One-time programmable data security system for programmable logic device

A data security fuse system is disclosed for allowing one-time programmability of protected data cells in a reprogrammable logic device, which may determine, for example, the logic architecture of the device. The system includes a fuse enable circuit which may be erased to the disabled state only prior to packaging of the device during manufacture. The protected data cells may be selected for programming by a decoder which decodes cell selection signals. A security fuse circuit is enabled by a fuse enable signal from the activated fuse enable circuit. The security fuse circuit allows the protected cells to be selected once for programming after the system has been activated, and thereafter defeats any attempts to access the protected data cells.

BACKGROUND OF THE INVENTION 
The present invention relates to programmable logic devices (PLDs), and 
more particularly to techniques for preventing the unauthorized 
modification of programmed data, such as data defining the architecture of 
PLDs. 
PLDs provide a flexible logic architecture, userprogrammed through 
on-circuit fuses or switches, to perform specific functions for a given 
application. PLDs can be purchased "off the shelf" like standard logic 
gates, but can be custom tailored like gate arrays. The PLD typically 
includes thousands of the fuses or switches, arranged in one or more 
matrices known as AND or OR arrays to facilitate their manufacture and 
programming. To use conventional PLDs, system designers typically draft 
equations describing how the hardware is to perform, and enter the 
equations into a PLD programming machine. The unprogrammed PLDs are 
inserted into the machine, which interprets the equations and provides 
appropriate signals to the device to blow the appropriate fuses or set the 
appropriate switches such that the PLD will perform the desired logic 
function in the user's system. 
It is known to employ security fuse circuits in bipolar PLDs and MOS EPROM 
PLDs to prevent interrogation of the data programmed into the device AND 
array. Bipolar devices employ fused links as the switch elements, and may 
not be erased once blown. The cells of PLDs using cells erasable by UV 
light may be erased, but this also erases the security fuse. 
A PLD employing electrically erasable cells which is capable of being 
configured (and reconfigured) to a plurality of specific logic devices by 
means of programmable array and architecture data is described in pending 
application, Ser. No. 707,662, entitled Improved Programmable Logic 
Device" and having a common assignee with the present invention. Thus, the 
device can take the place of many other PLDs as a result of its 
versatility. 
The referenced patent application entitled "Programmable Data Security 
Circuit for Programmable Logic Device," describes a security circuit which 
allows the device manufacturer of a reprogrammable logic device, e.g., one 
employing electrically erasable cells, to program the device to a 
particular logic architecture, and which thereafter prevents the user from 
modifying the protected data, which may be the architectural data and 
hence prevents the user from reconfiguring the device architecture. For 
some applications, it would be desirable to provide a reprogrammable PLD 
with a security device allowing the user to program the device 
architecture a single time if the security fuse has been set by the 
manufacturer or to repeatedly reconfigure the device architecture or other 
protected data if the fuse has not been set by the manufacturer. 
It would therefore represent an advance in the art to provide a 
programmable architecture security fuse circuit for a reconfigurable PLD 
which may be set after device fabrication, and thereafter allows the user 
to program the logic configuration a single time, thereafter defeating any 
further attempts to modify the device architecture. 
It would further be advantageous to provide a one time programmable 
architecture data security circuit for a PLD which allows the user of the 
PLD to program the architecture data, but thereafter defeats any attempts 
to alter the protected data, if the security circuit has been enabled 
during device fabrication, and otherwise allows the user to repeatedly 
reprogram the data. 
SUMMARY OF THE INVENTION 
The foregoing and other advantages and features are provided by the 
invention in a programmable logic device comprising a predetermined set of 
electrically erasable memory cells. A security fuse system is provided in 
the programmable logic device for allowing one-time programming of the set 
of memory cells. The system comprises an enable circuit responsive to a 
security fuse activation signal to provide a fuse enable signal. A decoder 
circuit is coupled to the set of memory cells for selecting the cells for 
programming in response to cell selection signals. The system further 
includes a security fuse circuit responsive to the fuse enable signal and 
to the cell selection signals. The fuse circuit is coupled to the decoder 
circuit for allowing one-time programming of the set of cells after the 
fuse enable circuit has been set, or enabled, and thereafter disables the 
decoder cell selection function to prevent subsequent selection of the 
cells for programming.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
The present invention comprises a novel security fuse system for 
programmable logic devices. In the following description numerous specific 
details are set forth, such as logic circuit and device block diagrams and 
the like, in order to provide a thorough understanding of the invention. 
