Chip programmable power domain system and method

Abstract

The application relates to the technical field of integrated circuits, and provides a chip programmable power supply domain system and method, wherein a new programmable power supply domain system structure is cooperatively designed, a configuration carrier is changed from a "physical level / logic signal" into control over "power network physical connection", a PMU is directly controlled to physically turn on and off a power supply domain, a cooperative locking mechanism of an OTP fuse and a safety arbitrator is introduced, true zero-power-off and permanent locking are realized, a fuse array is divided into two independent function domains of a configuration data area and a locking state bit, and state judgment and path control logic of the safety arbitrator are embedded in a reading process, separation control of configuration authority and configuration storage is realized, a general application layer interface is used as a post-configuration channel implementation and a high-level safety protocol, safety and mass production convenience are improved, and the final function of a chip can be determined flexibly, reliably and with low power consumption in the late production stage.

Description

Technical Field

[0001] This invention belongs to the field of integrated circuit technology and relates to a chip-programmable power domain system and method. Background Technology

[0002] In the integrated circuit industry, to meet diversified market demands, configuring different functions based on a single chip design has become a mainstream strategy for reducing R&D costs. Related technological developments mainly focus on how to selectively configure chip functions during production or application through hardware or software means. For example, pin-bonding configuration schemes, which bind dedicated configuration pins of the chip to power or ground during packaging to set the initial state of its internal logic, are often described in microelectronics packaging manuals as a typical method for "chip function selection." However, its configuration is permanently fixed in the package, lacking flexibility and consuming pin resources.

[0003] For example, non-volatile memory programming schemes write configuration information to fuse or floating-gate memory cells via electrical signals. Upon chip power-on, a power-on reset (POR) circuit triggers simple sequential logic to directly read the configuration information from the memory cells and load it into the function configuration register. This scheme is widely used in various programmable chips, such as microcontrollers (MCUs), where boot options or peripheral functions are configured by programming the OTP (One-Time Programmable) memory area. However, one-time programming schemes have poor fault tolerance; reprogrammable schemes increase chip area and cost. Furthermore, the configuration data reading process is completed directly by simple logic without intermediate authorization verification, making it impossible to embed security checks in the power-on process.

[0004] For example, software register configuration schemes access configuration registers via the bus to enable the logic functions of control modules. This scheme is the foundation of various complex System-on-a-Chip (SoC) designs, but it cannot shut down the module power, has static power consumption, and the configuration is easily modified by software, making it impossible to permanently lock. Another example is dedicated test interface configuration schemes, which reuse test interfaces such as JTAG and write control instructions through a scan chain. However, their protocols are complex, pose security risks, and are unsuitable for efficient mass production. Furthermore, these traditional schemes also suffer from the technical challenge of flexibly, reliably, and with low power consumption determining the final chip functionality in the later stages of production. Summary of the Invention

[0005] To address the problems existing in the above-mentioned traditional methods, this invention proposes a chip programmable power domain system and a chip programmable power domain management method, which can flexibly, reliably and with low power consumption determine the final function of the chip in the later stages of production.

[0006] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0007] On one hand, a chip-programmable power domain system is provided, including a permanent activation area and multiple functional modules located in independent power domains. The chip-programmable power domain system also includes:

[0008] The post-configuration interface serves as the physical link between the chip and an external configuration host. The post-configuration interface is located in the permanently active area of ​​the chip's programmable power domain system and is always powered on.

[0009] The instruction decoder is used to parse and verify the external configuration instructions received by the post-configuration interface and then convert them into corresponding operation commands.

[0010] The security arbiter is used to verify the permissions of the input operation command through a challenge-response mechanism, output the configuration instruction, and permanently close the configuration path after locking; the security arbiter is also used to read the pre-stored power domain configuration state from the configuration data area of ​​the one-time programmable configuration fuse array and load it into the power domain configuration latch register each time the chip is powered on.

[0011] A one-time programmable configuration fuse array includes a lock status bit and a configuration data area. The lock status bit is used to store a global enable flag indicating whether the configuration channel has been permanently disabled. The configuration data area is used to store the final configuration status of each power domain. The number of bits in the configuration data area corresponds to the number of power domains.

[0012] The power domain configuration latch register is used to store data from the corresponding input source under the control of the safety arbitrator. When the current state is the configuration phase, the input source is the configuration instruction of the safety arbitrator. When the current state is locked and powered on, the input source is the pre-stored configuration state read from the configuration data area.

[0013] The power management unit is used to directly control the power switches of multiple independent power domains based on the configuration words stored in the power domain configuration latch register.

[0014] In one embodiment, the security arbitrator includes a master control state machine, a key verification unit, access control path management logic, and a fuse status reading circuit.

