OTP / eFuse Controller

What it is

A One-Time-Programmable (OTP) / eFuse controller delivered as synthesizable SystemVerilog soft-IP: the fuse-backed provisioning store for keys, lifecycle state, and trim, with write-once enforcement and SECDED (Single-Error Correct / Double-Error Detect) read integrity so a marginal or aged fuse bit is corrected automatically or flagged uncorrectable rather than silently wrong.

Key Features

• Write-once programming FSM — checks the per-word programmed flag, region lock, and lifecycle state before every PROGRAM; a refused attempt sets STATUS.lock\_violation
• Each 32-bit word stored with a companion 7-bit SECDED (Hamming) code from ecc\_pkg — the same codec as ecc\_sram — written together with the data in one shot
• Read FSM auto-corrects single-bit fuse errors (STATUS.ecc\_corrected) and flags double-bit errors uncorrectable (STATUS.ecc\_uncorrectable, err\_code 1) instead of returning silently-wrong data
• NLOCK independent per-region write-lock bits, irreversible once set — a locked region refuses all further PROGRAM operations
• Monotonic 3-state lifecycle RAW → CONFIGURED → LOCKED; LIFECYCLE\_ADV only advances, never regresses, and LOCKED blocks all further programming
• ASIL-B: complementary DMR shadows on the lock bits and lifecycle register (err\_code 9) catch a fault that would otherwise unlock a region or roll back the lifecycle within one clock cycle
• Plain APB4 slave, 8-bit address decode, 8858 LUTs on xcu200 (Vivado 2022.1) — the fuse-backed persistence layer beneath rot‘s measured-boot reference digest and lc\_ctrl‘s device lifecycle

Standards & Compliance

AMBA APB4 (ARM IHI 0024); feeds the catalog’s rot, lc\_ctrl, aes, hmac, trng; ISO 26262 ASIL-B SEooC (SPFM 97.14%, LFM 100.00%, PMHF 3.94×10⁻⁹/h)

Functional Safety

ASIL-B (SEooC) · SPFM 97.14% · LFM 100.00% · PASS

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

…1 more registers — see datasheet for the full table.

Getting Started

// Minimal instantiation
otp #(
 .ADDR_W(6)
) u_otp (
 .clk (clk),
 .rst_n (rst_n),
 // APB4
 .p_paddr (paddr),
 .p_psel (psel),
 .p_penable (penable),
 .p_pwrite (pwrite),
 .p_pwdata (pwdata),
 .p_prdata (prdata),
 .p_pready (pready),
 // Safety
 .err_clear (1'b0),
 .err_valid (err_valid),
 .err_code (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.