ROM/OTP Code Patching with ECC-Triggered Exception Redirection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for patching code in read-only memory (ROM) or one time programmable (OTP) memory are complex and inefficient, as they require updating jump tables in RAM or OTP, which is cumbersome and not suitable for ROM/OTP memories.

Innovation Solution

A method involving ECC error manipulation is used to cause an exception, allowing an exception handler to locate and execute patched functions stored in nonvolatile writable memory by using a dictionary that correlates original and patch addresses, with modification flags indicating modified instructions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If jump tables are used to enable function patching in ROM/OTP memory, then software update capability is achieved, but device complexity and implementation difficulty increase significantly

Engineering Contradiction:
Improvesoftware update capabilityVSAvoidimplementation complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent introduces an intermediary mechanism (ECC error injection system) that mediates between the ROM/OTP memory and the exception handler. By injecting controlled ECC errors at specific locations, the system triggers exception handlers that redirect execution to patched functions, eliminating the need for complex jump tables while maintaining software update capability

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical/software-based jump table approach with an hardware-based ECC error injection mechanism. Instead of using software lookup tables that require complex indexing and address calculation, the system uses hardware ECC circuits to inject errors that automatically trigger exception handling, simplifying the overall system architecture

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

2Ease of operation

If FLASH memory is used for code storage to enable rewriting, then ease of patching is improved, but cost and memory reliability decrease

Engineering Contradiction:
Improveease of patchingVSAvoidmemory reliability
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent applies preliminary action by pre-configuring ECC checksum values and error injection mechanisms in the ROM/OTP memory during manufacturing. This allows the memory to be written only once with both the original code and the patching infrastructure, enabling future updates without requiring the memory to be rewritten, thus maintaining reliability while achieving ease of patching

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent changes the parameter of memory writability by using ECC error injection to create the illusion of modifiable code in read-only memory. By controlling the ECC status bits, the system can dynamically change which code paths are active without physically rewriting the memory, achieving FLASH-like flexibility with ROM/OTP reliability

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentUS12461806B2ROM/OTP patching using ECC/parity manipulation
Publication Date: 2025.11.04 SILICON LABORATORIES INC
  • US12461806B2 patent drawing
  • US12461806B2 patent drawing
  • US12461806B2 patent drawing

AI summary

Methods of performing updates to a software image that is disposed in a read only memory or a one time programmable memory device are disclosed. The method includes causing an ECC error at the beginning of a function that has been modified. This ECC error causes an exception. The exception handler determines the address where the ECC error was detected was located and searches a dictionary. This dictionary contains entries that each have an original address in the ROM or OTP Memory and the patch address in a nonvolatile writable memory. The exception handler then causes the processing unit to jump to the patch address, where a modified function is located.