[0015] The main control state machine is used to define and manage the overall configuration process of the chip's programmable power domain system. The key verification unit is used to execute the challenge-response protocol to generate challenge codes, verify the correctness of the response keys returned by the external configuration host, and output the corresponding verification results. The access control path management logic is used to generate key enable signals based on the state of the main control state machine and the verification results of the key verification unit.

[0016] The fuse status reading circuit is used to perform status reading, configuration data programming, fuse locking, and configuration data reading on a one-time programmable configuration fuse array.

[0017] In one embodiment, key enable signals include a temporary write enable signal generated upon successful verification and a permanent disable signal generated upon locking; the temporary write enable signal is used to briefly grant write access to the power domain configuration latch register, and the permanent disable signal is used to permanently disable the configuration path.

[0018] In one embodiment, the master control state machine is also used to automatically enter the autonomous test mode when the chip is powered on if it detects that the dedicated test mode pin is set to an active level and the configuration fuse of the corresponding test mode pin in the one-time programmable configuration fuse array is not locked; the test mode pin is not brought out in the final package of the chip.

[0019] In one embodiment, the fuses of the one-time programmable configuration fuse array include electric fuses or anti-fuse fuses.

[0020] In one embodiment, during the configuration phase, the post-configuration interface sends the external configuration command provided by the external configuration host to the command decoder for parsing and then to the security arbitrator. After verifying the permissions of the parsed external configuration command, the security arbitrator allows the configuration word corresponding to the external configuration command to be written into the power domain configuration latch register. The power management unit reads the value of the power domain configuration latch register in real time and controls the power supply status of the corresponding power domain.

[0021] In one embodiment, during the locking phase, the security arbiter triggers the programming operation of the one-time programmable configuration fuse array, stores the final configuration state image in the power domain configuration latch register into the configuration data area of ​​the one-time programmable configuration fuse array, and then blows the locking flag.

[0022] In one embodiment, during the locked operation phase, when the chip is powered on, the security arbitrator reads the pre-stored configuration information from the configuration data area of ​​the one-time programmable configuration fuse array and loads it into the power domain configuration latch register. Then, the power management unit controls the power supply of each power domain according to the value of the power domain configuration latch register.

[0023] In one embodiment, the post-configuration interface is a UART interface.

[0024] On the other hand, a chip-programmable power domain management method is also provided, applied to the aforementioned chip-programmable power domain system. The chip-programmable power domain management method includes the following steps:

[0025] The post-configuration interface obtains external configuration commands provided by the external configuration host;

[0026] The instruction decoder parses and verifies external configuration instructions before converting them into corresponding operation commands.

[0027] The security arbitrator verifies the permissions of the input operation command through a challenge-response mechanism, outputs the configuration instruction, and permanently closes the configuration path after locking. Each time the chip is powered on, the security arbitrator reads the pre-stored power domain configuration state from the configuration data area of ​​the one-time programmable configuration fuse array and loads it into the power domain configuration latch register.

[0028] The lock status bits of the one-time programmable configuration fuse array store a global enable flag indicating whether the configuration channel has been permanently disabled. The configuration data area of ​​the one-time programmable configuration fuse array stores the final configuration status of each power domain. The number of bits in the configuration data area corresponds to the number of power domains.

[0029] The power domain configuration latch register stores data from the corresponding input source under the control of the safety arbitrator. When the current state is the configuration phase, the input source is the configuration instruction from the safety arbitrator. When the current state is locked and powered on, the input source is the pre-stored configuration state read from the configuration data area.

[0030] The power management unit directly controls the power switching of multiple independent power domains based on the configuration words stored in the power domain configuration latch register.

[0031] One of the above technical solutions has the following advantages and beneficial effects:

[0032] The aforementioned programmable power domain system and method, through the collaborative design of a post-configuration interface, instruction decoder, security arbitrator, one-time programmable configuration fuse array, power domain configuration latch register, and power management unit, forms a new programmable power domain system structure. This transforms the configuration carrier from "physical level / logic signal" to the control of "physical connection of the power network." It directly controls the PMU to physically switch the power domain on and off, and introduces a collaborative locking mechanism between the OTP fuse and the security arbitrator to achieve true zero-power shutdown and permanent locking. The fuse array is divided into two independent functional domains: a configuration data area and a locked status bit. The status judgment and path control logic of the security arbitrator are embedded in the reading process, achieving separate management of configuration permissions and configuration storage. A general application layer interface is used as the post-configuration channel implementation and high-level security protocol, offering flexible configuration and pin savings. This replaces the complex testing protocols with high-level permissions at the lower level, improving security and mass production convenience. It enables flexible, reliable, and low-power determination of the chip's final functionality in the later stages of production. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a chip-programmable power domain system architecture in one embodiment;

[0035] Figure 2 This is a block diagram of the internal functional modules of a security arbitrator in one embodiment;

[0036] Figure 3 A flowchart of the main control state machine of the security arbitrator in one embodiment;

[0037] Figure 4 This is a schematic diagram of the chip configuration and locking process in one embodiment;

[0038] Figure 5 This is a flowchart illustrating a chip-programmable power domain management method in one embodiment. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention.

