Dead nozzle compensation

DEMANDE OU BREVET VOLUMINEUX

LA PRÉSENTE PARTIE DE CETTE DEMANDE OU CE BREVET COMPREND PLUS D’UN TOME.

CECI EST LE TOME 1 DE 4

CONTENANT LES PAGES 1 À 284

NOTE : Pour les tomes additionels, veuillez contacter le Bureau canadien des brevets

JUMBO APPLICATIONS/PATENTS

THIS SECTION OF THE APPLICATION/PATENT CONTAINS MORE THAN ONE VOLUME

THIS IS VOLUME 1 OF 4

CONTAINING PAGES 1 TO 284

NOTE: For additional volumes, please contact the Canadian Patent Office

NOM DU FICHIER / FILE NAME :

NOTE POUR LE TOME / VOLUME NOTE:

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

TITLE: DEAD NOZZLE COMPENSATION

FIELD OF INVENTION

The present invention relates to techniques for compensating for one or more dead nozzles in a multinozzle printhead.

The invention has primarily been developed for use with a printhead comprising one or more printhead modules constructed using microelectromechanical systems (MEMS) techniques, and will be described with reference to this application. However, it will be appreciated that the invention can be applied to other types of printing technologies in which analogous problems are faced.

BACKGROUND OF INVENTION

Manufacturing a printhead that has relatively high resolution and print-speed raises a number of problems.

Difficulties in manufacturing pagewidth printheads of any substantial size arise due to the relatively small dimensions of standard silicon wafers that are used in printhead (or printhead module) manufacture. For example, if it is desired to make an 8 inch wide pagewidth printhead, only one such printhead can be laid out on a standard 8-inch wafer, since such wafers are circular in plan. Manufacturing a pagewidth printhead from two or more smaller modules can reduce this limitation to some extent, but raises other problems related to providing a joint between adjacent printhead modules that is precise enough to avoid visible artefacts (which would typically take the form of noticeable lines) when the printhead is used. The problem is exacerbated in relatively high-resolution applications because of the tight tolerances dictated by the small spacing between nozzles.

The quality of a joint region between adjacent printhead modules relies on factors including a precision with which the abutting ends of each module can be manufactured, the accuracy with which they can be aligned when assembled into a single printhead, and other more practical factors such as management of ink channels behind the nozzles. It will be appreciated that the difficulties include relative vertical displacement of the printhead modules with respect to each other.

Whilst some of these issues may be dealt with by careful design and manufacture, the level of precision required renders it relatively expensive to manufacture printheads within the required tolerances. It would be desirable to provide a solution to one or more of the problems associated with precision manufacture and assembly of multiple printhead modules to form a printhead, and especially a pagewidth printhead.

In some cases, it is desirable to produce a number of different printhead module types or lengths on a substrate to maximise usage of the substrate’s surface area. However, different sizes and types of modules will have different numbers and layouts of print nozzles, potentially including different

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 horizontal and vertical offsets. Where two or more modules are to be joined to form a single printhead, there is also the problem of dealing with different seam shapes between abutting ends of joined modules, which again may incorporate vertical or horizontal offsets between the modules. Printhead controllers are usually dedicated application specific integrated circuits (ASICs) designed for specific use with a single type of printhead module, that is used by itself rather than with other modules. It would be desirable to provide a way in which different lengths and types of printhead modules could be accounted for using a single printer controller.

Printer controllers face other difficulties when two or more printhead modules are involved, especially if it is desired to send dot data to each of the printheads directly (rather than via a single printhead connected to the controller). One concern is that data delivered to different length controllers at the same rate will cause the shorter of the modules to be ready for printing before any longer modules. Where there is little difference involved, the issue may not be of importance, but for large length differences, the result is that the bandwidth of a shared memory from which the dot data is supplied to the modules is effectively left idle once one of the modules is full and the remaining module or modules is still being filled. It would be desirable to provide a way of improving memory bandwidth usage in a system comprising a plurality of printhead modules of uneven length.

In any printing system that includes multiple nozzles on a printhead or printhead module, there is the possibility of one or more of the nozzles failing in the field, or being inoperative due to manufacturing defect. Given the relatively large size of a typical printhead module, it would be desirable to provide some form of compensation for one or more “ dead” nozzles. Where the printhead also outputs fixative on a per-nozzle basis, it is also desirable that the fixative is provided in such a way that dead nozzles are compensated for.

A printer controller can take the form of an integrated circuit, comprising a processor and one or more peripheral hardware units for implementing specific data manipulation functions. A number of these units and the processor may need access to a common resource such as memory. One way of arbitrating between multiple access requests for a common resource is timeslot arbitration, in which access to the resource is guaranteed to a particular requestor during a predetermined timeslot.

One difficulty with this arrangement lies in the fact that not all access requests make the same demands on the resource in terms of timing and latency. For example, a memory read requires that data be fetched from memory, which may take a number of cycles, whereas a memory write can commence immediately. Timeslot arbitration does not take into account these differences, which may result in accesses being performed in a less efficient manner than might otherwise be the case. It would be desirable to provide a timeslot arbitration scheme that improved this efficiency as compared with prior art timeslot arbitration schemes.

Also of concern when allocating resources in a timeslot arbitration scheme is the fact that the priority of

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 an access request may not be the same for all units. For example, it would be desirable to provide a timeslot arbitration scheme in which one requestor (typically the memory) is granted special priority such that its requests are dealt with earlier than would be the case in the absence of such priority.

In systems that use a memory and cache, a cache miss (in which an attempt to load data or an instruction from a cache fails) results in a memory access followed by a cache update. It is often desirable when updating the cache'in this way to update data other than that which was actually missed. A typical example would be a cache miss for a byte resulting in an entire word or line of the cache associated with that byte being updated. However, this can have the effect of tying up bandwidth between the memory (or a memory manager) and the processor where the bandwidth is such that several cycles are required to transfer the entire word or line to the cache. It would be desirable to provide a mechanism for updating a cache that improved cache update speed and/or efficiency.

Most integrated circuits an externally provided signal as (or to generate) a clock, often provided from a dedicated clock generation circuit. This is often due to the difficulties of providing an onboard clock that can operate at a speed that is predictable. Manufacturing tolerances of such on-board clock generation circuitry can result in clock rates that vary by a factor of two, and operating temperatures can increase this margin by an additional factor of two. In some cases, the particular rate at which the clock operates is not of particular concern. However, where the integrated circuit will be writing to an internal circuit that is sensitive to the time over which a signal is provided, it may be undesirable to have the signal be applied for too long or short a time. For example, flash memory is sensitive to being written too for too long a period. It would be desirable to provide a mechanism for adjusting a rate of an on-chip system clock to take into account the impact of manufacturing variations on clockspeed.

One form of attacking a secure chip is to induce (usually by increasing) a clock speed that takes the logic outside its rated operating frequency. One way of doing this is to reduce the temperature of the integrated circuit, which can cause the clock to race. Above a certain frequency, some logic will start malfunctioning. In some cases, the malfunction can be such that information on the chip that would otherwise be secure may become available to an external connection. It would be desirable to protect an integrated circuit from such attacks.

In an integrated circuit comprising non-volatile memory, a power failure can result in unintentional behaviour. For example, if an address or data becomes unreliable due to falling voltage supplied to the circuit but there is still sufficient power to cause a write, incorrect data can be written. Even worse, the data (incorrect or not) could be written to the wrong memory. The problem is exacerbated with multiword writes. It would be desirable to provide a mechanism for reducing or preventing spurious writes when power to an integrated circuit is failing.

In an integrated circuit, it is often desirable to reduce unauthorised access to the contents of memory. This is particularly the case where the memory includes a key or some other form of security information

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 that allows the integrated circuit to communicate with another entity (such as another integrated circuit, for example) in a secure manner. It would be particularly advantageous to prevent attacks involving direct probing of memory addresses by physically investigating the chip (as distinct from electronic or logical attacks via manipulation of signals and power supplied to the integrated circuit).

It is also desirable to provide an environment where the manufacturer of the integrated circuit (or some other authorised entity) can verify or authorize code to be run on an integrated circuit.

Another desideratum would be the ability of two or more entities, such as integrated circuits, to communicate with each other in a secure manner. It would also be desirable to provide a mechanism for secure communication between a first entity and a second entity, where the two entities, whilst capable of some form of secure communication, are not able to establish such communication between themselves.

In a system that uses resources (such as a printer, which uses inks) it may be desirable to monitor and update a record related to resource usage. Authenticating ink quality can be a major issue, since the attributes of inks used by a given printhead can be quite specific. Use of incorrect ink can result in anything from misfiring or poor performance to damage or destruction of the printhead. It would therefore be desirable to provide a system that enables authentication of the correct ink being used, as well as providing various support systems secure enabling refilling of ink cartridges.

In a system that prevents unauthorized programs from being loaded onto or run on an integrated circuit, it can be laborious to allow developers of software to access the circuits during software development. Enabling access to integrated circuits of a particular type requires authenticating software with a relatively high-level key. Distributing the key for use by developers is inherently unsafe, since a single leak of the key outside the organization could endanger security of all chips that use a related key to authorize programs. Having a small number of people with high-security clearance available to authenticate programs for testing can be inconvenient, particularly in the case where frequent incremental changes in programs during development require testing. It would be desirable to provide a mechanism for allowing access to one or more integrated circuits without risking the security of other integrated circuits in a series of such integrated circuits.

In symmetric key security, a message, denoted by M, is plaintext. The process of transforming M into ciphertext C, where the substance of M is hidden, is called encryption. The process of transforming C back into M is called decryption. Referring to the encryption function as E, and the decryption function as D, we have the following identities:

E[M] = C

D[C] = M

Therefore the following identity is true:

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

DtÆ'tM]] = Μ

A symmetric encryption algorithm is one where:

• the encryption function E relies on key Ki, • the decryption function. D relies on key K₂, • K₂ can be derived from Ki, and • Ki can be derived from K₂.

In most symmetric algorithms, Ki equals K₂. However, even if Kj does not equal K₂, given that one key can be derived from the other, a single key K can suffice for the mathematical definition. Thus:

E_K[M\ = C

Z^[C] = M

The security of these algorithms rests very much in the key K. Knowledge of K allows anyone to encrypt or decrypt. Consequently K must remain a secret for the duration of the value of M. For example, M may be a wartime message My current position is grid position 123-456. Once the war is over the value of M is greatly reduced, and if K is made public, the knowledge of the combat unit's position may be of no relevance whatsoever. The security of the particular symmetric algorithm is a function of two things: the strength of the algorithm and the length of the key.

An asymmetric encryption algorithm is one where:

• the encryption function E relies on key Ki, • the decryption function D relies on key K₂, • K₂ cannot be derived from Ki in a reasonable amount of time, and • Ki cannot be derived from K₂ in a reasonable amount of time.

Thus:

E_KX[M\ = C

Z)^₂[C] = M

These algorithms are also called public-key because one key Kj can be made public. Thus anyone can encrypt a message (using Ki) but only the person with the corresponding decryption key (K₂) can decrypt and thus read the message.

In most cases, the following identity also holds:

Ej^LM] ⁼ C

D_Ki[C] = M

This identity is very important because it implies that anyone with the public key Ki can see M and know

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616 that it came from the owner of K2. No-one else could have generated C because to do so would imply knowledge of K₂. This gives rise to a different application, unrelated to encryption - digital signatures.

A number of public key cryptographic algorithms exist. Most are impractical to implement, and many generate a very large C for a given M or require enormous keys. Still others, while secure, are far too slow to be practical for several years. Because of this, many public key systems are hybrid - a public key mechanism is used to transmit a symmetric session key, and then the session key is used for the actual messages.

All of the algorithms have a problem in terms of key selection. A random number is simply not secure enough. The two large primes p and q must be chosen carefully - there are certain weak combinations that can be factored more easily (some of the weak keys can be tested for). But nonetheless, key selection is not a simple matter of randomly selecting 1024 bits for example. Consequently the key selection process must also be secure.

Symmetric and asymmetric schemes both suffer from a difficulty in allowing establishment of multiple relationships between one entity and a two or more others, without the need to provide multiple sets of keys. For example, if a main entity wants to establish secure communications with two or more additional entities, it will need to maintain a different key for each of the additional entities. For practical reasons, it is desirable to avoid generating and storing large numbers of keys. To reduce key numbers, two or more of the entities may use the same key to communicate with the main entity. However, this means that the main entity cannot be sure which of the entities it is communicating with. Similarly, messages from the main entity to one of the entities can be decrypted by any of the other entities with the same key. It would be desirable if a mechanism could be provided to allow secure communication between a main entity and one or more other entities that overcomes at least some of the shortcomings of prior art.

In a system where a first entity is capable of secure communication of some form, it may be desirable to establish a relationship with another entity without providing the other entity with any information related the first entity’s security features. Typically, the security features might include a key or a cryptographic function. It would be desirable to provide a mechanism for enabling secure communications between a first and second entity when they do not share the requisite secret function, key or other relationship to enable them to establish trust.

A number of other aspects, features, preferences and embodiments are disclosed in the Detailed Description of the Preferred Embodiment below.

SUMMARY OF THE INVENTION

In accordance with the invention, there is provided a method of compensating for an inoperative nozzle in a printhead, the method comprising the step of:

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 (a) mapping dot data intended for the inoperative nozzle into one or more operative nozzles of the printhead.

Preferably, step (a) includes the substep of mapping the dot data intended for the inoperative nozzle into a nozzle that will print a dot on print media close to a position at which the inoperative nozzle would have printed a dot had it been operative.

Preferably also, step (a) includes the substep of mapping tire dot data intended for the inoperative nozzle into a nozzle that will print a dot on print media immediately adjacent a position at which the inoperative nozzle would have printed a dot had it been operative.

In a preferred embodiment, step (a) includes the substeps of:

(i) determining one or more operative nozzles capable of printing a dot on print media close to a position at which the inoperative nozzle would have printed a dot had it been operative; and (ii) mapping the dot data from the inoperative nozzle to an operative nozzle determined in substep (i).

More preferably, in the event more than one operative nozzle is determined in substep (i), the dot data is remapped to one of the operative nozzles that will print a dot on print media closest to that which would have been printed by the inoperative nozzle.

It is preferred that during successive firings of the printhead, the dot data is remapped alternately to operative nozzles that will print a dot on print media either side of that which would have been printed by the inoperative nozzle.

In an alternative embodiment, during successive firings of the printhead, the dot data is remapped randomly, pseudo-randomly, or arbitrarily to operative nozzles that will print a dot on print media either side of that which would have been printed by the inoperative nozzle.

Preferably, the printhead including a plurality of sets of the nozzles for printing a corresponding plurality of channels of dot data, wherein step (a) includes the substep of mapping the dot data intended for the inoperative nozzle into one or more operative nozzles from the same set.

In one form, step (a) includes the substep of mapping the dot data into one or more operative nozzles that will print a dot on print media close to a position at which the inoperative nozzle would have printed a dot had it been operative.

In an alternative form, step (a) includes the substep of mapping the dot data intended for the inoperative nozzle into one or more operative nozzles including at least one nozzle from a different one of the sets.

In yet another embodiment, step (a) includes the substeps of:

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 determining which combination of one or more available operative nozzles near the inoperative nozzle will minimise perceived error in an image that the dot data forms part of, the determination being performed on the basis of a color model; and mapping the dot data intended for the inoperative nozzle to that combination of one or more operative nozzles.

Preferably, the inoperative nozzle is associated with a black print channel, and wherein step (a) includes remapping the dot data intended for the inoperative nozzle into a plurality of operative nozzles in other color channels to produce a process black output at or adjacent a location on print media where the inoperative nozzle would have deposited a droplet of a black printing substance in accordance with the dot data.

In a preferred embodiment, a plurality of dot data intended for a corresponding plurality of inoperative nozzles are mapped to operative nozzles.

In accordance with a second aspect of the invention, there is provided a printer controller configured to implement the method of the first aspect.

In accordance with a third aspect of the invention, there is provided a printer controller configured to implement the method of the first aspect to a printhead comprising a plurality of the nozzles.

In accordance with the invention, there is provided a method for outputting a portion of a dither matrix stored in a memory, comprising the step of:

(b) determining a start position and an end position in the memory;

(c) reading a plurality of dither values of the dither matrix from the memory, commencing at the start position; and (d) outputting a portion of the plurality of dither values read in step (b)

Preferably two or more dither matrices are stored in the memory. A plurality of dither values are read from at least two of die dither matrices with a single read. The matrices can be different sizes.

It is preferred that each read from the memory reads at least one, and preferably two or more, lines from one or more dither matrices.

The method can also be embodied in hardware.

It is also preferred that the memory is configurable to store different dither matrices for different color channels. It is particularly preferred that a single read of the memory loads a frill line for two or more dither matrices into a dither buffer. Typically, each dither matrix will be for a different color channel.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

In accordance with another aspect of the invention, there is provided a printer controller for supplying dot data to a printhead in a predetermined order, the printhead comprising at least a first printhead module having a plurality of rows of printing nozzles, the printer controller being configured to order and time the supply of the dot data to the first printhead module such that a relative skew between adjacent rows of printing nozzles on the at least one printhead module, in a direction normal to a direction of printing, is at least partially compensated for.

Preferably, the printer controller is configured to at least partially compensate for the relative skew between adjacent rows in each of a plurality of sets of the adjacent rows.

In a preferred embodiment, wherein the relative skew between each of the plurality of the sets of the adjacent rows is the same.

Preferably, the printer controller is configured to compensate for the skew by introducing a relative delay into the dot data destined for at least one of the rows of printing nozzles. More preferably, the printhead is configured to print the dots at a predetermined spacing across its width, and the delay introduced by the printer controller equates to an integral multiple of the spacing.

It is particularly preferred, that the printhead defines a printable region between printing boundaries. Nozzles of at least one of the rows of at least one of the at least one printhead modules are positioned outside the printable region due to the skew between adjacent rows of the nozzles on the at least one printhead module. The printer controller is configured to introduce a relative delay into the dot data supplied to at least one of the rows such that the nozzles outside the printable region do not print.

