Security Antifuse That Prevents Readout of Some but Not Other Information From a Programmed Field Programmable Gate Array

This invention relates to field programmable gate arrays employing antifuses.

FIG. 1 (Prior Art) is a simplified top-down diagram of a field programmable gate array 1 having a plurality of logic modules 2 oriented in rows and columns and a plurality of programming control shift registers 3-10. A programmable interconnect structure (not shown) of routing conductors and antifuses is disposed between the logic modules. To realize a user-specific circuit in the field programmable gate array, a user connects selected digital logic elements in selected logic modules together by programming the appropriate antifuses of the programmable interconnect structure.

FIG. 2 (Prior Art) is a simplified top-down diagram illustrating the programming of an antifuse 11 to connect horizontal routing conductor 12 and vertical routing conductor 13. A programming control driver (not shown) of programming control shift register 3 places a high voltage (VHH) at least one threshold above a programming voltage (VPP) onto vertically extending programming control conductor 14 to turn programming transistor 15 on. A programming control driver (not shown) of programming control shift register 10 places VHH onto horizontally extending programming control conductor 16 to turn programming transistor 17 on. Next, a programming driver (not shown) of programming control shift register 3 drives programming voltage VPP onto vertically extending programming conductor 18 and a programming driver (not shown) of programming control shift register 10 drives ground potential (GND) onto horizontally extending programming conductor 19. A programming current therefore flows as indicated by the arrows through antifuse 11 to program it.

It may be desired that the user-specific circuit programmed into a field programmable gate array not be readily decipherable by others once the antifuses of the interconnect structure are programmed. It is, however, possible to use the programming control shift registers 3-10 to determine which antifuses in the interconnect structure are programmed and which are not. For example, it is possible to determine whether anitfuse 11 is programmed by loading the programming control shift registers 3 and 10 as illustrated in FIG. 2 and then measuring the magnitude of a current flowing through the field programmable gate array (for example, into the VPP terminal of the field programmable gate array). If there is no current flow, then antifuse 11 is not programmed. If, on the other hand, there is current flow, then antifuse 11 is programmed. By successively testing each antifuse in this way, it may be possible to determine which antifuses are programmed and which antifuses are not programmed and therefore to decipher the user-specific circuit programmed into the field programmable gate array. A circuit is desired which will prevent such testing of antifuses.

It may, however, be desirable to be able to interrogate a programmed field programmable gate array and to determine whether or not certain other antifuses have been programmed. Two different types of field programmable gate array devices may, for example, be packaged in the same type of package having the same number of external terminals. If before the packages are marked, the two packaged field programmable gate arrays are intermixed, then it would be difficult to determine which type of field programmable gate array is in a particular package. It is therefore desirable to provide an antifuse on each field programmable gate array which can be read after it is programmed. If, for example, this antifuse is read as being in a programmed state, then it is determined that the field programmable gate array in the package is of a first type. If, on the other hand, the antifuse is read as not be in a programmed state, then it is determined that the field programmable gate array in the package is of a second type.

A field programmable gate array is therefore desired wherein some antifuses of the interconnect structure cannot be read after programming but wherein other antifuses can be read after programming.

A field programmable gate array has a security antifuse which when programmed prevents readout of data indicative of how the interconnect structure is programmed but which does not prevent readout of data indicative of which other antifuses are programmed. In some embodiments, the programming control shift registers adjacent the left and right sides of the field programmable gate array are disabled when the security antifuse is programmed but the programming control shift registers adjacent the top and bottom sides of the field programmable gate array are not disabled. A second security antifuse is also provided which when programmed disables a JTAG boundary scan register but does not disable a JTAG bypass register. Information can therefore be shifted through some JTAG register paths but the path that allows the JTAG circuitry used to extract information (indicative of how the interconnect structure is programmed) is disabled. Logic module and interface cell scan paths are provided and special JTAG test instructions are supported which allow test vectors to be loaded into the logic module and interface cell scan paths.

This summary does not purport to define the invention. The invention is defined by the claims.

FIG. 1 (Prior Art) is a simplified top-down diagram of a field programmable gate array.