[0040] It should be noted that, in this document, the reference to "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The presentation of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art will understand that the embodiments described herein can be combined with other embodiments. The term "and / or" as used herein refers to any combination of one or more of the associated listed items, and all possible combinations, including such combinations.

[0041] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0042] In traditional pin-bonding / bump configuration schemes, the configuration must be completed during the chip packaging process and cannot be changed, which lacks flexibility. At the same time, it also occupies dedicated pin or pad resources. This is because the configuration depends on the permanent physical connection formed during the packaging process, which is irreversible once established. In addition, the reserved configuration pins cannot be reused, resulting in reduced resource utilization.

[0043] Traditional non-volatile memory programming schemes employ one-time programming, which has poor fault tolerance and cannot be modified. Reprogrammable schemes, on the other hand, increase chip area and manufacturing costs, and lack access control and status judgment capabilities for read paths. This is because one-time components such as fuses are irreversible after programming, and embedded flash memory requires additional process steps, increasing complexity and area. Moreover, they only implement configuration data storage, not configuration access control.

[0044] Traditional software register configuration schemes cannot completely shut down the power supply of unused modules, resulting in wasted static power consumption. The configuration state is easily changed dynamically, making it difficult to achieve permanent model binding. This is because the scheme usually only controls the clock or logic enable without cutting off the power supply. The software registers can be read and written multiple times and do not have non-volatility.

[0045] Traditional dedicated test interface configuration schemes have complex configuration protocols, require specialized tools, are unsuitable for mass production, and pose security and operational risks. This is because their test interface protocol timing is complex, resulting in low efficiency during configuration; their test interfaces have high-privilege access capabilities, which may be used for unauthorized operations if used for routine configuration.

[0046] In summary, a comprehensive chip function configuration solution needs to be developed. This solution should improve configuration flexibility and save physical resources, enabling function configuration after chip packaging, shifting the model decision point to the final testing stage, and avoiding the use of dedicated configuration pins. It should eliminate static power consumption and provide a reliable mechanism to lock the configuration state by directly controlling the power supply of the independent power domain of the functional modules, achieving physical-level power shutdown and ensuring configuration stability. Furthermore, it should provide a solution for model locking without relying on special process non-volatile memory, avoiding additional process steps and area costs, thus optimizing production costs and complexity. Finally, it should utilize a general communication interface as the configuration channel, avoiding the use of complex and high-privilege test interfaces, reducing security risks, and facilitating production line integration, thereby ensuring the security and applicability of the configuration process.

[0047] In one embodiment, such as Figure 1 As shown, a chip-programmable power domain system is provided, including a permanent activation area and multiple functional modules located in independent power domains. The chip-programmable power domain system may further include:

[0048] The post-configuration interface serves as the physical link between the chip and an external configuration host. The post-configuration interface is located in the permanently active area of ​​the chip's programmable power domain system and is always powered on.

[0049] The instruction decoder is used to parse and verify the external configuration instructions received by the post-configuration interface and then convert them into corresponding operation commands.

[0050] The security arbiter is used to verify the permissions of the input operation command through a challenge-response mechanism, output the configuration instruction, and permanently close the configuration path after locking; the security arbiter is also used to read the pre-stored power domain configuration state from the configuration data area of ​​the one-time programmable configuration fuse array and load it into the power domain configuration latch register each time the chip is powered on.

[0051] A one-time programmable configuration fuse array includes a lock status bit and a configuration data area. The lock status bit is used to store a global enable flag indicating whether the configuration channel has been permanently disabled. The configuration data area is used to store the final configuration status of each power domain. The number of bits in the configuration data area corresponds to the number of power domains.

[0052] The power domain configuration latch register is used to store data from the corresponding input source under the control of the safety arbitrator. When the current state is the configuration phase, the input source is the configuration instruction of the safety arbitrator. When the current state is locked and powered on, the input source is the pre-stored configuration state read from the configuration data area.

[0053] The power management unit is used to directly control the power switches of multiple independent power domains based on the configuration words stored in the power domain configuration latch register.

[0054] It is understood that the core improvement of this embodiment lies in: integrating multiple configurable functional modules into a single chip design and allocating independent power domains to them; receiving external configuration commands through a universal communication interface that is necessarily accessible after packaging (such as, but not limited to, UART, I2C, or McBSP interfaces); after authorization verification and flow control by the chip's unique internal security arbitrator, directly operating the power management unit to physically power on or off the specified power domain; and finally permanently locking the configuration channel through a one-time programmable fuse, thereby transforming a general-purpose prefabricated chip into a specific model product with fixed functions, realizing a one-time secure transformation from a programmable silicon wafer to a finished commercial chip.