Preferably, the at least one printhead module includes at least one pair of adjacent rows of the nozzles such that each row of the pair is configured to print the same ink. The printhead is configured to provide the dot data to the pair of adjacent rows such that the dot data is shifted serially through the first of the rows then through the second of the rows, until the dot data has been supplied to all the nozzles. More preferably, the printhead is configured to provide the dot data to the pair of adjacent rows such that the dot data is shifted serially through the first of the rows in a first direction then looped back through the second of the rows in a second direction opposite the first, until the dot data has been supplied to all the nozzles.

Preferably, the printhead is configured to print a series of printhead-width rows of the dots, and wherein the first and second rows are configured to print odd and even dots, respectively, of the printhead-width rows, the printhead controller being configured to supply the one or more first rows with odd dot data and the one or more second rows with even dot data.

Preferably, the printhead has a plurality of the pairs of rows. The printer controller is configured to supply the dot data such that any relative skew between the first and second rows of each pair of rows, in a direction normal to a direction of printing, is at least partially compensated for.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

In one embodiment, each printhead module is configured to print a plurality of independent inks, and the nozzles in each row are configured to print in one of the inks. The printhead controller being configured to supply each of the inks to at least one row of at least one of the printhead modules.

Preferably, at least some of the printhead modules are of mutually unequal length, the printer controller being configured to order and time the supply of the dot data to the compensate for the unequal length.

It is also preferable that the printer controller is configured to at least partially compensate for any relative skew between adjacent rows of the nozzles on adjacent ones of the printhead modules.

In a preferred form of the invention, the printer controller is selectively configurable to compensate at least partially for a plurality of potential relative skews.

In one form, the controller is configured to compensate at least partly for a fixed amount of the skew.

In accordance with a further aspect, the invention comprises the printer engine comprising a printer controller according to the first aspect and a printhead, wherein the nozzles of the printhead are disposed in a printable region between printing boundaries of the printhead. The printhead includes at least one logical nozzle located outside the printable zone that can accept data but is not capable of printing. The logical nozzles are arranged to introduce a relative delay into the dot data supplied to at least one of the rows, such that dot data is supplied to the correct nozzles for printing.

In accordance with another aspect of the invention, there is provided a printer controller for supplying dot data to a printhead in a predetermined order, the printhead comprising at least first and second printhead modules, each comprising a plurality of printing nozzles and being disposed adjacent each other such that a printing width of the printhead is wider than a printing width of either of the printhead modules, the printer controller being configurable during or after manufacture to order and time supply of the dot data to the printhead modules such that any relative displacement between the printhead nozzles in a direction normal to the printhead printing width is at least partially compensated for.

Preferably, the printer controller is configurable to provide compensation for any of a plurality of different amounts of the relative displacement.

More preferably, where each of the printhead modules comprises a plurality of parallel rows of the printing nozzles, the printhead is configured such that each of the rows of each printhead module has a corresponding row in each of the other printhead modules. The printer controller is controllable to introduce a relative delay into the dot data supplied to one or more of the rows, thereby to provide the compensation.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

In a particularly preferred embodiment, where the printhead is configured to print the dots at a predetermined spacing in a direction in which print media is supplied for printing, the delay introduced by the printer controller equates to an integral multiple of the spacing during printing.

In accordance with a further aspect of the invention, there is a printer controller for supplying dot data to a printhead in a predetermined order, the printhead comprising at least first and second printhead modules, each of which comprises a plurality of printing nozzles and being disposed adjacent each other such that a printing width of the printhead is wider than a printing width of either of the printhead modules, the printer controller being configured to order and time supply of the dot data to the printhead modules in accordance with their respective widths, such that a difference in relative widths of the printhead modules is at least partially compensated for.

Preferably, each of the printhead modules comprises a plurality of rows of the printing nozzles, the controller being configured to supply the dot data to the rows of nozzles in serial form. More preferably, each of the printhead modules comprises one or more parallel pairs of the rows, the controller being configured to serially supply the data to a first of each of the rows of nozzles in the or each pair of rows, the data being serially clocked through the first row of the or each pair of rows, then through a second row of the or each pair or rows, until all printhead nozzles have received their respective data.

It is preferred that the data is clocked through the second row in a direction substantially opposite to that in which it was clocked through the first row.

In another aspect, there is provided a printer controller for supplying dot data to a printhead comprising at least one printhead module, the printer controller being configurable to supply the dot data to a selectable one of a plurality of potential printhead module types, each having a different number of nozzles for receiving the dot data.

Preferably, the printer controller includes non-volatile memory for storing at least one parameter value, the at least one parameter value determining which of the potential printhead types the printer controller has been configured to supply the dot data to.

More preferably, the printer controller is configurable to supply the dot data to the printhead module on the basis of one or more printer module widths indicated by the at least one parameter.

In a preferred embodiment, the printer controller is configurable to supply the dot data to a plurality of the printhead modules, on the basis of one or more widths of the printhead modules indicated by the at least one parameter.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

In accordance with a further aspect of the invention, there is provided a method of accounting for dead nozzle remapping in a multi-nozzle printhead, including remapping a fixative intended for a dot to be printed by the dead nozzle.

In one form, the remapping includes remapping the fixative to an operative nozzle to which dot data intended for the dead nozzle for printing at or adjacent a position at which the dead nozzle would have printed.

Alternatively, or in addition, the remapping includes preventing output of fixative onto the position where the dead nozzle would have printed a dot had it been operative.

In accordance with a further aspect of the invention, there is provided a method for arbitrating between a plurality of access requests issued in relation to a resource by a plurality of requestors, wherein each request can be one of at least two types, a first of the types having a higher latency associated with its performance than at least some of the other types, the method including the steps of:

(e) receiving a plurality of the access requests; (the requests are not placed anywhere, they are simply received) (f) maintaining a current pointer that points to a current timeslot in a timeslot list, and at least one lookahead pointer that points to a future timeslot in the timeslot list; and (g) in the event an access request as arbitrated via the lookahead pointer is of the first type, initiating performance of the access request earlier than the position in the list suggests it would be performed should it be started when the current pointer reached the timeslot.

Preferably, step (g) includes the substep of performing the access request indicated by the lookahead pointer immediately after the access request indicated by the current pointer is performed.

It is preferred that step (g) includes the substep of performing the access request indicated by the lookahead pointer immediately after the access request indicated by the current pointer is performed.

In a preferred embodiment, the number of timeslots between the timeslot indicated by the lookahead pointer and the timeslot indicated by the current pointer takes into account a latency difference between performing an access request of the first type and at least one of the other access request types.

In accordance with another aspect of the invention, there is provided an integrated circuit including:

a plurality of operative units, each of which is capable of issuing a request for access to a memory accessible by the integrated circuit; and an timeslot arbitrator for arbitrating between requests issued by the operative units for access to the memory, wherein each request can be one of at least two types, a first of the types having a higher latency associated with its performance than at least some of the other types, the timeslot arbitrator being configured to:

(h) receive a plurality of the access requests;

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616 (i) maintain a current pointer that points to a current timeslot in a timeslot list, and at least one lookahead pointer that points to a future timeslot in the timeslot list; and (j) in the event the access request as arbitrated via the lookahead pointer is of the first type, performing the access request earlier than the position in the list suggests it should be performed should it be started when the current pointer reached the timeslot.

Preferably, the first type of access request is a memory write request.

Preferably, the integrated circuit includes a memory interface unit operatively connected with, and under the control of, the timeslot arbitrator, and wherein the memory interface is operatively connected to:

one or more of the operative units via one or more communications buses, and the memory via a memory bus of greater width than the communications buses.

In a preferred form, the number of timeslots between the timeslot indicated by the lookahead pointer and the timeslot indicated by the current pointer takes into account a latency difference between performing an access request of the first type and at least one of access request types.

In accordance with a further aspect of the invention, there is provided a method of arbitrating between access requests from a plurality of requestors for access to a resource, wherein at least one of the requestors is defined as higher priority access to the resource, the method comprising the steps of:

(k) receiving a plurality of the access requests;

(l) in the event an access request from the at least one of the requestors is received, initiating performance of the access request in preference to the requestor as specified by the timeslot list and regardless of whether or not the at least one of the requestors is in the timeslot list.

Preferably, the at least one requestor requires lower latency access to the resource than at least one of the other requestors from which access requests can be received.

Preferably, the at least one requestor is a processor and/or the resource is a memory.

Preferably, step (1) includes the substep of performing the access request from the requestor immediately following completion of any cunent access request being reformed.

In a preferred form, step (1) is performed such that a frequency of the at least one requestor being granted preferential performance of its access requests is limited within a time period. More preferably, early performance of access requests from the at least one requestor is restricted to a maximum number of times within a predetermined number of timeslots.

Preferably, the requestors are hardware units on an integrated circuit and the method is implemented by a timeslot arbitrator unit on the integrated circuit.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

In accordance with another aspect of the invention, there is provided a method according to the third aspect, wherein each request can also be one of at least two types, a first of the types having a higher latency associated with its performance than at least some of the other types, the method including the steps of:

(m) receiving a plurality of the access requests;

(n) maintaining a current pointer that points to a current timeslot in the timeslot list, and at least one lookahead pointer that points to a future timeslot in the timeslot list; and (o) in the event an access request as arbitrated via the lookahead pointer is of the first type, initiating performance of the access request earlier than its position in the list suggests it should be performed should it be started when the current pointer reached the timeslot.

In accordance with another aspect of the invention, there is provided a method of updating a cache in an integrated circuit comprising:

the cache a processor connected to the cache via a cache bus;

a memory interface connected to the cache via a first bus and to the processor via a second bus, the first bus being wider than the second bus or the cache bus; and memory connected to the memory interface via a memory bus;

the method comprising the steps of:

(p) following a cache miss, using the processor to issue a request for first data via a first address, the first data being that associated with the cache miss;

(q) in response to the request, using the memory interface to fetch the first data from the memory, and sending the first data to the processor;

(r) sending, from the memory interface and via the first bus, the first data and additional data, the additional data being that stored in the memory adjacent the first data;

(s) updating the cache with the first data and the additional data via the first bus; and (t) updating flags in the cache associated with the first data and the additional data, such that the updated first data and additional data in the cache is valid.

Preferably, the processor is configured to attempt a cache update with the first data upon receiving it from the memory interface, the method further including the step of preventing the attempted cache update by the processor from being successful, thereby preventing interference with the cache update of steps (s) and/or (t).

More preferably, steps (r), (s), and (t) are performed substantially simultaneously.

In one embodiment, steps (s) and (t) are performed by the memory interface.

Preferably, steps (s) and (t) are performed in response to the processor attempting to update the cache following step (r). More preferably, the memory interface is configured to monitor the processor to determine when it attempts to update the cache following step (r).

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

In accordance with a further aspect of the invention, there is provided an integrated circuit, comprising a processor, an onboard system clock for generating a clock signal, and clock trim circuitry, the integrated circuit being configured to:

(u) receive an external signal;

(v) determine either the number of cycles of the clock signal during a predetermined number of cycles of the external signal, or the number of cycles of the external signal during a predetermined number of cycles of the clock signal;

(w) store a trim value in the integrated circuit, the trim value having been determined on the basis of the determined number of cycles; and (x) use the trim value to control the internal clock frequency.

Preferably, the integrated circuit is configured to, between steps (v) and (w):

output the result of the determination of step (v); and receive the trim value from an external source.

Preferably, the integrated circuit includes non-volatile memory, and (w) includes storing the trim value in the memory. More preferably, the memory is flash RAM.

In a preferred form step (x) includes loading the trim value from the memory into a register and using the trim value in the register to control a frequency of the internal clock.

In a preferred form, the trim value is determined and stored permanently in the integrated circuit. More preferably, the circuit includes one or more fuses that are intentionally blown following step (w), thereby preventing the stored trim value from subsequently being changed.

In a preferred embodiment, the system clock further includes a voltage controlled oscillator (VCO), an output frequency of which is controlled by the trim value. More preferably, the integrated circuit further includes a digital to analog convertor configured to convert the trim value to a voltage and supply the voltage to an input of the VCO, thereby to control the output frequency of the VCO.

Preferably, the integrated circuit is configured to operate under conditions in which the signal for which the number of cycles is being determined is at a considerably higher frequency than the other signal.

More preferably, the integrated circuit is configured to operate when a ratio of the number of cycles determined in step (v) and the predetermined number of cycles is greater than about 2. It is particularly preferred that the ratio is greater than about 4.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

Preferably, the integrated circuit is disposed in a package having an external pin for receiving the external signal. More preferably, the pin is a serial communication pin configurable for serial communication when the trim value is not being set

Preferably, the trim value was also determined on the basis of a compensation factor that took into account a temperature of the integrated circuit when the number of cycles are being determined.

Preferably, the trim value received was determined by the external source, the external source having determined the trim value including a compensation factor based on a temperature of the integrated circuit when the number of cycles are being determined.

Preferably, the trim value is determined by performing a number of iterations of determining the number of cycles, and averaging the determined number.

In accordance with a further aspect of the invention, there is provided an integrated circuit comprising a processor, non-volatile memory, an input for receiving power from a power supply and a power detection unit, wherein the integrated circuit is configured to enable multi-word writes to the non-volatile memory, the power detection unit being configured to:

monitor a quality of power supplied to the input;

in the event the quality of the power drops below a predetermined threshold, preventing subsequent words in any multi-word write currently being performed from being written to the memory.

Preferably, the integrated circuit is configured to prevent any further writes of any type to the memory once the quality is determined to have dropped below the threshold.

Preferably, the quality is a voltage.

Preferably, the memory is flash memory.

Preferably, the power detection unit is configured to provide a reset signal to at least some other circuits on the integrated circuit once any current writes have been finished.

In accordance with another aspect of the invention, there is provided an integrated circuit comprising a processor, a memory that the processor can access, a memory access unit for controlling accesses to the memory, an input for receiving power for the integrated circuit from an external power source, and a power detection unit, the power detection unit being configured to:

monitor a quality of power supplied to the input;

in the event the quality of the power drops below a predetermined threshold, disabling a power supply to circuitry for use in writing to the memory, such that the memory access unit’s ability to alter data in

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 the memory is disabled prior to address or data values to be written to the memory becoming unreliable due to failing power.

Preferably, the memory is flash memory and the power supply is one or more charge pump circuits. More preferably, a voltage output by the power supply falls fast enough that the voltage supplied to the flash memory becomes too low to enable a change in contents of the flash memory before the voltage levels of the address or data values become invalid.

Preferably, the integrated circuit is configured to cause a reset of at least some of the circuitry on the integrated circuit following disabling of the power supply.

More preferably, the integrated circuit is programmed or designed to have a variable delay between disabling of the power supply and causing the reset.

In accordance with a further aspect of the invention, there is provided an integrated circuit comprising a processor and memory, the memory storing a set of data representing program code and/or an operating value, wherein each bit of the data is stored as a bit/inverse-bit pair in corresponding pairs of physically adjacent bit cells in the memory.

Preferably, the integrated circuit further includes a memory management unit configured to receive a request for the set of data and to test, during processing of the request, whether the respective pairs of physically adjacent bit-cells that correspond to the set of data contain bit/inverse-bit pairs, thereby to confirm the validity of the set of data as stored in the memory. More preferably, the memory management unit is configured to store sets of data as sets of bit/inverse-bit pairs in the memory.

Preferably, the integrated circuit is selectively operable in either of first and second modes, wherein:

in the first mode, the memory management unit is configured to receive and process a request for the set of data, and to test, during processing of the request, whether the respective pairs of physically adjacent bit-cells corresponding to the set of data contain bit/inverse-bit pairs, thereby to confirm the validity of the set of data as stored in the memory; and in the second mode, the memory management unit is configured to receive and process a request for data stored in the memory, without testing whether pairs of physically adjacent bit-cells contain bit/inverse-bit pairs.

More preferably:

in the first mode, the memory management unit is configured to store a set of data associated with a memory write request as a corresponding set of bit/inverse-bit pairs, each of the bit/inverse-bit pairs being physically adjacent each other; and in the second mode, the memory management unit is configured to store a set of data associated with a memory write request as the set of data without corresponding inverse-bits.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

Preferably, the integrated circuit is configured to boot into the first mode by default.

Preferably, the integrated circuit is configured to implement a defensive action in the event the test fails.

More preferably, the defensive action includes resetting the integrated circuit.

In an alternative embodiment, the defensive reaction includes returning second data other than that the subject of the test.

Preferably, the second data is a string of identical digits.

Preferably, the defensive reaction is different depending upon whether the set of data represents program code or an operating value.

More preferably, in the event the test fails and the set of data is an operating value, the integrated circuit is configured to replace the failed value with a substitute value.

More preferably, the substitute value is selected to disrupt a program running on the integrated circuit.

Preferably, the substitute causes at least some circuitry on the integrated circuit to reset.

In a preferred embodiment, in the event the test fails, the integrated circuit is permanently prevented from running software.

Preferably, in the event the test fails, the integrated circuit is configured to delete from the memory some or all of the bit values associated with the set of data.

More preferably, in the event the test fails, the integrated circuit is configured to delete some or all of the contents of the memory.

In accordance with another aspect of the invention, there is provided an integrated circuit comprising a processor and memory storing:

secret information accessible via a first address, the secret information comprising a string of bit values;

an inverse-string accessible via a second address, the inverse-string comprising a string of bit values, wherein each of the bit values in the inverse-string is the logical inverse of a bit value at a corresponding bit position in the secret information, the integrated circuit being programmed with code configured to:

(i) receive a request for the secret information; and

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 (ii) test whether the bit-values of the inverse string are the inverse of the bit-values at respective corresponding bit positions of the secret information.

In accordance with a further aspect of the invention, there is provided a method of ensuring validity of secret information stored in a memory in the form of a string of bit values accessible via a first address, the memory also storing an inverse-string accessible via a second address, the inverse-string comprising a string of bit values that are the logical inverses of the bit values at corresponding respective bit positions of the secret information, the method including the steps of:

receiving a request for the secret information; and testing whether the bit-values of the inverse string are the inverse of the bit-values at respective corresponding bit positions of the secret information.

Preferably, the integrated circuit is configured and programmed to perform a defensive action in the event the test fails.

More preferably, the defensive action incudes deleting or destroying some or all of the contents of the memory in the event the test fails. Preferably, the defensive action includes deleting or destroying at least the secret information and/or the inverse string.

