Method and apparatus for protecting an integrated circuit from erroneous operation

A data processing system (10) has an embedded non-volatile memory (22) that is programmed and erased by use of a high voltage provided by a charge pump (78). In order to prevent the non-volatile memory (22) from being inadvertently programmed or erased during low power supply voltage conditions, the charge pump (78) is disabled and discharged when the power supply voltage drops below a predetermined value. This is accomplished by enabling a low voltage detect circuit (110) in response to a program or erase operation being initiated. A control register (76) will provide a high voltage enable signal to the charge pump (78) only when a power supply valid signal is received. In another embodiment, the low voltage detect circuit (110) may be enabled by another condition to protect the data processing system (10) from an authorized access.

FIELD OF THE INVENTION

The present invention relates generally to integrated circuits, and more particularly, to a method and apparatus for protecting an integrated circuit from erroneous operation.

RELATED ART

Non-volatile memories, such as Electrically Erasable Programmable Read Only Memory (EEPROM) and flash memory, are commonly used in embedded data processing applications. Many non-volatile memory types, such as EEPROM and flash, are programmed using an on-chip charge pump.

Unfortunately, the stored values in these memory types may be subject to being altered unintentionally. For example, the stored state of a memory cell may be altered because the power supply voltage dips, causing, for example, erroneous circuit operation, inadvertently re-programming or erasing the cell.

Low voltage inhibit (LVI) circuitry has been used to prevent the charge pump from being enabled when the power supply voltage is low. However, the LVI circuitry generally requires a reference voltage generator that consumes a significant amount of power. When a data processing system is capable of operating in a low power or standby mode, the LVI circuitry is commonly disabled because of the amount of power it requires, thus exposing the non-volatile memory to the possibility of inadvertent program or erase operations. Therefore, a need exists to protect the data processing system from erroneous operation when the power supply voltage drops. Also, the need exists to protect the non-volatile memory from inadvertent data corruption, even when the LVI circuitry has been disabled.

DETAILED DESCRIPTION OF THE DRAWINGS

Generally, the present invention provides an integrated circuit having a processing unit, a circuit, and a low voltage detection circuit. The circuit, such as for example, a non-volatile memory, is coupled to the processing unit, for implementing a first predetermined operation, such as for example, a program or erase operation, in response to receiving a control signal from the processing unit. The low voltage detection circuit determines if a power supply voltage provided to the integrated circuit is below a predetermined voltage level. In response to the first predetermined operation being performed in the circuit, a voltage detection enable signal is provided to enable operation of the low voltage detection circuit. If the power supply voltage is below the predetermined voltage level, the low voltage detection circuit causes a second predetermined operation to be initiated in the integrated circuit. The second predetermined operation may be, for example, a reset signal or a signal to disable a charge pump for providing a programming voltage.

In another embodiment, the present invention provides a circuit for disabling and discharging the high-voltage charge pump for the nonvolatile memory when the power supply voltage is below a predetermined voltage level. When the charge pump is disabled and discharged, the high-voltage required for programming and erase will not be present and therefore the contents of nonvolatile memory cannot be inadvertently modified.

FIG. 1illustrates, in block diagram form, a data processing system10in accordance with an embodiment of the present invention. Data processing system10can be implemented as a single integrated circuit called a microcontroller. Data processing system10has various on-board peripherals which are bi-directionally coupled by way of an information bus30. The particular embodiment ofFIG. 1has a central processing unit (CPU)12, a low voltage inhibit circuit14, an analog-to-digital converter (ADC)16, serial circuitry18, timer circuit20, non-volatile memory22, a static random access memory26, and system integration circuitry28, which are all bi-directionally coupled to the information bus30. System integration circuit28may receive and transmit signals external to data processing system10by output terminals (not shown). ADC16can receive and transmit signals external to data processing system10by way of integrated circuit pins36. Serial circuitry18can receive and transmit signals external to data processing system10by way integrated circuit pins38. Timer circuitry20can receive and transmit signals external to data processing system by way of integrated circuit pins40. The low voltage inhibit circuit14provides a signal labeled “VDD VALID” to an input terminal of non-volatile memory22, and receives a signal labeled “VDD DET EN” from the non-volatile memory22. The embodiment ofFIG. 1illustrates only one embodiment of the data processing10. For example, other embodiments of data processing system10may not have ADC16, timer circuit20, serial circuitry18, or static random access memory26. Also, other embodiments of data processing system10may have fewer, more, or different peripherals than those illustrated inFIG. 1.