[0055] like Figure 1 As shown, the system mainly includes the following core modules: a post-configuration interface, an instruction decoder, a security arbiter, a one-time programmable configuration fuse array, a power domain configuration latch register, a power management unit (PMU), a permanent activation area, and multiple functional modules located in independent power domains. The permanent activation area and functional modules are inherent components of the system itself, and their explanations can be found by referring to the descriptions of permanent activation areas and functional modules in chips of this art; they will not be elaborated upon further in this specification.

[0056] The post-configuration interface serves as the physical link between the chip and the external configuration host. It can be, but is not limited to, the UART interface, because its protocol is simple and its pins are few, which can ensure that it can be brought out and accessed in different packages. The post-configuration interface is located in the permanently active area and is always powered on. For ease of understanding, the following explanation uses the UART interface as an example. Other types of interfaces are similar and can be adapted accordingly.

[0057] The instruction decoder is used to parse and verify the received serial data (such as external configuration instructions), and convert the verified data into operation commands that can be recognized by the internal logic according to a predefined instruction set (e.g., but not limited to "enable power domain 1" and "lock"). The predefined instruction set can be defined by the project team during chip development. The instruction set may include, but is not limited to, control instructions such as: enabling DSP core 0 when the received data is 01010101, disabling DSP core 0 when the received data is 01010110, enabling DSP core 1 when the received data is 10101010, and resetting the system when the received data is 00000000. A UART protocol data frame can be up to 8 bits, and the corresponding instruction combinations can be 2... 8 In order to avoid interference from ordinary data, a command sequence can be constructed (e.g., if a single frame of data is invalid, multiple frames must be sent in a fixed order to be considered a true command) to ensure normal communication.

[0058] The security arbitrator serves as the core control and security hub (its internal functional modules include...) Figure 2 (As shown). A one-time programmable configuration fuse array consists of a set of electric fuses or antifuses, and its storage content is divided into two functional fields: a lock status bit and a configuration data area. The lock status bit stores a global enable flag indicating whether the configuration channel has been permanently disabled; the configuration data area stores the final configuration status of each independent power domain (e.g., "PD1 On / Off", "PD2 On / Off", etc.), and its number of bits corresponds to the number of power domains. The one-time programmable configuration fuse array is written once during a locking operation. Once a fuse blows, its stored configuration status cannot be changed, but it can be read upon power-on.

[0059] The power domain configuration latch register includes a set of multiplexed output memory cells controlled by a security arbitrator, and is a volatile register structure. The input source of the power domain configuration latch register is selected by the security arbitrator based on the current state: when the current state is the configuration phase (fuse unlocked), the input source is the configuration command output of the security arbitrator, which can be written to in real time by an external configuration host; when the current state is power-on after locking (fuse locked), the input source automatically switches to the pre-stored configuration state read from the configuration data area of ​​the one-time programmable configuration fuse array. As a bridge between the configuration data and the power management unit, the power domain configuration latch register ensures the chip's power-on configuration self-recovery capability throughout its entire lifecycle.

[0060] The power management unit receives the configuration word stored in the power domain configuration latch register and directly controls multiple independent power switches to achieve physical on / off switching of power supply to functional modules. For the permanently active area and multiple functional modules located in independent power domains, each configurable functional module is located in an independent power domain. The permanently active area includes the minimum logic required for the configuration system and is always-on in the power domain. The permanently active area is the inherent control center for the chip's power management and wake-up mechanisms.

[0061] The aforementioned programmable power domain system, through the collaborative design of a post-configuration interface, instruction decoder, security arbitrator, one-time programmable configuration fuse array, power domain configuration latch register, and power management unit, forms a new programmable power domain system architecture. This transforms the configuration carrier from "physical level / logic signal" to the control of "physical connection of the power network." It directly controls the PMU to physically switch the power domain on and off, and introduces a collaborative locking mechanism between the OTP fuse and the security arbitrator to achieve true zero-power shutdown and permanent locking. The fuse array is divided into two independent functional domains: a configuration data area and a locked status bit. The status judgment and path control logic of the security arbitrator are embedded in the read process, achieving separate management of configuration permissions and configuration storage. A general application layer interface is used as the post-configuration channel implementation and high-level security protocol, offering flexible configuration and pin savings. This replaces the complex testing protocols with high-level permissions at the lower level, improving security and mass production convenience. It enables flexible, reliable, and low-power determination of the chip's final functionality in the later stages of production.

[0062] In one embodiment, the security arbiter includes a main control state machine, a key verification unit, access control path management logic, and fuse status reading circuitry. It may also expose a test mode pin (i.e., the chip's TEST_MODE pin) to support autonomous test mode. The security arbiter verifies permissions through a challenge-response mechanism (existing security authentication protocols based on random numbers and keys) and permanently closes the configuration path after locking. Furthermore, the security arbiter is also used to read the pre-stored power domain configuration state from the configuration data area of ​​the one-time programmable configuration fuse array and load it into the power domain configuration latch register each time the chip powers on, thereby achieving permanent retention of configuration information and power-on self-recovery.

