Hardware Interfaces and Registers

Interfaces

Referring to the Comportable guideline for peripheral device functionality, the module otp_ctrl has the following hardware interfaces defined.

Primary Clock: clk_i

Other Clocks: clk_edn_i

Bus Device Interfaces (TL-UL): core_tl, prim_tl

Bus Host Interfaces (TL-UL): none

Peripheral Pins for Chip IO:

Pin name	direction	Description
test[7:0]	output	Test-related GPIOs. Only active in DFT-enabled life cycle states.

Inter-Module Signals: Reference

Inter-Module Signals
Port Name	Package::Struct	Type	Act	Width	Description
otp_ext_voltage_h		io	none	1
otp_ast_pwr_seq	otp_ctrl_pkg::otp_ast_req	uni	req	1	Power sequencing signals to AST (VDD domain).
otp_ast_pwr_seq_h	otp_ctrl_pkg::otp_ast_rsp	uni	rcv	1	Power sequencing signals coming from AST (VCC domain).
edn	edn_pkg::edn	req_rsp	req	1	Entropy request to the entropy distribution network for LFSR reseeding and ephemeral key derivation.
pwr_otp	pwrmgr_pkg::pwr_otp	req_rsp	rsp	1	Initialization request/acknowledge from/to power manager.
lc_otp_vendor_test	otp_ctrl_pkg::lc_otp_vendor_test	req_rsp	rsp	1	Vendor test control signals from/to the life cycle TAP.
lc_otp_program	otp_ctrl_pkg::lc_otp_program	req_rsp	rsp	1	Life cycle state transition interface.
otp_lc_data	otp_ctrl_pkg::otp_lc_data	uni	req	1	Life cycle state output holding the current life cycle state, the value of the transition counter and the tokens needed for life cycle transitions.
lc_escalate_en	lc_ctrl_pkg::lc_tx	uni	rcv	1	Life cycle escalation enable coming from life cycle controller. This signal moves all FSMs within OTP into the error state.
lc_creator_seed_sw_rw_en	lc_ctrl_pkg::lc_tx	uni	rcv	1	Provision enable qualifier coming from life cycle controller. This signal enables SW read / write access to the RMA_TOKEN and CREATOR_ROOT_KEY_SHARE0 and CREATOR_ROOT_KEY_SHARE1.
lc_seed_hw_rd_en	lc_ctrl_pkg::lc_tx	uni	rcv	1	Seed read enable coming from life cycle controller. This signal enables HW read access to the CREATOR_ROOT_KEY_SHARE0 and CREATOR_ROOT_KEY_SHARE1.
lc_dft_en	lc_ctrl_pkg::lc_tx	uni	rcv	1	Test enable qualifier coming from from life cycle controller. This signals enables the TL-UL access port to the proprietary OTP IP.
lc_check_byp_en	lc_ctrl_pkg::lc_tx	uni	rcv	1	Life cycle partition check bypass signal. This signal causes the life cycle partition to bypass consistency checks during life cycle state transitions in order to prevent spurious consistency check failures.
otp_keymgr_key	otp_ctrl_pkg::otp_keymgr_key	uni	req	1	Key output to the key manager holding CREATOR_ROOT_KEY_SHARE0 and CREATOR_ROOT_KEY_SHARE1.
flash_otp_key	otp_ctrl_pkg::flash_otp_key	req_rsp	rsp	1	Key derivation interface for FLASH scrambling.
sram_otp_key	otp_ctrl_pkg::sram_otp_key	req_rsp	rsp	3	Array with key derivation interfaces for SRAM scrambling devices.
otbn_otp_key	otp_ctrl_pkg::otbn_otp_key	req_rsp	rsp	1	Key derivation interface for OTBN scrambling devices.
otp_hw_cfg	otp_ctrl_part_pkg::otp_hw_cfg	uni	req	1	Output of the HW_CFG partition.
obs_ctrl	ast_pkg::ast_obs_ctrl	uni	rcv	1	AST observability control signals.
otp_obs	logic	uni	req	8	AST observability bus.
core_tl	tlul_pkg::tl	req_rsp	rsp	1
prim_tl	tlul_pkg::tl	req_rsp	rsp	1

Interrupts:

Interrupt Name	Type	Description
otp_operation_done	Event	A direct access command or digest calculation operation has completed.
otp_error	Event	An error has occurred in the OTP controller. Check the `ERR_CODE` register to get more information.