Preferably, the defensive action includes preventing the processor from executing software.

Preferably, the defensive action includes resetting some or all of logic on the integrated circuit.

Preferably, the first and second addresses are at the same address in the memory.

Preferably, the string and inverse string are stored at different sub-addresses within the same address.

In accordance with a further aspect of the invention, there is provided method of manufacturing a plurality of the integrated circuits, comprising the steps, for each of the plurality of integrated circuits, of:

storing the secret information and the inverse string at the first and second addresses in the memory of the integrated circuit; and storing the code on the integrated circuit;

wherein the first and second addresses are randomly, pseudo-randomly or arbitrarily selected for each of the integrated circuits and the code for each integrated circuit is customised to know the first and second addresses of its secret information and inverse string.

Preferably, the first and second addresses are restricted to one of two potential locations in the memory of each integrated circuit, the secret information and the inverse string for each integrated circuit being allocated to the first and second addresses randomly, pseudo-randomly or arbitrarily.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

More preferably, the secret information differs between at least two of the integrated circuits.

In accordance with another aspect of the invention, there is provided a plurality of integrated circuits, each of the integrated circuits comprising a processor and non-volatile memory, and including code for running identical software processes, wherein each of the integrated circuits also includes secret information used by the software process, the secret information in each chip being located in a different location in the memory relative to a plurality of the other chips.

Preferably, the code on each integrated circuit is such that the software process of each chip knows the location in memory via which the secret information is accessible.

In accordance with a further aspect of the invention, there is provided a method of manufacturing a plurality of the integrated circuits, including the steps of:

manufacturing a plurality of physical integrated circuits; and injecting, into the non-volatile memory of each of the integrated circuits:

code for running a software process; and secret information;

wherein the secret information is positioned in relatively different locations of the non-volatile memories and the code on each integrated circuit is such that the software process of each integrated circuit knows the location in memory via which the secret information is accessible on that integrated circuit.

In accordance with another aspect of the invention, there is provided an integrated circuit comprising a processor and non-volatile memory, the non-volatile memory storing a first number and a second number, wherein the second number is the result of an encryption function taking a third number and secret information as operands, the integrated circuit comprising software configured to decrypt the second number using the first number, thereby to determine the secret information as required.

Preferably, the first and third numbers are the same.

Preferably, the first and second numbers are of the same length.

Preferably, the first number is a random number that was generated using a stochastic process.

Preferably, the encryption function is an XOR logical function.

Preferably, the software is configured to decrypt the second number by performing an XOR logical function using the first and second numbers as operands.

In accordance with a further aspect of the invention, there is provided a method of manufacturing a plurality of integrated circuits in accordance with claim 1, including the steps, for each integrated circuit, of:

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616 determining the first number, the third number and the secret information;

generating the second number by way of an encryption function that uses the third number and the secret information as operands;

storing the first and second numbers on the integrated circuit.

Preferably, the first number is different amongst at least a plurality of the integrated circuits.

Preferably, the first numbers are determined randomly, pseudo-randomly, or arbitrarily.

Preferably, the first number is stored on the integrated circuit first, then extracted therefrom for use in generating the third and thence the second number.

In accordance with another aspect of the invention, there is provided a method of enabling authenticated communication of information between at least a primary entity and each of one or more secondary entities, each of the one or more secondary entities having an identifier associated with it, the method including the steps of:

allocating first secret information to the primary entity;

for each of the one or more secondary entities, determining second secret information, the second secret information being the result of a one way function applied to that second secret entity’s identifier and the first secret information;

allocating the second secret information to the or each secondary entity.

Preferably, the identifiers allocated to the secondary entities are generated stochastically, pseudo-randomly or arbitrarily.

Preferably, the one way function is a hash function.

Preferably, the first secret information is a key. More preferably, the one way function is a SHA function.

Preferably, each of the entities is implemented in an integrated circuit.

Preferably, each of the entities is implemented in an integrated circuit separate from the integrated circuits in which the other entities are implemented.

Preferably, one or more of the secondary entities are implemented in a corresponding plurality of integrated circuits.

Preferably, the primary entity is implemented in an integrated circuit.

Preferably, both the primary and secondary entities are implemented in integrated circuits.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

Preferably, the first entity wishes to communicate with one of the second entities, the method including the steps, in the first entity, of:

receiving data from the second entity;

using the data and the first secret information to generate the second secret information associated with the second entity.

Preferably, the data contains an identifier for the second entity

Preferably, the first entity wishes to send an authenticated message to the second entity, the method including the steps, in the first entity, of:

using the generated second secret information to sign a message, thereby generating a digital signature;

outputting the message and the digital signature for use by the second entity, which can validate the message by using the digital signature and its own copy of the second secret information.

Preferably, the generated signature includes a nonce from the first entity, and the output from the first entity includes the nonce, thereby enabling the second entity to validate the message using the digital signature, the nonce, and its own copy of the second secret information.

Preferably, the data contains a first nonce.

Preferably, the first entity wishes to send an authenticated message to the second entity, the method including the steps, in the first entity, of:

using the generated second secret information and the first nonce to sign a message, thereby generating a digital signature;

outputting the message and the digital signature for use by the second entity, which can validate the message by using the digital signature and its own copy of the second secret information.

Preferably, the generated signature includes a second nonce from the first entity, and the output from the first entity includes the second nonce, thereby enabling the second entity to validate the message using the digital signature, the first and second nonces, and its own copy of the second secret information.

Preferably, the first entity wishes to send an encrypted message to the second entity, the method including the steps, in the first entity, of:

using the generated second secret information to encrypt a message, thereby generating an encrypted message;

outputting the encrypted message for use by the second entity, which can decrypt the message by using its own copy of the second secret information.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

Preferably, the encrypted message includes a nonce from the first entity, and the output from the first entity includes the nonce, thereby enabling the second entity to decrypt the message using the nonce, and its own copy of the second secret information.

Preferably, the first entity wishes to send an encrypted message that incorporates the first nonce to the second entity, the method including the steps, in the first entity, of:

using the generated second secret information to encrypt a message and the first nonce, thereby generating an encrypted message;

outputting the encrypted message for use by the second entity, which can decrypt the encrypted message by using its own copy of the second secret information.

Preferably, the encrypted message includes a second nonce from the first entity, and the output from the first entity includes the second nonce.

In accordance with another aspect of the invention, there is provided a method of generating and sending a message from a first entity, the method including the steps of:

determining a message including an action;

generating an authentication code on the basis of the action and a parameter, the parameter being indicative of an attribute of the action; and sending the message and authentication code from the first entity.

In accordance with a further aspect of the invention, there is provided a method of generating and sending a message from a first entity, the first entity including an identifier that distinguishes it from a plurality of other entities of a similar type, the method comprising the steps of:

determining a message including an action;

generating an authentication code on the basis of the action and a parameter, the parameter being based on the identifier; and sending the message and authentication code from the first entity.

Preferably, the action is a function, and the parameter is indicative of the function.

More preferably, the entity is capable of generating messages for each of a plurality of types of function, and the parameter is indicative of the type of function comprised by the message that is sent.

Preferably, the message includes one or more operands of the function.

Preferably, the function is a read function and the one or more operands include an address to be read.

Preferably, the function is a write function and the one or more operands include data to be written.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

Preferably, the types of function include at least a read and a write, wherein the authentication step produces a different authentication code depending upon whether the action is a read or a write.

Preferably, the authentication step produces includes authentication codes

In accordance with another aspect of the invention, there is provided a method of generating a first authentication code for a first message for a first function, wherein operands for the first authentication function used to generate the first authentication code include at least part of the first message and at least one identifier associated with the first function,

Preferably, the method further including the steps of verifying the authentication code in accordance with the at least one identifier associated with the first function.

Preferably, the identifier is indicative of a type of the function.

Preferably, the at least one identifier is indicative of the entity generating the authentication code.

Preferably, the at least one identifier is indicative of an entity for which the authentication code is generated.

Preferably, the method includes the step, prior to generating the authentication code, of receiving a request from the entity for the first message, the request including information indicative of an identity of the entity.

In accordance with another aspect of the invention, there is provided a method of preventing a first action associated with a first message from being performed in a target entity, the method including the steps of: sending the first message to the target entity, the first message being configured to cause the entity to perform the first action and a second action; and sending a second message to the target entity, the second message being configured to cause the entity to perform a third action;

wherein the entity is configured such that performance of the second action and the third action is mutually incompatible.

In accordance with a further aspect of the invention, there is provided a method of attempting first write and a second write to first and second security fields in a target entity, the method including the steps of:

sending a first message to the target entity, the first message being configured to cause the entity to perform an action and to update the first and second security fields; and sending a second message to the target entity, the second message being configured to cause the entity to update the first and second security fields;

wherein the security fields have write restrictions associated with them such that updating the security fields in accordance with the first message prevents subsequent updating of the security fields in accordance with the second message, and wherein updating the security fields in accordance with the second

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 message prevents subsequent updating of the security fields with the first message, and wherein the first action is only performed when updating of the security fields by the first message is successful.

In accordance with a further aspect of the invention, there is provided a method of performing a second attempted write to two security fields in a target entity to prevent subsequent application of an earlier attempted write to a data field, wherein:

each of the first and second security fields has a monotonically changeable write restriction associated with it; and the first attempted write included a first data value for the data field and first and second security values for the first and second security fields respectively;

the method including the step of sending a second write to the target entity, the second write including third and fourth security values for the first and second security fields respectively, wherein the write restrictions are such that application of the third and fourth security values to the first and second fields are mutually incompatible with application of the first and second security values to the first and second security fields, such that if any of the fields cannot be written to, none of them are written to.

Preferably, the write restrictions:

prevent the second write from being performed in the event that the first write was previously performed; and prevent the first write from subsequently being performed in the event that the second write is performed.

Preferably, the second write is sent in response to a notification that the first write was not successfully performed.

Preferably, the second write is sent in response to a notification that the first write was not received.

Preferably, the second write is sent after a predetermined time has elapsed after sending the first write without receiving confirmation of the first write being received or successfully performed.

Preferably, the method further includes the step of sending the second write a plurality of times until the second write is successfully received and/or performed.

Preferably, the method further includes the step of verifying the successful second write by performing an authenticated read of the first and second security fields.

Preferably, the method further includes updating a value related to the data field.

Preferably, the write permissions are such that only decrementing or incrementing of the security fields are permitted.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

More preferably, the write permissions are such that only decrementing of the security fields is permitted, and wherein:

the value in the first security field prior to the first attempted write was x;

the value in the second security field prior to the first attempted write was y;

the value of the first security data was x-a;

the value of the second security data was y-b;

the value of the third security data being x-c; and the value of the fourth security data being y-d;

wherein a<b, d<c and a, b, c and d are >0.

It is particularly preferable that a=d and b=c, and even more preferable that a=d=l and b=c=2.

Preferably, the target entity is a first integrated circuit and the messages are sent by a second integrated circuit.

In accordance with another aspect of the invention, there is provided a method of enabling selection of one or more pieces of secret information stored in a first entity, the first entity also storing at least one value indicative of at least one attribute for each of the one or more pieces of secret information, the method comprising the steps of:

(y) receiving at the first entity a request from a second entity for one or more of the values for one or more of the pieces of secret information stored in the first entity; and (z) in response to the request, outputting the values to the second entity.

Preferably, each of the pieces of secret information has an associated index and the request in step (y) includes one or more of the indexes to identify those pieces of secret information for which the values are requested.

Preferably, the request in step (y) is a request for the values all of the pieces of secret information and the response in step (z) orders the values such that the second entity can determine which values are associated with which piece of secret information, and can use the order to generate an index for the secret information.

Preferably, the method further includes the steps, in the first entity and following step (z), of:

(iii) receiving a request from the second entity identifying a function and identifying the index of a piece of secret information to be used in performing the function; and (iv) performing the function using the identified piece of secret information.

Preferably, the method further includes the steps, in the first entity and following step (z), of:

(v) receiving a request from the second entity identifying a function and a piece of secret information to be used in performing the function; and

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 (vi) performing the function using at least the identified piece of secret information, the identified piece of secret information being identified in the request of step (v) on the basis of at least one of the values output in step (z).

Preferably, the secret information is stored in one or more physical locations of the first entity, and wherein the values are not indicative of those physical locations.

Preferably, the first entity is implemented in a first integrated circuit and the second entity is implemented in a second integrated circuit.

Preferably, the first integrated circuit includes a memory for storing the pieces of secret information and the values.

Preferably, there is a plurality of the first integrated circuits, wherein the physical location of a piece of the secret information having particular attributes is mutually different for at least some of the first integrated circuits.

Preferably, each of the pieces of secret information is a key for use with a corresponding authentication, encryption or decryption function.

Preferably, the integrated circuit is programmed and configured to apply at least one of the authentication, encryption or decryption functions to data using the corresponding key as an operand.

Preferably, the attribute stored for at least one of the pieces of secret information is the length of that at least one of the pieces of secret information.

Preferably, the attribute stored for at least one of the pieces of secret information is the authentication, encryption or decryption type associated with that at least one of the pieces of secret information.

Preferably, the attribute value stored for at least one of the pieces of secret information is indicative of a permission associated with that at least one of the pieces of secret information.

In accordance with a further aspect of the invention, there is provided a system including first and second integrated circuits, the first integrated circuit implementing the first entity of claim 1, the second integrated circuit being programmed and configured to issue a request to the first integrated circuit for attribute values of any secret information stored by the first integrated circuit, and the first integrated circuit being programmed and configured to respond to the request by supplying the attribute values of the pieces of secret information to the external source.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

Preferably, the second integrated circuit is a printer controller chip and the first integrated circuit is a peripheral chip in communication with the printer controller.

Preferably, the printer controller chip is installed in a printer and the peripheral chip is in a package that is releasably attachable to the printer via a connector, the connector enabling communication between the printer controller chip and the peripheral chip.

Preferably, the printer controller chip and the peripheral chip are installed in a printer.

Preferably, the package is an ink refill cartridge.

Preferably, the package is a performance setting cartridge configured to set a performance level of the printer.

Preferably, in the event at least one of the pieces of secret information can be altered or updated, the first integrated circuit is configured to alter the attribute values associated with that at least one piece of secret information as required by the alteration or update such that the update or alteration of the at least one piece of secret information and its associated attributes is atomic.

In accordance with another aspect of the invention, there is provided an integrated circuit including an onboard system clock, the integrated circuit including a clock filter configured to determine a temperature of the integrated circuit and to alter an output of the system clock based on the temperature.

Preferably, the clock filter is configured to alter the output of the system clock in the event the temperature is outside a predetermined temperature range.

More preferably, altering the output includes preventing the clock signal from reaching one or more logical circuits on the integrated circuit to which it would otherwise be applied.

It is particularly preferred that the predetermined temperature range is selected such that a temperature-related speed of the system clock output that is not due to the clock filter is within a predetermined frequency range.

It is desirable that the frequency range be within an operating frequency of some or all of the logic circuitry to which the system clock is supplied.

In the preferred form of the invention, the clock filter is configured to prevent the system clock from reaching some or all of the logic circuitry in the event the temperature falls below a predetermined level. This level is chosen to be high enough that race conditions, in which the clock speeds up to the point where logic circuitry behaviour becomes unpredictable, are avoided.

In accordance with another aspect of the present invention, there is provided a method of manufacturing a series of integrated circuits having related functionality, the method including the steps of:

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616 (vii) determining an identifier;

(viii) permanently storing the identifier on one of the integrated circuits;

(ix) repeating steps (vii) and (viii) for each integrated circuit in the series;

wherein the identifiers for the series are determined in such a way that knowing the identifier of one of the integrated circuits does not improve the ability of an attacker to determine the identifier of any of the other integrated circuits.

Preferably, the identifier for each integrated circuit is determined using a stochastic mechanism, thereby rendering highly improbable the replication of some or all of the series of identifiers stored on the series of the integrated circuits.

In accordance with another aspect of the invention, there is provided a series of integrated circuits having related functionality, wherein each of the integrated circuits incorporates an identifier determined and stored in accordance with the first aspect.

Preferably, each of the integrated circuits is a printer controller.

In accordance with another aspect of the invention, there is provided a first integrated circuit of a series of integrated circuits according to the second aspect, operable in first and second mode, wherein in the first mode, supervisor code can access the identifier and in the second mode, user code cannot access the identifier.

Preferably, the supervisor mode is available to a program upon verification of that program by a boot program of the integrated circuit.

Preferably, the identifier is mapped into a key K.

Preferably, K is the identifier.

Preferably, K is created by applying a hash function or one-way function to the identifier.

Preferably, the integrated circuit is configured to produce and output a message, the message including a result of encrypting K.

In accordance with another aspect of the invention, there is provided a method of injecting a key into a target integrated circuit, comprising the step of receiving the message generated by the first integrated circuit of claim 10, and transferring a second key into the target integrated circuit, the second key being based on K.

Preferably, the method includes generating the second key by manipulating K with a function.

More preferably, the function uses K and a code associated with the target integrated circuit as operands.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

Preferably, the code is a code that is relatively unique to the target integrated circuit.

Preferably, K and the second key enable secure communication between the first integrated circuit and the target integrated circuit.

Preferably, the second integrated circuit is configured to communicate securely with a third integrated circuit, thereby enabling it to act as an intermediary between the first integrated circuit and the third integrated circuit, allowing secure communication therebetween.

Preferably, the first integrated circuit and the third integrated circuit do not share a key for use in the secure communication.

Preferably, the first integrated circuit is a printer controller configured to perform an authenticated read of the third integrated circuit by securely communicating via the second integrated circuit.

Preferably, the authenticated read relates to monitoring or updating usage of a resource.

In accordance with another aspect of the invention,, there is provided a method of enabling software development for an integrated circuit, the integrated circuit being configured to run a boot program that prevents unverified software from subsequently being loaded onto, or run by, the integrated circuit, the method including the step of loading an intermediate program onto the integrated circuit, the intermediate program being customised for a particular one or more of a plurality of potential integrated circuits that, when run on the processor, enables loading or running of code on only the particular one or more integrated circuits.

Preferably, the intermediate program enables the loading or running of unverified code on only the particular one or more integrated circuits.