[0063] The main control state machine is used to define and manage the states of the overall configuration process, and its detailed state transition logic is as follows: Figure 3 As shown.

[0064] The key verification unit has built-in existing cryptographic algorithm logic (algorithm engine) or secure key storage unit to execute the challenge-response protocol. It generates a challenge code based on the chip's unique identifier and a random number generated by a true random number generator according to the existing challenge code generation logic. It also verifies the correctness of the response key returned by the external configuration host according to the existing response comparison logic and outputs the corresponding verification result.

[0065] The access control path management logic is used to generate key enable signals based on the state of the main control state machine and the verification result of the key verification unit. For example, when the verification is successful, a temporary write enable signal is generated to briefly grant write access to the power domain configuration latch register. Or, when locking is performed, a permanent disable signal is generated to permanently disable the configuration path (i.e., the corresponding configuration channel) to cut off all subsequent configuration instruction paths from the hardware logic.

[0066] The fuse status read circuit has been expanded to have bidirectional operation capability, and its functions include status read, configuration data programming, fuse locking, and configuration data read. Status read reads the lock status bit of the one-time programmable configuration fuse array to determine whether the configuration channel is disabled; configuration data programming writes the final configuration status in the power domain configuration latch register to the configuration data area of ​​the one-time programmable configuration fuse array before executing the lock instruction; fuse locking triggers a high-voltage pulse to blow the fuse corresponding to the lock status bit of the one-time programmable configuration fuse array, physically and permanently disabling the corresponding configuration channel; configuration data read reads the pre-stored configuration status from the configuration data area of ​​the one-time programmable configuration fuse array and loads it into the power domain configuration latch register each time the chip is powered on, ensuring that the functional status of the locked chip remains consistent after any power-on or power-off cycle.

[0067] In one embodiment, the master control state machine is also used to automatically enter the autonomous test mode when the chip is powered on if it detects that the dedicated test mode pin is set to an active level and the configuration fuse of the corresponding test mode pin in the one-time programmable configuration fuse array is not locked; the test mode pin is not brought out in the final package of the chip.

[0068] It is understood that support for the autonomous test (TEST_MODE) mode is provided: to further facilitate production testing and debugging, the main control state machine of the security arbiter also supports an autonomous test mode. In this embodiment, the pins of the chip in TEST_MODE mode can also be brought out before final packaging, which can distinguish it from the chip's normal functional mode. If TEST_MODE mode is selected, the chip enters autonomous test mode, allowing the chip to undergo fault testing and chip screening before solidification.

[0069] Specifically, when the chip powers on, if the main control state machine detects that the dedicated TEST_MODE pin is set to an active level and the configuration fuse for the corresponding TEST_MODE pin in the one-time programmable configuration fuse array is not locked, it automatically enters the autonomous test mode. In autonomous test mode, the safety arbiter can control the power management unit to power on each power domain according to the predefined test configuration, enabling the chip to run its built-in self-test program without waiting for external configuration instructions. This TEST_MODE pin is not brought out in the final chip package, thus ensuring the safety of mass-produced chip products.

[0070] In some implementations, the data flow of the above-mentioned chip programmable power domain system differs between the configuration phase and the post-locking operation phase, as follows:

[0071] During the configuration phase (fuse unlocked): After the external configuration command passes through the configuration interface (e.g., UART interface), it enters the chip. After being parsed by the command decoder, it is sent to the security arbitrator. After the security arbitrator verifies the permissions of the parsed external configuration command, it allows the configuration word corresponding to the external configuration command to be written into the power domain configuration latch register. The power management unit reads the value of the power domain configuration latch register in real time and controls the power supply status of the corresponding power domain.

[0072] During the locking phase: The security arbiter triggers the programming operation of the one-time programmable configuration fuse array, stores the final configuration state image in the power domain configuration latch register into the configuration data area of ​​the one-time programmable configuration fuse array, and then blows the locking flag.

[0073] During the lock-on operation phase (any power-on): When the chip is powered on, the security arbiter first reads the pre-stored configuration information from the configuration data area of ​​the one-time programmable configuration fuse array and loads it into the power domain configuration latch register; the power management unit then controls the power supply of each power domain according to the value of the power domain configuration latch register.

[0074] This bidirectional data flow design ensures the permanent retention of configuration information and the ability to recover upon power-on.

[0075] The chip-programmable power domain system described in the above embodiments employs a two-layer memory architecture of "volatile latch + non-volatile fuse array" to ensure reliable retention of configuration information. Specifically, it can be divided into:

[0076] Real-time configuration layer: The power domain configuration latch register is a volatile register whose value reflects the current switching state of each power domain in real time during chip operation. The power domain configuration latch register has extremely high write speed, meeting the real-time debugging requirements of the configuration phase.