Security Alerts:

Alert Name	Description
fatal_macro_error	This alert triggers if hardware detects an uncorrectable error during an OTP transaction, for example an uncorrectable ECC error in the OTP array.
fatal_check_error	This alert triggers if any of the background checks fails. This includes the digest checks and concurrent ECC checks in the buffer registers.
fatal_bus_integ_error	This fatal alert is triggered when a fatal TL-UL bus integrity fault is detected.
fatal_prim_otp_alert	Fatal alert triggered inside the OTP primitive, including fatal TL-UL bus integrity faults of the test interface.
recov_prim_otp_alert	Recoverable alert triggered inside the OTP primitive.

Security Countermeasures:

Countermeasure ID	Description
OTP_CTRL.BUS.INTEGRITY	End-to-end bus integrity scheme.
OTP_CTRL.SECRET.MEM.SCRAMBLE	Secret partitions are scrambled with a full-round PRESENT cipher.
OTP_CTRL.PART.MEM.DIGEST	Integrity of buffered partitions is ensured via a 64bit digest.
OTP_CTRL.DAI.FSM.SPARSE	The direct access interface FSM is sparsely encoded.
OTP_CTRL.KDI.FSM.SPARSE	The key derivation interface FSM is sparsely encoded.
OTP_CTRL.LCI.FSM.SPARSE	The life cycle interface FSM is sparsely encoded.
OTP_CTRL.PART.FSM.SPARSE	The partition FSMs are sparsely encoded.
OTP_CTRL.SCRMBL.FSM.SPARSE	The scramble datapath FSM is sparsely encoded.
OTP_CTRL.TIMER.FSM.SPARSE	The background check timer FSM is sparsely encoded.
OTP_CTRL.DAI.CTR.REDUN	The direct access interface address counter employs a cross-counter implementation.
OTP_CTRL.KDI_SEED.CTR.REDUN	The key derivation interface counter employs a cross-counter implementation.
OTP_CTRL.KDI_ENTROPY.CTR.REDUN	The key derivation entropy counter employs a cross-counter implementation.
OTP_CTRL.LCI.CTR.REDUN	The life cycle interface address counter employs a cross-counter implementation.
OTP_CTRL.PART.CTR.REDUN	The address counter of buffered partitions employs a cross-counter implementation.
OTP_CTRL.SCRMBL.CTR.REDUN	The srambling datapath counter employs a cross-counter implementation.
OTP_CTRL.TIMER_INTEG.CTR.REDUN	The background integrity check timer employs a duplicated counter implementation.
OTP_CTRL.TIMER_CNSTY.CTR.REDUN	The background consistency check timer employs a duplicated counter implementation.
OTP_CTRL.TIMER.LFSR.REDUN	The background check LFSR is duplicated.
OTP_CTRL.DAI.FSM.LOCAL_ESC	The direct access interface FSM is moved into an invalid state upon local escalation.
OTP_CTRL.LCI.FSM.LOCAL_ESC	The life cycle interface FSM is moved into an invalid state upon local escalation.
OTP_CTRL.KDI.FSM.LOCAL_ESC	The key derivation interface FSM is moved into an invalid state upon local escalation.
OTP_CTRL.PART.FSM.LOCAL_ESC	The partition FSMs are moved into an invalid state upon local escalation.
OTP_CTRL.SCRMBL.FSM.LOCAL_ESC	The scramble datapath FSM is moved into an invalid state upon local escalation.
OTP_CTRL.TIMER.FSM.LOCAL_ESC	The background check timer FSM is moved into an invalid state upon local escalation.
OTP_CTRL.DAI.FSM.GLOBAL_ESC	The direct access interface FSM is moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.LCI.FSM.GLOBAL_ESC	The life cycle interface FSM is moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.KDI.FSM.GLOBAL_ESC	The key derivation interface FSM is moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.PART.FSM.GLOBAL_ESC	The partition FSMs are moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.SCRMBL.FSM.GLOBAL_ESC	The scramble datapath FSM is moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.TIMER.FSM.GLOBAL_ESC	The background check timer FSM is moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.PART.DATA_REG.INTEGRITY	All partition buffer registers are protected with ECC on 64bit blocks.
OTP_CTRL.PART.DATA_REG.BKGN_CHK	The digest of buffered partitions is recomputed and checked at pseudorandom intervals in the background.
OTP_CTRL.PART.MEM.REGREN	Unbuffered ('software') partitions can be read-locked via a CSR until the next system reset.
OTP_CTRL.PART.MEM.SW_UNREADABLE	Secret buffered partitions become unreadable to software once they are locked via the digest.
OTP_CTRL.PART.MEM.SW_UNWRITABLE	All partitions become unwritable by software once they are locked via the digest.
OTP_CTRL.LC_PART.MEM.SW_NOACCESS	The life cycle partition is not directly readable nor writable via software.
OTP_CTRL.ACCESS.CTRL.MUBI	The access control signals going from the partitions to the DAI are MUBI encoded.
OTP_CTRL.TOKEN_VALID.CTRL.MUBI	The token valid signals going to the life cycle controller are MUBI encoded.
OTP_CTRL.LC_CTRL.INTERSIG.MUBI	The life cycle control signals are multibit encoded.
OTP_CTRL.TEST.BUS.LC_GATED	Prevent access to test signals and the OTP backdoor interface in non-test lifecycle states.
OTP_CTRL.TEST_TL_LC_GATE.FSM.SPARSE	The control FSM inside the TL-UL gating primitive is sparsely encoded.
OTP_CTRL.DIRECT_ACCESS.CONFIG.REGWEN	The direct access CSRs are REGWEN protected.
OTP_CTRL.CHECK_TRIGGER.CONFIG.REGWEN	The check trigger CSR is REGWEN protected.
OTP_CTRL.CHECK.CONFIG.REGWEN	The check CSR is REGWEN protected.
OTP_CTRL.MACRO.MEM.INTEGRITY	The OTP macro employs a vendor-specific integrity scheme at the granularity of the native 16bit OTP words. The scheme is able to at least detect single bit errors.
OTP_CTRL.MACRO.MEM.CM	The OTP macro may contain additional vendor-specific countermeasures.