It will be obvious to those skilled in the art that the invention may be 
practiced without these specific details. In other instances, well-known 
circuit and device details are not described in detail so as not to 
obscure the invention. 
FIG. 1A is a partial block diagram of a PLD incorporating the security fuse 
circuit in accordance with the present invention. While the disclosed 
embodiment is for protecting programmable data defining the logic 
architecture of a PLD, it will be appreciated that the invention may be 
employed generally to protect programmed data of any type in a PLD 
employing reprogrammable data cells against alteration. 
The PLD depicted in FIG. 1A is fabricated with a complementary 
metal-oxide-semiconductor (CMOS) technology and assembled in a multi-lead 
protective package. The PLD comprises AND matrix 10, comprising a large 
number of electrically programmable cells, arranged in rows and columns. 
The columns may form (with output inverters which are not shown) a product 
term, comprising the logical AND combinations of those row input line 
signals which are coupled to the product term. With a cell disposed at the 
intersection of each row input lines and each column or product terms, the 
cells provide the capability of selectively coupling a respective row 
input line to a corresponding product term. Output logic circuit 40 
couples the product terms to the device output pins to provide the device 
logical outputs. Thus, the user may, by programming the cells or bits of 
the user portion of array 10 determine which input signals contribute to 
the logical outputs of the device. To this general extent, the 
programmability of the AND array is conventional, as described, for 
example, in the " .RTM. Handbook," Monolithic Memories, Inc., 1983, 
Section One, pages 5-11. 
For purposes of describing the disclosed embodiment, it may be assumed that 
the logic architecture of the exemplary PLD is determined by the status of 
the data bits stored in the architecture row and the "XOR" row of the 
array. The bits in the XOR row provide the capability of inverting the 
output lines of the PLD to provide either inverted or non-inverted logical 
outputs. Thus, for a PLD having eight output lines, eight bits in the XOR 
row determine whether an inverter in each output line is activated. In 
this embodiment, seventy-four data bits in the architecture row determine 
the architecture of the remaining output circuitry, i.e., defining the 
specific output logic paths and functions to which the output circuit 40 
of the PLD is configured. 
By way of example, FIG. 1B is a simplified schematic of a typical output 
logic macrocell (OLMC) 50 comprising the output circuit 40. In this 
example, eight product terms are coupled to the cell 40, which is 
replicated eight times in circuit 40 to receive 64 product terms from the 
AND array 10. In the normal user mode, eight bit bus 52 couples the 
outputs of eight sense amplifiers associated with eight product terms to 
the OLMC 50. The OLMC 50 provides an output at pin 54, and allows the 
output signal to be individually set to active high or active low, with 
either combinational (asynchronous) or registered (synchronous) 
configurations. A common output enable (OE) can be connected to all 
synchronous device outputs, or a product term can be used to provide 
individual output enable controls for asynchronous outputs. 
The various output circuit configurations of the PLD are controlled by 
programming bits within the architecture control word stored in the 
architecture row. Architecture control bit AC0 and the eight AC1 bits 
direct the outputs to be wired always on, always off (as an input), have a 
common OE term, or to be tri-state controlled separately from a product 
term. The architecture control bits also determine the source of the array 
feedback term through multiplexer 56, and select through multiplexer 60 
either combinational or registered outputs. The SYN bit determines whether 
the PLD will have registered output capability or will have purely 
combinational outputs. The eight XOR bits determine individually each 
device output polarity. The OLMC operation will be apparent to those 
skilled in the art, and need not be described in additional detail. 
The specific details as to the type and location of the data to be 
protected are exemplary, as the invention is not limited to protection of 
architecture data in a specific location in the PLD. 