Preferably, the intermediate program enables the loading or running of the code only when the code includes data indicative of the particular one or more integrated circuits.

Preferably, the intermediate program includes an intermediate boot key, such that the intermediate program enables loading or running of the code only when the code is verified in accordance with the intermediate boot key.

In accordance with another aspect of the invention, there is provided an integrated circuit configured to run a boot program that prevents unverified software from subsequently being loaded onto, or run by, the integrated circuit.

Preferably, the integrated circuit is programmed with program code configured to:

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616 receive software data and a digital signature of the software data generate a first digest from the software data; and compare the first digest against a second digest obtained via the digital signature that accompanied the received software data;

wherein the program is considered valid when the first and second digests match.

Preferably, one or both of the digests were generated using a SHA1 function.

Preferably, the boot program contains a plurality of keys, and one of the keys is selected for use in generating the first digest, the key being selected in accordance with a selection criterion.

Preferably, the selection criterion is time-based, a particular one of the keys being selected depending on the time the selection is made.

Preferably, the selection criteria relates to a physical arrangement or configuration of the integrated circuit.

Preferably, the physical arrangement or configuration includes one or more of the following:

one or more pads wired to a reference voltage or to ground;

one or more fuses, one or more of which has been blown; or the contents of non-volatile memory.

Preferably, the integrated circuit is programmed with program code configured to:

receive encrypted software data, decrypt the software data; and validate the software data;

wherein the decrypted software is executed only when the validation is successful.

Preferably, the encryption function is RSA.

Preferably, the boot program contains a plurality of keys, and one of the keys is selected for use in decrypting the software data, the key being selected in accordance with a selection criterion.

Preferably, the selection criterion is time-based, a particular one of the keys being selected depending on the time the selection is made.

Preferably, the selection criteria relates to a physical arrangement or configuration of the integrated circuit.

Preferably, the physical arrangement or configuration includes one or more of the following:

one or more pads wired to a reference voltage or to ground;

one or more fuses, one or more of which has been blown; or

CA 02508141 2005-06-01

WO 2004/050369 , PCT/AU2003/001616 the contents of non-volatile memory.

In accordance with a further aspect of the invention, there is provided a method of passing validated information along a series of entities, the series of entities including a source entity, a series of at least one intermediate entity, and a target entity, wherein each of the entities shares a validation parameter with its immediately neighbouring entity or entities in the series, the method comprising the steps, commencing in the source entity, of:

(x) in the current entity, generating a validation code for the information, the validation code being based on the validation parameter shared between the current entity and the next entity in the series;

(xi) outputting the validation code;

(xii) receiving the validation code in the next entity in the series and making that entity the cunent entity; (xiii) verifying the information via the validation code in the current entity using the validation parameter required to verify it;

(xiv) repeating steps (x) to (xi) until the last intermediate entity in the series has output the validation code it generated;

(xv) receiving the validation code in the target entity and verifying the information via the validation code and the validation parameter required to verify it.

Preferably, step (xi) includes the substep of outputting the information.

Preferably, step (xv) includes receiving the information and using it during the verification.

Preferably, step (xii) includes receiving the information and using it during the verification.

Preferably, a controller is in contact with at least some of the entities, the controller being configured to pass the information and/or the validation codes between adjacent entities in the series.

Preferably, step (x) is performed in response to an instruction issued by the controller.

Preferably, the instruction includes a request for the information upon which the validation is to be performed.

Preferably, the validation code is a digital signature produced by a digital signature function using the information and the validation parameter as operands.

Preferably, the validation parameter is a key

Preferably, the key is a symmetric key

Preferably, the validation parameter is an asymmetric key-pair, and the public and private components of the key-pair are in respective neighbouring entities in the series.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

Preferably, the validation code is a digital signature generated with a digital signature function using the key or key-pair component, the information and at least one nonce as inputs.

Preferably, the at least one nonce is generated in the current entity in response to an instruction issued by the neighbouring entity of the current entity closer to the target entity.

Preferably, the at least one nonce is randomly, pseudo-randomly or arbitrarily generated number.

Preferably, the at least one nonce is supplied to the current entity in an instruction issued by the neighbouring entity of the current entity closer to the target entity.

Preferably, the nonce is randomly, pseudo-randomly or arbitrarily generated number.

Preferably, a different validation parameter is used for the validation step performed at any two adjacent entities.

Preferably, at least one of the entities is an integrated circuit.

Preferably, the target entity is a printer controller integrated circuit.

Preferably, the source entity is a printer controller integrated circuit.

Preferably, either the source entity or the target entity is a printer controller integrated circuit and the at least one intermediate entity is a verification chip associated with the printer controller.

Preferably, the controller is a printer controller integrated circuit.

Preferably, one of the entities is the controller.

Preferably, the printer controller has a relatively unique identity and the verification chip includes a key based on the unique identity.

Preferably, the source or target entity is an integrated circuit associated with a package that contains ink.

In accordance with a further aspect of the invention, there is provided an integrated circuit incorporating microelectromechanical systems (MEMS), having a total area greater than an area of at least one of the reticles used to manufacture it.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

Preferably, the integrated circuit includes a stitch region where the multiple reticle fields overlapped during manufacturing of the integrated circuit.

Preferably, the surface area of the integrated circuit is larger than a single stepping field of a reticle used to manufacture the integrated circuit.

In accordance with another aspect of the invention, there is provided an integrated circuit according to the first aspect, manufactured using at least two different types of reticles.

Preferably, the integrated circuit is manufactured using multiple applications of the same reticle.

Preferably, the integrated circuit is a printhead.

In accordance with a further aspect of the invention, there is provided a method of manufacturing an integrated circuit incorporating MEMS, comprising laying out the integrated circuit using a plurality of overlapping reticles.

Preferably, the overlapping reticles are the same as each other.

Preferably, the reticles are different to each other.

Preferably, the reticles are different lengths.

Preferably, a plurality of the integrated circuits are manufactured on a single substrate wafer, wherein each of the integrated circuits is manufactured incorporating MEMS, comprising laying out of the integrated circuit using a plurality of overlapping reticles.

Preferably, at least some of the integrated circuits are different to each other.

Preferably, the integrated circuits are of different lengths.

In accordance with another aspect of the invention, there is provided a method of laying out an integrated circuit, the method including the steps of:

deling a layout of an integrated circuit;

defining a joint path;

modifying at least one element within an overlap area adjacent the joint path to take into account reticle field overlap during a subsequent manufacturing step.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

In accordance with another embodiment of the invention, there is provided, in a system comprising a plurality of consumers of one or more common resources, a method of tracking usage of the one or more common resources, comprising the steps of:

from each consumer, broadcasting to each of the other consumers a value indicative of an amount of the one or more resources consumed;

at each of the consumers, receiving the broadcasted values from the other consumers; and in each consumer, storing a record of the total of the values that the consumer broadcasted and the values received from the other consumers.

Preferably, a memory stores a total indicative of the sum of all values broadcast by the consumers, the method further comprising the steps of, for each of at least a plurality of the consumers:

performing an authenticated read of the total in the memory; comparing the total in the consumer's record with the total read from the memory; and in the event the totals do not match, performing an action.

Preferably, the memory is in one of the consumers and comprises that consumer's record.

Preferably, the action includes halting printing and or outputting an error message;

Preferably, the values are broadcast in a non-secure manner.

Preferably, the value is signless, thereby preventing recrediting of the total in the memory.

Preferably, the consumers are printer controllers.

Preferably, each of the printer controllers controls printing to a different part of print media to be printed.

Preferably, the resource is ink and the one or more values represent one or more corresponding inks consumed by one or more printheads associated with the printer controllers.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

BRIEF DESCRIPTION OF THE DRAWINGS

Preferred and other embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

Figure 1 is an example of state machine notation

Figure 2 shows document data flow in a printer

Figure 3 is an example of a single printer controller (hereinafter “SoPEC”) A4 simplex printer system

Figure 4 is an example of a dual SoPEC A4 duplex printer system

Figure 5 is an example of a dual SoPEC A3 simplex printer system

Figure 6 is an example of a quad SoPEC A3 duplex printer system

Figure 7 is an example of a SoPEC A4 simplex printing system with an extra SoPEC used as

DRAM storage

Figure 8 is an example of an A3 duplex printing system featuring four printing SoPECs

Figure 9 shows pages containing different numbers of bands

Figure 10 shows the contents of a page band

Figure 11 illustrates a page data path from host to SoPEC

Figure 12 shows a page structure

Figure 13 shows a SoPEC system top level partition

Figure 14 shows a SoPEC CPU memory map (not to scale)

Figure 15 is a block diagram of CPU

Figure 16 shows CPU bus transactions

Figure 17 shows a state machine for a CPU subsystem slave

Figure 18 shows a SoPEC CPU memory map (not to scale)

Figure 19 shows an external signal view of a memory management unit (hereinafter MMU”) subblock partition

Figure 20 shows an internal signal view of an MMU sub-block partition

Figure 21 shows a DRAM write buffer

Figure 22 shows DIU waveforms for multiple transactions

Figure 23 shows a SoPEC LEON CPU core

Figure 24 shows a cache data RAM wrapper

Figure 25 shows a realtime debug unit block diagram

Figure 26 shows interrupt acknowledge cycles for single and pending interrupts

Figure 27 shows an A3 duplex system featuring four printing SoPECs with a single SoPEC DRAM device

Figure 28 is an SCB block diagram

Figure 29 is a logical view of the SCB of figure 28

Figure 30 shows an ISI configuration with four SoPEC devices

Figure 31 shows half-duplex interleaved transmission from ISIMaster to ISISIave

Figure 32 shows ISI transactions

Figure 33 shows an ISI long packet

Figure 34 shows an ISI ping packet

CA 02508141 2008-08-01

Figure 35 shows a short ISI packet

Figure 36 shows successful transmission of two long packets with sequence bit toggling

Figure 37 shows sequence bit operation with errored long packet

Figure 38 shows sequence bit operation with ACK error

Figure 39 shows an ISI sub-block partition

Figure 40 shows an ISI serial interface engine functional block diagram

Figure 41 is an SIE edge detection and data IO diagram

Figure 42 is an SIE Rx/Tx state machine Tx cycle state diagram

Figure 43 shows an SIE Rx/Tx state machine Tx bit stuff Ό’ cycle state diagram

Figure 44 shows an SIE Rx/Tx state machine Tx bit stuff T cycle state diagram

Figure 45 shows an SIE Rx/Tx state machine Rx cycle state diagram

Figure 46 shows an SIE Tx functional timing example

Figure 47 shows an SiE Rx functional timing example

Figure 48 shows an SIE Rx/Tx FIFO block diagram

Figure 49 shows SIE Rx/Tx FIFO control signal gating

Figure 50 shows an SIE bit stuffing state machine Tx cycle state diagram

Figure 51 shows an SIE bit stripping state machine Rx cycle state diagram

Figure 52 shows a CRC16 generation/checking shift register

Figure 53 shows circular buffer operation

Figure 54 shows duty cycle select

Figure 55 shows a GPIO partition

Figure 56 shows a motor control RTL diagram

Figure 57 is an input de-glitch RTL diagram

Figure 58 is a frequency analyser RTL diagram

Figure 59 shows a brushless DC controller

Figure 60 shows a period measure unit

Figure 61 shows line synch generation logic

Figure 62 shows an ICU partition

Figure 63 is an interrupt clear state diagram

Figure 63A Timers sub-block partition diagram

Figure 64 is a watchdog timer RTL diagram

Figure 65 is a generic timer RTL diagram

Figure 66 is a schematic of a timing pulse generator

Figure 67 is a Pulse generator RTL diagram

Figure 68 shows a SoPEC clock relationship

Figure 69 shows a CPR block partition

Figure 70 shows reset deglitch logic

Figure 71 shows reset synchronizer logic

Figure 72 is a clock gate logic diagram

Figure 73 shows a PLL and Clock divider logic

CA 02508141 2008-08-01

Figure 74 shows a PLL control state machine diagram

Figure 75 shows a LSS master system-level interface

Figure 76 shows START and STOP conditions

Figure 77 shows an LSS transfer of 2 data bytes

Figure 78 is an example of an LSS write to a QA Chip

Figure 79 is an example of an LSS read from QA Chip

Figure 80 shows an LSS block diagram

Figure 81 shows an LSS rnulti-command transaction

Figure 82 shows start and stop generation based on previous bus state

Figure 83 shows an LSS master state machine

Figure 84 shows LSS master timing

Figure 85 shows a SoPEC system top level partition

Figure 86 shows an ead bus with 3 cycle random DRAM read accesses

Figure 87 shows interleaving of CPU and non-CPU read accesses

Figure 88 shows interleaving of read and write accesses with 3 cycle random DRAM accesses

Figure 89 shows interleaving of write accesses with 3 cycle random DRAM accesses

Figure 90 shows a read protocol for a SoPEC Unit making a single 256-bit access

Figure 91 shows a read protocol for a SoPEC Unit making a single 256-bit access

Figure 92 shows a write protocol for a SoPEC Unit making a single 256-bit access

Figure 93 shows a protocol for a posted, masked, 128-bit write by the CPU

Figure 94 shows a write protocol shown for CDU making four contiguous 64-bit accesses

Figure 95 shows timeslot-based arbitration

Figure 96 shows timeslot-based arbitration with separate pointers

Figure 97 shows a first example (a) of separate read and write arbitration

Figure 98 shows a second example (b) of separate read and write arbitration

Figure 99 shows a third example (c) ofseparate read and write arbitration

Figure 100 shows a DIU partition

Figure 101 shows a DIU partition

Figure 102 shows multiplexing and address translation logic for two memory instances

Figure 103 shows a timing of dau_dcu_valid, dcu_dau_adv and dcu_dau_wadv

Figure 104 shows a DCU state machine

Figure 105 shows random read timing

Figure 106 shows random write timing

Figure 107 shows refresh timing

Figure 108 shows page mode write timing

Figure 109 shows timing of non-CPU DIU read access

Figure 110 shows timing of CPU DIU read access

Figure 111 shows a CPU DIU read access

Figure 112 shows timing of CPU DIU write access

Figure 113 shows timing of a non-CDU / non-CPU DIU write access

CA 02508141 2008-08-01

Figure 114 shows timing of CDU DIU write access

Figure 115 shows command multiplexor sub-block partition

Figure 116 shows command multiplexor timing at DIU requestors interface

Figure 117 shows generation of re_arbitrate and re_arbitrate_wadv

Figure 118 shows CPU interface and arbitration logic

Figure 119 shows arbitration timing

Figure 120 shows setting RotationSync to enable a new rotation.

Figure 121 shows a timeslot based arbitration

Figure 122 shows a timeslot based arbitration with separate pointers

Figure 123 shows a CPU pre-access write lookahead pointer

Figure 124 shows arbitration hierarchy

Figure 125 shows hierarchical round-robin priority comparison

Figure 126 shows a read multiplexor partition

Figure 127 shows a read command queue (4 deep buffer)

Figure 128 shows state-machines for shared read bus accesses

Figure 129 shows a write multiplexor partition

Figure 130 shows a read multiplexer timing for back-to-back shared read bus transfer

Figure 131 shows a write multiplexer partition

Figure 132 shows a block diagram of a PCU

Figure 133 shows PCU accesses to PEP registers

Figure 134 shows command arbitration and execution

Figure 135 shows DRAM command access state machine

Figure 136 shows an outline of contone data flow with respect to CDU

Figure 137 shows a DRAM storage arrangement for a single line of JPEG 8x8 blocks in 4 colors

Figure 138 shows a read control unit state machine

Figure 139 shows a memory arrangement of JPEG blocks

Figure 140 shows a contone data write state machine

Figure 141 shows lead-in and lead-out clipping of contone data in multi-SoPEC environment

Figure 142 shows a block diagram of CFU

Figure 143 shows a DRAM storage arrangement for a single line of JPEG blocks in 4 colors

Figure 144 shows a block diagram of color space converter

Figure 145 shows a converter/invertor

Figure 146 shows a high-level block diagram of LBD in context

Figure 147 shows a schematic outline of the LBD and the SFU

Figure 148 shows a block diagram of lossless bi-level decoder

Figure 149 shows a stream decoder block diagram

Figure 150 shows a command controller block diagram

Figure 151 shows a state diagram for command controller (CC) state machine

Figure 152 shows a next edge unit block diagram

Figure 153 shows a next edge unit buffer diagram

CA 02508141 2008-08-01

Figure 154 shows a next edge unit edge detect diagram

Figure 155 shows a state diagram for the next edge unit state machine

Figure 156 shows a line fill unit block diagram

Figure 157 shows a state diagram for the Line Fill Unit (LFU) state machine

Figure 158 shows a bi-level DRAM buffer

Figure 159 shows interfaces between LBD/SFU/HCU

Figure 160 shows an SFU sub-block partition

Figure 161 shows an LBDPrevLineFifo sub-block

Figure 162 shows timing of signals on the LBDPrevLineFIFO interface to DIU and address generator

Figure 163 shows timing of signals on LBDPrevLineFIFO interface to DIU and address generator

Figure 164 shows LBDNextLineFifo sub-block

Figure 165 shows timing of signals on-LBDNextLineFIFO interface to DIU and address generator

Figure 166 shows LBDNextLineFIFO DIU interface state diagram

Figure 167 shows an LDB to SFU write interface

Figure 168 shows an LDB to SFU read interface (within a line)

Figure 169 shows an HCUReadLineFifo Sub-block

Figure 170 shows a DIU write Interface

Figure 171 shows a DIU Read Interface multiplexing by select_hrfplf

Figure 172 shows DIU read request arbitration logic

Figure 173 shows address generation

Figure 174 shows an X scaling control unit

Figure 175 Y shows a scaling control unit

Figure 176 shows an overview of X and Y scaling at HCU interface

Figure 177 shows a high level block diagram of TE in context

Figure 178 shows a QR Code

Figure 179 shows Netpage tag structure

Figure 180 shows a Netpage tag with data rendered at 1600 dpi (magnified view)

Figure 181 shows an example of 2x2 dots for each block of QR code

Figure 182 shows placement of tags for portrait & landscape printing

Figure 183 shows agGeneral representation of tag placement

Figure 184 shows composition of SoPEC’s tag format structure

Figure 185 shows a simple 3x3 tag structure

Figure 186 shows 3x3 tag redesigned for 21 x 21 area (not simple replication)

