle can only be advanced. Thus, the life cycle data LCD is a permanent signature written to the non-volatile memory that determines the stage of the processing system 10 in its life cycle.

[0038] For example, each lifetime may be encoded using a corresponding bit sequence.

[0039] For example, Figure 3 As shown, the bit sequence LCD may be stored in the one-time programmable memory 126 .

[0040] For example, this may be implemented using one-hot encoding, where a fuse is blown each time a given stage has been reached. In general, the lifecycle data LCD may also be stored at a reserved memory location of the non-volatile memory 104 .

[0041] Thus, advancing the lifecycle to the next stage can be accomplished by the entity that owns the device in the current lifecycle stage (e.g., a chip producer will advance the lifecycle when shipping it to the customer delivery stage; a first-tier customer will advance the lifecycle when shipping it to the OEM production stage, etc.).

[0042] As mentioned before, generally, when advancing the life cycle stage, more and more security features of the processing system 10 are activated. Generally, such security functions are directed to the protection of several micro resources in order to cycle access to them.

[0043] For example, the lifecycle data LCD may be provided to a resource 106, such as a debug interface, which is enabled or disabled based on the data LCD; a memory 104 or memory 104b, which prohibits (read or write) access to a given memory address range; or a processing core 102, which may execute firmware that changes operation based on the data LCD, thereby implementing a software-based protection mechanism.

[0044] Therefore, the operating circuit may allow unauthorized access (e.g., hacking), but also limits the possibility of testing / analyzing the device, and the most critical scenario is when the device is returned due to a failure. In fact, in order to be able to analyze the root cause of the failure, several security layers that the first-tier customers and OEM customers may have put in place need to be bypassed. For hard-failed units, this operation may be difficult. Therefore, a stage called failure analysis is usually adopted, which automatically removes some non-safety critical protections so that when the device is shipped back (e.g., to the producer of the processing system 10 or the hardware or software developer) for diagnostic purposes, failure analysis tests can be run (i.e., the life cycle data LCD may indicate the following additional stage: "Failure Analysis" (LC5)).

[0045] Therefore, the Failure Analysis phase represents a special case, since the Failure Analysis phase may be reached by an earlier life cycle phase, but one or more of the previously activated safety mechanisms are now disabled (e.g., the debug interface is enabled again). In this regard, once the device reaches the Failure Analysis phase, the modern processing system 10 may enable other protection mechanisms, such as making it permanently impossible to reuse the device in a car after the Failure Analysis phase has begun.

[0046] Thus, to avoid possible attacks and from a security perspective, the entry into the failure analysis phase must be a well-controlled operation and must not occur accidentally.

[0047] For example, accidentally activating a fault analysis phase in a live electronic control system while the equipment is still active in the field could have catastrophic consequences. Summary of the invention

[0048] In view of the foregoing, it would be advantageous to provide a solution for programming the life cycle phases of a processing system.

[0049] According to one or more embodiments, one or more of the above objects are achieved by means of a processing system having the features set out in detail in the appended claims. Embodiments also relate to related integrated circuits, devices and methods.

[0050] As previously mentioned, various embodiments of the present disclosure are directed to a processing system (eg, a processing system implemented in an integrated circuit).

[0051] In various embodiments, the processing system includes a digital processing core that includes a microprocessor configured to execute software instructions. The processing system also includes a hardware circuit (e.g., a peripheral device of the processing system) that is configured to change operation based on decoded life cycle data indicating a life cycle stage. Specifically, the non-volatile memory is configured to store encoded life cycle data indicating a life cycle stage. Thus, the processing system also includes a hardware configuration circuit that is configured to read the encoded life cycle data from the non-volatile memory, generate decoded life cycle data by decoding the encoded life cycle data, and provide the decoded life cycle data to the hardware circuit.

[0052] In various embodiments, the processing system includes a reset terminal (e.g., a pad or pin of a corresponding integrated circuit) configured to receive an external reset signal; and a reset circuit terminal configured to monitor the external reset signal received via the reset terminal. In various embodiments, the reset circuit is configured to perform an operation sequence in response to determining that the external reset signal has a first logic level. Specifically, during the reset phase, the reset circuit generates a reset of the processing system. During the configuration phase, the reset circuit activates the hardware configuration circuit, so that the hardware configuration circuit reads the encoded life cycle data, decodes the encoded life cycle data, and provides the decoded life cycle data to the hardware circuit. During the waiting phase, the reset circuit waits until the external reset signal has a second logic level. Conversely, in response to determining that the external reset signal has a second logic level, the reset circuit starts the microprocessor (i.e., the microprocessor begins executing software instructions).

[0053] In various embodiments, the processing system includes a communication interface that is activated during the wait phase and is configured to receive a request from an external device.

[0054] In various embodiments, the communication interface may be a serial communication interface, preferably a JTAG interface.

[0055] In various embodiments, the processing system comprises a hardware verification circuit. Specifically, the verification circuit is configured to verify (at least) whether the request comprises a given reference password and whether the reset circuit is in a waiting phase.

[0056] In various embodiments, in response to determining that the request includes a given reference password and the reset circuit is in a waiting phase, the verification circuit generates a lifecycle advance request signal indicating the following request: to advance the lifecycle phase indicated by the encoded lifecycle data to a given predetermined lifecycle phase.

[0057] Often, verification circuits can also verify other conditions.

[0058] In various embodiments, the processing system includes a test mode terminal configured to receive an external test mode signal. In this case, the verification circuit can be configured to verify whether the external test mode signal has a given logic level, and only when the external test mode signal has the given logic level, the life cycle advance request signal is generated.

[0059] Additionally or alternatively, the verification circuit may use an enable flag.

[0060] In various embodiments, the processing system includes a plurality of configuration data clients in various embodiments, each configuration data client including registers for storing configuration data. In this case, the non-volatile memory may be configured to also store configuration data, and the hardware configuration circuit may be configured to read the configuration data from the non-volatile memory during the configuration phase and transmit the configuration data to the plurality of configuration data clients. Thus, in this case, the verification circuit may be configured to receive an enable flag from the configuration data client, verify whether the enable flag has a given logic level, and generate a lifecycle advance request signal only if the enable flag has the given logic level.

[0061] In various embodiments, the verification circuit may be configured to receive a reference password from a configuration data client in a similar manner.

[0062] Therefore, in various embodiments, the write circuit of the non-volatile memory can be configured to monitor the life cycle advance request signal, and in response to determining that the life cycle advance request signal is set, write one or more bits of the encoded life cycle data stored in the non-volatile memory, thereby advancing the life cycle stage indicated by the encoded life cycle data to a given predetermined life cycle stage.

[0063] In various embodiments, the processing system includes at least three registers, wherein the lifecycle advance request signal is stored in the at least three registers. In this case, the write circuit can be implemented using a state machine such as a hardware state machine or other microprocessor, wherein the state machine is configured to read the contents of the at least three registers, determine the logic levels of most bits of the at least three registers, and in response to determining that most bits are set, write one or more bits of the encoded lifecycle data stored in the non-volatile memory.

[0064] In various embodiments, when the state machine is implemented using (or including) other microprocessors, at least three registers may be implemented using register interfaces of other microprocessors. Thus, in this case, the other microprocessors may be configured to read the contents of the at least three registers and determine the logic levels of most bits of the at least three registers via software instructions executed by the other microprocessors. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] For a more complete understanding of the present disclosure and its advantages, reference is now made to the following description in conjunction with the accompanying drawings, wherein

[0066] Figure 1 is a diagram of an example electronic system;

[0067] Figure 2 and Figure 3 is a diagram of an example processing system;

[0068] Figure 4 is a diagram of an embodiment of a processing system;

[0069] Figure 5 and Figure 6 is a diagram of an embodiment for distributing configuration data and lifecycle data in a processing system;

[0070] Figure 7 is a flow chart of an embodiment method for operating a processing system;

[0071] Figure 8 is a schematic diagram of an embodiment processing system; and

[0072] Fig. 9 , Fig.10 , Fig.11 , Fig.12 and Fig.13 is a diagram of an embodiment of details of a processing system. DETAILED DESCRIPTION

[0073] The present disclosure provides a wide variety of applicable inventive concepts that can be embodied in a variety of specific contexts. Specific embodiments are only used to illustrate specific configurations and do not limit the scope of the claimed embodiments. Unless otherwise specified, features from different embodiments can be combined to form other embodiments.

[0074] The variations or modifications described for one embodiment in the embodiments may also be applied to other embodiments. Further, it should be understood that various changes, substitutions and alterations may be made herein without departing from the spirit and scope of the present disclosure as defined by the appended claims.

[0075] In the following description, numerous specific details are given to provide a thorough understanding of the embodiments. The embodiments may be implemented without one or more of the specific details or using other methods, components, materials, etc. In other cases, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the embodiments.

[0076] References throughout the specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the phrases "in one embodiment" or "in an embodiment" appearing in various places throughout the specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0077] The headings provided herein are for convenience only and do not interpret the scope or meaning of the embodiments.

[0078] In the following Figures 4 to 13 In the various parts of Figures 1 to 3 The described parts, elements or components are indicated by the same reference numerals used previously in that figure; the description of these previously described elements will not be repeated below to avoid unnecessarily complicating this detailed description.

[0079] As described above, modern processing systems may use the lifecycle data LCD to activate a given safety protection mechanism (ie, the hardware or software behavior of the processing system may be changed according to the lifecycle data LCD).