[0077] Persistent Storage Layer: The configuration data area in the one-time programmable configuration fuse array is non-volatile storage, used to permanently back up the final state of the real-time configuration layer during locking operations. Once the fuse blows, the stored configuration data cannot be changed, but it can be read upon power-on.

[0078] The advantage of this design is that during the configuration and debugging phase before locking, the user can repeatedly modify the configuration (write it to the latch); once the final configuration is confirmed and locking is performed, the system automatically saves the final state to the fuse array; at the same time, the latch loads the configuration from the fuse array when powered on, ensuring that the locked chip maintains a consistent functional state after any power-on or power-off cycle.

[0079] In some implementations, such as Figure 4 The diagram illustrates the complete chip configuration and locking process, which strictly follows the logic defined in the main control state machine of the security arbitrator:

[0080] (1) Startup and Status Judgment: After the chip is powered on, the security arbiter first reads the fuse status and detects the TEST_MODE pin level. If the fuse is locked, the configuration information is loaded directly and the chip is started; if the fuse is not locked and the TEST_MODE pin is valid, the chip enters the self-test mode, loads the predefined test configuration and starts the chip to perform self-test; if the fuse is not locked and the TEST_MODE pin is invalid, the chip enters the configurable mode.

[0081] (2) Enter configurable mode: The security arbitrator generates a challenge code and sends it to the external configuration host via the UART interface.

[0082] (3) Authorization verification: The security arbitrator waits for and verifies the response key returned by the external configuration host. After successful verification, the main control state machine transitions to the "configuration enabled" state, temporarily granting write permissions.

[0083] (4) Cyclic configuration: Within the authorization window, the external configuration host can send a series of power domain configuration commands to gradually configure the chip to the state required by the target model.

[0084] (5) Permanent Lock: After configuration, the external configuration host sends a lock command. The security arbitrator performs final verification (including secondary key verification), and then performs the following irreversible operations: writes the final configuration state in the current power domain configuration latch register into the configuration data area of ​​the one-time programmable configuration fuse array (i.e., configuration data burning); blows the fuse corresponding to the lock state bit (i.e., global lock flag burning); activates the hardware permanent disable logic, physically cutting off the processing path of all subsequent configuration commands (i.e., logic path closing). The execution order of the above operations is: first burn the configuration data, then blow the lock flag to ensure that even in the event of an abnormal power outage, the configuration data can be safely stored before locking.

[0085] (6) Power-on recovery and operation after locking: After the chip is reset or powered on again, the safety arbiter detects that the fuse corresponding to the locking flag has blown and performs the following actions: reads the pre-stored power domain configuration state from the configuration data area of ​​the one-time programmable configuration fuse array and loads it into the power domain configuration latch register (i.e., configuration state recovery); after confirming that the state of the power domain configuration latch register is consistent with the fuse storage state, controls the power management unit to complete the power supply allocation of each independent power domain (i.e., verify consistency); the chip enters the normal product operation mode (i.e., functional mode), and no longer responds to any configuration commands during the entire operation. This mechanism ensures that the configuration state remains consistent during any power-on or power-off cycle throughout the entire chip lifecycle, truly realizing the characteristics of a finalized product.

[0086] In some implementations, a general-purpose microcontroller chip integrating a CAN controller, Ethernet MAC, and an additional analog-to-digital converter (ADC) is used as an example to illustrate how this solution can be configured for different models:

[0087] (1) Model A (Vehicle Gateway Type): Requires a CAN controller and an Ethernet MAC, but no additional ADC. Configuration command sequence: ENABLE_PD CAN (enable the CAN controller power domain), ENABLE_PD ETH (enable the Ethernet power domain), DISABLE_PD ADC (disable the ADC power domain), and LOCK (lock the configuration). Result: The power domains of the CAN controller and Ethernet MAC are powered on, and the power domain of the ADC is powered off. The chip is permanently locked to Model A.

[0088] (2) Target Model B (High-Precision Acquisition Type): Requires an additional ADC, but does not require a CAN controller or Ethernet MAC. Configuration command sequence: DISABLE_PD CAN, DISABLE_PD ETH, ENABLE_PD ADC, and LOCK. Result: The ADC's power domain is powered on, and the CAN controller and Ethernet MAC's power domains are powered off. The chip is permanently locked to Model B.

[0089] (3) Production testing application: During the wafer testing stage, the tester can send the command ENABLE_PD ALL to temporarily power on all power domains, perform full-function testing on the chip, and screen out defective products at the silicon wafer level. Good products are restored to the "unlocked" state and enter the packaging process, pending final configuration according to order requirements.