FIG. 2 (Prior Art) is a simplified top-down diagram illustrating how an antifuse in the field programmable gate array of FIG. 1 can be tested to determine if it is programmed.

FIG. 3 is a simplified top-down diagram of a field programmable gate array in accordance with an embodiment of the present invention wherein the programming control shift registers adjacent the left and right sides of the field programmable gate array are disabled by programming a security antifuse but wherein the programming control shift registers adjacent the top and bottom sides are not disabled.

FIG. 4 is a simplified circuit diagram of a circuit 117 for disabling the left and right programming control shift registers of FIG. 3.

FIG. 4A1-4A4 is a more detailed diagram of the test decode logic block 119 of FIG. 4.

FIG. 5 is a simplified diagram of a circuit 200 for disabling a JTAG boundary scan register but for leaving a JTAG bypass register functional after antifuses of the interconnect structure of a field programmable gate array have been programmed.

FIG. 6 is a top-down diagram illustrating a scan path through a logic module.

FIG. 7 is a top-down diagram illustrating a scan path through an interface cell.

FIG. 3 is a simplified top-down diagram of a field programmable gate array 100 in accordance with an embodiment of the present invention. Antifuses 101-108 are antifuses which are not used to interconnect logic modules, but rather are provided so that they can be programmed to store information. The antifuses may, for example, be amorphous silicon antifuses such as set forth in U.S. Pat. No. 5,557,136 (the subject matter of this patent is incorporated herein by reference).

Consider antifuse 101. The programming conductor 109 by which the programming voltage VPP is supplied to one electrode of antifuse 101 is driven by the same programming control shift register 110 as the programming control conductor 111 which controls the programming transistor 112 which grounds the other electrode of antifuse 101. Accordingly, the programming control shift registers 113-116 adjacent the left and right sides of the field programmable gate array can be disabled after programming of the antifuses of the interconnect structure (not shown) and the antifuses 101-108 can still be read using the programming control shift registers adjacent the top and bottom sides of the field programmable gate array. To read antifuse 101, for example, the programming control shift register 110 is loaded such that voltage VHH is present on the programming control conductor 111. Programming control shift register 110 is then controlled such that a voltage is driven onto conductor 109 (but not onto the programming conductors of the other antifuses 101-108). If a current flows into the field programmable gate array (for example, into a VPP terminal of the field programmable gate array), then it is determined that the antifuse through which the current must be flowing (antifuse 101 in this case) is in a programmed state. If a current does not flow, then it is determined that the antifuse 101 is not in a programmed state. It is therefore seen that the programming control shift registers 113-116 adjacent the left and right sides of the field programmable gate array can be disabled and the antifuses 101-108 can still be read.

In accordance with one embodiment, the programming control shift registers adjacent the left and right sides of the field programmable gate array are disabled to prevent information indicative of which antifuses of the interconnect structure have been programmed from being extracted from the field programmable gate array. The programming control shift registers adjacent the top and bottom sides of the field programmable gate array are, however, not disabled but rather are usable to extract information indicative of which of the antifuses 101-108 are programmed. For additional details on programming control shift registers and a field programmable gate array employing programming control shift registers, see: U.S. patent application Ser. No. 08/667,702, entitled "Programming Architecture For A Programmable Integrated Circuit Employing Antifuses", by Paige A. Kolze, et al., filed Jun. 21, 1996 (the subject matter of this document is incorporated herein by reference).

FIG. 4 is a simplified circuit diagram of a circuit 117 for disabling the left programming control shift registers 113 and 114 and the right programming control shift registers 115 and 116 of FIG. 3 without disabling the top and bottom programming control shift registers of FIG. 3. Circuit 117 includes a security antifuse 118 which can be programmed after the antifuses of the interconnect structure are programmed such that shifting of the left and right programming control shift registers is permanently prevented. Test decode logic 119 decodes the values on an STM (special test mode) terminal 120, six input only terminals 121-126, and a TCK (test clock) terminal 127 to generate the digital logic levels on output leads 128-133. FIG. 4A is a more detailed diagram of a specific embodiment of the test decode logic block 119 of FIG. 4.