[0080] Typically, security features are not activated solely based on the life cycle data LCD, but additional security configuration data SCD are used to specify whether a given security feature should be activated (e.g. once a given life cycle phase has been reached). Typically, these security configuration data SCD are stored to the non-volatile memory 104 (e.g., a reserved memory location of the non-volatile memory 104 configured to store firmware for one or more processors 102) together with other configuration data CD. These configuration data CD are usually read by some circuits during the reset phase of the processing system and are distributed to various components (e.g., the processing core 102, the memory controller 100 or the resources 106), whereby the security configuration data SCD are provided to the security framework and are also used to enable or disable the relevant protection according to the life cycle data LCD.

[0081] In this respect, as disclosed in document EP 3 413 194 A1, at least part of the configuration data CD, in particular the security configuration data SCD, may not be modifiable after being stored in the non-volatile memory. The reason is to ensure that a certain security configuration is enforced and cannot be modified so that protection is always active.

[0082] In various embodiments, conventional solutions to permit debugging / testing of a processing system include the debugging interface of the processing system being disabled and one or more components being accessible through processing core 102 .

[0083] Thus, in this way, the processing core 102 can receive commands via the communication interface IF of the processing system (such as a CAN interface) and perform a given (software) operation (e.g., reading data from a given memory address or writing data to a given memory address) according to the received command, where the memory address is associated (e.g., associated with a given memory location in the memory 104 or memory 104b or resource 106).

[0084] In various embodiments, the processing core 102 may even be configured to rewrite a given security configuration data SCD so as to disable a given security mechanism (eg, to enable a debug interface again).

[0085] Thus, processing core 102 may implement a software debug interface (essentially a backdoor) that may verify other conditions not typically implemented in a hardware debug interface (eg, verifying that a command includes a correct password).

[0086] This means that once a certain security protection is enabled, it may be necessary to "do something" (e.g., provide a correct password) as a prerequisite for being able to run a predetermined test routine or debug the processing system. However, this password verification operation may involve various operations.

[0087] In various embodiments, the password must be provided to the processing core 102 via the communication interface IF, the password must be verified, and finally, the result of the request must be transmitted again via the communication interface IF.

[0088] Additionally, the password verification operation may also involve encrypting the password, where the processing core 102 must forward the encrypted communication or simply the encrypted password to the hardware security module / cryptographic coprocessor of the processing system to obtain the plaintext password for the verification operation. This means that in some cases, some (hardware or software) cryptographic operations may be performed before the password can be used to bypass certain security protections.

[0089] Therefore, while such a software debug interface may be useful for monitoring the operation of the processing system, when the processing system is in normal use (in the "field" phase), in the event of a device failure, it may be more appropriate to advance the life cycle phase of the processing system to a failure analysis phase (if supported), whereby the processing system itself deactivates the given hardware security protection (e.g., automatically reactivates the processing system's debug interface).

[0090] However, since the debug interface is usually disabled in the "field" phase, the advancement of the lifecycle phase can only be performed via the processing core 102. Therefore, in order to advance the device to the failure analysis phase, some software needs to be executed via the processing core 102.

[0091] In various embodiments, processing core 102 may receive commands via the communication interface, verify the password (possibly including cryptographic operations), and perform operations to advance the lifecycle stage.

[0092] Thus, using the microprocessor 102 as a debug interface or for an early life cycle phase may not be so appropriate because a large number of resources may be involved, such as the processing core 102, the non-volatile memory 104 that has stored the software executed by the processing core 102, the volatile memory 104b for storing temporary results of the processing core 102, the communication interface IF, and possibly other resources 106 (such as a cryptographic coprocessor).

[0093] In fact, usually, the fault analysis phase should be initiated in the event of a hardware fault in the processing system. Thus, since substantially all major components of the processing system are involved, such a software approach may not be so suitable, and a fault in one of these components may inhibit the processing core 102 from being able to perform software debugging operations or advance the life cycle phase of the processing system.

[0094] Thus, in the following a solution will be described which allows managing the lifecycle of a processing system in a more efficient manner.

[0095] Figure 4An embodiment of a processing system 10a according to the present description is shown.

[0096] In various embodiments, the underlying architecture of the processing system 10a is similar to that of Figure 2 and Figure 3 The processing systems described correspond, and the corresponding description applies in their entirety. In addition, therefore, in this case, the processing system 10a, such as an integrated circuit, includes at least one processing core 102, a memory controller 100 configured to be connected to a (internal or external) non-volatile memory 104, at least one resource 106, and a communication system 114 connecting the one or more processing cores 102, the memory controller 100 and the one or more resources 106.

[0097] As mentioned before, the behavior of the processing system 10a may also vary based on the configuration data CD and the life cycle data LCD.

[0098] In various embodiments, according to the description of EP 3 413 194 A1, these configuration data CD and life cycle data LCD can be written into a specific area of ​​the non-volatile memory 104 and retrieved when the processing system 10a is powered on. Preferably, the non-volatile memory 104 is integrated in an integrated circuit and can also be used to store firmware of one or more processing cores 102.

[0099] However, the firmware may also be stored in a separate non-volatile memory 104 .

[0100] In various embodiments, where the program memory is integrated into an integrated circuit, a non-volatile program memory may be used.

[0101] In contrast, in case the program memory is an external memory, an additional (small) internal non-volatile memory 104 may be used. Thus, in various embodiments, the configuration data CD and the life cycle data LCD are stored in a non-volatile memory of an integrated circuit including the circuits requiring the configuration data, such as the processor 102 or one or more of the hardware resources 106.

[0102] In various embodiments, the configuration data CD may include calibration data for ensuring consistent hardware behavior, thereby compensating for possible production process tolerances.

[0103] In various embodiments, this generally applies to calibration of analog components of a processing system, such as temperature sensors, analog-to-digital converters, voltage references, and the like.

[0104] In various embodiments, the voltage monitor threshold levels of the analog comparators may be "trimmed" to exact expected values ​​by adjusting some of the levels using configuration / calibration data written by the manufacturer of the processing system's hardware (eg, a microcontroller manufacturer).

[0105] Furthermore, the configuration data CD may also be used to customize the behavior of the hardware (eg, the hardware resource 106 ) according to different application requirements.

[0106] In various embodiments, once the firmware of the processing system has been stored in the processing system 10a, some configuration data CD (i.e., secure configuration data SCD) may be written to disable the debug interface, which may be used, for example, to download the firmware of the processing system 10a. Alternatively, only access to the non-volatile memory via the debug interface may be disabled (i.e., the entire debug interface may not be disabled), but access to other circuits by the debug interface may be restricted.

[0107] Thus, typically, a first portion of the configuration data CD may be written by a producer of the hardware of the processing system (eg, a producer of integrated circuits), or a second portion of the configuration data CD may be written by a developer of firmware for the processing system 10a.

[0108] As mentioned previously, the programmed configuration data CD may be read during a reset phase, which typically begins as soon as the processing system 10a is powered on.

[0109] Specifically, Figure 4 As shown, the processing system 10a may include for this purpose a hardware configuration circuit 108, which is configured to read the configuration data CD and the life cycle data LCD from the non-volatile memory 104 and distribute these data within the processing system 10a.

[0110] In various embodiments, the hardware configuration module 108 may be configured to read the configuration data CD and the life cycle data LCD from the non-volatile memory 104 by sending a read request to the memory controller 100 via the communication system 114. Additionally or alternatively, the hardware configuration module 108 may also be directly connected to the memory controller 100 or configured to read data directly from the memory 104.

[0111] Likewise, the hardware configuration module 108 may be configured to send the configuration data CD and the lifecycle data LCD to the respective circuits by sending a write request via the communication system 114. However, the hardware configuration module 108 may also use separate communication channels for the configuration data CD or the lifecycle data LCD.

[0112] Figure 5A possible embodiment of the configuration circuit 108 is shown. The configuration data CD is stored in a reserved memory area (e.g., in the form of a plurality of consecutive memory locations). Thus, the configuration module 108 accesses the reserved memory area containing the configuration data CD, reads the configuration data CD, and transmits the configuration data CD to the corresponding circuit 110 within the processing system 10a.

[0113] In general, circuit 110 may correspond to any circuit of processing system 10a requiring configuration data, and may correspond to processor 102, hardware resource 106, or even memory 104 or memory 104b.

[0114] In various embodiments, the circuit 110 may be a debug interface of the processing system 10a, which is enabled or disabled based on the configuration data CD. Likewise, the configuration data CD may be used to configure a read or write protected area of ​​the memory.

[0115] In various embodiments, each circuit 110 may have been associated with a corresponding configuration data client 112 in order to distribute the configuration data CD.

[0116] In various embodiments, Figure 5 1 and 110c and three configuration data clients 112a, 112b, and 112c are shown. In general, each configuration data client 112 may be explicitly associated with a single hardware circuit 110 and only provide configuration data to the associated hardware circuit 110 (e.g., a specific hardware resource 106), or may be associated with multiple hardware circuits 110 (e.g., multiple hardware resources 106). In general, the configuration data clients 112a, 112b, and 112c may also be integrated into the respective circuits 110a, 110b, and 110c.

[0117] Thus, in the embodiment under consideration, the configuration module 108 may determine corresponding configuration data (selected from the configuration data CD) for each target circuit 110 to be configured and transmit the configuration data associated with the target circuit 110 to the configuration data client 112 associated with the target circuit 110 .

[0118] Likewise, when reading configuration data CD from memory 104 , configuration module 108 may determine one or more target circuits of the current configuration information and send the current configuration data to one or more configuration data clients associated with the one or more corresponding target circuits.

[0119] Generally, any communication may be used to transfer configuration data to configuration data client 112, including serial communication and parallel communication.

[0120] In various embodiments, configuration module 108 and configuration data clients 112 may be connected via communication system 114 or an additional bus, and each configuration data client 112 may have associated therewith a corresponding target address.