In the preferred embodiment, the PLD data cells of the matrix comprise 
electrically erasable floating gate transistors which may be programmed 
either into the depletion mode or enhancement mode, wherein the cell is 
respectively conductive or nonconductive during cell interrogation. The 
data cells further comprise a cell select transistor which is gated by an 
appropriate input line to select the particular cell. The memory cells of 
each row are programmable in a device "edit" mode by selecting the cells 
in a particular row and applying appropriate programming voltages to the 
gate, source and drain of the respective floating gate transistors of each 
cell to program particular ones of the floating gate transistors to the 
depletion mode (conductive when interrogated) in dependence on the status 
of programming data. Thus, only certain ones of the cells in a selected 
row are programmed to the conductive-when-interrogated state when the 
cells in the row are selected for programming; these particular ones are 
determined by the device user by specifying the programming data which in 
turn determines the levels of the voltages applied to the gate source and 
drain of the floating gate transistor during the programming mode. This 
sequence is repeated for each active row of the array 10 to program the 
array in the desired manner. 
For this exemplary PLD, the device edit mode is selected by application of 
a super voltage (+20 volts) signal EDT to a predetermined pin of the 
device. This activates row decoders for each of the rows of the matrix 10, 
and otherwise reconfigures the device pin functions. In the edit mode, six 
of the device input pin signals define the six-bit word "RAG" (row address 
gate) which defines a particular row address. Thus, by way of example, row 
decoders 20 and 30 (FIG. 1) decode the particular RAG word selecting the 
XOR row and architecture row, respectively. The inputs to each of the row 
decoders comprise the "RAG" word and the CLR signal, which is activated by 
the user to clear or erase each of the user-accessible memory cell 
locations in the array. Another input to the XOR row decoder 20 is the USF 
signal, a signal generated by a user security fuse circuit which the 
device user activates to protect the user AND array cells and the XOR row 
from interrogation alteration. 
Another input signal to the architecture row decoder 30 is the VSF signal, 
which is the output of the architecture security fuse 35 comprising the 
present invention. 
The architecture security fuse 35 is provided to permit the device user to 
access the architecture row a single time in order to program the 
architecture configuration bits if the security fuse has been enabled 
during manufacture. If the security fuse has not been set by the 
manufacturer, the device user may program the architecture bits 
repeatedly. These architecture configuration bits determine the 
configuration of the output logic circuits 40 and their relationship to 
the AND matrix. Thus, when the output VSF of the architecture security 
fuse 35 is active, the function of decoder 30 to select the architecture 
row for programming is disabled. 
The one-time programmable security fuse system is illustrated in block 
diagram form in FIG. 2. This fuse system provides the capability of 
allowing the user to conduct a single programming cycle to program the 
protected cell locations if the system has been enabled during 
manufacture, and thereafter prevents the protected cells from being 
reprogrammed. However, their data contents can be read for verification of 
the architecture data. One advantage of this fuse circuit allowing 
one-time programming is that the manufacturer of a reprogrammable logic 
device could configure the device for one-time programming by the user, 
allowing the user to configure the part once to a desired logic 
configuration, thereafter locking the part to that configuration. The 
manufacturer also has the choice of setting or not setting the security 
fuse; if the fuse is not set, then the user may repeatedly change the 
programmed data determining the logic configuration. 
In FIG. 2, security fuse 35 comprises security fuse enable circuit 100 and 
security fuse circuit 300. Security fuse enable circuit 100 enables the 
fuse circuit 300 by a security fuse enable signal SFE. The security fuse 
circuit 300 generates the security fuse signal VSF which is coupled to the 
decoder 30 for the protected cells, in this exemplary embodiment 
containing the architecture data. 
Security Fuse Enable Circuit 
An exemplary embodiment of the security fuse enable ("SFE") circuit 100 is 
illustrated in schematic form in FIG. 3. While the PLD is implemented in 
CMOS technology, the SFE circuit comprises depletion NMOS-type transistors 
109, 111, 113, 117, 119 and 121, which are doped with arsenic so that the 
threshold turn-on gate voltage for these transistors is negative. 