FIG. 2illustrates, in block diagram form, the non-volatile memory22of the data processing system ofFIG. 1in more detail. The non-volatile memory22includes an array68, bus interface circuitry70, row decode circuitry64, high voltage decode circuit62, column decode/block select circuitry66, data I/O and programming circuitry60, control registers76, charge pump78, and AND logic gate104. A single array of flash memory cells68is divided into a plurality of blocks50–57. Each block receives a plurality of word lines from row decode circuitry64. Row decode circuitry64and high voltage decode62receive address signals65from bus interface circuitry70. Although row decode circuit64and high voltage decode62in the illustrated embodiment receives address signals A6–A14, row decode circuitry64and high voltage decode62in alternate embodiments may receive fewer, more or different address signals. Row decode circuit64is coupled to array68by word lines80. Bus interface circuitry70is coupled to information bus30in order to allow non-volatile memory22to communicate with other portions of circuitry in data processing system10. For example, bus interface circuit70may receive address and data signals from CPU12across information bus30, and bus interface circuit70may transfer data signals back to CPU12across information bus30. Bus interface circuit70transfers address signals to column decode circuitry66by way of conductors63. Although column decode circuitry66in the illustrated embodiment receives address signals A0–A5, column decode circuitry66in alternate embodiments of the present invention may receive fewer, more or different address signals. Column decode/block select circuitry66provides column select signals to array68by way of conductors71.

Bus interface circuitry70provides address and control signals labeled “ADDRESS CONTROL” to a first input of control registers76. Likewise, bus interface circuitry70provides the ADDRESS CONTROL signals to data I/O and programming circuitry60. Bus interface circuitry70provides data signal labeled “DATA SIGNALS” to a second input of control registers76. Bus interface circuit70transfers address signals and control signals to data I/O and programming circuit60. The column decode signals are used during read accesses and programming. The block select signals61are used during erasing and programming.

Control registers76provides a high voltage enable signal labeled “HVEN” to a first input of AND logic gate104. A second input of AND logic gate104receives a signal labeled “VDD VALID” for indicating if the power supply voltage VDD is above a predetermined value. An output of AND logic gate104provides a charge pump enable signal labeled “CPEN” to an input of a charge pump78. Note that the AND logic gate104is only intended to illustrate a logical function and may be implemented using one or more other logic gates. Charge pump78is a conventional charge pump and functions to provide an elevated charge pump voltage81to the array68for programming and erasing operations. In other embodiments, the charge pump voltage81may be provided by a source external to data processing system10.

In one embodiment of the present invention, control registers76receives the address and control signals ADDRESS CONTROL on conductors82and data signals DATA SIGNALS on conductors67, and sets the values of control bits to perform read, erase, and programming operations on the memory cells of array68. In the illustrated embodiment, array68comprises an array of flash memory cells, but in other embodiments, array68may comprise other types of non-volatile memory cells that require an elevated voltage for program and erase, such as for example, an EEPROM.

During normal operation of the non-volatile memory22, charge pump enable signal CPEN must be asserted as a logical high voltage before charge pump78can provide the charge pump voltage81to array68. For CPEN to be asserted as a logical high, both the high voltage enable signal HVEN and the VDD VALID signal must be asserted. The high voltage enable signal HVEN indicates that the charge pump78is needed for a program or erase operation and must be enabled. The VDD VALID signal is provided by the low voltage inhibit circuit14to indicate that the power supply voltage for the data processing system10is above a predetermined value for proper operation. Any time the power supply voltage is found to be lower than necessary for proper operation, then the VDD VALID signal is a logical low voltage, and the charge pump78will be disabled and discharged and the HVEN signal will be deasserted. When the supply voltage returns to normal, the VDD VALID signal is again asserted and the charge pump78can be enabled when the HVEN signal is re-asserted.

The AND logic gate104should be implemented with circuits that operate at lower power supply voltage to ensure that the AND logic gate104can perform its functions of disabling the charge pump78at low power supply voltages. Also, the AND logic gate104should be implemented as close as possible to the charge pump78to eliminate the necessity for additional logic that may not operate at low power supply voltages. In one embodiment, the data processing system10may be implemented on an integrated circuit using primarily transistors having a relatively high threshold voltage (VT) to achieve low standby power consumption. The AND logic gate104, OR logic gates109and120, and related circuitry may be implemented using low VT devices to get better tolerance to low power supply voltages.

Some systems are designed to operate with multiple supply voltages. A system operating at a lower supply voltage may not operate reliably at the same clock frequency as a system operating at a higher supply voltage. In those systems that operate on multiple supply voltages, it may be optionally determined if the clock frequency is appropriate for the selected supply voltage and provide the determination as an input to AND logic gate104. Also, in other embodiments, any other disqualifying condition for proper operation may be sensed during the program or erase operation, and can be used to generate a corresponding signal in order to ensure that no unexpected corruption of nonvolatile memory contents can occur. The other disqualifying conditions may include, for example, a program sequence error, a block protection violation error, and a wrong clock frequency. Further, the disqualifying conditions may be associated with one of the other peripherals or the CPU12of data processing system10. For example, a disqualifying condition may be a security violation, such as an unauthorized attempt to access the data processing system. An unauthorized attempt to access the data processing system10may be through a “backdoor” that may be available when the data processing system10is caused to operate in a low voltage or power saving mode. In this case, the unauthorized attempt is detected and a control signal is provided to enable the low voltage inhibit circuit14. The low voltage inhibit circuit14then causes a system reset to prevent the unauthorized access.