[0121] Thus, each configuration data client 112 is configured to receive configuration data from the module 108, store them in internal registers (e.g., store them in one or more internal flip-flops or latches), and then use the data stored in the registers to generate one or more signals that affect the behavior of one or more hardware circuits 110.

[0122] Figure 6 In this regard, a possible embodiment of the communication between the configuration module 108 and the configuration data clients 112 is shown. The processing system 10a comprises a configuration module 108, which is configured to read the configuration data CD from one or more non-volatile memories 104, and a plurality of configuration data clients 112, which are configured to receive the corresponding configuration data from the module 108 and distribute them among a plurality of circuits 110 (not shown) requiring the configuration data.

[0123] In various embodiments, each configuration data client 112 may be explicitly associated with a corresponding circuit 110 .

[0124] In various embodiments, processing system 10a includes three configuration data clients 112a, 112b, and 112c.

[0125] The configuration module 108 includes a data reading module 1080 configured to read configuration data CD from the memory 104 ; and a scheduling module 1082 configured to transmit the configuration data to the configuration data client 112 .

[0126] As mentioned previously, any communication may be used to communicate between the scheduling module 1082 and the configuration data client 112 .

[0127] In various embodiments, the communication between the scheduling module 1082 and the configuration data client 112 is based on data frames according to a given format referred to hereinafter as Device Configuration Format (DCF).

[0128] In various embodiments, each data frame includes two fields: a payload (i.e., the actual data), referred to as a DCF format payload; and additional data attributes that may be used to identify a recipient of the data, referred to as DCF format attributes, where the recipient is one of the configuration data clients 112 representing a DCF client.

[0129] In various embodiments, the data attribute may consist of 16 bits or 32 bits, where a given number of bits specifies the address of one of the configuration data clients 112, and the payload may consist of 16 bits or 32 bits.

[0130] In various embodiments, the data read module 1080 is configured as a circuit that reads 64 bits from the memory 104, wherein the first 32 bits contain data attributes (including the address of the configuration data client), and the second 32 bits contain the configuration data to be transmitted to the address specified in the data attributes. As previously mentioned, this address may correspond to a physical address of the communication system 114 or a physical address of a separate communication bus.

[0131] Each configuration data client / DCF client 112 may be a hardware module, typically comprising a combinational circuit configured to store received data in an internal register implemented (e.g., using flip-flops / latches), thereby permitting the received configuration data to be distributed to various portions of one or more associated hardware circuits 110 via generation of one or more internal signals based on the data stored in the internal register.

[0132] In various embodiments, each configuration data client 112 may have been associated with a univocal address (i.e., a univocal address within each processing system 10a), and the data transmitted by the scheduling module 1082 is analyzed to determine whether the additional data attributes (DCF format attributes) contain an address associated with the configuration data client 112.

[0133] In various embodiments, the modules 108 may also include a state control module 1084 configured to manage various configuration stages of the processing system 10a.

[0134] In various embodiments, once the processing system 10 a is turned on, the reset module 116 of the processing system 10 a may generate a reset signal RESET, which is used to reset various components of the processing system 10 a.

[0135] In various embodiments, the reset signal RESET may correspond to a reset pulse of a given number of clock cycles provided to the circuit 110 of the processing system 10 a .

[0136] In various embodiments, configuration data client 112 may use reset signal RESET to set internal registers to given reset values.

[0137] Likewise, in response to the reset, the reset circuit 116 may activate the state control module 1084, thereby activating the configuration phase. Specifically, during the configuration phase, the data reading module 1080 may read the configuration data CD from the memory 104. The scheduling module 1082 may send the configuration data CD to each configuration data client 112, thereby overwriting the reset value.

[0138] In various embodiments, the scheduling module 1082 may generate a data signal DATA having a given number of bits (corresponding to the bits of the payload) containing configuration data to be transmitted to a given configuration data client 112 and other control signals for selecting a target configuration data client 112 .

[0139] In various embodiments, the scheduling module 1082 also generates an address signal ADR including an address of the target configuration data client 112 and optionally a chip select signal CS for signaling that the address signal ADR and the data signal DATA are valid.

[0140] In various embodiments, the address signal ADR (and the chip select signal CS) are provided to a decoder 124 that is configured to activate one of the configuration data clients 112 based on the address signal ADD.

[0141] In various embodiments, decoder 124 sets chip select signal CSa to indicate that configuration data client 112a should read data signal DATA when address signal ADR corresponds to an address assigned to configuration data client 112a (and chip select signal CS is set).

[0142] In various embodiments, decoder 124 sets chip select signal CSb to indicate that configuration data client 112b should read data signal DATA when address signal ADR corresponds to an address assigned to configuration data client 112b (and chip select signal CS is set).

[0143] Thus, the configuration data CD may also include security configuration data SCD for activating or deactivating given security functions of the processing system 10a, such as: external access to a debug interface; (read or write) access to a given memory location, etc.

[0144] Moreover, the configuration data CD may include two subsets of configuration data, a first group of configuration data (e.g., calibration data) written by a producer of the processing system 10a (e.g., a chip manufacturer) and a second group of configuration data written during a later stage (such as configuration data written by a firmware developer or a system integrator (such as a producer of an engine control unit)).

[0145] In various embodiments, these configuration data sets are written to different areas of memory 104, thereby permitting the sets to be independently configured, or a second configuration data set to be appended to a first configuration data set.

[0146] In various embodiments, the security configuration data SCD included in the first configuration data set may also permit setting access rights to the memory location in which the first configuration data set is stored.

[0147] In various embodiments, the first configuration data set may not be overwritten, or the memory interface may prohibit read access to the first configuration data set (eg, processor 102 ).

[0148] In contrast, the configuration data CD / security configuration data SCD included in the second configuration data group can be used to configure the behavior of the circuit 110 from a functional perspective (e.g., enable or disable the debug interface, etc.). Therefore, once the debug interface is disabled or the corresponding memory location is protected, the second configuration data group cannot be rewritten or read.

[0149] Likewise, the data reading module 1080 may also read the life cycle data LCD from the memory 104 and provide it to the life cycle circuit 1102 .

[0150] In various embodiments, the life cycle circuit 1102 may include an internal register in which the life cycle data LCD read from the memory 104 is stored. More specifically, in various embodiments, the life cycle circuit 1102 is configured to receive the encoded life cycle data LCD, decode the life cycle data LCD into a decoded data LC identifying the current life cycle stage, that is, a data LC identifying the current life cycle stage. The current life cycle stage may be stored in the life cycle circuit 1102 and provided to other circuits.

[0151] In various embodiments, this operation may be managed by the state control module 1084 (e.g., the state control module may drive the life cycle module 1102), causing the life cycle module 1102 to decode the life cycle data LCD and store the decoded data LC in an internal register (e.g., when the processing system 10a is in the configuration phase—after a reset state).

[0152] The life cycle circuit 1102 may then provide the decoded life cycle data LC to each circuit 110. Preferably, the separate communication channel is used to provide the same decoded life cycle data LC to each circuit 110, because it may be quite useless for the separate communication channel to use additional registers (e.g., in the configuration data client 112) to store information that is already stored in the registers of the life cycle circuit 1102.

[0153] Thus, in various embodiments, the hardware configuration circuit 108 is configured to read (via a suitable communication channel) the configuration data CD and the life cycle data LCD from the non-volatile memory 104, and transmit the configuration data CD and the decoded life cycle data LC to various circuits 110 (e.g., one or more processing cores 102, the memory controller 100, and the resources 106).

[0154] Specifically, based on control implemented in the state control circuit 1084, for example, in the form of a sequential logic circuit implementing a state machine, the hardware configuration circuit reads the configuration data CD and the life cycle data LCD after reset but before one or more processing cores 102 are activated.

[0155] As disclosed in European Patent Application No. EP 3 719 636 A1, the entire contents of which are incorporated herein by reference, two types of resets can be used in conventional processing systems. The first type of reset corresponds to a "simple" reset substantially as described above, in which some kind of reset event activates the internal reset stage 116 to perform a functional reset of the processing system. The second type of reset corresponds to a complex reset that can perform other operations.

[0156] Figure 7 An embodiment of the operation of the reset circuit 116 is schematically illustrated.

[0157] At step 3000, reset is activated and at step 3002, reset is performed.

[0158] In various embodiments, reset module 116 may assert signal RESET at step 3002. Thus, in response to the reset requested at step 3002, various latches / registers of processing system 10a are reset (eg, the contents of configuration data client 112 and configuration module 108).

[0159] Next, the reset module 116 starts at step 3004 (configuration phase), for example, by setting the signal SCP, which is provided to the state control module 1084. In response to the signal SCP, the configuration circuit 108 reads and distributes the configuration data CD and the life cycle data LCD. Generally, the signal SCP is purely optional because the configuration phase can be automatically started when the reset signal RESET is deasserted.

[0160] At the end of the configuration phase, configuration circuitry 108 may set signal ECP to indicate that the configuration phase is complete.

[0161] Therefore, if Figure 7As shown, the reset circuit 116 may proceed from step 3004 to the verification step 3006. The reset module 116 waits until the signal ECP is set by the configuration circuit 108 (the output "N" of the verification step 3006). Once the signal ECP is set (the output "Y" of the verification step 3006), the processing system 10a is configured. Thus, steps 3004 and 3006 implement the configuration phase CP1 of the processing system 10a.

[0162] Thus, generally speaking, after the verification step 3006, the processing core 102 may start at step 3022, and the reset process may end at step 3024. Thus, step 3022 begins as a software runtime phase SW.

[0163] However, if Figure 7 As shown, the processing system 10a may also be configured to run a diagnostic phase DP, wherein the processing system 10a performs one or more optional system diagnostic operations (ie, the processing system 10a performs a built-in self test (BIST)).