[0090] The beneficial effects of the above design can be summarized as follows:

[0091] Based on a single system architecture design, multiple models can be derived through post-configuration instructions, enabling design reuse and standardized inventory, thereby reducing R&D and material management costs. Physical power disconnection completely eliminates the static power consumption of inactive modules, achieving true zero-power shutdown. A hardware locking mechanism based on challenge-response and one-time fuses ensures the product model cannot be tampered with, achieving secure final product locking. On-demand configuration during the final testing phase allows for comprehensive testing during wafer testing, improving yield and optimizing the production process. Before final locking, the design supports unlimited reconfiguration of chip functions via configuration instructions. This allows the chip to act as a reconfigurable hardware verification platform during R&D and production testing. Users or testing systems can safely and realistically test the performance and power consumption of all potential functional modules under different combinations, providing flexibility for functional verification and troubleshooting that traditional one-time fixation solutions lack.

[0092] Compared to existing solutions: The above design transforms the configuration carrier from "physical level / logic signal" to the control of "physical connection of power network". It directly controls the PMU to physically switch the power domain on and off, and introduces a collaborative locking mechanism of OTP fuse and safety arbiter to achieve true zero-power shutdown and permanent locking. The fuse array is divided into two independent functional domains: configuration data area and lock status bit. The status judgment and path control logic of the safety arbiter are embedded in the reading process to achieve separate management of configuration permissions and configuration storage. A general application layer interface is used as the post-configuration channel implementation and high-level security protocol. The configuration is flexible and saves pins, replacing the complex test protocol with high-level permissions at the lower level, improving security and mass production convenience.

[0093] In one embodiment, such as Figure 5 As shown, a chip-programmable power domain management method is also provided, applied to the above-mentioned chip-programmable power domain system. The chip-programmable power domain management method may include the following verification steps S10 to S20:

[0094] S10, after configuration interface obtains external configuration instructions provided by external configuration host;

[0095] S12, the instruction decoder performs frame parsing and verification on the external configuration instruction and then converts it into the corresponding operation command;

[0096] S14, the security arbitrator verifies the permission of the input operation command through the challenge-response mechanism, outputs the configuration instruction, and permanently closes the configuration path after locking; each time the chip is powered on, the security arbitrator reads the pre-stored power domain configuration state from the configuration data area of ​​the one-time programmable configuration fuse array and loads it into the power domain configuration latch register;

[0097] S16, the lock status bit of the one-time programmable configuration fuse array is used to store a global enable flag indicating whether the configuration channel has been permanently disabled, and the configuration data area of ​​the one-time programmable configuration fuse array stores the final configuration status of each power domain; the number of bits in the configuration data area corresponds to the number of power domains;

[0098] S18, the power domain configuration latch register stores the data of the corresponding input source under the control of the safety arbiter; when the current state is the configuration stage, the input source is the configuration instruction of the safety arbiter; when the current state is locked and powered on, the input source is the pre-stored configuration state read from the configuration data area.

[0099] S20, the power management unit directly controls the power switches of multiple independent power domains based on the configuration word stored in the power domain configuration latch register.

[0100] It is understood that for specific limitations of the features in this embodiment, please refer to the corresponding limitations of the chip programmable power domain system above, which will not be repeated here.

[0101] The aforementioned chip programmable power domain management method utilizes a new programmable power domain system architecture to transform the configuration carrier from "physical level / logic signal" to the control of "physical connection of power network". It directly controls the PMU to physically switch the power domain on and off, and introduces a collaborative locking mechanism of OTP fuse and security arbiter to achieve true zero-power shutdown and permanent locking. The fuse array is divided into two independent functional domains: a configuration data area and a locked status bit. The status judgment and path control logic of the security arbiter are embedded in the reading process to achieve separate management of configuration permissions and configuration storage. A general application layer interface is used as the post-configuration channel implementation and high-level security protocol. The configuration is flexible and saves pins, replacing the complex test protocol of the underlying high-privilege level, improving security and mass production convenience, and enabling flexible, reliable and low-power determination of the chip's final function in the later stages of production.

[0102] It should be understood that, although Figure 5 The steps are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order in which these steps are executed; they can be performed in other orders. Figure 5 At least some of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0103] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0104] The above embodiments merely illustrate several implementation methods of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of protection of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and all such modifications and improvements fall within the scope of protection of the present invention.