Transistors 109, 111, 113 and inverter 107 form a high impedance voltage 
pull-up circuit 110 which is coupled to node 106. Pull-up circuit 110 is 
adapted to pull node 106 up to the potential on node 112 (+20 volts) when 
transistor 105 is nonconductive, and to isolate the +20 volt supply from 
node 106 when node 106 is grounded, i.e., when transistor 105 is 
conductive. Transistors 117,119,121 and inverter 115 form a similar 
voltage pull-up circuit 116 which is coupled to node 122. If the node 122 
is pulled low to ground, the pull-up circuit 116 is unable to pull the 
node potential above ground. Such pull-up circuits are known to those 
skilled in the art and need not be described in further detail. 
Transistor 125 is the data storage element of the SFE circuit 100, and is a 
floating gate, N channel field effect transistor. The floating gate 
transistor is a well-known semiconductor device, and its characteristics 
are discussed, for example, in the book "Physics of Semiconductor 
Devices," by S. M. Sze, John Wiley & Sons, 1969, at Chapter 10. The 
floating gate transistor in the preferred embodiment is adapted to employ 
the well-known Fowler-Nordheim tunneling effect to configure the 
transistor in the enhancement or depletion mode. The floating gate is 
separated from the drain region comprising the transistor by a thin (100 
Angstrom) oxide layer, so that in the presence of a sufficient electric 
field, charge will tunnel between the drain and the floating gate. 
As will be described more fully below, when the floating gate transistor 
125 is "erased," i.e., programmed to the enhancement mode (nonconductive 
when interrogated), the security fuse enable circuit output SFE is HIGH, 
permitting the PLD architecture row data to be repeatedly programmed. When 
the floating gate transistor is programmed to the depletion mode 
(conductive when interrogated), however, the circuit 100 output SFE will 
be LOW to enable the security fuse circuit 300. 
The inputs to NOR gate 101 are the CLR and EDT signals, and the signal SFE, 
the output of inverter 151 of the SFE circuit 100. The output of NOR gate 
101 will be HIGH only when all inputs to the gate are low. The output of 
NOR gate 101 at node 102 is coupled as one input to NOR gate 103. The 
other input to NOR gate 103 is node "P21." This node is buffered from a 
wafer probe pad which is accessible to wafer probe only prior to device 
die packaging. 
As will be discussed below, node P21 provides an override function to force 
transistor 105 to the nonconductive state and cause node 106 to be pulled 
HIGH by pull-up circuit 110. This results from the operation of NOR gate 
103, since if P21 is forced HIGH, the NOR gate output at node 104 will be 
LOW, irrespective of the state of the other gate input. 
When node P21 is LOW, NOR gate 103 acts to invert the signal at node 102, 
the output of NOR gate 101. This effectively creates a logical OR 
function, so that with P21 low, the status of node 104 is the logical OR 
of CLR, EDT, and SFE. 
The output 104 of gate 103 is coupled to the gate of transistor 105, and 
when "HIGH" biases the transistor to the conductive state. Node 106, 
coupled to the gates of transistors 125, 113 in the pull-up circuit 110 
will then be grounded. 
If the output of gate 103 is LOW, transistor 105 will be nonconductive, 
node 106 is not clamped to ground, and the potential at node 106 is pulled 
up to +20 volts by circuit 110. 
With the condition that transistor 105 is conductive, pull-up circuit 116 
operates in a similar manner with respect to node 122 as described with 
respect to circuit 110 and node 106. However, there are two possible paths 
from node 122 to ground, the first path through transistors 123, 125, and 
127, and the second path through transistor 131. 
Transistor 123 is connected for diode operation, and is employed with 
transistor 125 to create an electrically erasable, programmable data 
storage cell 124. Interrogation of the status of memory cell 124 is 
performed by inverter 115, and occurs when node 106 is grounded 
(transistor 105 in the conductive state), transistor 127 is conductive 
(signal "ASG" applied to its gate is at +2.5 volts) and transistor 131 is 
nonconductive (with its gate at ground). The status of node 122 will 
depend on the state of memory cell 124. If the floating gate transistor 
125 is erased, so that it is in the enhancement mode, transistor 125 will 
be nonconductive. Node 122 will be pulled HIGH by pull-up circuit 116, and 
the output of inverter 115, at node 133, will be LOW. 