[0164] In various embodiments, processing system 10a includes hardware diagnostic circuit 118 that is activated via signal SDP.

[0165] Thus, in various embodiments, once the signal ECP is set (the output of the verification step 3006 is "Y"), the reset circuit 116 may set the signal SDP at step 3010, thereby enabling the diagnostic circuit 118. Next, the reset module 116 may wait at step 3012 until the diagnostic operation has been performed (i.e., the self-test has been completed).

[0166] In various embodiments, once the diagnostic operation is performed, the diagnostic circuit 118 may set the signal EDP.

[0167] Thus, the reset circuit 116 may proceed from step 3010 to the verification step 3012. The reset module 116 waits until the diagnostic circuit 118 sets the signal EDP (output "N" of the verification step 3012). Once the signal EDP is set (output "Y" of the verification step 3012), the diagnostic phase DP (steps 3010 and 3012) is completed.

[0168] In various embodiments, the self-test operations performed by diagnostic circuitry 118 may test one or more registers of processing system 10a that typically involve write operations or read operations, thereby modifying the contents of these registers.

[0169] Thus, in various embodiments, once the diagnostic phase DP has been performed, the reset module may perform a further reset of the processing system 10a at step 3014 .

[0170] In various embodiments, the reset circuit 116 may set the signal RESET again at step 3014 .

[0171] Typically, the reset performed at step 3002 , representing a first reset, and the reset performed at step 301 6 , representing a second reset, may differ, for example, with respect to registers or circuits reset by reset circuit 116 .

[0172] In various embodiments, the reset circuit 116 generates a reset mode signal RM, which is set to a first logic level at step 3002 and is set to a second logic level at step 3014. However, the reset circuit may also set a first reset signal RESET1 (for resetting the first circuit subset) at step 3002 and set a second reset signal RESET2 (for resetting the second circuit subset) at step 3014.

[0173] In various embodiments, the diagnostic circuit 118 may also test registers of the configuration data client 112 and the life cycle circuit 1102. Thus, in this case, it is also useful to read the configuration data CD or the life cycle data LCD in the second configuration phase CP2.

[0174] Thus, in various embodiments, the reset module 116 may proceed from step 3014 to step 3016, where the reset circuit 116 starts the configuration phase, for example, by setting a signal SCP provided to the state control module 1084. In response to the signal SCP, the configuration circuit 108 reads and distributes the configuration data CD and the life cycle data LCD. At the end of the configuration phase, the configuration circuit 108 sets the signal ECP to indicate that the configuration phase is complete.

[0175] Thus, the reset circuit 116 may proceed from step 3016 to a verification step 3018, wherein the reset circuit 116 waits until the signal ECP is set by the configuration circuit 108 (output "N" of the verification step 3018). Once the signal ECP is set (output "Y" of the verification step 3018), the processing circuit may thus proceed to step 3022 for starting the processing core 102.

[0176] In various embodiments, the reset circuit 116 may be configured to optionally start the diagnostic phase DP after the configuration phase CP1. This configuration may be hardwired or programmable. Specifically, the configuration data CD has been allocated at the end of the configuration phase CP1. Thus, the configuration data CD may also include data indicating whether the self-test function should be activated, which data may include data specifying which self-test should be performed.

[0177] In various embodiments, such data may be provided to reset circuit 116 or diagnostic circuit 118 by associating a corresponding configuration data client 112 with these circuits.

[0178] Thus, at the end of step 3006, the reset circuit 116 may proceed to the verification step 3008. Specifically, when the execution of the diagnostic phase DP is enabled (output "Y" of the verification step 3008), the reset module 116 proceeds to step 3010. Conversely, when the execution of the self-test is disabled (output "N" of the verification step 3008), the process may proceed directly to step 3022 to start the normal operation mode of the processing system.

[0179] Thus, a simple reset implements only a single reset (step 3002) and configuration phase CP1. In contrast, a complex reset implements a diagnostic phase DP, other resets at step 3014, and optionally other configuration phases CP2. In general, the processing system 10a may support both types of resets, with complex resets being performed in response to a first set of events and simple resets being performed in response to a second set of events (e.g., verified at step 3008).

[0180] In various embodiments, a complex reset may be performed in response to startup of processing system 10a or in response to a given (critical) error, whereas a simple reset may be performed in response to a reset request by processor 102. In general, reset events may be static / hardwired or may be configurable.

[0181] Typically, the first reset at step 3002 is called a "destructive reset" DR because typically all registers of the processing system 10a are reset to reset values, and because not necessarily all registers of the processing system (such as registers of one or more resources in the resources 106) are reset, the second reset at step 3014 is typically identified as a functional reset FR.

[0182] In various embodiments, the registers of the reset module 116 cannot be reset at step 3016 , because otherwise the reset module 116 will lose the information whether the first reset has been performed at step 3002 .

[0183] Typically, in the case where the BIST does not test the registers of the configuration data client 112 and the life cycle module 1102, the functional reset of step 3014 can also be a so-called "short functional reset", in which the processing system 10a is reset, but the configuration circuit 108 no longer reads the configuration data CD, and the life cycle data LCD (i.e., configuration phase CP2) can be omitted.

[0184] In this regard, a given event (such as power-on of processing system 10a) may trigger Figure 7 A complex reset process is shown (beginning with a destructive reset 3002), while other events (eg, a reset requested by a resource 106) may only trigger a functional reset (ie, immediately beginning step 3016).

[0185] Moreover, other events (e.g., a reset requested by the processor 102) may trigger only a short functional reset. Typically, reset flip-flops are classified as functional, short functional, or destructive at design time, or may be configured via configuration data CD. Likewise, as mentioned previously, the execution of the BIST may be set at design time, or may be configured via configuration data CD for each flip-flop associated with a destructive reset.

[0186] Thus, in various embodiments, when a complex or simple reset is performed (ie, between step 3002 and step 3020), one or more processing cores 102 are not running (ie, one or more processing cores 102 are not executing any software).

[0187] In various embodiments, this may be achieved by maintaining one or more processing cores 102 in a reset state. Instead, other circuits of processing system 10a may be operable, such as reset circuit 116, diagnostic circuit 118, hardware configuration circuit 108, non-volatile memory 104, one or more of resources 106, etc.

[0188] In various embodiments, at least circuits 104, 108 and 116 are used to manage the reset phase of the processing system 10a, including one or more configuration phases and diagnostic phases, thereby ensuring that configuration data CD and life cycle data LCD are available once one or more processing cores 102 are activated at step 3022.

[0189] In this regard, the reset circuit 116 or the state control module 1084 may also implement other steps, such as an initialization phase, in which the reset circuit 116 or the state control module 1084, for example, waits for the non-volatile memory 104 to complete its initialization, thereby ensuring that the data reading circuit 1080 can read the configuration data CD and the life cycle data LCD from the non-volatile memory 104.

[0190] In various embodiments, reset circuit 116 is configured to reset processing system 10a in response to a signal received via a reset terminal RP of processing system 10a, such as a pad of a corresponding integrated circuit die or a pin of a corresponding packaged integrated circuit.

[0191] For example, this Figure 6 Moreover, in various embodiments, the reset circuit 116 is configured to verify at step 3030 (before proceeding to step 3022) whether the signal applied to the reset terminal RP is de-asserted.

[0192] In various embodiments, the processing system 10a may be configured to start a complex reset at step 3000 when the signal applied to the reset terminal RP has a first logic value, such as a low value. Next, the reset circuit performs steps 3002 to 3018, and the processing system 10a stays at step 3020, while the signal applied to the reset terminal RP has a first logic level (verifying the output "Y" of step 3020) when the logic level of the signal applied to the reset terminal RP has a second logic level, such as a high value (i.e., the processing system 10a proceeds from step 3020 to step 3022 (verifying the output "N" of step 3020). Thus, in the embodiment under consideration, one or more processing cores are only started at step 3022 when the signal applied to the reset terminal RP has a second logic level.

[0193] Moreover, in various embodiments, at least one communication interface IF_JTAG, preferably a serial communication interface such as a JTAG (Joint Test Action Group) interface, is operable during step 3020 .

[0194] Therefore, in various embodiments, after reading the configuration data CD and the life cycle data LCD, the reset phase can be extended by keeping the reset terminal RP at a first logic level (e.g., low). This makes it possible to keep the processing system 10a in a reset state, and during this phase, send one or more commands via an interface IF_JTAG such as a JTAG interface.

[0195] Usually, although Figure 7 An embodiment is shown in which the various reset phases are managed by reset circuit 116, but these phases may also be managed by state control circuit 1084 or another state machine. Thus, in general, Figure 7 The illustrated operations may be implemented by processing system 10a in any suitable manner.

[0196] The inventors have observed that the above described behavior can be used to manage the advancement of the life cycle phases via the interface IF_JTAG (preferably a serial communication interface such as a JTAG interface) without intervening one or more processing cores 102 .

[0197] In various embodiments, the processing system 10a is configured to enable or disable a given safety function depending on the life cycle data LCD and the optional safety configuration data SCD.

[0198] In various embodiments, the life cycle data LCD may identify one of a plurality of life cycle stages, such as "production", when the processing system 10 (e.g., a microcontroller) is in chip form; "customer delivery" (LC2), when the processing system 10 has been shipped to a first-tier customer (e.g., a producer of an engine control unit); "OEM production" (LC3), when the device is shipped to a next-tier customer (e.g., an automobile manufacturer); "field" (LC4), when the device is installed in a final product (e.g., in a car sold on the market); and "failure analysis" (LC5), when the device is shipped back (e.g., to the producer of the processing system 10 or a hardware or software developer) for diagnostic purposes.