FIG. 3illustrates, in partial block diagram form and partial logic diagram form, the low voltage inhibit (LVI) circuit14ofFIG. 1and the control registers76ofFIG. 2in more detail. The LVI circuit14includes a LVI enable bit108, an OR logic gate109, a low voltage detect (LVD) circuit110, a flip flop112, and AND logic gates114and116. The control registers76includes control registers118and OR logic gate120. Note that the logic gates illustrated inFIG. 3are only intended to illustrate logical functions and each of the logic gates may be implemented using one or more other logic gates.

In the LVI circuit14, an LVI enable bit108is set by a user to enable or disable operation of the LVI circuit14. A power supply detection enable signal labeled “VDD DET EN” is generated in response to a program (PROGRAM) or erase (ERASE) operation being initiated by the control registers118. The LVI enable bit108is provided to one input of the OR logic gate109, and the power supply detection enable signal VDD DET EN is provided to a second input of the OR logic gate109. Either of these two signals can enable operation of the LVD circuit110. When enabled, the LVD circuit110provides a first output labeled “VDD LOW” when the power supply voltage is below a predetermined value. Also, the LVD circuit110will provide a VDD VALID signal at a second output to indicate that the power supply voltage is at or above the predetermined value. In the illustrated embodiment, while the LVD circuit110is enabled, the VDD VALID signal is a logical complement of the VDD LOW signal. While the LVD circuit110is disabled, both the LVD LOW and the LVD VALID signals are de-asserted. The flip flop112has a first input labeled “S” for receiving VDD LOW signal, a second input labeled “R” for receiving a power on reset signal labeled “POR”, and an output labeled “Q” for providing a signal labeled “LVI ERROR FLAG”. The LVI ERROR FLAG is provided to inputs of AND logic gates114and116. If a LVI interrupt enable signal labeled “LVI INT EN” is asserted, the AND logic gate114will provide a logic high LVI interrupt signal LVI INT in response to the AND logic gate114receiving a logical high LVI ERROR FLAG. Likewise, if a LVI reset enable signal labeled “LVI RESET EN” is asserted, the AND logic gate116will provide a logical high LVI RST signal in response to the AND logic gate116receiving a logical high LVI ERROR FLAG.

If the power supply voltage is above the predetermined value, then the VDD VALID signal is asserted and AND logic gate104is enabled. As discussed above, the AND logic gate104receives signal HVEN from the control registers118in response to the control registers118determining that the charge pump is needed for a program or erase operation. When the power supply voltage is valid and the HVEN is enabled, the charge pump78is enabled to provide CHARGE PUMP VOLTAGE81. In the illustrated embodiment, an inverter106is used to provide a signal (CP DISCHARGE) that is a logical complement of the CPEN signal to discharge the charge pump in the event the power supply voltage is below the predetermined value. Note that in other embodiments, the CP DISCHARGE signal may not be used. If the power supply voltage transitions below the predetermined value, then VDD VALID is de-asserted causing charge pump78to be disabled and discharged, and a current program or erase operation will be stopped. The de-asserted VDD VALID signal is also provided to the control registers118, and control registers118causes the HVEN signal to be de-asserted. When the power supply recovers, the HVEN signal must first be asserted before the charge pump78can be enabled for a new program or erase operation.

The disclosed embodiment functions to protect the contents of the non-volatile memory array68whether or not a user sets the LVI EN BIT108to enable the LVI circuit14. If the user elects to disable the LVI circuit14to, for example, save power during a standby mode of operation, the LVI circuit14can be enabled in response to the control registers118commanding a program or erase operation. The LVD circuit110of LVI circuit14is enabled by the control registers118asserting a PROGRAM or ERASE signal. The LVD circuit110is enabled even though the LVI EN BIT108is not set. In the event a low voltage is detected by the LVD circuit110, the VDD VALID signal is asserted as a logic low voltage, causing the AND logic gate104to provide a logic low CPEN signal to disable and discharge the charge pump78. The charge pump will remain disabled and discharged, and cannot be enabled as long as the low voltage condition exists, thus protecting the contents of array68from being corrupted.

In another embodiment, another control signal from the control registers76may be used to enable the LVD circuit110instead of the program and erase signals. For example, the VDD DET EN signal may be provided by a monitor mode bit or an internal test circuit bit to prevent an unauthorized access to the non-volatile memory or other portion of the data processing system10. Also, instead of disabling the charge pump, via the VDD valid signal to AND logic gate104, the VDD valid signal may be provided to, for example, the LVI RESET EN input of AND logic gate116. Then, in the event of an unauthorized access, the LVD circuit110will be enabled to cause a system reset operation to a predetermined condition.