Registers

Registers visible under device interface `core`

Summary
Name	Offset	Length	Description
otp_ctrl.INTR_STATE	0x0	4	Interrupt State Register
otp_ctrl.INTR_ENABLE	0x4	4	Interrupt Enable Register
otp_ctrl.INTR_TEST	0x8	4	Interrupt Test Register
otp_ctrl.ALERT_TEST	0xc	4	Alert Test Register
otp_ctrl.STATUS	0x10	4	OTP status register.
otp_ctrl.ERR_CODE	0x14	4	This register holds information about error conditions that occurred in the agents interacting with the OTP macro via the internal bus. The error codes should be checked if the partitions, DAI or LCI flag an error in the `STATUS` register, or when an `INTR_STATE.otp_error` has been triggered. Note that all errors trigger an otp_error interrupt, and in addition some errors may trigger either an fatal_macro_error or an fatal_check_error alert.
otp_ctrl.DIRECT_ACCESS_REGWEN	0x18	4	Register write enable for all direct access interface registers.
otp_ctrl.DIRECT_ACCESS_CMD	0x1c	4	Command register for direct accesses.
otp_ctrl.DIRECT_ACCESS_ADDRESS	0x20	4	Address register for direct accesses.
otp_ctrl.DIRECT_ACCESS_WDATA_0	0x24	4	Write data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is being written to.
otp_ctrl.DIRECT_ACCESS_WDATA_1	0x28	4	Write data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is being written to.
otp_ctrl.DIRECT_ACCESS_RDATA_0	0x2c	4	Read data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is read from.
otp_ctrl.DIRECT_ACCESS_RDATA_1	0x30	4	Read data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is read from.
otp_ctrl.CHECK_TRIGGER_REGWEN	0x34	4	Register write enable for `CHECK_TRIGGER`.
otp_ctrl.CHECK_TRIGGER	0x38	4	Command register for direct accesses.
otp_ctrl.CHECK_REGWEN	0x3c	4	Register write enable for `INTEGRITY_CHECK_PERIOD` and `CONSISTENCY_CHECK_PERIOD`.
otp_ctrl.CHECK_TIMEOUT	0x40	4	Timeout value for the integrity and consistency checks.
otp_ctrl.INTEGRITY_CHECK_PERIOD	0x44	4	This value specifies the maximum period that can be generated pseudo-randomly. Only applies to the HW_CFG and SECRET* partitions once they are locked.
otp_ctrl.CONSISTENCY_CHECK_PERIOD	0x48	4	This value specifies the maximum period that can be generated pseudo-randomly. This applies to the LIFE_CYCLE partition and the HW_CFG and SECRET* partitions once they are locked.
otp_ctrl.VENDOR_TEST_READ_LOCK	0x4c	4	Runtime read lock for the VENDOR_TEST partition.
otp_ctrl.CREATOR_SW_CFG_READ_LOCK	0x50	4	Runtime read lock for the CREATOR_SW_CFG partition.
otp_ctrl.OWNER_SW_CFG_READ_LOCK	0x54	4	Runtime read lock for the OWNER_SW_CFG partition.
otp_ctrl.VENDOR_TEST_DIGEST_0	0x58	4	Integrity digest for the VENDOR_TEST partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the VENDOR_TEST partition is locked and the digest becomes visible in this CSR.
otp_ctrl.VENDOR_TEST_DIGEST_1	0x5c	4	Integrity digest for the VENDOR_TEST partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the VENDOR_TEST partition is locked and the digest becomes visible in this CSR.
otp_ctrl.CREATOR_SW_CFG_DIGEST_0	0x60	4	Integrity digest for the CREATOR_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the CREATOR_SW_CFG partition is locked and the digest becomes visible in this CSR.
otp_ctrl.CREATOR_SW_CFG_DIGEST_1	0x64	4	Integrity digest for the CREATOR_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the CREATOR_SW_CFG partition is locked and the digest becomes visible in this CSR.
otp_ctrl.OWNER_SW_CFG_DIGEST_0	0x68	4	Integrity digest for the OWNER_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the OWNER_SW_CFG partition is locked and the digest becomes visible in this CSR.