The field programmable gate array can either be in a "normal operation mode" or can be in a "special test mode". The special test mode (defined by a digital logic high on the STM terminal) has multiple modes including a "shift model" and a "link mode". One combination of digital values on the six input only terminals 121-126 is decoded to indicate the "shift mode". This combination is placed on input only terminals 121-126. In the shift mode, programming data can be shifted into programming control shift registers that are not disabled. TCK terminal 127 is used (as explained further below) to clock the programming data into programming control shift registers. In this way, digital logic ones are loaded into the shift register bits corresponding with Vlgsi and Vldal. Because the field programmable gate array is in the shift mode and not the link mode, the programming driver associated with the Vlgsi conductor is not enabled despite the corresponding shift register bit being loaded with a digital one. A digital logic low is output onto the programming control conductor Vlgsi. Programming control conductor Vlgsi is also shown in FIG. 3. As a result, transistor 134 is nonconductive. Output lead 129 carries a digital logic low throughout this period. Because transistor 134 is off, Vldal (which also supplies other nodes in the device) is not pulled low in shift mode if security antifuse 118 is programmed. Nodes except those associated with Vlgsi (such as N1) are thus precharged in this mode to an intermediate voltage (for example, 6 volts). Because signal 130 from test decode logic 119 is decoded to be low, transistors 135 and 136 are on. If security antifuse 118 is programmed, then node N3 is low and shifting in the vertical direction is blocked.

Next, another combination of digital values is placed on the six input only terminals 121-126 to place the field programmable gate array into the "link mode". When in the link mode, programming drivers associated with shift register bits that hold digital high values are enabled to output the programming voltage VPP. Because the shift register bits associated with vertically extending programming conductor Vldal and Vlgsi contain digital logic highs, the programming driver driving conductor Vldal is enabled and transistor 134 is on. The conductive path that now exists through transistors 134 and 135 is blocked by the unprogrammed security antifuse 118.

Next, the magnitude of the voltage on the VPP terminal of the field programmable gate array is increased (for example, from 6 volts to 12 volts). As a result, a programming current flows through security antifuse 118 to ground and security antifuse 118 is programmed. Next, the magnitude of the voltage on the VPP terminal is decreased (for example, from 12 volts to 6 volts) and the current flowing into the VPP terminal of the field programmable gate array is measured to make sure the security antifuse 118 is in fact programmed. This measuring step is performed to make sure that the programming current actually flowed through the security antifuse 118 and not through a leakage path to ground (for example, through a leakage path in transistor 134 to substrate). If the current at the decreased voltage is adequately large indicating that the security antifuse 118 is programmed (for example, 4 mA), then a digital logic level low is supplied onto the STM terminal 120 to take the field programmable gate array out of the special test mode.

If one were to attempt to use the left and right programming control shift registers 113-116 to determine which antifuses of the interconnect structure were programmed, then the field programmable gate array would be placed into the shift mode to clock the appropriate digital values into the programming control shift registers (including the left and right programming control shift registers) so that current flow or the lack thereof could be observed through a particular antifuse. In the shift mode, the programming control shift registers are clocked by placing a clock signal on TCK terminal 127. This clock signal is converted into clock signal CLKIN on output lead 132 by buffering in the test decode logic 119. If the digital logic level at node N2 is a digital low, then the CLKIN signal on output lead 132 is passed through NAND gate 138 and is converted into non-overlapping clock signals CLKOUT and CLKOUT by a non-overlapping clock signal generating circuit 139.

If, however, security antifuse 118 is programmed and the field programmable gate array is in the shift mode, then transistors 135 and 136 are controlled to be on. A digital logic level low is therefore present on node N3, a digital logic high is latched into latch 140, and a digital logic high is passed onto node N2 through NOR gate 141 and inverter 142. If a digital logic level high is present on node N2, then a digital logic level low is present on node N4. NAND gate 138 therefore outputs a digital logic level high regardless of whether clock signal CLKIN is switching or not. The clock signal passing into the left and right programming control shift registers is blocked (gated by NAND gate 138) such that the left and right programming control shift registers cannot be shifted.