Figure 187 shows a TE Block Diagram

Figure 188 shows a TE Hierarchy

Figure 189 shows a block diagram of PCU accesses

Figure 190 shows a tag encoder top-level FSM

Figure 191 shows generated control signals

Figure 192 shows logic to combine dot information and encoded data

CA 02508141 2008-08-01

Figure 193 shows generation of Lastdotintag/1

Figure 194 shows generation of Dot Position Valid

Figure 195 shows generation of write enable to the TFU

Figure 196 shows generation of Tag Dot Number

Figure 197 shows TDI Architecture

Figure 198 shows data flow through the TDI

Figure 199 shows raw tag data interface block diagram

Figure 200 shows an RTDI State Flow Diagram

Figure 201 shows a relationship between TE_endoftagdata, cdu_startofbandstore and cdu_endofbandstore

Figure 202 shows a TDi State Flow Diagram

Figure 203 shows mapping of the tag data to codewords 0-7

Figure 204 shows coding and mapping of uncoded fixed tag data for (15,5) RS encoder

Figure 205 shows mapping of pre-coded fixed tag data

Figure 206 shows coding and mapping of variable tag data for (15,7) RS encoder

Figure 207 shows coding and mapping of uncoded fixed tag data for (15,7) RS encoder

Figure 208 shows mapping of 2D decoded variable tag data

Figure 209 shows a simple block diagram for an m=4 Reed Solomon encoder

Figure 210 shows an RS encoder I/O diagram

Figure 211 shows a (15,5) & (15,7) RS encoder block diagram

Figure 212 shows a (15,5) RS encoder timing diagram

Figure 213 shows a (15,7) RS encoder timing diagram

Figure 214 shows a circuit for multiplying by alpha³

Figure 215 shows adding two field elements

Figure 216 shows an RS encoder implementation

Figure 217 shows an encoded tag data interface

Figure 218 shows an encoded fixed tag data interface

Figure 219 shows an encoded variable tag data interface .Figure 220 shows an encoded variable tag data sub-buffer

Figure 221 shows a breakdown of the tag format structure

Figure 222 shows a TFSIFSM state flow diagram

Figure 223 shows a TFS block diagram

Figure 224 shows a table A interface block diagram

Figure 225 shows a table A address generator

Figure 226 shows a table C interface block diagram

Figure 227 shows a table B interface block diagram

Figure 228 shows interfaces between TE, TFU and HCU

Figure 229 shows a 16-byte FIFO in TFU

Figure 230 shows a high level block diagram showing the HCU and its external interfaces

Figure 231 shows a block diagram of the HCU

CA 02508141 2008-08-01

Figure 232 shows a block diagram of the control unit

Figure 233 shows a block diagram of determine advdot unit

Figure 234 shows a page structure

Figure 235 shows a block diagram of a margin unit

Figure 236 shows a block diagram of a dither matrix table interface

Figure 237 shows an example of reading lines of dither matrix from DRAM

Figure 238 shows a state machine to read dither matrix table

Figure 239 shows a contone dotgen unit

Figure 240 shows a block diagram of dot reorg unit

Figure 241 shows an HCU to DNC interface (also used in DNC to DWU, LLU to PHI)

Figure 242 shows SFU to HCU interface (all feeders to HCU)

Figure 243 shows representative logic of the SFU to HCU interface

Figure 244 shows a high-level block diagram of DNC

Figure 245 shows a dead nozzle table format

Figure 246 shows set of dots operated on for error diffusion

Figure 247 shows a block diagram of DNC

Figure 248 shows a sub-block diagram of ink replacement unit

Figure 249 shows a dead nozzle table state machine

Figure 250 shows logic for dead nozzle removal and ink replacement

Figure 251 shows a sub-block diagram of error diffusion unit

Figure 252 shows a maximum length 32-bit LFSR used for random bit generation

Figure 253 shows a high-level data flow diagram of DWU in context

Figure 254 shows a printhead nozzle layout for 36-nozzle bi-lithic printhead

Figure 255 shows a printhead nozzle layout for a 36-nozzle bi-lithic printhead

Figure 256 shows a dot line store logical representation

Figure 257 shows a conceptual view of printhead row alignment

Figure 258 shows a conceptual view of printhead rows (as seen by the LLU and PHI)

Figure 259 shows a comparison of 1.5x v 2x buffering

Figure 260 shows an even dot order in DRAM (increasing sense, 13320 dot wide line)

Figure 261 shows an even dot order in DRAM (decreasing sense, 13320 dot wide line)

Figure 262 shows a dotline FIFO data structure in DRAM

Figure 263 shows a DWU partition

Figure 264 shows a buffer address generator sub-block

Figure 265 shows a DIU Interface sub-block

Figure 266 shows an interface controller state diagram

Figure 267 shows a high level data flow diagram of LLU in context

Figure 268 shows paper and printhead nozzles relationship (example with Di=D₂=5)

Figure 269 shows printhead structure and dot generate order

Figure 270 shows an order of dot data generation and transmission

Figure 271 shows a conceptual view of printhead rows

CA 02508141 2008-08-01

Figure 272 shows a dotline FIFO data structure in DRAM (LLU specification)

Figure 273 shows an LLU partition

Figure 274 shows a dot generator RTL diagram

Figure 275 shows a DIU interface

Figure 276 shows an interface controller state diagram

Figure 277 shows high-level data flow diagram of PHI in context

Figure 278 shows power on reset

Figure 279 shows printhead data rate equalization

Figure 280 shows a printhead structure and dot generate order

Figure 281 shows an order of dot data generation and transmission

Figure 282 shows an order of dot data generation and transmission (single printhead case)

Figure 283 shows printhead interface timing parameters

Figure 284 shows printhead timing with margining

Figure 285 shows a PHI block partition

Figure 286 shows a sync generator state diagram

Figure 287 shows a line sync de-glitch RTL diagram

Figure 288 shows a fire generator state diagram

Figure 289 shows a PHI controller state machine

Figure 290 shows a datapath unit partition

Figure 291 shows a dot order controller state diagram

Figure 292 shows a data generator state diagram

Figure 293 shows data serializer timing

Figure 294 shows a data serializer RTL Diagram

Figure 295 shows printhead types 0 to 7

Figure 296 shows an ideal join between two dilithic printhead segments

Figure 297 shows an example of a join between two bilithic printhead segments

Figure 298 shows printable vs non-printable area under new definition (looking at colors as if 1 row only)

Figure 299 shows identification of printhead nozzles and shift-register sequences for printheads in arrangement 1

Figure 300 shows demultiplexing of data within the printheads in arrangement 1

Figure 301 shows double data rate signalling for a type 0 printhead in arrangement 1

Figure 302 shows double data rate signalling for a type 1 printhead in arrangement 1

Figure 303 shows identification of printheads nozzles and shift-register sequences for printheads in arrangement 2

Figure 304 shows demultiplexing of data within the printheads in arrangement 2

Figure 305 shows double data rate signalling for a type 0 printhead in arrangement 2

Figure 306 shows double data rate signalling for a type 1 printhead in arrangement 2

Figure 307 shows all 8 printhead arrangements

Figure 308 shows a printhead structure

CA 02508141 2008-08-01

Figure 309 shows a column Structure

Figure 310 shows a printhead dot shift register dot mapping to page

Figure 311 shows data timing during printing

Figure 312 shows print quality

Figure 313 shows fire and select shift register setup for printing

Figure 314 shows a fire pattern across butt end of printhead chips

Figure 315 shows fire pattern generation

Figure 316 shows determination of select shift register value

Figure 317 shows timing for printing signals figure 318 shows initialisation of printheads figure 319 shows a nozzle test latching circuit figure 320 shows nozzle testing figure 321 shows a temperature reading figure 322 shows CMOS testing figure 323 shows a reticle layout figure 324 shows a stepper pattern on Wafer Figure 325 shows relationship between datasets Figure 326 shows a validation hierarchy

Figure 327 shows development of operating system code

Figure 328 shows protocol for directly verifying reads from ChipR

Figure 329 shows a protocol for signature translation protocol

Figure 330 shows a protocol for a direct authenticated write

Figure 331 shows an alternative protocol for a direct authenticated write

Figure 332 shows a protocol for basic update of permissions

Figure 333 shows a protocol for a multiple-key update

Figure 334 shows a protocol for a single-key authenticated read

Figure 335 shows a protocol for a single-key authenticated write

Figure 336 shows a protocol for a single-key update of permissions

Figure 337 shows a protocol for a single-key update

Figure 338 shows a protocol for a multiple-key singie-M authenticated read

Figure 339 shows a protocol for a multiple-key authenticated write

Figure 340 shows a protocol for a multiple-key update of permissions

Figure 341 shows a protocol for a multiple-key update

Figure 342 shows a protocol for a multiple-key multiple-M authenticated read

Figure 343 shows a protocol for a multiple-key authenticated write

Figure 344 shows a protocol for a multiple-key update of permissions

Figure 345 shows a protocol for a multiple-key update

Figure 346 shows relationship of permissions bits to M[n] access bits

Figure 347 shows 160-bit maximal period LFSR

Figure 348 shows clock filter

CA 02508141 2008-08-01

Figure 349 shows tamper detection line

Figure 350 shows an oversize nMOS transistor layout of Tamper Detection Line

Figure 351 shows a Tamper Detection Line

Figure 352 shows how Tamper Detection Lines cover the Noise Generator

Figure 353 shows a prior art FET Implementation of CMOS inverter

Figure 354 shows non-flashing CMOS

Figure 355 shows components of a printer-based refill device

Figure 356 shows refilling of printers by printer-based refill device

Figure 357 shows components of a home refill station

Figure 358 shows a three-ink reservoir unit

Figure 359 shows refill of ink cartridges in a home refill station

Figure 360 shows components of a commercial refill station

Figure 361 shows an ink reservoir unit

Figure 362 shows refill of ink cartridges in a commercial refill station (showing a single refill unit)

Figure 363 shows equivalent signature generation

Figure 364 shows a basic field definition

Figure 365 shows an example of defining field sizes and positions

Figure 366 shows permissions

Figure 367 shows a first example of permissions for a field

Figure 368 shows a second example of permissions for a field

Figure 369 shows field attributes

Figure 370 shows an output signature generation data format for Read

Figure 371 shows an input signature verification data format for Test

Figure 372 shows an output signature generation data format for Translate

Figure 373 shows an input signature verification data format for WriteAuth

Figure 374 shows input signature data format for ReplaceKey

Figure 375 shows a key replacement map

Figure 376 shows a key replacement map after tÇ is replaced

Figure 377 shows a key replacement process

Figure 378 shows an output signature data format for GetProgramKey

Figure 379 shows transfer and rollback process

Figure 380 shows an upgrade flow

Figure 381 shows authorised ink refill paths in the printing system

Figure 382 shows an input signature verification data format for XferAmount

Figure 383 shows a transfer and rollback process

Figure 384 shows an upgrade flow

Figure 385 shows authorised upgrade paths in the printing system

Figure 386 shows a direct signature validation sequence

Figure 387 shows signature validation using translation

Figure 388 shows setup of preauth field attributes

CA 02508141 2008-08-01

Figure 389 shows a high level block diagram of QA Chip

Figure 390 shows an analogue unit

Figure 391 shows a serial bus protocol for trimming

Figure 392 shows a block diagram of a trim unit

Figure 393 shows a block diagram of a CPU of the QA chip

Figure 394 shows block diagram of an MIU

Figure 395 shows a block diagram of memory components

Figure 396 shows a first byte sent to an IOU

Figure 397 shows a block diagram of the IOU

Figure 398 shows a relationship between external SDa and SCIk and generation of internal signals

Figure 399 shows block diagram of ALU

Figure 400 shows a block diagram of DataSel

Figure 401 shows a block diagram of ROR

Figure 402 shows a block diagram of the ALU’s IO block

Figure 403 shows a block diagram of PCU

Figure 404 shows a block diagram of an Address Generator Unit

Figure 405 shows a block diagram for a Counter Unit

Figure 406 shows a block diagram of PMU

Figure 407 shows a state machine for PMU

Figure 408 shows a block diagram of MRU

Figure 409 shows simplified MAU state machine

Figure 410 shows power-on reset behaviour

Figure 411 shows a ring oscillator block diagram

Figure 412 shows a system clock duty cycle

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

DETAILED DESCRIPTION OF PREFERRED AND OTHER EMBODIMENTS

It will be appreciated that the detailed description that follows takes the form of a highly detailed design of the invention, including supporting hardware and software. A high level of detailed disclosure is provided to ensure that one skilled in the art will have ample guidance for implementing the invention.

Imperative phrases such as “must”, “requires”, “necessary” and “important” (and similar language) should be read as being indicative of being necessary only for the preferred embodiment actually being described. As such, unless the opposite is clear from the context, imperative wording should not be interpreted as such. Nothing in the detailed description is to be understood as limiting the scope of the invention, which is intended to be defined as widely as is defined in the accompanying claims.

Indications of expected rates, frequencies, costs, and other quantitative values are exemplary and estimated only, and are made in good faith. Nothing in this specification should be read as implying that a particular commercial embodiment is or will be capable of a particular performance level in any measurable area.

It will be appreciated that the principles, methods and hardware described throughout this document can be applied to other fields. Much of the security-related disclosure, for example, can be applied to many other fields that require secure communications between entities, and certainly has application far beyond the field of printers.

SYSTEM OVERVIEW

The preferred of the present invention is implemented in a printer using microelectromechanical systems (MEMS) printheads. The printer can receive data from, for example, a personal computer such as an IBM compatible PC or Apple computer. In other embodiments, the printer can receive data directly from, for example, a digital still or video camera. The particular choice of communication link is not important, and can be based, for example, on USB, Firewire, Bluetooth or any other wireless or hardwired communications protocol.

Print System Overview

Introduction

This document describes the SoPEC (Small office home office Print Engine Controller) ASIC (Application Specific Integrated Circuit) suitable for use in, for example, SoHo printer products. The SoPEC ASIC is intended to be a low cost solution for bi-lithic printhead control, replacing the multichip solutions in larger more professional systems with a single chip. The increased cost competitiveness is achieved by integrating several systems such as a modified PEC1 printing pipeline, CPU control system, peripherals and memory sub-system onto one SoC ASIC, reducing component count and simplifying board design.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

This section will give a general introduction to Memjet printing systems, introduce the components that make a bi-lithic printhead system, describe possible system architectures and show how several SoPECs can be used to achieve A3 and A4 duplex printing. The section “SoPEC ASIC” describes the SoC SoPEC ASIC, with subsections describing the CPU, DRAM and Print Engine Pipeline subsystems. Each section gives a detailed description of the blocks used and their operation within the overall print system. The final section describes the bi-lithic printhead construction and associated implications to the system due to its makeup.

Nomenclature

4.1 Bi-lithic Printhead Notation

A bi-lithic based printhead is constructed from 2 printhead ICs of varying sizes. The notation M:N is used to express the size relationship of each IC, where M specifies one printhead IC in inches and N specifies the remaining printhead IC in inches.

The ‘SoPEC/MoPEC Bilithic Printhead Reference’ document [10] contains a description of the bilithic printhead and related terminology.

4.2 Definitions

The following terms are used throughout this specification:

<td> Bi-lithic printhead CPU</td><td> Refers to printhead constructed from 2 printhead ICs Refers to CPU core, caching system and MMU.</td>

<td> ISI-Bridge chip</td><td> A device with a high speed interface (such as USB2.0, Ethernet or IEEE1394) and one or more ISI interfaces. The ISI-Bridge would be the ISIMaster for each of the ISI buses it interfaces to.</td>

<td> ISIMaster</td><td> The ISIMaster is the only device allowed to initiate communication on the Inter Sopec Interface (ISI) bus. The ISIMaster interfaces with the host.</td>

<td> ISISIave</td><td> Multi-SoPEC systems will contain one or more ISISIave SoPECs connected to the ISI bus. ISISIaves can only respond to communication initiated by the ISIMaster.</td>

<td> LEON</td><td> Refers to the LEON CPU core.</td>

<td> LineSyncMaster</td><td> The LineSyncMaster device generates the line synchronisation pulse that all SoPECs in the system must synchronise their line outputs to.</td>

<td> Multi-SoPEC</td><td> Refers to SoPEC based print system with multiple SoPEC devices</td>

<td> Netpage PEC1</td><td> Refers to page printed with tags (normally in infrared ink). Refers to Print Engine Controller version 1, precursor to SoPEC used to control printheads constructed from multiple angled printhead segments.</td>

<td> Printhead IC</td><td> Single MEMS IC used to construct bi-lithic printhead</td>

<td> PrintMaster</td><td> The PrintMaster device is responsible for coordinating all aspects of the print operation. There may only be one PrintMaster in a system.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td> QA Chip</td><td> Quality Assurance Chip</td>

Storage SoPEC An ISISIave SoPEC used as a DRAM store and which does not print.

<td> Tag</td><td> Refers to pattern which encodes information about its position and orientation which allow it to be optically located and its data contents read.</td>

4.3 Acronym and Abbreviations

The following acronyms and abbreviations are used in this specification

<td> CFU</td><td> Contone FIFO Unit</td>

<td> CPU</td><td> Central Processing Unit</td>

<td> DIU</td><td> DRAM Interface Unit</td>

<td> DNC</td><td> Dead Nozzle Compensator</td>

<td> DRAM</td><td> Dynamic Random Access Memory</td>

<td> DWU</td><td> DotLine Writer Unit</td>

<td> GPIO</td><td> General Purpose Input Output</td>

<td> HCU</td><td> Halftoner Compositor Unit</td>

<td> ICU</td><td> Interrupt Controller Unit</td>

<td> ISI</td><td> Inter SoPEC Interface</td>

<td> LDB</td><td> Lossless Bi-level Decoder</td>

<td> LLU</td><td> Line Loader Unit</td>

<td> LSS</td><td> Low Speed Serial interface</td>

<td> MEMS</td><td> Micro Electro Mechanical System</td>

<td> MMU</td><td> Memory Management Unit</td>

<td> PCU</td><td> SoPEC Controller Unit</td>

<td> PHI</td><td> PrintHead Interface</td>

<td> PSS</td><td> Power Save Storage Unit</td>

<td> RDU</td><td> Real-time Debug Unit</td>

<td> ROM</td><td> Read Only Memory</td>

<td> SCB</td><td> Serial Communication Block</td>

<td> SFU</td><td> Spot FIFO Unit</td>

<td> SMG4</td><td> Silverbrook Modified Group 4.</td>

<td> SoPEC</td><td> Small office home office Print Engine Controller</td>

<td> SRAM</td><td> Static Random Access Memory</td>

<td> TE</td><td> Tag Encoder</td>

<td> TFU</td><td> Tag FIFO Unit</td>

<td> TIM</td><td> Timers Unit</td>

<td> USB</td><td> Universal Serial Bus</td>

4.4 Pseudocode notation

In general the pseudocode examples use C like statements with some exceptions.