otp_ctrl.OWNER_SW_CFG_DIGEST_1	0x6c	4	Integrity digest for the OWNER_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the OWNER_SW_CFG partition is locked and the digest becomes visible in this CSR.
otp_ctrl.HW_CFG_DIGEST_0	0x70	4	Integrity digest for the HW_CFG partition. The integrity digest is 0 by default. The digest calculation can be triggered via the `DIRECT_ACCESS_CMD`. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.
otp_ctrl.HW_CFG_DIGEST_1	0x74	4	Integrity digest for the HW_CFG partition. The integrity digest is 0 by default. The digest calculation can be triggered via the `DIRECT_ACCESS_CMD`. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.
otp_ctrl.SECRET0_DIGEST_0	0x78	4	Integrity digest for the SECRET0 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the `DIRECT_ACCESS_CMD`. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.
otp_ctrl.SECRET0_DIGEST_1	0x7c	4	Integrity digest for the SECRET0 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the `DIRECT_ACCESS_CMD`. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.
otp_ctrl.SECRET1_DIGEST_0	0x80	4	Integrity digest for the SECRET1 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the `DIRECT_ACCESS_CMD`. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.
otp_ctrl.SECRET1_DIGEST_1	0x84	4	Integrity digest for the SECRET1 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the `DIRECT_ACCESS_CMD`. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.
otp_ctrl.SECRET2_DIGEST_0	0x88	4	Integrity digest for the SECRET2 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the `DIRECT_ACCESS_CMD`. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.
otp_ctrl.SECRET2_DIGEST_1	0x8c	4	Integrity digest for the SECRET2 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the `DIRECT_ACCESS_CMD`. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.
otp_ctrl.SW_CFG_WINDOW	0x1000	2048	Any read to this window directly maps to the corresponding offset in the creator and owner software config partitions, and triggers an OTP readout of the bytes requested. Note that the transaction will block until OTP readout has completed.

otp_ctrl.INTR_STATE @ 0x0

Interrupt State Register

Reset default = 0x0, mask 0x3

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16

15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
														otp_error	otp_operation_done

Bits Type Reset Name Description

rw1c

0x0

otp_operation_done

A direct access command or digest calculation operation has completed.

rw1c

0x0

otp_error

An error has occurred in the OTP controller. Check the ERR_CODE register to get more information.

otp_ctrl.INTR_ENABLE @ 0x4

Interrupt Enable Register

Reset default = 0x0, mask 0x3

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16

15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
														otp_error	otp_operation_done

Bits Type Reset Name Description

0x0

otp_operation_done

Enable interrupt when INTR_STATE.otp_operation_done is set.

0x0

otp_error

Enable interrupt when INTR_STATE.otp_error is set.

otp_ctrl.INTR_TEST @ 0x8

Interrupt Test Register

Reset default = 0x0, mask 0x3

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16

15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
														otp_error	otp_operation_done

Bits Type Reset Name Description

0x0

otp_operation_done

Write 1 to force INTR_STATE.otp_operation_done to 1.