If, on the other hand, transistor 125 is programmed to the depletion mode, 
the transistor will be in the conductive state with its gate grounded. 
With transistor 127 also conducting, node 122 will be LOW. Under these 
conditions, the output of inverter 115 at node 133 will be HIGH. 
Node 133 at the output of inverter 115 is coupled through inverter 118 to 
latch 140. The output of latch 140 is the SFE circuit output signal SFE, 
which is coupled in the inverted form SFE to the input of NOR gate 101 via 
inverter 151. Except when signal EDT is active, latch 140 is transparent 
to the state of node 133. When EDT goes HIGH the signal SFE is latched to 
the current state, and is not affected by subsequent changes in the state 
at node 133 while EDT is HIGH. 
Security Fuse Circuit 
FIG. 4 is a schematic diagram of the security fuse circuit 300. The circuit 
300 comprises electrically erasable cell 324, formed by floating gate 
N-channel transistor 325 and select transistor 323. Node 322 of cell 324 
is coupled to ground through transistor 331, which is gated by the signal 
SFE. The circuit 300 further comprises a high voltage pull-up circuit 316, 
including transistors 317, 319 and 321, and inverter 315, which operates 
in a similar fashion to circuit 116 of FIG. 3. 
The output of inverter 315 on node 333 is coupled to latch 340, and the 
latched signal is provided as one input to NOR gate 345. The signals SFE 
and P (active except in the device edit mode) are also provided as inputs 
to gate 345. 
The security fuse circuit output signal is the output VSF from the NOR gate 
345. 
Cell 324 illustrates a general cell configuration which may be replicated 
throughout the array 10 to form the programmable connections of the array. 
The circuit 300 operates in the following manner. The cell 324 is selected 
by a HIGH signal on the gate of the select transistor 323, i.e., the 
condition that the signal ARCH ROW is at the HIGH logic level. The 
transistor 325 is interrogated by the signal MCG1, nominally +2.5 volts, 
applied to its gate. Thus, when the cell 323 is "selected," and transistor 
325 is interrogated, transistor 323 is conductive. Transistor 325 will be 
conductive if programmed to the depletion mode, and nonconductive if 
erased to the enhancement mode. 
During the device normal user mode, the signal ASG will be at the nominal 
+2.5 volt level, gating the transistor 327 to the conductive state. The 
potential at node 322 will then depend on the state of transistor 325. If 
it is conductive, node 322 will be coupled to ground, and the sensed 
output of the cell at node 333 will be HIGH. If transistor 325 is not 
conductive node 322 will be pulled HIGH by the pull-up circuit 316, and 
the sensed output of the cell 324 at node 333 will be LOW. 
The cell 324 is selected for programming at the same time the architecture 
row is selected Thus, the signal ARCH ROW goes HIGH, driving the select 
transistor 323 to the conductive state. The MCG1 signal at the gate of 
floating gate transistor 325 is brought to ground. Signal ASG is also 
brought to ground, gating transistor 327 to the nonconductive state. 
With these conditions, the potential at node 322 will remain at ground so 
long as the signal SFE is HIGH, gating transistor 331 to the conductive 
state. This will prevent the transistor 325 from being programmed to the 
depletion mode. 
When the SFE circuit is enabled by programming the SFE bit, the signal SFE 
goes LOW, turning off transistor 331. This allows the transistor 325 to be 
programmed to the depletion mode the next time the architecture row is 
selected for programming. Now, with select transistor 323 pulled HIGH to 
+20 volts, transistors 327 and 331 turned off, and the signal MCG1 
grounded, the potential at 322 will rise due to the pull-up action of 
transistors 319, 321. Inverter 315 will flip LOW as the potential at node 
122 rises, turning off transistor 317 so that node 322 rise to +20 volts. 