To ensure that the programming control shift registers can only shift in the "shift mode", the test decode logic 119 controls the SHIFTDIS signal on output lead 131 to be high (shifting is disabled) except when in the shift mode. Latch 140 is provided to prevent transients due to decoding signal skews from inadvertently clocking the left and right programming control shift registers. Transistor 136 blocks the high programming voltage VPP present on node N1 during security antifuse programming from damaging the input of inverter 143.

In link mode, transistor 136 is off. To prevent the input of inverter 143 from floating and thereby resulting in current being drawn by inverter 143 when security antifuse 118 is not programmed (node N3 should be high), node N3 is pulled up by a small inverter 144. Test decode logic 119 controls small inverter 144 to function as a weak pullup on node N3 in link mode and shift mode. If security antifuse 118 is programmed, node N3 will be pulled down in shift mode through large transistors 135 and 136 despite the weak pullup action of small inverter 144.

Pass transistor 145 is provided to facilitate testing of the security circuit. When a special shift security mode is entered by placing the proper code on the input only terminals 121-126 and bringing STM terminal 120 high, signal 129 is forced high turning transistor 145 on. Transistor 145 thus shorts across security antifuse 118, thereby simulating the action of security antifuse 118 being in a programmed state. Data is then shifted through the programming shift registers to determine if the circuit properly blocks vertical programming control shift register shifting but not horizontal programming control shift register shifting.

To read the information stored in the programming pattern of antifuses 101-108 after security antifuse 118 is programmed, the shift mode is entered, a digital logic level high is loaded into the bit of the top programming control shift register 110 corresponding with the Vlgsi and a digital logic level high is loaded into the bit corresponding with a desired one of the antifuses 101-108. The link mode is then entered and the magnitude of the voltage on the programming voltage VPP terminal of the field programmable gate array is increased to 6 volts. The current flowing into the VPP terminal is measured using, for example, a HP82000 characterization system. If the current is, for example, above 4 mA, then the desired antifuse is determined to be in the programmed state. This process is repeated for each of the other antifuses 101-108 and is possible despite the fact that the left and right programming control shift registers cannot be shifted.

Information stored in antifuses 101-108 may include: 1) a device identification number (indicating, for example, 3 k gates or 5 k gates), 2) whether the device is a high voltage or low voltage device (for example, 5 volts Vcc or 3 volts Vcc), 3) whether the device was successfully programmed, 4) whether the device successfully passed automatic test vector testing, 5) the mask option of the device, 6) a checksum of the design programmed into the device, 7) a code indicative of an error which occurred in programming, 8) an indication of the software revision used to program the device, 9) an identification number of the programmer used to program the device, 10) the number of the wafer from which the device originated, 11) the date programmed, 12) an indication of an adjustment made at wafer sort, 13) an indication of an adjustment made at final test, and/or 14) an indication of an adjustment made by the programmer. Other information may also be stored.

FIG. 5 is a simplified diagram of a circuit 200 for disabling a Joint Test Action Group (JTAG--IEEE Standard 1149.1) boundary scan register 201 but for leaving a JTAG bypass register 202 functional after the antifuses of the interconnect structure of the field programmable gate array have been programmed. Because it may be possible to decipher the user-specific circuit programmed into the field programmable gate array using the JTAG boundary scan register 201, a security antifuse 203 is provided. When this security antifuse 203 is in a programmed state, shifting of the boundary scan register 201 is prevented. For additional background information on JTAG boundary scan registers, instruction registers, bypass registers and the control of those registers see the text "Boundary-Scan Test", by Barry Bleeker et al., Kluwer Academic Publishers, 1993, pages 1-84 (the subject matter of this text is incorporated herein by reference).

The Vlgsi and Vlda2 conductors of FIG. 5 are also illustrated in FIG. 3. Programming of the security antifuse 203 of FIG. 5 is similar to the programming of the security antifuse 118 of FIG. 4. The JTAG RESET terminal 204 is provided so that the circuit does not draw current through inverter 144A and transistors 136A and 135A unnecessarily. The JTAG boundary scan security circuit is active and therefore could potentially draw current if security antifuse 203 is programmed and the JTAG circuitry is not in the reset state. In the embodiment illustrated in FIG. 5, information from boundary scan register 201 cannot be extracted from the field programmable gate array after security antifuse 203 is programmed because the clock signal supplied to the boundary scan register is gated with a NAND gate 205. It is understood, however, that numerous other methods of preventing information in the boundary scan register 201 from being extracted from the field programmable gate array are possible. Shifting of the boundary scan register 201 may, for example, be enabled but a path from the output of the boundary scan register to an output terminal of the field programmable gate array may be blocked.