[0199] Typically, relevant to the present application is the management of at least three lifecycle phases: one or more development phases, identified, for example, via phases LC1, LC2, and LC3; a "field" phase LC4; and a "failure analysis" phase LC5.

[0200] Specifically, in various embodiments, during one or more development phases, one or more safety mechanisms may have been activated, and during the "field" phase, the maximum level of protection is activated. Conversely, during the "failure analysis" phase, one or more safety mechanisms activated during the "field" phase are deactivated.

[0201] In general, it is not particularly relevant which bit sequence identifies a given life cycle stage.

[0202] In various embodiments, the life cycle data LCD may include a given number of bits, such as 32 bits or 64 bits, and a subset of the bits may be associated with each life cycle stage, such as 4 bits or 8 bits. In this case, the life cycle circuit 108 may be configured to read the life cycle data LCD; determine for each bit subset whether the majority of bits have the reset value of the non-volatile memory 104; determine the highest life cycle stage in which the majority of bits are not set to the reset value of the non-volatile memory 104; and set the signal LC to indicate the highest life cycle stage.

[0203] Generally, the first life cycle LC1 may be identified by the life cycle data LCD having all bits set to a reset value of the nonvolatile memory.

[0204] In various embodiments, it is assumed that the lifecycle data LCD has 32 bits with the following bit subsets: [0..7]: LC2, [8..15]: LC3, [16..23]: LC4, [24..31]: LC5.

[0205] Furthermore, it is assumed that the reset value of a given bit of the non-volatile memory corresponds to "1". Thus, in this case, when all bits are set to "1", a first life cycle stage LC1 is identified, and when at least five bits (i.e., most) of the corresponding bit subset are set to "0", it is assumed that a given another life cycle is reached. Among these life cycle stages, when at least five bits of the bit subset [24..31] are set to "0", the life cycle circuit 1102 then selects the highest life cycle stage, for example, the signal LC is set to indicate the life cycle stage LC5.

[0206] However, other encoding schemes may also be used for the lifecycle data LCD. In fact, the encoding of the lifecycle data LCD must be configured so that the lifecycle stage can only be advanced (ie, it can never be restored to an earlier stage).

[0207] Figure 8 An embodiment of a processing system 10a according to the present disclosure is shown.

[0208] Specifically, this embodiment is basically based on Figure 4 The illustrated embodiment further includes a communication interface IF_JTAG, preferably a serial communication interface such as a JTAG interface, which is connected to one or more terminals (not shown) of the processing system 10a such as pins or pads of a corresponding integrated circuit to receive one or more requests REQ from an external device such as an external debugging device; and a verification circuit 130, which is configured to analyze the request REQ and determine whether the request REQ indicates a request for advancing the life cycle stage of the processing system 10a.

[0209] Thus, in the considered embodiment, the verification circuit 130 is a separate hardware circuit and can request the advancement of the life cycle phase without intervention of one or more processing cores 102. In particular, in various embodiments, the verification circuit 130 is configured to manage only the advancement of the life cycle phase to the failure analysis phase LC5, while the advancement of other life cycle phases (LC1 to LC4) can still be managed by the processing core 102, for example, by receiving corresponding requests via the CAN interface.

[0210] Thus, in various embodiments, when the request REQ indicates a request to advance the life cycle phase to the failure analysis phase LC5 , the verification circuit 130 generates the signal LCFA_REQ.

[0211] More specifically, the signal LCFA_REQ is directly provided to the non-volatile memory 104 which has stored the life cycle data LCD, thereby avoiding the need to transmit the communication through the communication channel 114 .

[0212] For example, Fig. 9 An embodiment of a non-volatile memory 104 according to the present disclosure is shown. Specifically, in the embodiment under consideration, the non-volatile memory 104 includes one or more physical non-volatile memory areas 1048, such as a plurality of flash banks; and a control circuit 1040.

[0213] Specifically, in various embodiments, the control circuit 1040 includes a security management circuit 1042 and a read and write management circuit 1044 that is configured to manage read and write requests addressed to a given memory region of the non-volatile memory region 1048 .

[0214] Usually, if Fig. 9 As shown, the read and write management circuit 1044 may include two separate circuits, namely, a read management circuit 1044r configured to manage read requests and a write management circuit 1044w configured to manage write requests.

[0215] Thus, in the embodiment considered, the memory controller 100 receives a read or write request from the communication system 114 and forwards the request to the control circuit 1040. In general, the memory controller 100 may also form a part of the control circuit 1040, although shown separately.

[0216] Specifically, in various embodiments, the control circuit 1040 (and in particular the security management circuit 1042) is configured to determine whether to grant a read or write request.

[0217] In various embodiments, the security management circuit 1042 may determine whether a read request or a write request may access a given memory region based on the configuration data CD (particularly the security configuration data SCD) or the life cycle data LCD.

[0218] In various embodiments, the control circuit 1040 may have associated a corresponding configuration data client 112 (with a corresponding address) and may provide the secure configuration data SCP to the security management circuit 1042 by storing the secure configuration data SCP together with the configuration data CD in the non-volatile memory 104, wherein the secure configuration data SCP is stored in the memory 104 in the form of a DCF data packet and also includes the address of the configuration data client 112 associated with the control circuit 1040. Thus, in this way, the configuration circuit 108 will read the configuration data CD and transmit the corresponding secure configuration data SCP to the configuration data client 112 associated with the control circuit 1040.

[0219] In the event that the security management circuit 1042 determines that the request is granted, the security management circuit 1042 forwards the request to the read and write management circuit 1044 (1044r or 1044w), which executes the read or write request.

[0220] Furthermore, in the embodiment considered, the control circuit 1040 comprises a lifecycle programming circuit 1046 configured to generate, when the signal LCFA_REQ is set, a write request to a given memory location of the memory area 1048. In various embodiments, the lifecycle programming circuit 1046 may also verify one or more other conditions COND1, which will be described in more detail below.

[0221] Additionally or alternatively, such as Fig.10 As shown, the verification circuit 130 may also generate a signal LCFA_REQ according to the request REQ and one or more conditions COND2.

[0222] Thus, the verification circuit 130 and the lifecycle programming circuit 1046 permit the lifecycle stage to be advanced to the failure analysis stage by using a minimal set of device resources and bypassing all protection layers described so far, such as the security management circuit 1042. Thus, the advancement of the lifecycle stage to the failure analysis stage (and preferably, only to that stage) can be done separately, with a reduced amount of circuitry involved, thereby reducing the risk of malfunctioning circuitry when advancing the lifecycle stage.

[0223] In various embodiments, the mechanism may still guarantee the required level of security to ensure that it is not advanced maliciously, and may also guarantee the required level of security and availability so that the lifecycle cannot be advanced to the failure analysis stage during runtime of the processing system 10a.

[0224] Therefore, in Figure 8 , Fig. 9 and Fig.10In the illustrated embodiment, two circuits are involved, namely, a first circuit 130 (located externally with respect to the non-volatile memory 104), acting as an initiator of advancing to the fault analysis phase, configured to verify several conditions (in particular the content of the request REQ and the additional condition COND2) and generate a signal LCFA_REQ, which indicates an (authorized) request to advance the life cycle phase to the fault analysis phase; and a second circuit 1046 (located internally with respect to the non-volatile memory 104), performing programming of the non-volatile memory 104 according to the signal LCFA_REQ.

[0225] Fig.11 and Fig.12 A possible embodiment of the verification circuit 130 is shown. Specifically, Fig.11 An embodiment of a circuit is shown which is configured to verify the additional condition COND2 of the verification circuit 130. In general, however, the corresponding circuit may also be integrated directly within the verification circuit 130.

[0226] Specifically, Fig.12 As shown, the verification circuit 130 is configured to receive: a request REQ provided by the communication interface IF_JTAG; and an additional condition COND2 (such as Fig.11 shown).

[0227] Specifically, in various embodiments, a set of input conditions is selected to ensure safety, security, and availability. For example, these conditions must ensure that 1) operations are not initiated due to errors when the processing system 10a is in use (availability protection); 2) operations cannot be initiated maliciously (security protection); and 3) operations can only be performed when the processing system 10a is in a safe state (security protection).

[0228] In various embodiments, the first condition is verified by monitoring a signal TESTMODE applied to a terminal TP, such as a pin or pad of a corresponding integrated circuit.

[0229] In various embodiments, when the processing system 10a is in use, the terminal TP (and thus the signal TESTMODE) is connected to a first logic level, e.g., a high level. Conversely, to ensure that the processing system 10a is not in use but in a laboratory environment, the verification circuit 130 can verify whether the signal TESTMODE applied to the terminal TP has a second logic level, e.g., a low level.

[0230] In various embodiments, to set pin TP low, processing system 10a must be removed from the application (e.g., engine control unit) and connected to a test board. In various embodiments, terminal TP may also be connected to a supply voltage (i.e., logic high) via a pull-up resistor to ensure that an accidental disconnection of the wire connecting the package pin or solder ball to the pad does not leave the pad in an undefined state. Typically, a pull-down resistor will be used if signal TESTMODE is active high (i.e., test mode is activated when terminal TP is externally connected to a logic high level).

[0231] In various embodiments, the second condition (security) is verified by providing a password verification circuit 1300 within the verification circuit 130, which is configured to verify whether the request REQ contains a reference password / keyword RK. Generally, since it is assumed that the processing system 10a is now in a laboratory environment, it is preferred that the password is submitted in plain text in the request REQ, thereby avoiding the need for complex secret code operations. Thus, in various embodiments, the circuit 1300 is configured to generate a signal PW_OK when the request REQ provided via the communication interface IF_JTAG corresponds to a given predetermined bit sequence including the reference keyword RK.

[0232] In various embodiments, the reference secret key RK may be hardwired or stored in the configuration data CD.