0x0

otp_error

Write 1 to force INTR_STATE.otp_error to 1.

otp_ctrl.ALERT_TEST @ 0xc

Alert Test Register

Reset default = 0x0, mask 0x1f

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16

15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
											recov_prim_otp_alert	fatal_prim_otp_alert	fatal_bus_integ_error	fatal_check_error	fatal_macro_error

Bits

Type

Reset

Name

Description

0x0

fatal_macro_error

Write 1 to trigger one alert event of this kind.

0x0

fatal_check_error

Write 1 to trigger one alert event of this kind.

0x0

fatal_bus_integ_error

Write 1 to trigger one alert event of this kind.

0x0

fatal_prim_otp_alert

Write 1 to trigger one alert event of this kind.

0x0

recov_prim_otp_alert

Write 1 to trigger one alert event of this kind.

otp_ctrl.STATUS @ 0x10

OTP status register.

Reset default = 0x0, mask 0x1ffff

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
															CHECK_PENDING
15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
DAI_IDLE	BUS_INTEG_ERROR	KEY_DERIV_FSM_ERROR	SCRAMBLING_FSM_ERROR	LFSR_FSM_ERROR	TIMEOUT_ERROR	LCI_ERROR	DAI_ERROR	LIFE_CYCLE_ERROR	SECRET2_ERROR	SECRET1_ERROR	SECRET0_ERROR	HW_CFG_ERROR	OWNER_SW_CFG_ERROR	CREATOR_SW_CFG_ERROR	VENDOR_TEST_ERROR

Bits Type Reset Name Description

0x0

VENDOR_TEST_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

0x0

CREATOR_SW_CFG_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

0x0

OWNER_SW_CFG_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

0x0

HW_CFG_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

0x0

SECRET0_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

0x0

SECRET1_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

0x0

SECRET2_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

0x0

LIFE_CYCLE_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

0x0

DAI_ERROR

Set to 1 if an error occurred in the DAI. If set to 1, SW should check the ERR_CODE register at the corresponding index.

0x0

LCI_ERROR

Set to 1 if an error occurred in the LCI. If set to 1, SW should check the ERR_CODE register at the corresponding index.

0x0

TIMEOUT_ERROR

Set to 1 if an integrity or consistency check times out. This raises an fatal_check_error alert and is an unrecoverable error condition.

0x0

LFSR_FSM_ERROR

Set to 1 if the LFSR timer FSM has reached an invalid state. This raises an fatal_check_error alert and is an unrecoverable error condition.

0x0

SCRAMBLING_FSM_ERROR

Set to 1 if the scrambling datapath FSM has reached an invalid state. This raises an fatal_check_error alert and is an unrecoverable error condition.

0x0

KEY_DERIV_FSM_ERROR

Set to 1 if the key derivation FSM has reached an invalid state. This raises an fatal_check_error alert and is an unrecoverable error condition.

0x0

BUS_INTEG_ERROR

This bit is set to 1 if a fatal bus integrity fault is detected. This error triggers a fatal_bus_integ_error alert.

0x0

DAI_IDLE

Set to 1 if the DAI is idle and ready to accept commands.

0x0

CHECK_PENDING

Set to 1 if an integrity or consistency check triggered by the LFSR timer or via CHECK_TRIGGER is pending.

otp_ctrl.ERR_CODE @ 0x14

This register holds information about error conditions that occurred in the agents interacting with the OTP macro via the internal bus. The error codes should be checked if the partitions, DAI or LCI flag an error in the STATUS register, or when an INTR_STATE.otp_error has been triggered. Note that all errors trigger an otp_error interrupt, and in addition some errors may trigger either an fatal_macro_error or an fatal_check_error alert.

Reset default = 0x0, mask 0x3fffffff

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
		ERR_CODE_9			ERR_CODE_8			ERR_CODE_7			ERR_CODE_6			ERR_CODE_5...
15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
...ERR_CODE_5	ERR_CODE_4			ERR_CODE_3			ERR_CODE_2			ERR_CODE_1			ERR_CODE_0

Bits Type Reset Name Description

2:0

0x0

ERR_CODE_0

0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

5:3

0x0

ERR_CODE_1

0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

8:6

0x0

ERR_CODE_2

0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

11:9

0x0

ERR_CODE_3

0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.