In the embodiment of FIG. 5, a scan path extends through the sequential logic elements in the logic modules as well as through the sequential logic elements in the interface cells. FIG. 6 illustrates the scan path through the sequential logic element in one logic module 206. The sequential logic element has a scan path input lead and in this case a scan path output lead. The scan path output lead of one such logic module is coupled to the scan path input lead of the next such logic module to form a logic module scan path represented in FIG. 5 by block 207. FIG. 7 illustrates the scan path through an interface cell 208. A scan path through numerous chained interface cells is represented in FIG. 5 by block 209.

To prevent the use of the module scan path 207 or the interface cells scan path 209 to extract information from the field programmable gate array in the special PBIST JTAG instruction after the security antifuse is programmed, the serial output lead of the interface cells scan path 209 is coupled to the serial input lead of the boundary scan register 201. A multiplexer 210 is provided in the boundary scan register 201 such that information can be clocked into the boundary scan register from input terminal TDI 211 or from the serial output lead of the interface cells scan path block 209. Inhibiting clocking of the boundary scan register 201 therefore prevents information in the modules and interface cells scan paths from being read out of the field programmable gate array.

In some embodiments, special JTAG instructions are supported. For example, if decoder 212 detects one such special JTAG instruction (called "pBIST") in instruction register 213, then a demultiplexer 215 is switched such that serial information from terminal 211 can be clocked into the modules scan path 207. Multiplexer 210 is also switched to receive the serial output of the interface cells scan path 209. A test vector can therefore be loaded into all the sequential logic elements of the modules scan path 207, the interface scan path 209 and the boundary scan register 201. Test data in the sequential logic elements of the modules scan path 207, the interface scan path 209 and the boundary scan register 201 can also be read out of the field programmable gate array via TDO terminal 216. Another special instruction (called "UNICLK") may also be provided which when executed clocks each of the sequential logic elements in the logic modules and the interface cells scan paths once to load the sequential logic elements in parallel with test information.

In one embodiment, a test vector is shifted from the TDI terminal 211 into the modules scan path 207, the interface scan path 209 and the boundary scan register 201 using the pBIST instruction. After the test vector is loaded, resulting test data output by the circuit under test is parallel loaded (captured) into the bits of the boundary scan register 201 by repeating the RTI state in the JTAG sequence more than once while in the PBIST instruction. Another special UNICLK instruction is then entered. During this instruction, staying in the RTI state for more than one clock cycle generates a signal which clocks all the modules 207 and interface cells 209. This operation captures the result of the input vector into these registers. Another pBIST instruction is then executed and the sequential elements of the boundary scan 201, interface cells 209 and modules 207 are scanned out. Because the normal JTAG capture state has been disabled in pBIST, the data in the boundary scan registers is not lost when the capture DR state is entered prior to entering the shift DR state to shift out the sequential elements.

Although the present invention is described in connection with certain specific embodiments for instructional purposes, the present invention is not limited thereto. Numerous other circuits for programming a security antifuse under the control of digital values present on certain terminals of a field programmable gate array are possible. Programming of a security antifuse need not be restricted to occur only during link mode operation. The antifuses can be any suitable type including amorphous silicon and ONO types. The specifics of the JTAG circuitry can be adapted for particular applications and particular field programmable gate array architectures. Logic module and interface cell scan paths can be incorporated into the JTAG test circuitry without serializing the logic module and interface cell scan paths with the boundary scan register scan path. In some embodiments, the data supplied to programming control shift registers is gated rather than the clock signal supplied to programming control shift registers. Accordingly, various modifications, adaptations, and combinations of various features of the described embodiments can be practiced without departing from the scope of the invention as set forth in the following claims.