[0233] In various embodiments, the verification circuit 130 may already be associated with a corresponding configuration data client 112 (with a corresponding address), and the reference password RK may be provided to the verification circuit 130 by storing the reference password RK together with the configuration data CD in the non-volatile memory 104, wherein the reference password RK is stored in the memory 104 in the form of a DCF data packet, and also includes the address of the configuration data client 112 associated with the verification circuit 130. Thus, the configuration circuit 108 reads the configuration data CD and transmits the corresponding reference password RK to the configuration data client 112 associated with the verification circuit 130.

[0234] In various embodiments, possible implementations of the password verification circuit may be referred to European Patent Application No. EP 3432 190 A1, which is incorporated herein by reference.

[0235] In various embodiments, the third condition (safety) is verified by ensuring that the processing system 10a is in a reset state, as this is considered a safe state by the ISO 26262 standard.

[0236] Specifically, as mentioned above about Figure 7As described, by applying a given logic level (e.g., low) to the reset terminal / pin / pad RP, the reset circuit 116 will start the reset process at step 3000. Thus, the reset circuit 116 performs the reset and configuration phase CP1 (and optionally the diagnosis phase DP and the configuration phase CP2). Moreover, the reset circuit 116 remains at step 3020 until the logic level at the reset terminal / pin / pad RP is set to a second logic level (e.g., high).

[0237] In various embodiments, the communication interface IF_JTAG is active during step 3022 , thus allowing the request REQ to be sent via the interface IF_JTAG. Since the communication interface IF_JTAG is usually also active when the processing core is running, the verification circuit 130 is configured to determine whether the reset circuit 116 is in step 3022 .

[0238] In various embodiments, verification circuit 130 receives a signal RA from reset circuit 116 indicating that reset module 116 is waiting at step 3022. In various embodiments, verification circuit 130 may also monitor a signal ECP indicating that the configuration phase has completed.

[0239] In various embodiments, the signal RA may also correspond to the signal at the terminal RP (or an inverted version thereof). In various embodiments, the verification circuit 130 may verify the signal RM that distinguishes the first reset phase from the second reset phase.

[0240] Verification circuitry 130 may verify whether a given flag is set to enable or disable the described operations for the early lifecycle phase in various embodiments.

[0241] In various embodiments, the verification circuit 130 monitors the signal LCFA_EN provided by the configuration data client 112 associated with the verification circuit 130. Thus, the signal LCFA_EN may be generated by storing a corresponding DCF data packet having the address of the configuration data client to the configuration data CD.

[0242] exist Fig.11 and Fig.12 In the illustrated embodiment, the above conditions are verified by generating a signal COND2 according to the signals TESTMODE, ECP, LCFA_EN, and RA via the combinatorial logic circuit 132. Conversely, the verification circuit 130 generates a signal LCFA_REQ according to the signals PW_OK and COND2 via the combinatorial logic circuit 1302. Therefore, in general, the combinatorial logic circuits 132 and 1302 may also be combined.

[0243] In various embodiments, signal LCFA_REQ is stored to register 1304, preferably a plurality of redundant registers / flip-flops, such as three parallel flip-flops.

[0244] Thus, in various embodiments, the signal LCFA_REQ is set only in the following cases: the life cycle is advanced to the fault analysis phase via the signal LCFA_EN; the processing system 10a is in a reset state, for example, via the signal RA, as indicated; the configuration data CD and the life cycle data LCD have been read, for example, via the signal ECP, as indicated; the request REQ corresponds to a valid request, for example, the correct password RK has been included in the request REQ, as verified via the circuit 1300 / indicated via the signal PW_OK; and the terminal / pin / pad TP has been set to the correct level indicating the test mode.

[0245] Thus, in the embodiment considered, the user can set the signal LCFA_REQ by setting the logic level at the terminals TP and RP and, once the configuration CP2 phase is completed, send a given request REQ (with the reference key RK) via the communication interface IF_JTAG. In fact, since one or more processing cores 102 have not yet started, such a request cannot be provided via software, which is not executed during this phase.

[0246] Specifically, in various embodiments, the register(s) / flip-flop(s) 1304 are reset only in response to the reset generated at step 3002 and not in response to the reset generated at step 3014 .

[0247] like Fig.12 As shown, register / trigger 1304 can be configured to: reset signal LCFA_REQ when signal RESET is set and signal RM has a first logic level (e.g., high) set at step 3002; and disable resetting of signal LCFA_REQ when signal RESET is set and signal RM has a second logic level (e.g., low) set at step 3016.

[0248] Alternatively, register / flip-flop 1304 may be reset only in response to reset signal RESET1 (reset signal / destructive reset DR generated at step 3002) but not reset signal RESET2 (reset signal / functional reset FR generated at step 3016).

[0249] In various embodiments, the signal LCFA_REQ is also provided to the reset circuit 116. The operation of this feedback is described in more detail below with respect to the lifecycle programming circuit 1046.

[0250] Before going into the details of the lifecycle programming circuit 1046, it is worth briefly describing the manner in which data is programmed into a non-volatile memory such as flash memory.

[0251] Typically, writing data to nonvolatile memory is more complex than writing data to RAM, where a single write instruction moves some data directly into RAM and then immediately latches the data into memory. In contrast, in the case of nonvolatile memory, programming typically requires a sequence of operations.

[0252] In various embodiments, in order to program a non-volatile memory, it may be necessary to set the power supply voltage of the memory to a higher voltage. This may involve a given time before the voltage stabilizes to the new value. Likewise, once the programming operation is completed, the higher voltage should be removed. Moreover, a single programming / write operation may involve a complex sequence of micro-operations to control the entire programming operation. The reason is that for non-volatile memories, undesirable analog effects may vary depending on the non-volatile memory technology used, which may hinder the successful completion of the programming operation.

[0253] In various embodiments, in the case of flash memory, the battery may become "depleted", which is a condition in which the battery has lost its trapped charge; in this case, the battery drives too much current flow along the bit line to which it is connected, and it is extremely difficult to recover the battery and bring it to a programmed state. Moreover, specialized algorithms may be required to recover a depleted battery.

[0254] Thus, typically, processing core 102 must perform a sequence of operations to write data to non-volatile memory 104 .

[0255] In various embodiments, the processing core 102 may be configured to perform the following steps for programming data into the non-volatile memory 104: 1) configuring the non-volatile memory 104 so that it is in a programming mode; 2) providing data to be programmed into the non-volatile memory 104 (via the memory controller 100); 3) setting the power supply voltage of the non-volatile memory 104 to a higher (write) voltage; 4) waiting until the programming operation is completed; 5) setting the power supply voltage of the non-volatile memory 104 to a lower (read) voltage; 6) performing a read operation of the non-volatile memory 104 (via the memory controller 100) to verify that the data has been correctly programmed; and 7) configuring the non-volatile memory 104 so that it is in a normal operating mode.

[0256] Typically, the above operations are performed by sending requests from processing core 102 to control circuit 1040 via software instructions.

[0257] In various embodiments, control circuit 1040 may also manage a register interface, wherein each register (such as a write data register, a read data register, an address register, and a control register) may have associated therewith a corresponding address.

[0258] In various embodiments, during the fourth step, the actual programming operation of the memory area 1048 is performed. During this step, the software can wait until the non-volatile memory 104 is finished programming. From the software's perspective, this is just a simple waiting step, but in reality, during this time frame, the non-volatile memory 104 performs a complex sequence of micro-operations, such as giving a short voltage pulse, then comparing the current cell to the reference cell, and if the current is not the target current, giving another pulse, and so on. Typically, an unbalanced ratio in the cell VI (voltage-current) characteristics is applied between the cell being programmed and the reference, so that when the unbalanced VI ratio is used during the read operation, the end operation that marks that the current of the programmed cell has reached a sufficient distance from the current of the reference cell will provide a larger margin (in terms of the current distance between the programmed cell and the reference cell). It should be appreciated by those skilled in the art that this is a simplification of the programming operation of the non-volatile memory, and in reality, the internal operation sequence may be more complicated, depending on the type of technology used for the non-volatile memory.

[0259] Thus, the write management circuit 1044w must execute a sequence of micro-operations to implement a programming operation.

[0260] To this end, the write management circuit 1044w may be implemented using a hardware finite state machine or a microprocessor programmed via software instructions.

[0261] In various embodiments, the microprocessor may have associated therewith a programmable voltage source for setting the supply voltage of the memory area 1048, and an analog-to-digital converter for monitoring the voltage of a given battery of the memory area 1048, etc.

[0262] In various embodiments, the use of a microprocessor is particularly useful for permitting improved programming operations.

[0263] In various embodiments, such a microprocessor permits (at least during the development phase) the use of different sequences or even later updating of different sequences.Such sequences of micro-operations executed by a microprocessor are generally referred to as "embedded algorithms".

[0264] Therefore, the microprocessor provides more flexibility than a fixed state machine. Such a microprocessor can be used only to manage more complex write operations, while read operations can still be performed via the dedicated hardware circuit 1044r. In fact, although the microprocessor provides greater flexibility, such a microprocessor usually has higher power consumption than the dedicated hardware circuit. For this reason, the microprocessor (but there may also be similar problems for the complex state machine 1044w that manages write operations) is usually turned off (or at least suspended) during the read operation. In fact, during runtime, the non-volatile memory 104 is mainly read and rarely written.

[0265] In various embodiments, this step may turn on the write circuit / microprocessor 1044w of the non-volatile memory 104 when the processing core 102 activates the programming mode of the non-volatile memory 104 .

[0266] However, this may mean that the lifecycle programming circuit 1046 must also activate the write circuit 1044w in some way, for example, a corresponding microprocessor. In fact, as mentioned before, the control circuit 1040 typically activates the write circuit 1044w only in response to one or more commands received from the memory controller 100.