With the gate of transistor 325 grounded and the drain at +20 volts less 
the enhancement threshold voltage of transistor 323, or about 18 volts, 
electrons will tunnel off the floating gate to the drain, programming the 
transistor 325 to the depletion mode. In this mode, cell 324 will conduct 
when interrogated by the signal MCG1 at 2.5 volts and when sensed by 
inverter 315, coupling node 322 to ground. With its input at ground, the 
inverter output goes HIGH. 
Security Fuse Row Decoder 
The row decoder 145 for selecting the security fuse enable function is 
shown in schematic form in FIG. 5. The decoder basically performs a OR 
decode function (represented schematically by OR AND complex gate 133 in 
FIG. 3) on the RAG row selection signals. Depletion transistor 137 
performs a voltage pull-up function on node 135g when the node is not 
clamped to ground through transistor 136 and any of transistors 135a-f. 
Inverter 138 inverts the state of node 135g, and node 132 is connected to 
the gate of transistor 131 (FIG. 3). Thus, when the SFE row is selected, 
each of transistors 135a-f is turned off, transistor 137 pulls up the 
voltage on node 135g, and node 132 goes LOW, turning off transistor 131. 
When the SFE row is not selected and when EDT is HIGH, node 135g is 
clamped to ground, node 132 goes HIGH, and transistor 131 is turned on. 
Architecture Row Decoder 
FIG. 6 is a schematic drawing of architecture row decoder 30. This decoder 
decodes the row address gate (RAG) row selection signals to select the row 
containing the protected information, in this embodiment the logic 
architecture data. Generally, a row is selected for programming or 
verification of the data residing in the memory cells of a particular row. 
The decoder 30 essentially performs a NOR function on the RAG word and EDT 
signals. The transistors 205, 210 and depletion transistors 215, 220, 225 
form a high impedance, high voltage pull-up circuit. When no path to 
ground from node 250 exists, the voltage pull-up circuits pull the voltage 
at node 250 up to a HIGH level. 
In the device edit mode, the signal EDT is HIGH, turning on transistor 247. 
Except when performing a "bulk erase" cycle, CLR is LOW, turning off 
transistor 246 and driving node 250 to +20 volts independent of the RAG 
address. Each of transistors 240-245 will be turned off when the 
appropriate RAG word to select the architecture row is present, so that 
there is no path to ground from node 250 through transistors 240-245 in 
this condition, and unless transistor 248 is turned on, node 250 will be 
pulled HIGH. 
Node 250 is the row decoder output and is coupled to each of the select 
transistors comprising the memory cells in the architecture row, thereby 
selecting each of the memory cells in that row for programming or 
verification. The high potential at node 250 also turns on transistor 249, 
which couples the MCG.0. signal to node MCG1, coupled to the gates of the 
floating transistor memory elements of the programmable cell matrix (for 
example, cells 324 of FIG. 4). The MCG.0. signal is at the appropriate 
voltage level (+2.5v) for interrogation of the user array cell states. 
Thus, a HIGH signal at node 250 serves to select the memory cells of the 
architecture row for erasure by allowing MCG1 to rise to +20 volts. 
If VSF is low, i.e., the architecture security fuse is erased, then 
transistor 248 of decoder 30 is turned off, allowing node 250 to be pulled 
HIGH when selected. However, if the fuse is programmed, VSF is HIGH, 
turning on transistor 248. Node 250 is then clamped to ground through 
transistors 248 and 247, preventing the memory cells in the architecture 
row from being selected, irrespective of the status of the RAG word. 
During the PLD bulk erase cycle, CLR goes low, turning off transistor 246. 
Then node 250 will be pulled HIGH, unless VSF is HIGH, irrespective of the 
state of the RAG word. However, the security fuse signal VSF will defeat 
the bulk erase cycle for the architecture row, i.e., if VSF is HIGH. 
SFE Circuit Initialization 
To initialize the state of the SFE circuit, node P21 is forced HIGH during 
the wafer probe stage of the PLD chip fabrication, from a probe pad which 
is not accessible once the wafer has been packaged. The output of NOR gate 
103 is LOW unless both inputs are LOW. Hence, with one input (P21) to NOR 
gate 103 forced HIGH, its output will be LOW, driving the gate of 
transistor 105 LOW so that the transistor becomes non-conductive. 