Symbol and naming convections used for pseudocode.

<td> //</td><td> Comment Assignment</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td> ==,!=,&lt;,&gt; &amp; | A « » ~ J&gt;5</td><td> Operator equal, not equal, less than, greater than Operator addition, subtraction, multiply, divide, modulus Bitwise AND, bitwise OR, bitwise exclusive OR, left shift, right shift, complement</td>

AND,OR,NOT Logical AND, Logical OR, Logical inversion

<td> [XX:YY] {a, b, c} ++, -</td><td> Array/vector specifier Concatenation operation Increment and decrement</td>

4.4.1 Register and signal naming conventions

In general register naming uses the C style conventions with capitalization to denote word delimiters. Signals use RTL style notation where underscore denote word delimiters. There is a direct translation between both convention. For example the CmdSourceFifo register is equivalent to cmd_source_fifo signal.

4.5 State machine notation

State machines should be described using the pseudocode notation outlined above. State machine descriptions use the convention of underline to indicate the cause of a transition from one state to another and plain text (no underline) to indicate the effect of the transition i.e. signal transitions which occur when the new state is entered.

A sample state machine is shown in Figure 1.

Printing Considerations

A bi-lithic printhead produces 1600 dpi bi-level dots. On low-diffusion paper, each ejected drop forms a 22.5pm diameter dot. Dots are easily produced in isolation, allowing dispersed-dot dithering to be exploited to its fullest. Since the bi-lithic printhead is the width of the page and operates with a constant paper velocity, color planes are printed in perfect registration, allowing ideal dot-on-dot printing. Dot-on-dot printing minimizes ‘muddying’ of midtones caused by inter-color bleed.

A page layout may contain a mixture of images, graphics and text. Continuous-tone (contone) images and graphics are reproduced using a stochastic dispersed-dot dither. Unlike a clustered-dot (or amplitude-modulated) dither, a dispersed-dot (or frequency-modulated) dither reproduces high spatial frequencies (i.e. image detail) almost to the limits of the dot resolution, while simultaneously reproducing lower spatial frequencies to their full color depth, when spatially integrated by the eye.

A stochastic dither matrix is carefully designed to be free of objectionable low-frequency patterns when tiled across the image. As such its size typically exceeds the minimum size required to support a particular number of intensity levels (e.g. 16χ16χ 8 bits for 257 intensity levels).

Human contrast sensitivity peaks at a spatial frequency of about 3 cycles per degree of visual field and then falls off logarithmically, decreasing by a factor of 100 beyond about 40 cycles per degree and becoming immeasurable beyond 60 cycles per degree [25][25j. At a normal viewing distance of 12 inches (about 300mm), this translates roughly to 200-300 cycles per inch (cpi) on the printed page, or 400-600 samples per inch according to Nyquist’s theorem.

In practice, contone resolution above about 300 ppi is of limited utility outside special applications such as medical imaging. Offset printing of magazines, for example, uses contone resolutions in the range 150 to 300 ppi. Higher resolutions contribute slightly to color error through the dither.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

Black text and graphics are reproduced directly using bi-level black dots, and are therefore not antialiased (i.e. low-pass filtered) before being printed. Text should therefore be supersampled beyond the perceptual limits discussed above, to produce smoother edges when spatially integrated by the eye. Text resolution up to about 1200 dpi continues to contribute to perceived text sharpness (assuming low-diffusion paper, of course).

A Netpage printer, for example, may use a contone resolution of 267 ppi (i.e. 1600 dpi / 6), and a black text and graphics resolution of 800 dpi. A high end office or departmental printer may use a contone resolution of 320 ppi (1600 dpi / 5) and a black text and graphics resolution of 1600 dpi. Both formats are capable of exceeding the quality of commercial (offset) printing and photographic reproduction.

Document Data Flow

6.1 Considerations

Because of the page-width nature of the bi-lithic printhead, each page must be printed at a constant speed to avoid creating visible artifacts. This means that the printing speed can’t be varied to match the input data rate. Document rasterization and document printing are therefore decoupled to ensure the printhead has a constant supply of data. A page is never printed until it is fully rasterized. This can be achieved by storing a compressed version of each rasterized page image in memory. This decoupling also allows the RIP(s) to run ahead of the printer when rasterizing simple pages, buying time to rasterize more complex pages.

Because contone color images are reproduced by stochastic dithering, but black text and line graphics are reproduced directly using dots, the compressed page image format contains a separate foreground bi-level black layer and background contone color layer. The black layer is composited over the contone layer after the contone layer is dithered (although the contone layer has an optional black component). A final layer of Netpage tags (in infrared or black ink) is optionally added to the page for printout.

Figure 2 shows the flow of a document from computer system to printed page.

At 267 ppi for example, a A4 page (8.26 inches x 11.7 inches) of contone CMYK data has a size of 26.3MB. At 320 ppi, an A4 page of contone data has a size of 37.8MB. Using lossy contone compression algorithms such as JPEG [27], contone images compress with a ratio up to 10:1 without noticeable loss of quality, giving compressed page sizes of 2.63MB at 267 ppi and 3.78 MB at 320 ppi.

At 800 dpi, a A4 page of bi-level data has a size of 7.4MB. At 1600 dpi, a Letter page of bi-level data has a size of 29.5 MB. Coherent data such as text compresses very well. Using lossless bilevel compression algorithms such as SMG4 fax as discussed in Section 8.1.2.3.1, ten-point plain text compresses with a ratio of about 50:1. Lossless bi-level compression across an average page is about 20:1 with 10:1 possible for pages which compress poorly. The requirement for SoPEC is to be able to print text at 10:1 compression. Assuming 10:1 compression gives compressed page sizes of 0.74 MB at 800 dpi, and 2.95 MB at 1600 dpi.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

Once dithered, a page of CMYK contone image data consists of 116MB of bi-level data. Using lossless bi-level compression algorithms on this data is pointless precisely because the optimal dither is stochastic - i.e. since it introduces hard-to-compress disorder.

Netpage tag data is optionally supplied with the page image. Rather than storing a compressed bilevel data layer for the Netpage tags, the tag data is stored in its raw form. Each tag is supplied up to 120 bits of raw variable data (combined with up to 56 bits of raw fixed data) and covers up to a 6mm x 6mm area (at 1600 dpi). The absolute maximum number of tags on a A4 page is 15,540 when the tag is only 2mm x 2mm (each tag is 126 dots x 126 dots, for a total coverage of 148 tags x 105 tags). 15,540 tags of 128 bits per tag gives a compressed tag page size of 0.24 MB.

The multi-layer compressed page image format therefore exploits the relative strengths of lossy JPEG contone image compression, lossless bi-level text compression, and tag encoding. The format is compact enough to be storage-efficient, and simple enough to allow straightforward realtime expansion during printing.

Since text and images normally don’t overlap, the normal worst-case page image size is image only, while the normal best-case page image size is text only. The addition of worst case Netpage tags adds 0.24MB to the page image size. The worst-case page image size is text over image plus tags. The average page size assumes a quarter of an average page contains images. Table 1 shows data sizes for compressed Letter page for these different options.

Table 1. Data sizes for A4 page (8.26 inches x 11.7 inches)

<td></td><td> 267 ppi contone 800 dpi bi-level</td><td> 320 ppi contone 1600 dpi bi-level</td>

<td> Image only (contone), 10:1 compression</td><td> 2.63 MB</td><td> 3.78 MB</td>

<td> Text only (bi-level), 10:1 compression</td><td> 0.74 MB</td><td> 2.95 MB</td>

<td> Netpage tags, 1600 dpi</td><td> 0.24 MB</td><td> 0.24 MB</td>

<td> Worst case (text + image + tags)</td><td> 3.61 MB</td><td> 6.67 MB</td>

<td> Average (text + 25% image + tags)</td><td> 1.64 MB</td><td> 4.25 MB</td>

6.2 Document Data Flow

The Host PC rasterizes and compresses the incoming document on a page by page basis. The page is restructured into bands with one or more bands used to construct a page. The compressed data is then transferred to the SoPEC device via the USB link. A complete band is stored in SoPEC embedded memory. Once the band transfer is complete the SoPEC device reads the compressed data, expands the band, normalizes contone, bi-level and tag data to 1600 dpi and transfers the resultant calculated dots to the bi-lithic printhead.

The document data flow is • The RIP software rasterizes each page description and compress the rasterized page image.

• The infrared layer of the printed page optionally contains encoded Netpage [5] tags at a programmable density.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616 • The compressed page image is transferred to the SoPEC device via the USB normally on a band by band basis.

• The print engine takes the compressed page image and starts the page expansion.

• The first stage page expansion consists of 3 operations performed in parallel • expansion of the JPEG-compressed contone layer • expansion of the SMG4 fax compressed bi-level layer • encoding and rendering of the bi-level tag data.

• The second stage dithers the contone layer using a programmable dither matrix, producing up to four bi-level layers at full-resolution.

• The second stage then composites the bi-level tag data layer, the bi-level SMG4 fax decompressed layer and up to four bi-level JPEG de-compressed layers into the full-resolution page image.

• A fixative layer is also generated as required.

• The last stage formats and prints the bi-level data through the bi-lithic printhead via the printhead interface.

The SoPEC device can print a full resolution page with 6 color planes. Each of the color planes can be generated from compressed data through any channel (either JPEG compressed, bi-level SMG4 fax compressed, tag data generated, or fixative channel created) with a maximum number of 6 data channels from page RIP to bi-lithic printhead color planes.

The mapping of data channels to color planes is programmable, this allows for multiple color planes in the printhead to map to the same data channel to provide for redundancy in the printhead to assist dead nozzle compensation.

Also a data channel could be used to gate data from another data channel. For example in stencil mode, data from the bilevel data channel at 1600 dpi can be used to filter the contone data channel at 320 dpi, giving the effect of 1600 dpi contone image.

6.3 Page considerations due to SoPEC

The SoPEC device typically stores a complete page of document data on chip. The amount of storage available for compressed pages is limited to 2Mbytes, imposing a fixed maximum on compressed page size. A comparison of the compressed image sizes in Table 2 indicates that SoPEC would not be capable of printing worst case pages unless they are split into bands and printing commences before all the bands for the page have been downloaded. The page sizes in the table are shown for comparison purposes and would be considered reasonable for a professional level printing system. The SoPEC device is aimed at the consumer level and would not be required to print pages of that complexity. Target document types for the SoPEC device are shown Table 2.

Table 2. Page content targets for SoPEC

<td> Page Content Description</td><td> Calculation</td><td> Size</td>

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

<td></td><td></td><td> (MByte)</td>

<td> Best Case picture Image, 267ppi with 3 colors, A4 size</td><td> 8.26x11.7x267x267x3 @10:1</td><td> 1.97</td>

<td> Full page text, 800dpi A4 size</td><td> 8.26x11.7x800x800 @ 10:1</td><td> 0.74</td>

<td> Mixed Graphics and Text - Image of 6 inches x 4 inches @ 267 ppi and 3 colors - Remaining area text ~73 inches², 800 dpi</td><td> 6x4x267x267x3 @ 5:1 800x800x73 @10:1</td><td> 1.55</td>

<td> Best Case Photo, 3 Colors, 6.6 MegaPixel Image</td><td> 6.6 Mpixel @ 10:1</td><td> 2.00</td>

If a document with more complex pages is required, the page RIP software in the host PC can determine that there is insufficient memory storage in the SoPEC for that document. In such cases the RIP software can take two courses of action. It can increase the compression ratio until the compressed page size will fit in the SoPEC device, at the expense of document quality, or divide the page into bands and allow SoPEC to begin printing a page band before all bands for that page are downloaded. Once SoPEC starts printing a page it cannot stop, if SoPEC consumes compressed data faster than the bands can be downloaded a buffer underrun error could occur causing the print to fail. A buffer underrun occurs if a line synchronisation pulse is received before a line of data has been transferred to the printhead.

Other options which can be considered if the page does not fit completely into the compressed page store are to slow the printing or to use multiple SoPECs to print parts of the page. A Storage SoPEC ( Section 7.2.5) could be added to the system to provide guaranteed bandwidth data delivery. The print system could also be constructed using an ISI-Bridge chip (Section 7.2.6) to provide guaranteed data delivery.

Memjet Printer Architecture

The SoPEC device can be used in several printer configurations and architectures.

In the general sense every SoPEC based printer architecture will contain:

• One or more SoPEC devices.

• One or more bi-lithic printheads.

• Two or more LSS busses.

• Two or more QA chips.

• USB 1.1 connection to host or ISI connection to Bridge Chip.

• ISI bus connection between SoPECs (when multiple SoPECs are used).

Some example printer configurations as outlined in Section 7.2. The various system components are outlined briefly in Section 7.1.

7.1 System Components

7.1.1 SoPEC Print Engine Controller

The SoPEC device contains several system on a chip (SoC) components, as well as the print engine pipeline control application specific logic.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

7.1.1.1 Print Engine Pipeline (PEP) Logic

The PEP reads compressed page store data from the embedded memory, optionally decompresses the data and formats it for sending to the printhead. The print engine pipeline functionality includes expanding the page image, dithering the contone layer, compositing the black layer over the contone layer, rendering of Netpage tags, compensation for dead nozzles in the printhead, and sending the resultant image to the bi-lithic printhead.

7.1.1.2 Embedded CPU

SoPEC contains an embedded CPU for general purpose system configuration and management. The CPU performs page and band header processing, motor control and sensor monitoring (via the GPIO) and other system control functions. The CPU can perform buffer management or report buffer status to the host. The CPU can optionally run vendor application specific code for general print control such as paper ready monitoring and LED status update.

7.1.1.3 Embedded Memory Buffer

A 2.5Mbyte embedded memory buffer is integrated onto the SoPEC device, of which approximately 2Mbytes are available for compressed page store data. A compressed page is divided into one or more bands, with a number of bands stored in memory. As a band of the page is consumed by the PEP for printing a new band can be downloaded. The new band may be for the current page or the next page.

Using banding it is possible to begin printing a page before the complete compressed page is downloaded, but care must be taken to ensure that data is always available for printing or a buffer underrun may occur.

An Storage SoPEC acting as a memory buffer (Section 7.2.5) or an ISl-Bridge chip with attached DRAM (Section 7.2.6) could be used to provide guaranteed data delivery.

7.1.1.4 Embedded USB 1.1 Device

The embedded USB 1.1 device accepts compressed page data and control commands from the host PC, and facilitates the data transfer to either embedded memory or to another SoPEC device in multi-SoPEC systems.

7.1.2 Bi-lithic Printhead

The printhead is constructed by abutting 2 printhead ICs together. The printhead ICs can vary in size from 2 inches to 8 inches, so to produce an A4 printhead several combinations are possible.

For example two printhead ICs of 7 inches and 3 inches could be used to create a A4 printhead (the notation is 7:3). Similarly 6 and 4 combination (6:4), or 5:5 combination. For an A3 printhead it can be constructed from 8:6 or an 7:7 printhead IC combination. For photographic printing smaller printheads can be constructed.

7.1.3 LSS interface bus

Each SoPEC device has 2 LSS system buses for communication with QA devices for system authentication and ink usage accounting. The number of QA devices per bus and their position in the system is unrestricted with the exception that PRINTER_QA and INK_QA devices should be on separate LSS busses.

7.1.4 QA devices

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

Each SoPEC system can have several QA devices. Normally each printing SoPEC will have an associated PRINTER_QA. Ink cartridges will contain an INK_QA chip. PRINTER_QA and INK__QA devices should be on separate LSS busses. All QA chips in the system are physically identical with flash memory contents defining PRINTER_QA from INK_QA chip.

7.1.5 ISI interface

The Inter-SoPEC Interface (ISI) provides a communication channel between SoPECs in a multiSoPEC system. The ISIMaster can be SoPEC device or an ISI-Bridge chip depending on the printer configuration. Both compressed data and control commands are transferred via the interface.

7.1.6 ISI-Bridge Chip

A device, other than a SoPEC with a USB connection, which provides print data to a number of slave SoPECs. A bridge chip will typically have a high bandwidth connection, such as USB2.0, Ethernet or IEEE1394, to a host and may have an attached external DRAM for compressed page storage. A bridge chip would have one or more ISI interfaces. The use of multiple ISI buses would allow the construction of independent print systems within the one printer. The ISI-Bridge would be the ISIMaster for each of the ISI buses it interfaces to.

7.2 Possible SoPEC Systems

Several possible SoPEC based system architectures exist. The following sections outline some possible architectures. It is possible to have extra SoPEC devices in the system used for DRAM storage. The QA chip configurations shown are indicative of the flexibility of LSS bus architecture, but not limited to those configurations.

7.2.1 A4 Simplex with 1 SoPEC device

In Figure 3, a single SoPEC device can be used to control two printhead ICs. The SoPEC receives compressed data through the USB device from the host. The compressed data is processed and transferred to the printhead.

7.2.2 A4 Duplex with 2 SoPEC devices

In Figure 4, two SoPEC devices are used to control two bi-lithic printheads, each with two printhead ICs. Each bi-lithic printhead prints to opposite sides of the same page to achieve duplex printing. The SoPEC connected to the USB is the ISIMaster SoPEC, the remaining SoPEC is an ISISIave. The ISIMaster receives all the compressed page data for both SoPECs and re-distributes the compressed data over the Inter-SoPEC Interface (ISI) bus.