[0267] In various embodiments, the control circuit 1040 is configured to activate the write circuit 1044w only when: a first request is received, wherein the first request activates a programming mode, for example, by setting a bit of a control register of the control circuit 1040 to activate the programming mode; and a second request is a receiver, wherein the second request provides data to be written, for example, by storing the data in a write data register of the control circuit 1040 to provide the data to be written.

[0268] In various embodiments, this allows avoiding the write circuit 1044w from being activated due to a false (isolated) first request or second request.

[0269] Thus, in various embodiments, the lifecycle programming circuit 1046 must also somehow activate the write circuit 1044w to program the non-volatile memory region 1048. Thus, the lifecycle programming circuit 1046 may perform the operations mentioned above for starting the write circuit 1044.

[0270] Instead, in various embodiments of the present disclosure, the feedback of signal LCFA_REQ to reset circuit 116 described above is used for this purpose.

[0271] Specifically, in various embodiments, during the destructive or functional reset at step 3002 or 3014, a circuit such as a microprocessor or a state machine that implements the write circuit 1044w is also activated, for example, to perform several internal initializations, and then the circuit is disabled, i.e., in various embodiments, the circuit that implements the write circuit 1044w is activated in response to the reset generated at step 3002 and the reset generated at step 3014, and once the non-volatile memory 104 is initialized, the circuit that implements the write circuit 1044 is disabled.

[0272] However, as regards Figure 7 As described, after the reset at step 3002, the reset circuit 116 activates the configuration phase CP1, during which the configuration data CD and the life cycle data LCD are read. Only once the configuration data are read, the diagnosis phase DP, its reset 3014 and the other configuration phase CP2 may also be performed, and the processing system 10a can be maintained in the reset phase via a signal at the reset terminal RP. Therefore, when the request REQ can be sent via the communication interface IF_JTAG and the verification circuit 130 verifies the request REQ and the additional condition COND2, the circuit that implements the write circuit 1044w may have been deactivated.

[0273] In this regard, as previously mentioned, the one or more registers / one or more flip-flops 1304 are configured to be reset only in response to the reset / destructive reset DR at step 3002, while the one or more registers / one or more flip-flops 1304 maintain their values ​​in response to the reset / functional reset FR at step 3014. Therefore, the circuit implementing the write circuit 1044w can be activated by starting the functional reset FR at step 3014, that is, the reset circuit 116 is configured to start the functional reset at step 3014 in response to the signal LCFA_REQ being set. Optionally, the reset circuit 116 can also verify additional conditions, such as the logic level of the terminal TP or the terminal RP (see the corresponding description of the verification circuit 130).

[0274] Thus, when the reset process is initiated at step 3014, register / flip-flop 1304 is not reset, but the circuitry implementing write circuit 1044w is activated.

[0275] Thus, in various embodiments, the circuit implementing the write circuit 1044w may be configured to verify the signal LCFA_REQ when the circuit is activated (e.g., in response to a reset). Furthermore, in response to determining that the signal LCFA_REQ is set, the write circuit 1044w may program the life cycle data LCD in the memory area 1048 to advance the life cycle stage to the failure analysis stage.

[0276] Specifically, once the processing system 10a is turned on, the reset circuit 116 will perform a reset at step 3002 and start the configuration phase CP1 (and optionally the diagnosis phase DP, the second reset at step 3014, and the second configuration phase CP2). Thus, when the circuit implementing the write circuit 1044w is initialized in response to the reset at step 3002 (and optionally the reset at step 3014), the signal LCFA_REQ is not set (e.g., is low).

[0277] Next, when the verification circuit 130 sets the signal LCFA_REQ, this signal will also trigger a new reset at step 3014. Specifically, as mentioned before, in the considered embodiment, the register 1304 maintains its content during the reset at step 3014.

[0278] Thus, when the circuitry implementing write circuit 1044w is initialized in response to the reset at step 3014, signal LCFA_REQ is now set (eg, high).

[0279] Fig.13 In this respect a possible embodiment of the programming circuit 1046 is shown. Generally, as mentioned before, the signal LCFA_REQ may also be provided directly to the write circuit 1044 (ie the programming circuit 1046 is purely optional).

[0280] However, if Fig.13 As shown, an additional programming circuit 1046 can be used: in the case where the signal LCFA_REQ is provided by multiple registers / triggers, to generate the signal LCFA_REQ' by combining the signal LCFA_REQ via the circuit 1052, for example, by setting the signal LCFA_REQ' to the bit value of the majority value of the signal LCFA_REQ, such as a three-vote decision; or to determine the signal FCFA via the circuits 134 and 1050 based on the signal LCFA_REQ (or the signal LCFA_REQ') and one or more optional other conditions COND1.

[0281] In various embodiments, the programming circuit 1046 can verify at least one of the logic levels of the terminal TP (i.e., signal TESTMODE) or the terminal RP via the combinational logic circuits 134 and 1050 (see the corresponding description of the verification circuit 130); or verify at step 3014 whether the circuit implementing the write circuit 1044 has been activated in response to the functional reset FM (e.g., by verifying the logic value of the signal RM).

[0282] In various embodiments, the programming operation of the life cycle data LCD starts only when the writing circuit determines the following conditions during the initialization phase, for example via the programming circuit 1046: most bits of the signal LCFA_REQ are set; and the signal TESTMODE applied to the terminal TP is set.

[0283] Usually, although Fig.13 1044w, but the signal LCFA_REQ, LCFA_REQ' or LCFA can be provided to a register interface of the microprocessor 1044w, for example, a so-called special function register (SFR) of the microprocessor implementing the write circuit 1044w. Generally, although the verification of the additional condition COND1 is shown via the hardware combinational circuit 134 or the hardware combinational circuit 1050, at least part of these verifications can be performed via software instructions. Similarly, the operation of the (voting) circuit 1052 can be performed via software instructions executed by the microprocessor 1044.

[0284] Typically, dedicated voting circuit 1052 may be used even in a software implementation because signal LCFA_REQ′ may be used to signal a reset request to reset module 116 (i.e., reset circuit 116 may be configured to initiate a functional reset in response to signal LCFA_REQ′ instead of signal LCFA_REQ).

[0285] In various embodiments, similar voting circuits may be implemented directly in the reset circuit 116 .

[0286] Thus, in various embodiments, circuit 1052 may correspond to a register interface of a microprocessor implementing write circuit 1044w, thereby providing signal LCFA_REQ (provided by register 1304) directly to the microprocessor.

[0287] Preferably, the voting of the signal LCFA_REQ and the combination with at least the additional conditions at the circuit 1050 (and optionally also the operation of the circuit 134) are performed directly via software instructions. The reason for mirroring all the signals LCFA_REQ to the corresponding register bits (e.g., 3 bits) of the microprocessor 1044 is to protect the mechanism from false activation, which could be disastrous for the application, since the device would enter a fault analysis phase in which the application may no longer run.

[0288] However, in various embodiments, the microprocessor within the non-volatile memory 104 is not classified as an ASIL-D component according to the ISO26262 specification, and it may eventually fail. In contrast, an ASIL-D microprocessor comes at the expense of additional area and power consumption. Therefore, by reading multiple independent bits of the signal LCFA_REQ and implementing a vote via software instructions, such as a three-vote decision, the probability of failure is significantly reduced.

[0289] As mentioned before, when the functional reset of step 3014 is triggered in response to the signal LCFA_REQ, the nonvolatile memory 104 starts its own initialization again, and during this time, because the signal LCFA_REQ maintains its value, the request to advance the life cycle stage to the failure analysis stage is activated.

[0290] In this regard, because the memory location of the life cycle data LCD in the non-volatile memory 1048 is fixed and the signature to be programmed to advance the life cycle stage to the failure analysis stage is also fixed, no additional information is required to advance the life cycle stage to the failure analysis stage. As previously described, how the life cycle data LCD is encoded is not particularly relevant.

[0291] In various embodiments, it is sufficient to associate a given bit sequence with a bit subset associated with a fault analysis phase. Thus, by programming the corresponding bit subset, the life cycle phase can be advanced to the fault analysis phase, regardless of the previous life cycle phase. However, when a more complex encoding scheme is used, the write circuit 1044 can also read the old life cycle data LCD first.

[0292] Typically, once the writing circuit 1044 has completed programming the life cycle data LCD, the processing circuit 10a needs to read the life cycle data LCD again. However, it is also necessary to reset one or more signals LCFA_REQ.

[0293] In various embodiments, this is accomplished by executing a new reset starting at step 3000 , thereby performing a reset of one or more registers 1304 at step 3002 .

[0294] Typically, a new reset can also be performed manually (for example, once the correct request REQ is sent), the user can wait for a given time, for example, more than 1s, whereby the write circuit 1044w completes the programming operation on the life cycle data LCD; de-asserts the signal at the reset terminal RP; and asserts the signal at the reset terminal RP again, thereby starting a new reset at step 3000.

[0295] Thus, in various embodiments, advancing the cycle phase may involve the following: 1) activating a destructive reset via terminal RP (step 3002); 2) in response to the destructive reset DR, the configuration module 108 reads the configuration data CD and the life cycle data LCD (configuration phase CP1), and optionally performs other operations until step 3020; 3) once the configuration phase CP1 and optionally CP2 are terminated, the verification circuit is activated; 4) in order to have enough time to submit the request, the reset terminal remains set (step 3020); 5) submitting the request REQ using the correct password; 6) once the request REQ is verified, the signal LCFA_REQ is set; 7) Signal LCFA_REQ is used to generate a functional reset of the processing system 10a (step 3016); 8) In response to the functional reset, the circuit implementing the write circuit 1044w is activated and its initialization is performed; 9) The circuit implementing the write circuit 1044w reads the signal LCFA_REQ during initialization; 10) The write circuit 1044w or the programming circuit 1046 verifies whether most of the bits of the signal LCFA_REQ are set; 11) Since the LCFA_REQ signal is set, the write circuit 1044w writes the life cycle data LCD to advance to the fault analysis stage; and 12) A new destructive reset is started manually or automatically (step 3002).