With transistor 105 non-conductive, node 106 is no longer clamped to 
ground, and as the potential on node 106 is pulled up as discussed above, 
the output of inverter 107 is flipped low, turning off transistor 109. 
Transistor 111 turns on, and with both transistors 111, 113 turned on, the 
voltage at node 106, coupled to the gate of transistor 125, rises to +20 
volts. 
Under these conditions, during the device edit mode, floating gate 
transistor 125 of cell 124 may be "erased" to the enhancement mode by 
turning on transistors 127 and 131. The ASG signal at the gate of 
transistor 127 is brought to 5 volts to turn on transistor 127. The EDT 
signal is HIGH during the edit mode; the security fuse row is not selected 
so that the gate of transistor 131 is brought HIGH, as discussed above, 
turning on transistor 131. With both the drain and source of transistor 
125 coupled to ground potential through conductive transistors 127,131, 
and its gate at +20 volts, electrons will tunnel from the drain onto the 
floating gate, programming the transistor to a strong enhancement mode, 
wherein a positive threshold gate voltage of at least 6-7 volts is 
required to turn on the transistor in this mode. Since the gate of 
transistor 125 is grounded during interrogation, the transistor will then 
be nonconductive. Node 122 is pulled HIGH, and the output of inverter 115 
at node 133 goes LOW. The SFE signal, the output of inverter 118, is HIGH. 
Fuse Circuit Enablement 
The architecture security fuse circuit is activated by addressing the 
security fuse row and programming the transistor 124 of cell 125 to the 
depletion mode (conductive when interrogated). The output of decoder 
circuit 145 (FIG. 5) goes LOW when the security fuse row is selected. This 
turns transistor 131 off, so that there is no path to ground from node 122 
through transistor 131. 
To program the transistor 125 to the depletion mode, node 106 is brought 
LOW by turning on transistor 105. This will normally be done only after 
the PLD has been packaged, so that pad P21 is no longer accessible. The 
EDT signal is LOW during the edit mode. The signal SFE is LOW until the 
circuit 100 has been enabled. However, CLR is LOW only during the user 
clear cycle, and it is otherwise HIGH. Thus, with the CLR input to gate 
101 HIGH, the output of gate 101 will be driven LOW. With both inputs to 
NOR gate 103 LOW, the output of NOR gate 103 is driven HIGH, turning on 
transistor 105, and grounding the gate of transistor 125. Similarly, 
signal ASG is brought LOW, turning off transistor 127. 
With these conditions, the potential at node 122 will rise due to the 
pull-up action of transistors 119, 121. Inverter 115 will flip LOW as the 
potential at node 122 rises, turning off transistor 117, so that node 122 
rises to +20 volts. With the gate of transistor 125 grounded and the drain 
at +20 volts less the enhancement threshold voltage of device 123, or 
about 18 volts, electrons will tunnel off the floating gate to the drain, 
programming the transistor to the depletion mode. Now, during the normal 
user device mode, the transistor will conduct when its gate is grounded 
and when sensed by inverter 115, pulling node 122 LOW. With its input LOW, 
the inverter 115 output goes HIGH. 
The inverter 115 output is coupled through inverter 118 to latch 140, which 
is adapted to latch its existing input state to its output (SFE) when EDT 
is HIGH, during the edit mode. When EDT is LOW, the latch is transparent. 
The latch prevents the SFE signal from changing in the Edit mode when the 
interrogation voltages are changed to their respective programming 
conditions. 
The SFE HIGH condition prevents future regenerative erases (as described 
below), and enables the security fuse circuit 300. The SFE circuit 100 may 
not be erased, however, once it has been enabled. 