It may not be possible to print an A4 page every 2 seconds in this configuration since the USB 1.1 connection to the host may not have enough bandwidth. An alternative would be for each SoPEC to have its own USB 1.1 connection. This would allow a faster average print speed.

7.2.3 A3 Simplex with 2 SoPEC devices

In Figure 5, two SoPEC devices are used to control one A3 bi-lithic printhead. Each SoPEC controls only one printhead IC (the remaining PHI port typically remains idle). This system uses the SoPEC with the USB connection as the ISIMaster. In this dual SoPEC configuration the compressed page store data is split across 2 SoPECs giving a total of 4Mbyte page store, this allows the system to

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 use compression rates as in an A4 architecture, but with the increased page size of A3. The ISIMaster receives all the compressed page data for all SoPECs and re-distributes the compressed data over the Inter-SoPEC Interface (ISl) bus.

It may not be possible to print an A3 page every 2 seconds in this configuration since the USB 1.1 connection to the host will only have enough bandwidth to supply 2Mbytes every 2 seconds. Pages which require more than 2MBytes every 2 seconds will therefore print more slowly. An alternative would be for each SoPEC to have its own USB 1.1 connection. This would allow a faster average print speed.

7.2.4 A3 Duplex with 4 SoPEC devices

In Figure 6 a 4 SoPEC system is shown. It contains 2 A3 bi-lithic printheads, one for each side of an A3 page. Each printhead contain 2 printhead ICs, each printhead IC is controlled by an independent SoPEC device, with the remaining PHI port typically unused. Again the SoPEC with USB 1.1 connection is the ISIMaster with the other SoPECs as ISISIaves. In total, the system contains 8Mbytes of compressed page store (2Mbytes per SoPEC), so the increased page size does not degrade the system print quality, from that of an A4 simplex printer. The ISIMaster receives all the compressed page data for all SoPECs and re-distributes the compressed data over the InterSoPEC Interface (ISl) bus.

It may not be possible to print an A3 page every 2 seconds in this configuration since the USB 1.1 connection to the host will only have enough bandwidth to supply 2Mbytes every 2 seconds. Pages which require more than 2MBytes every 2 seconds will therefore print more slowly. An alternative would be for each SoPEC or set of SoPECs on the same side of the page to have their own USB

1.1 connection (as ISISIaves may also have direct USB connections to the host). This would allow a faster average print speed.

7.2.5 SoPEC DRAM storage solution: A4 Simplex with 1 printing SoPEC and 1 memory SoPEC Extra SoPECs can be used for DRAM storage e.g. in Figure 7 an A4 simplex printer can be built with a single extra SoPEC used for DRAM storage. The DRAM SoPEC can provide guaranteed bandwidth delivery of data to the printing SoPEC. SoPEC configurations can have multiple extra SoPECs used for DRAM storage.

7.2.6 ISI-Bridge chip solution: A3 Duplex system with 4 SoPEC devices

In Figure 8, an ISI-Bridge chip provides slave-only ISl connections to SoPEC devices. Figure 8 shows a ISI-Bridge chip with 2 separate ISl ports. The ISI-Bridge chip is the ISIMaster on each of the ISl busses it is connected to. All connected SoPECs are ISISIaves. The ISI-Bridge chip will typically have a high bandwidth connection to a host and may have an attached external DRAM for compressed page storage.

An alternative to having a ISI-Bridge chip would be for each SoPEC or each set of SoPECs on the same side of a page to have their own USB 1.1 connection. This would allow a faster average print speed.

Page Format and Printflow

When rendering a page, the RIP produces a page header and a number of bands (a non-blank page requires at least one band) for a page. The page header contains high level rendering

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 parameters, and each band contains compressed page data. The size of the band will depend on the memory available to the RIP, the speed of the RIP, and the amount of memory remaining in SoPEC while printing the previous band(s). Figure 9 shows the high level data structure of a number of pages with different numbers of bands in the page.

Each compressed band contains a mandatory band header, an optional bi-level plane, optional sets of interleaved contone planes, and an optional tag data plane (for Netpage enabled applications). Since each of these planes is optional¹, the band header specifies which planes are included with the band. Figure 10 gives a high-level breakdown of the contents of a page band.

A single SoPEC has maximum rendering restrictions as follows:

• 1 bi-level plane • 1 contone interleaved plane set containing a maximum of 4 contone planes • 1 tag data plane • a bi-lithic printhead with a maximum of 2 printhead ICs

The requirement for single-sided A4 single SoPEC printing is • average contone JPEG compression ratio of 10:1, with a local minimum compression ratio of 5:1 for a single line of interleaved JPEG blocks.

• average bi-level compression ratio of 10:1, with a local minimum compression ratio of 1:1 for a single line.

If the page contains rendering parameters that exceed these specifications, then the RIP or the Host PC must split the page into a format that can be handled by a single SoPEC.

In the general case, the SoPEC CPU must analyze the page and band headers and generate an appropriate set of register write commands to configure the units in SoPEC for that page. The various bands are passed to the destination SoPEC(s) to locations in DRAM determined by the host.

The host keeps a memory map for the DRAM, and ensures that as a band is passed to a SoPEC, it is stored in a suitable free area in DRAM. Each SoPEC is connected to the ISI bus or USB bus via its Serial communication Block (SCB). The SoPEC CPU configures the SCB to allow compressed data bands to pass from the USB or ISI through the SCB to SoPEC DRAM. Figure 11 shows an example data flow for a page destined to be printed by a single SoPEC. Band usage information is generated by the individual SoPECs and passed back to the host.

SoPEC has an addressing mechanism that permits circular band memory allocation, thus facilitating easy memory management. However it is not strictly necessary that all bands be stored together.

As long as the appropriate registers in SoPEC are set up for each band, and a given band is contiguous , the memory can be allocated in any way.

Although a band must contain at least one plane

Contiguous allocation also includes wrapping around in SoPECs band store memory.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

8.1 PRINT ENGINE EXAMPLE PAGE FORMAT

This section describes a possible format of compressed pages expected by the embedded CPU in SoPEC. The format is generated by software in the host PC and interpreted by embedded software in SoPEC. This section indicates the type of information in a page format structure, but implementations need not be limited to this format. The host PC can optionally perform the majority of the header processing.

The compressed format and the print engines are designed to allow real-time page expansion during printing, to ensure that printing is never interrupted in the middle of a page due to data underrun.

The page format described here is for a single black bi-level layer, a contone layer, and a Netpage tag layer. The black bi-level layer is defined to composite over the contone layer.

The black bi-level layer consists of a bitmap containing a 1 -bit opacity for each pixel. This black layer matte has a resolution which is an integer or non-integer factor of the printer’s dot resolution. The highest supported resolution is 1600 dpi, i.e. the printer’s full dot resolution.

The contone layer, optionally passed in as YCrCb, consists of a 24-bit CMY or 32-bit CMYK color for each pixel. This contone image has a resolution which is an integer or non-integer factor of the printer’s dot resolution. The requirement for a single SoPEC is to support 1 side per 2 seconds A4/Letter printing at a resolution of 267 ppi, i.e. one-sixth the printer’s dot resolution.

Non-integer scaling can be performed on both the contone and bi-level images. Only integer scaling can be performed on the tag data.

The black bi-level layer and the contone layer are both in compressed form for efficient storage in the printer’s internal memory.

8.1.1 Page structure

A single SoPEC is able to print with full edge bleed for Letter and A3 via different stitch part combinations of the bi-lithic printhead. It imposes no margins and so has a printable page area which corresponds to the size of its paper. The target page size is constrained by the printable page area, less the explicit (target) left and top margins specified in the page description. These relationships are illustrated below.

8.1.2 Compressed page format

Apart from being implicitly defined in relation to the printable page area, each page description is complete and self-contained. There is no data stored separately from the page description to which the page description refers.³ The page description consists of a page header which describes the size and resolution of the page, followed by one or more page bands which describe the actual page content.

8.1.2.1 Page header

Table 3 shows an example format of a page header.

³SoPEC relies on dither matrices and tag structures to have already been set up, but these are not considered to be part of a general page format. It is trivial to extend the page format to allow exact specification of dither matrices and tag structures.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

Table 3. Page header format

<td> field</td><td> format</td><td> description</td>

<td> signature</td><td> 16-bit integer</td><td> Page header format signature.</td>

<td> version</td><td> 16-bit integer</td><td> Page header format version number.</td>

<td> structure size</td><td> 16-bit integer</td><td> Size of page header.</td>

<td> band count</td><td> 16-bit integer</td><td> Number of bands specified for this page.</td>

<td> target resolution (dpi)</td><td> 16-bit integer</td><td> Resolution of target page. This is always 1600 for the Memjet printer.</td>

<td> target page width</td><td> 16-bit integer</td><td> Width of target page, in dots.</td>

<td> target page height</td><td> 32-bit integer</td><td> Height of target page, in dots.</td>

<td> target left margin for black and contone</td><td> 16-bit integer</td><td> Width of target left margin, in dots, for black and contone.</td>

<td> target top margin for black and contone</td><td> 16-bit integer</td><td> Height of target top margin, in dots, for black and contone.</td>

<td> target right margin for black and contone</td><td> 16-bit integer</td><td> Width of target right margin, in dots, for black and contone.</td>

<td> target bottom margin for black and contone</td><td> 16-bit integer</td><td> Height of target bottom margin, in dots, for black and contone.</td>

<td> target left margin for tags</td><td> 16-bit integer</td><td> Width of target left margin, in dots, for tags.</td>

<td> target top margin for tags</td><td> 16-bit integer</td><td> Height of target top margin, in dots, for tags.</td>

<td> target right margin for tags</td><td> 16-bit integer</td><td> Width of target right margin, in dots, for tags.</td>

<td> target bottom margin for tags</td><td> 16-bit integer</td><td> Height of target bottom margin, in dots, for tags.</td>

<td> generate tags</td><td> 16-bit integer</td><td> Specifies whether to generate tags for this page (0 - no, 1 - yes).</td>

<td> fixed tag data</td><td> 128-bit integer</td><td> This is only valid if generate tags is set.</td>

<td> tag vertical scale factor</td><td> 16-bit integer</td><td> Scale factor in vertical direction from tag data resolution to target resolution. Valid range = 1-511. Integer scaling only</td>

<td> tag horizontal scale factor</td><td> 16-bit integer</td><td> Scale factor in horizontal direction from tag data resolution to target resolution. Valid range = 1-511. Integer scaling only.</td>

<td> bi-level layer vertical scale factor</td><td> 16-bit integer</td><td> Scale factor in vertical direction from bi-level resolution to target resolution (must be 1 or greater). May be non-integer. Expressed as a fraction with upper 8-bits the numerator and the lower 8 bits the denominator.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td> bi-level layer horizontal scale factor</td><td> 16-bit integer</td><td> Scale factor in horizontal direction from bilevel resolution to target resolution (must be 1 or greater). May be non-integer. Expressed as a fraction with upper 8-bits the numerator and the lower 8 bits the denominator.</td>

<td> bi-level layer page width</td><td> 16-bit integer</td><td> Width of bi-level layer page, in pixels.</td>

<td> bi-level layer page height</td><td> 32-bit integer</td><td> Height of bi-level layer page, in pixels.</td>

<td> contone flags</td><td> 16 bit integer</td><td> Defines the color conversion that is required for the JPEG data. Bits 2-0 specify how many contone planes there are (e.g. 3 for CMY and 4 for CMYK). Bit 3 specifies whether the first 3 color planes need to be converted back from YCrCb to CMY. Only valid if b2-0 = 3 or 4. 0 - no conversion, leave JPEG colors alone 1 - color convert. Bits 7-4 specifies whether the YCrCb was generated directly from CMY, or whether it was converted to RGB first via the step: R = 255-C, G = 255-M, B = 255-Y. Each of the color planes can be individually inverted. Bit 4: 0 - do not invert color plane 0 1 - invert color plane 0 Bit 5: 0 - do not invert color plane 1 1 - invert color plane 1 Bit 6: 0 - do not invert color plane 2 1 - invert color plane 2 Bit 7: 0 - do not invert color plane 3 1 - invert color plane 3 Bit 8 specifies whether the contone data is JPEG compressed or non-com pressed: 0 - JPEG compressed 1 - non-com pressed The remaining bits are reserved (0).</td>

<td> contone vertical scale factor</td><td> 16-bit integer</td><td> Scale factor in vertical direction from contone channel resolution to target resolution. Valid</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td></td><td></td><td> range = 1-255. May be non-integer. Expressed as a fraction with upper 8-bits the numerator and the lower 8 bits the denominator.</td>

<td> contone horizontal scale factor</td><td> 16-bit integer</td><td> Scale factor in horizontal direction from contone channel resolution to target resolution. Valid range = 1-255. May be noninteger. Expressed as a fraction with upper 8-bits the numerator and the lower 8 bits the denominator.</td>

<td> contone page width</td><td> 16-bit integer</td><td> Width of contone page, in contone pixels.</td>

<td> contone page height</td><td> 32-bit integer</td><td> Height of contone page, in contone pixels.</td>

<td> reserved</td><td> up to 128 bytes</td><td> Reserved and 0 pads out page header to multiple of 128 bytes.</td>

The page header contains a signature and version which allow the CPU to identify the page header format. If the signature and/or version are missing or incompatible with the CPU, then the CPU can reject the page.

The contone flags define how many contone layers are present, which typically is used for defining whether the contone layer is CMY or CMYK. Additionally, if the color planes are CMY, they can be optionally stored as YCrCb, and further optionally color space converted from CMY directly or via RGB. Finally the contone data is specified as being either JPEG compressed or non-com pressed. The page header defines the resolution and size of the target page. The bi-level and contone layers are clipped to the target page if necessary. This happens whenever the bi-level or contone scale factors are not factors of the target page width or height.

The target left, top, right and bottom margins define the positioning of the target page within the printable page area.

The tag parameters specify whether or not Netpage tags should be produced for this page and what orientation the tags should be produced at (landscape or portrait mode). The fixed tag data is also provided.

The contone, bi-level and tag layer parameters define the page size and the scale factors.

8.1.2.2 Band format

Table 4 shows the format of the page band header.

Table 4. Band header format

<td> field</td><td> format</td><td> description</td>

<td> signature</td><td> 16-bit integer</td><td> Page band header format signature.</td>

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

<td> version</td><td> 16-bit integer</td><td> Page band header format version number.</td>

<td> structure size</td><td> 16-bit integer</td><td> Size of page band header.</td>

<td> bi-level layer band height</td><td> 16-bit integer</td><td> Height of bi-level layer band, in black pixels.</td>

<td> bi-level layer band data size</td><td> 32-bit integer</td><td> Size of bi-level layer band data, in bytes.</td>

<td> contone band height</td><td> 16-bit integer</td><td> Height of contone band, in contone pixels.</td>

<td> contone band data size</td><td> 32-bit integer</td><td> Size of contone plane band data, in bytes.</td>

<td> tag band height</td><td> 16-bit integer</td><td> Height of tag band, in dots.</td>

<td> tag band data size</td><td> 32-bit integer</td><td> Size of unencoded tag data band, in bytes. Can be 0 which indicates that no tag data is provided.</td>

<td> reserved</td><td> up to 128 bytes</td><td> Reserved and 0 pads out band header to multiple of 128 bytes.</td>

The bi-level layer parameters define the height of the black band, and the size of its compressed band data. The variable-size black data follows the page band header.

The contone layer parameters define the height of the contone band, and the size of its compressed page data. The variable-size contone data follows the black data.

The tag band data is the set of variable tag data half-lines as required by the tag encoder. The format of the tag data is found in Section 26.5.2. The tag band data follows the contone data. Table 5 shows the format of the variable-size compressed band data which follows the page band header.

Table 5. Page band data format

<td> field</td><td> format</td><td> Description</td>

<td> black data</td><td> Modified G4 facsimile bitstream⁴</td><td> Compressed bi-level layer.</td>

<td> contone data</td><td> JPEG bytestream</td><td> Compressed contone datalayer.</td>

<td> tag data map</td><td> Tag data array</td><td> Tag data format. See Section 26.5.2.</td>

The start of each variable-size segment of band data should be aligned to a 256-bit DRAM word boundary.

The following sections describe the format of the compressed bi-level layers and the compressed contone layer, section 26.5.1 on page 442 describes the format of the tag data structures.

8.1.2.3 Bi-level data compression

The (typically 1600 dpi) black bi-level layer is losslessly compressed using Silverbrook Modified Group 4 (SMG4) compression which is a version of Group 4 Facsimile compression [22] without Huffman and with simplified run length encodings. Typically compression ratios exceed 10:1. The encoding are listed in Table 6 and Table 7.

Table 6. Bi-Level group 4 facsimile style compression encodings

<td></td><td> Encoding</td><td> Description</td>

<td> same as Group 4</td><td> 1000</td><td> Pass Command: aO &lt;- b2, skip next two edges</td>

See section 8.1.2,3 on page 63 for note regarding the use of this standard

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

<td> Facsimile</td><td></td><td></td>

<td rowspan="5"></td><td> 1</td><td> Vertical(O): aO &lt;- b1, color = Icolor</td>

<td> 110</td><td> Vertical^ ): aO &lt;- b1 + 1, color = Icolor</td>

<td> 010</td><td> Vertical(-1 ): aO &lt;- b1 -1, color = icolor</td>

<td> 110000</td><td> Vertical(2): aO &lt;- b1 + 2, color = Icolor</td>

<td> 010000</td><td> Vertical(-2): aO &lt;- b1 - 2, color = Icolor</td>

<td> Unique to this implementation</td><td> 100000</td><td> Vertical(3): aO &lt;- b1 + 3, color = Icolor</td>

<td rowspan="2"></td><td> 000000</td><td> Vertical(-3): aO &lt;- b1 - 3, color = Icolor</td>

<td> &lt;RL&gt;&lt;RL&gt;100</td><td> Horizontal: aO &lt;- aO + &lt;RL&gt; + &lt;RL&gt;</td>

SMG4 has a pass through mode to cope with local negative compression. Pass through mode is activated by a special run-length code. Pass through mode continues to either end of line or for a pre-programmed number of bits, whichever is shorter. The special run-length code is always executed as a run-length code, followed by pass through. The pass through escape code is a medium length run-length with a run of less than or equal to 31.