Claims

1. A chip-programmable power domain system, comprising a permanently active region and multiple functional modules located within independent power domains, characterized in that, Chip-programmable power domain systems also include: The post-configuration interface serves as the physical link between the chip and an external configuration host. The post-configuration interface is located in the permanently active area of ​​the chip's programmable power domain system and is always powered on. The instruction decoder is used to parse and verify the external configuration instructions received by the post-configuration interface and then convert them into corresponding operation commands. The security arbiter is used to verify the permissions of the input operation command through a challenge-response mechanism, output the configuration instruction, and permanently close the configuration path after locking; the security arbiter is also used to read the pre-stored power domain configuration state from the configuration data area of ​​the one-time programmable configuration fuse array and load it into the power domain configuration latch register each time the chip is powered on. A one-time programmable configuration fuse array includes a lock status bit and a configuration data area. The lock status bit is used to store a global enable flag indicating whether the configuration channel has been permanently disabled. The configuration data area is used to store the final configuration status of each power domain. The number of bits in the configuration data area corresponds to the number of power domains. The power domain configuration latch register is used to store data from the corresponding input source under the control of the safety arbitrator. When the current state is the configuration phase, the input source is the configuration instruction of the safety arbitrator. When the current state is locked and powered on, the input source is the pre-stored configuration state read from the configuration data area. The power management unit is used to directly control the power switches of multiple independent power domains based on the configuration words stored in the power domain configuration latch register. The security arbitrator includes a main control state machine, a key verification unit, access control path management logic, and a fuse status reading circuit. The main control state machine is used to define and manage the overall configuration process of the chip's programmable power domain system. The key verification unit is used to execute the challenge-response protocol to generate challenge codes, verify the correctness of the response keys returned by the external configuration host, and output the corresponding verification results. The access control path management logic is used to generate key enable signals based on the state of the main control state machine and the verification results of the key verification unit. The fuse status reading circuit is used to perform status reading, configuration data programming, fuse locking, and configuration data reading on a one-time programmable configuration fuse array.

2. The chip-programmable power domain system according to claim 1, characterized in that, Key enable signals include a temporary write enable signal generated upon successful verification and a permanent disable signal generated upon locking; the temporary write enable signal is used to briefly grant write access to the power domain configuration latch register, and the permanent disable signal is used to permanently disable the configuration path.

3. The chip-programmable power domain system according to claim 1 or 2, characterized in that, The master control state machine is also used to automatically enter the autonomous test mode when the chip is powered on, if it detects that the dedicated test mode pin is set to an active level and the configuration fuse of the corresponding test mode pin in the one-time programmable configuration fuse array is not locked; the test mode pin is not brought out in the final package of the chip.

4. The chip-programmable power domain system according to claim 1 or 2, characterized in that, The fuses in a one-time programmable configuration fuse array include electric fuses or anti-fuse fuses.

5. The chip-programmable power domain system according to claim 1 or 2, characterized in that, During the configuration phase, the post-configuration interface sends the external configuration instructions provided by the external configuration host to the instruction decoder for parsing, and then sends them to the security arbitrator. After verifying the permissions of the parsed external configuration instructions, the security arbitrator allows the configuration word corresponding to the external configuration instructions to be written into the power domain configuration latch register. The power management unit reads the value of the power domain configuration latch register in real time and controls the power supply status of the corresponding power domain.

6. The chip-programmable power domain system according to claim 5, characterized in that, During the locking phase, the security arbiter triggers the programming operation of the one-time programmable configuration fuse array, stores the final configuration state image in the power domain configuration latch register into the configuration data area of ​​the one-time programmable configuration fuse array, and then blows the lock flag.

7. The chip-programmable power domain system according to claim 5, characterized in that, During the locked operation phase, when the chip is powered on, the safety arbiter reads the pre-stored configuration information from the configuration data area of ​​the one-time programmable configuration fuse array and loads it into the power domain configuration latch register. Then, the power management unit controls the power supply of each power domain according to the value of the power domain configuration latch register.

8. The chip-programmable power domain system according to claim 5, characterized in that, The interface was later configured as a UART interface.

9. A chip-programmable power domain management method, characterized in that, Applied to the chip-programmable power domain system according to any one of claims 1 to 8, the chip-programmable power domain management method includes the following steps: The post-configuration interface obtains external configuration commands provided by the external configuration host; The instruction decoder performs frame parsing and verification on external configuration instructions and then converts them into corresponding operation commands. The security arbitrator verifies the permissions of the input operation command through a challenge-response mechanism, outputs the configuration instruction, and permanently closes the configuration path after locking. Each time the chip is powered on, the security arbitrator reads the pre-stored power domain configuration state from the configuration data area of ​​the one-time programmable configuration fuse array and loads it into the power domain configuration latch register. The lock status bits of the one-time programmable configuration fuse array store a global enable flag indicating whether the configuration channel has been permanently disabled. The configuration data area of ​​the one-time programmable configuration fuse array stores the final configuration status of each power domain. The number of bits in the configuration data area corresponds to the number of power domains. The power domain configuration latch register stores data from the corresponding input source under the control of the safety arbitrator. When the current state is the configuration phase, the input source is the configuration instruction from the safety arbitrator. When the current state is locked and powered on, the input source is the pre-stored configuration state read from the configuration data area. The power management unit directly controls the power switches of multiple independent power domains based on the configuration words stored in the power domain configuration latch register.

Images