[0296] Typically, instead of indirectly activating the circuitry implementing write circuit 1044w by generating a reset in response to one or more signals LCFA_REQ (or signal LCFA_REQ′), the circuitry implementing write circuit 1044w may also be activated in other ways in response to setting one or more signals LCFA_REQ.

[0297] In various embodiments, the circuit implementing the write circuit 1044w may be directly activated in response to the signal LCFA_REQ or the signal LCFA_REQ′, for example, by configuring one or more corresponding signals as a wake-up signal of the circuit implementing the write circuit 1044w.

[0298] Thus, the present disclosure proposes a new solution to easily advance a failed device to the fault analysis stage, thereby bypassing most of the circuit systems that are usually involved in advancing the life cycle stage. By adopting the proposed solution, it is guaranteed to advance to the fault analysis stage with a higher probability compared to the standard method of life cycle programming via application software. The adopted solution does not compromise the overall security because it only allows the life cycle to be advanced after a successful challenge of the secret password. In addition, the proposed solution does not compromise security because the operation is only performed during the reset phase, which is considered a guaranteed state by the ISO26262 standard. Finally, the proposed solution does not include availability because a set of conditions is put in place to avoid any spurious activation of the life cycle advancement.

[0299] Of course, without prejudice to the principle of the invention, the details of construction and the embodiments may vary widely with respect to what is described and illustrated herein purely by way of example, without thereby departing from the scope of the invention as defined in the appended claims.

[0300] Although a mechanism for advancing the life cycle phase to the fault analysis phase has been described above, modern processing systems may alternatively or additionally include a test life cycle phase. The test life cycle phase generally has less impact on overall safety than the fault analysis phase. Therefore, the write circuit 1044 may also be advanced to the test life cycle phase rather than to the fault analysis phase. In fact, it is relevant to the present disclosure to use a separate mechanism to advance the life cycle phase to a phase where fewer safety mechanisms are active compared to the field phase.

[0301] Although the specification has been described in detail, it should be understood that various changes, substitutions and variations can be made without departing from the spirit and scope of the present disclosure as defined by the appended claims. In each of the accompanying drawings, the same elements are represented by the same reference numerals. Moreover, since it is easy for a person of ordinary skill in the art to appreciate according to the present disclosure that the processes, machines, manufactures, material compositions, devices, methods or steps that exist now or will be developed later can perform functions substantially the same as the corresponding embodiments described herein or achieve substantially the same results, the scope of the present disclosure is not intended to be limited to the specific embodiments described herein. Therefore, the appended claims are intended to include these processes, machines, manufactures, material compositions, devices, methods or steps within their scope.

[0302] Accordingly, the specification and drawings are to be regarded simply as illustrations of the present disclosure, which are defined by the appended claims, and are intended to cover any and all modifications, variations, combinations or equivalents that fall within the scope of the present disclosure.

Claims

1. A processing system comprising: a microprocessor configured to execute software instructions; a hardware circuit configured to change an operation based on the decoded lifecycle data; A reset circuit configured to, in response to determining that an external reset signal received via a reset terminal has a first logic level, cause the reset circuit to: generating a first reset of the processing system during a reset phase, activating hardware configuration circuitry during a configuration phase, wherein the hardware configuration circuitry reads encoded lifecycle data stored in a non-volatile memory, decodes the encoded lifecycle data, and provides the decoded lifecycle data to the hardware circuitry, and enabling the microprocessor in response to determining that the external reset signal has a second logic level during a wait phase; a communication interface activated during the waiting phase and configured to receive a request; as well as The hardware verification circuit is configured to generate a lifecycle advance request signal in response to determining that the request includes a reference password and the reset circuit is in the waiting stage, the lifecycle advance request signal indicating the following request: advance the lifecycle stage to a given predetermined lifecycle stage indicated by the encoded lifecycle data.

2. The processing system of claim 1 , wherein the non-volatile memory comprises a write circuit, the write circuit being configured to: in response to determining that the lifecycle advance request signal is set, write one or more bits of the encoded lifecycle data stored in the non-volatile memory, the writing causing the lifecycle stage to be advanced to the given predetermined lifecycle stage.

3. The processing system according to claim 2, further comprising a test mode terminal configured to receive an external test mode signal, and wherein the hardware verification circuit is configured to generate the life cycle advance request signal only when the external test mode signal has a given logic level. 4 . The processing system of claim 2 , further comprising at least three registers, wherein the lifecycle advance request signal is stored in the at least three registers.

5. The processing system of claim 4 , wherein the write circuit is implemented using a state machine, the state machine being configured to: reading the contents of the at least three registers; and In response to determining that a majority of the bits are set, the one or more bits of the encoded lifecycle data stored in the non-volatile memory are written.

6. The processing system of claim 5 , wherein the state machine is one of a hardware state machine or a second microprocessor, wherein the at least three registers are implemented using a register interface of the second microprocessor, and wherein the second microprocessor is configured to read contents of the at least three registers and determine logic levels of the majority of bits of the at least three registers via software instructions executed by the second microprocessor.

7. The processing system of claim 5 , wherein the reset circuit is configured to monitor an internal reset signal and, in response to determining that the internal reset signal is set, generate a second reset of the processing system, wherein the at least three registers are configured to be reset in response to the first reset and to maintain values ​​stored by the at least three registers in response to the second reset, and wherein the internal reset signal corresponds to the lifecycle advance request signal.

8. The processing system of claim 7, wherein the state machine is configured to be activated in response to the first reset and the second reset generated by the reset circuit, and wherein the state machine is configured to read the contents of the at least three registers in response to being activated.

9. The processing system of claim 1 , further comprising a plurality of configuration data clients, each configuration data client having a register for storing configuration data, wherein the non-volatile memory is configured to store the configuration data, and wherein the hardware configuration circuit is configured to read the configuration data from the non-volatile memory during the configuration phase and transmit the configuration data to the plurality of configuration data clients.

10. The processing system of claim 9, wherein the hardware verification circuit is configured to receive an enable flag from a configuration data client, and wherein the hardware verification circuit is configured to generate the lifecycle advance request signal only when the enable flag has a given logic level.

11. The processing system of claim 9, wherein the hardware verification circuit is configured to receive the reference password from a configuration data client.

12. The processing system of claim 1, wherein the communication interface is a serial communication interface.

13. The processing system of claim 1, wherein the communication interface is a Joint Test Action Group (JTAG) interface.

14. An apparatus comprising a plurality of processing systems, each processing system comprising: a microprocessor configured to execute software instructions; a hardware circuit configured to change an operation based on the decoded lifecycle data; A reset circuit configured to, in response to determining that an external reset signal received via a reset terminal has a first logic level, cause the reset circuit to: generating a first reset of the processing system during a reset phase, activating hardware configuration circuitry during a configuration phase, wherein the hardware configuration circuitry reads encoded lifecycle data stored in a non-volatile memory, decodes the encoded lifecycle data, and provides the decoded lifecycle data to the hardware circuitry, and enabling the microprocessor in response to determining that the external reset signal has a second logic level during a wait phase; a communication interface activated during the waiting phase and configured to receive a request; as well as The hardware verification circuit is configured to generate a lifecycle advance request signal in response to determining that the request includes a reference password and the reset circuit is in the waiting stage, the lifecycle advance request signal indicating the following request: advance the lifecycle stage to a given predetermined lifecycle stage indicated by the encoded lifecycle data.

15. The device of claim 14, wherein the device is a vehicle.

16. The apparatus of claim 14, wherein each processing system is connected to another processing system via a communication system.

17. The device of claim 14, wherein the non-volatile memory comprises a write circuit, the write circuit being configured to: in response to determining that the lifecycle advance request signal is set, write one or more bits of the encoded lifecycle data stored in the non-volatile memory, the writing advancing the lifecycle stage to the given predetermined lifecycle stage.

18. A method for operating a processing system, comprising: generating, by a reset circuit, a first reset of the processing system during a reset phase in response to determining that the external reset signal received via the reset terminal has a first logic level, activating a hardware configuration circuit by the reset circuit during a configuration phase, wherein the hardware configuration circuit reads encoded life cycle data stored in a non-volatile memory, decodes the encoded life cycle data, and provides the decoded life cycle data to a hardware circuit, the hardware circuit changing operation according to the decoded life cycle data; as well as activating a microprocessor of the processing system in response to determining that the external reset signal has a second logic level during the wait phase; activating a communication interface during said waiting phase; receiving a request during the waiting phase; as well as In response to determining that the request includes a given reference password and the reset circuit is in the waiting stage, a life cycle advance request signal is generated by the hardware verification circuit, and the life cycle advance request signal indicates the following request: to advance the life cycle stage to a given predetermined life cycle stage indicated by the encoded life cycle data.

19. The method according to claim 18, further comprising: In response to determining that the lifecycle advance request signal is set, one or more bits of the encoded lifecycle data stored in the non-volatile memory are written by a writing circuit, the writing advancing the lifecycle stage to the given predetermined lifecycle stage.

20. The method of claim 18, further comprising: applying the first logic level to the reset terminal of the processing system, wherein the reset circuit performs the reset phase, the configuration phase, and the wait phase; as well as The request is sent via the communication interface of the processing system, the request including the given reference password, wherein the hardware verification circuit generates the lifecycle advance request signal.

Images