Security Fuse System Operation 
The security fuse system 300 operates in the following manner. The SFE 
enable circuit 100 is activated, providing the signal SFE at the LOW logic 
level. This releases node 322, since the transistor 331, gated by the 
signal SFE, is now nonconductive. With these conditions, the cell 324 will 
be programmed to the conductive state the next time the architecture row 
is selected, i.e., when the signal ARCH ROW representing the output of the 
row decoder 30 is at the HIGH logic level, and the signal MCG1 driving the 
gate of the floating gate transistor 325 is grounded during a programming 
cycle. Once the cell 324 is programmed to the conductive state (when 
interrogated), the state of the cell data will be latched at node 341 (the 
output of latch 340), the output of the NOR gate 345 (the signal VSF) will 
be at the HIGH logic level, and the transistor 248 of the row decoder 30 
depicted in FIG. 5 (driven by the signal VSF) will be gated to the 
conductive condition. With the gate of transistor 248 driven HIGH, the 
signal ARCH ROW is pulled LOW, and the cells in the architecture row 
cannot be selected for programming again, preventing further changes to 
the device architecture. 
Post-Assembly Regenerative SFE Erase 
With the SFE circuit "erased," the PLD architecture may be configured (or 
reconfigured) from its existing logic configuration. It is important to 
ensure that the "erased" status of the SFE circuit not degenerate 
resulting from charge loss from the floating gate, since this would enable 
the security fuse circuit 300. This is accomplished by a post-assembly 
regenerative erase function, which occurs when all inputs to NOR gate 101 
of circuit 100 are low, that is, when SFE is LOW (erased), the device is 
in the "clear" mode (EDT=CLR=0), and transistor 131 is turned on (i.e., 
the security fuse row is not selected). When these conditions are met, 
node 102 goes HIGH, turning off transistor 105, allowing node 106 to be 
pulled HIGH to +20 volts, thereby erasing the cell to its full enhancement 
mode floating gate potential. 
The regenerative erase occurs each time the "user clear" device function is 
selected, provided SFE is not HIGH. The PLD is adapted to allow the user 
to erase all memory locations during a "bulk erase" cycle; during this 
cycle EDT and CLR are both low. The regenerative erase does not erase a 
programmed SFE circuit cell 124, since the signal SFE is HIGH in this 
state, and the gate 101 output will remain low. With both inputs to gate 
103 low, its output is HIGH, turning on transistor 105 and grounding the 
gate of floating gate transistor 125. Since the gate must be elevated to 
the HIGH programming voltage to erase the transistor to the enhancement 
mode, the memory cell is not erased. Thus, the regenerative erase function 
only affects an erased SFE circuit cell 124. 
Reduced Interrogation Voltage 
Further margin against charge loss on the floating gate of the transistor 
125 resulting from high temperature packaging steps is provided by 
reducing the read or interrogation voltage of the memory cell 124. The PLD 
is typically packaged with the SFE circuit cell 124 in the erased state. 
The manufacturer, for example, may choose to thereafter enable the SFE 
circuit 100. The transistor 125 of memory cell 124 of the SFE circuit 100 
is read or interrogated with its gate at ground potential, instead of the 
+2.5 volts gate potential nominally employed to read memory cells of this 
type. As charge loss from the floating gate of transistor 125 occurs with 
the transistor in the enhancement mode, the required threshold gate 
voltage required to turn on the transistor is reduced. Thus, reducing the 
cell interrogation voltage from +2.5 volts to 0 volts provides additional 
margin against the high temperature induced charge loss 
After the PLD has been packaged and the SFE circuit 100 has been enabled, 
there is no way to erase the SFE circuit cell 124. The circuit logic 
prevents the storage transistor 125 from being erased whenever the 
security fuse is enabled, i.e., whenever SFE is LOW. This follows from the 
operation of NOR gate 101 and its inputs as discussed above. Thus, the 
preferred embodiment of the security fuse allows one-time programming of 
the protected data once the circuit has been enabled. 
There has been described above a novel security circuit for selectively 
allowing one-time programming of protected information in a PLD. The 
security circuit allows selective reprogrammability of the protected data 
to be determined by the manufacturer of the PLD prior to shipment to the 
user. Moreover, those AND array cells not protected by the security system 
are still reprogrammable even when the security system is activated. 
It is understood that the above-described embodiment is merely illustrative 
of the possible specific embodiments which can represent principles of the 
present invention. Other arrangements may be devised in accordance with 
these principles by those skilled in the art without departing from the 
scope of the invention.