Table 7. Run length (RL) encodings

<td></td><td> Encoding</td><td> Description</td>

<td> Unique to this implementation</td><td> RRRRR1</td><td> Short Black Runlength (5 bits)</td>

<td></td><td> RRRRR1</td><td> Short White Runlength (5 bits)</td>

<td></td><td> RRRRRRRRRR10</td><td> Medium Black Runlength (10 bits)</td>

<td></td><td> RRRRRRRR10</td><td> Medium White Runlength (8 bits)</td>

<td></td><td> RRRRRRRRRR10</td><td> Medium Black Runlength with RRRRRRRRRR &lt;= 31, Enter pass through</td>

<td></td><td> RRRRRRRR10</td><td> Medium White Runlength with RRRRRRRR &lt;= 31, Enter pass through</td>

<td></td><td> RRRRRRRRRRRRRRR00</td><td> Long Black Runlength (15 bits)</td>

<td></td><td> RRRRRRRRRRRRRRR00</td><td> Long White Runlength (15 bits)</td>

Since the compression is a bitstream, the encodings are read right (least significant bit) to left (most significant bit). The run lengths given as RRRR in Table are read in the same way (least significant bit at the right to most significant bit at the left).

Each band of bi-level data is optionally self contained. The first line of each band therefore is based on a ‘previous’ blank line or the last line of the previous band.

8.1.2.3.1 Group 3 and 4 facsimile compression

The Group 3 Facsimile compression algorithm [22] losslessly compresses bi-level data for transmission over slow and noisy telephone lines. The bi-level data represents scanned black text and graphics on a white background, and the algorithm is tuned for this class of images (it is explicitly not tuned, for example, for halftoned bi-level images). The 1D Group 3 algorithm

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 runlength-encodes each scanline and then Huffman-encodes the resulting runlengths. Runlengths in the range 0 to 63 are coded with terminating codes. Runlengths in the range 64 to 2623 are coded with make-up codes, each representing a multiple of 64, followed by a terminating code. Runlengths exceeding 2623 are coded with multiple make-up codes followed by a terminating code. The Huffman tables are fixed, but are separately tuned for black and white runs (except for make-up codes above 1728, which are common). When possible, the 2D Group 3 algorithm encodes a scanline as a set of short edge deltas (0, +1, +2, +3) with reference to the previous scanline. The delta symbols are entropy-encoded (so that the zero delta symbol is only one bit long etc.) Edges within a 2D-encoded line which can’t be delta-encoded are runlength-encoded, and are identified by a prefix. 1D- and 2D-encoded lines are marked differently. 1 D-encoded lines are generated at regular intervals, whether actually required or not, to ensure that the decoder can recover from line noise with minimal image degradation. 2D Group 3 achieves compression ratios of up to 6:1 [32], The Group 4 Facsimile algorithm [22] losslessly compresses bi-level data for transmission over error-free communications lines (i.e. the lines are truly error-free, or error-correction is done at a lower protocol level). The Group 4 algorithm is based on the 2D Group 3 algorithm, with the essential modification that since transmission is assumed to be error-free, ID-encoded lines are no longer generated at regular intervals as an aid to error-recovery. Group 4 achieves compression ratios ranging from 20:1 to 60:1 for the CCITT set of test images [32].

The design goals and performance of the Group 4 compression algorithm qualify it as a compression algorithm for the bi-level layers. However, its Huffman tables are tuned to a lower scanning resolution (100-400 dpi), and it encodes runlengths exceeding 2623 awkwardly.

8.1.2.4 Contone data compression

The contone layer (CMYK) is either a non-com pressed bytestream or is compressed to an interleaved JPEG bytestream. The JPEG bytestream is complete and self-contained. It contains all data required for decompression, including quantization and Huffman tables.

The contone data is optionally converted to YCrCb before being compressed (there is no specific advantage in color-space converting if not compressing). Additionally, the CMY contone pixels are optionally converted (on an individual basis) to RGB before color conversion using R=255-C, G=255-M, B=255-Y. Optional bitwise inversion of the K plane may also be performed. Note that this CMY to RGB conversion is not intended to be accurate for display purposes, but rather for the purposes of later converting to YCrCb. The inverse transform will be applied before printing.

8.1.2.4.1 JPEG compression

The JPEG compression algorithm [27] lossily compresses a contone image at a specified quality level. It introduces imperceptible image degradation at compression ratios below 5:1, and negligible image degradation at compression ratios below 10:1 [33].

JPEG typically first transforms the image into a color space which separates luminance and chrominance into separate color channels. This allows the chrominance channels to be subsampled without appreciable loss because of the human visual system’s relatively greater sensitivity to luminance than chrominance. After this first step, each color channel is compressed separately.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

The image is divided into 8x8 pixel blocks. Each block is then transformed into the frequency domain via a discrete cosine transform (DCT). This transformation has the effect of concentrating image energy in relatively lower-frequency coefficients, which allows higher-frequency coefficients to be more crudely quantized. This quantization is the principal source of compression in JPEG. Further compression is achieved by ordering coefficients by frequency to maximize the likelihood of adjacent zero coefficients, and then runlength-encoding runs of zeroes. Finally, the runlengths and non-zero frequency coefficients are entropy coded. Decompression is the inverse process of compression.

8.1.2.4.2 Non-com pressed format

If the contone data is non-com pressed, it must be in a block-based format bytestream with the same pixel order as would be produced by a JPEG decoder. The bytestream therefore consists of a series of 8x8 block of the original image, starting with the top left 8x8 block, and working horizontally across the page (as it will be printed) until the top rightmost 8x8 block, then the next row of 8x8 blocks (left to right) and so on until the lower row of 8x8 blocks (left to right). Each 8x8 block consists of 64 8-bit pixels for color plane 0 (representing 8 rows of 8 pixels in the order top left to bottom right) followed by 64 8-bit pixels for color plane 1 and so on for up to a maximum of 4 color planes.

If the original image is not a multiple of 8 pixels in X or Y, padding must be present (the extra pixel data will be ignored by the setting of margins).

8.1.2.4.3 Compressed format

If the contone data is compressed the first memory band contains JPEG headers (including tables) plus MCUs (minimum coded units). The ratio of space between the various color planes in the JPEG stream is 1:1:1:1. No subsampling is permitted. Banding can be completely arbitrary i.e there can be multiple JPEG images per band or 1 JPEG image divided over multiple bands. The break between bands is only memory alignment based.

8.1.2.4.4 Conversion of RGB to YCrCb (in RIP)

YCrCb is defined as per CCIR 601-1 [24] except that Y, Cr and Cb are normalized to occupy all 256 levels of an 8-bit binary encoding and take account of the actual hardware implementation of the inverse transform within SoPEC.

The exact color conversion computation is as follows:

• Y* = (9805/32768)R + (19235/32768)G + (3728/32768)B • Cr* = (16375/32768)R - (13716/32768)G - (2659/32768)B + 128 • Cb* = -(5529/32768)R - (10846/32768)G + (16375/32768)B + 128

Y, Cr and Cb are obtained by rounding to the nearest integer. There is no need for saturation since ranges of Y*, Cr* and Cb* after rounding are [0-255], [1-255] and [1-255] respectively. Note that full accuracy is possible with 24 bits. See [14] for more information.

SoPEC ASIC

Overview

The Small Office Home Office Print Engine Controller (SoPEC) is a page rendering engine ASIC that takes compressed page images as input, and produces decompressed page images at up to 6

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 channels of bi-level dot data as output. The bi-level dot data is generated for the Memjet bi-lithic printhead. The dot generation process takes account of printhead construction, dead nozzles, and allows for fixative generation.

A single SoPEC can control 2 bi-lithic printheads and up to 6 color channels at 10,000 lines/sec⁵, equating to 30 pages per minute. A single SoPEC can perform full-bleed printing of A3, A4 and Letter pages. The 6 channels of colored ink are the expected maximum in a consumer SOHO, or office Bi-lithic printing environment:

• CMY, for regular color printing.

• K, for black text, line graphics and gray-scale printing.

• IR (infrared), for Netpage-enabled [5] applications.

• F (fixative), to enable printing at high speed. Because the bi-lithic printer is capable of printing so fast, a fixative may be required to enable the ink to dry before the page touches the page already printed. Otherwise the pages may bleed on each other. In low speed printing environments the fixative may not be required.

SoPEC is color space agnostic. Although it can accept contone data as CMYX or RGBX, where X is an optional 4th channel, it also can accept contone data in any print color space. Additionally, SoPEC provides a mechanism for arbitrary mapping of input channels to output channels, including combining dots for ink optimization, generation of channels based on any number of other channels etc. However, inputs are typically CMYK for contone input, K for the bi-level input, and the optional Netpage tag dots are typically rendered to an infra-red layer. A fixative channel is typically generated for fast printing applications.

SoPEC is resolution agnostic. It merely provides a mapping between input resolutions and output resolutions by means of scale factors. The expected output resolution is 1600 dpi, but SoPEC actually has no knowledge of the physical resolution of the Bi-lithic printhead.

SoPEC is page-length agnostic. Successive pages are typically split into bands and downloaded into the page store as each band of information is consumed and becomes free.

SoPEC provides an interface for synchronization with other SoPECs. This allows simple multiSoPEC solutions for simultaneous A3/A4/Letter duplex printing. However, SoPEC is also capable of printing only a portion of a page image. Combining synchronization functionality with partial page rendering allows multiple SoPECs to be readily combined for alternative printing requirements including simultaneous duplex printing and wide format printing.

Table 8 lists some of the features and corresponding benefits of SoPEC.

Table 8. Features and Benefits of SoPEC

<td> Feature</td><td> Benefits</td>

<td> Optimised print architecture in hardware</td><td> 30ppm full page photographic quality color printing from a desktop PC</td>

⁵10,000 lines per second equates to 30 A4/Letter pages per minute at 1600 dpi

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td> 0.13micron CMOS (&gt;3 million transistors)</td><td> High speed Low cost High functionality</td>

<td> 900 Million dots per second</td><td> Extremely fast page generation</td>

<td> 10,000 lines per second at 1600 dpi</td><td> 0.5 A4/Letter pages per SoPEC chip per second</td>

<td> 1 chip drives up to 133,920 nozzles</td><td> Low cost page-width printers</td>

<td> 1 chip drives up to 6 color planes</td><td> 99% of SoHo printers can use 1 SoPEC device</td>

<td> Integrated DRAM</td><td> No external memory required, leading to low cost systems</td>

<td> Power saving sleep mode</td><td> SoPEC can enter a power saving sleep mode to reduce power dissipation between print jobs</td>

<td> JPEG expansion</td><td> Low bandwidth from PC Low memory requirements in printer</td>

<td> Lossless bitplane expansion</td><td> High resolution text and line art with low bandwidth from PC (e.g. over USB)</td>

<td> Netpage tag expansion</td><td> Generates interactive paper</td>

<td> Stochastic dispersed dot dither</td><td> Optically smooth image quality No moire effects</td>

<td> Hardware compositor for 6 image planes</td><td> Pages composited in real-time</td>

<td> Dead nozzle compensation</td><td> Extends printhead life and yield Reduces printhead cost</td>

<td> Color space agnostic</td><td> Compatible with all inksets and image sources including RGB, CMYK, spot, CIE L*a*b*, hexachrome, YCrCbK, sRGB and other</td>

<td> Color space conversion</td><td> Higher quality / lower bandwidth</td>

<td> Computer interface</td><td> USB1.1 interface to host and ISI interface to ISI-Bridge chip thereby allowing connection to IEEE 1394, Bluetooth etc.</td>

<td> Cascadable in resolution</td><td> Printers of any resolution</td>

<td> Cascadable in color depth</td><td> Special color sets e.g. hexachrome can be used</td>

<td> Cascadable in image size</td><td> Printers of any width up to 16 inches</td>

<td> Cascadable in pages</td><td> Printers can print both sides simultaneously</td>

<td> Cascadable in speed</td><td> Higher speeds are possible by having each SoPEC print one vertical strip of the page.</td>

<td> Fixative channel data generation</td><td> Extremely fast ink drying without wastage</td>

<td> Built-in security</td><td> Revenue models are protected</td>

<td> Undercolor removal on dot-by-dot basis</td><td> Reduced ink usage</td>

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

<td> Does not require fonts for high speed operation</td><td> No font substitution or missing fonts</td>

<td> Flexible printhead configuration</td><td> Many configurations of printheads are supported by one chip type</td>

<td> Drives Bi-lithic printheads directly</td><td> No print driver chips required, results in lower cost</td>

<td> Determines dot accurate ink usage</td><td> Removes need for physical ink monitoring system in ink cartridges</td>

9.1 Printing rates

The required printing rate for SoPEC is 30 sheets per minute with an inter-sheet spacing of 4 cm.

To achieve a 30 sheets per minute print rate, this requires:

300mm x 63 (dot/mm) 12 sec = 105.8 μseconds per line, with no inter-sheet gap.

340mm x 63 (dot/mm) / 2 sec = 93.3 μseconds per line, with a 4 cm inter-sheet gap.

A Printline for an A4 page consists of 13824 nozzles across the page [2]. At a system clock rate of 160 MHz 13824 dots of data can be generated in 86.4 pseconds. Therefore data can be generated fast enough to meet the printing speed requirement. It is necessary to deliver this print data to the print-heads.

Printheads can be made up of 5:5, 6:4, 7:3 and 8:2 inch printhead combinations [2], Print data is transferred to both print heads in a pair simultaneously. This means the longest time to print a line is determined by the time to transfer print data to the longest print segment. There are 9744 nozzles across a 7 inch printhead. The print data is transferred to the printhead at a rate of 106 MHz (2/3 of the system clock rate) per color plane. This means that it will take 91.9 με to transfer a single line for a 7:3 printhead configuration. So we can meet the requirement of 30 sheets per minute printing with a 4 cm gap with a 7:3 printhead combination. There are 11160 across an 8 inch printhead. To transfer the data to the printhead at 106 MHz will take 105.3 με. So an 8:2 printhead combination printing with an inter-sheet gap will print slower than 30 sheets per minute.

9.2 SOPEC BASIC ARCHITECTURE

From the highest point of view the SoPEC device consists of 3 distinct subsystems • CPU Subsystem • DRAM Subsystem • Print Engine Pipeline (PEP) Subsystem

See Figure 13 for a block level diagram of SoPEC.

9.2.1 CPU Subsystem

The CPU subsystem controls and configures all aspects of the other subsystems. It provides general support for interfacing and synchronising the external printer with the internal print engine. It also controls the low speed communication to the QA chips. The CPU subsystem contains various peripherals to aid the CPU, such as GPIO (includes motor control), interrupt controller, LSS Master and general timers. The Serial Communications Block (SCB) on the CPU subsystem provides a full speed USB1.1 interface to the host as well as an Inter SoPEC Interface (ISI) to other SoPEC devices.

9.2.2 DRAM Subsystem

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

The DRAM subsystem accepts requests from the CPU, Serial Communications Block (SCB) and blocks within the PEP subsystem. The DRAM subsystem (in particular the DIU) arbitrates the various requests and determines which request should win access to the DRAM. The DIU arbitrates based on configured parameters, to allow sufficient access to DRAM for all requestors. The DIU also hides the implementation specifics of the DRAM such as page size, number of banks, refresh rates etc.

9.2.3 Print Engine Pipeline (PEP) subsystem

The Print Engine Pipeline (PEP) subsystem accepts compressed pages from DRAM and renders them to bi-level dots for a given print line destined for a printhead interface that communicates directly with up to 2 segments of a bi-lithic printhead.

The first stage of the page expansion pipeline is the CDU, LBD and TE. The CDU expands the JPEG-compressed contone (typically CMYK) layer, the LBD expands the compressed bi-level layer (typically K), and the TE encodes Netpage tags for later rendering (typically in IR or K ink). The output from the first stage is a set of buffers: the CFU, SFU, and TFU. The CFU and SFU buffers are implemented in DRAM.

The second stage is the HCU, which dithers the contone layer, and composites position tags and the bi-level spotO layer over the resulting bi-level dithered layer. A number of options exist for the way in which compositing occurs. Up to 6 channels of bi-level data are produced from this stage. Note that not all 6 channels may be present on the printhead. For example, the printhead may be CM Y only, with K pushed into the CMY channels and IR ignored. Alternatively, the position tags may be printed in K if IR ink is not available (or for testing purposes).

The third stage (DNC) compensates for dead nozzles in the printhead by color redundancy and error diffusing dead nozzle data into surrounding dots.

The resultant bi-level 6 channel dot-data (typically CMYK-IRF) is buffered and written out to a set of line buffers stored in DRAM via the DWU.

Finally, the dot-data is loaded back from DRAM, and passed to the printhead interface via a dot FIFO. The dot FIFO accepts data from the LLU at the system clock rate (pc/fc), while the PHI removes data from the FIFO and sends it to the printhead at a rate of 2/3 times the system clock rate (see Section 9.1).

9.3 SoPEC Block Description

Looking at Figure 13, the various units are described here in summary form:

Table 9. Units within SoPEC

<td> Subsystem</td><td> Unit Acronym</td><td> Unit Name</td><td> Description</td>

<td> DRAM</td><td> DIU</td><td> DRAM interface unit</td><td> Provides the interface for DRAM read and write access for the various SoPEC units, CPU and the SCB block. The DIU provides arbitration between competing units controls DRAM</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td></td><td></td><td></td><td> access.</td>

<td></td><td> DRAM</td><td> Embedded DRAM</td><td> 20Mbits of embedded DRAM,</td>

<td> CPU</td><td> CPU</td><td> Central Processing Unit</td><td> CPU for system configuration and control</td>

<td></td><td> MMU</td><td> Memory Management Unit</td><td> Limits access to certain memory address areas in CPU user mode</td>

<td></td><td> RDU</td><td> Real-time Debug Unit</td><td> Facilitates the observation of the contents of most of the CPU addressable registers in SoPEC in addition to some pseudo-registers in realtime.</td>

<td></td><td> TIM</td><td> General Timer</td><td> Contains watchdog and general system timers</td>

<td></td><td> LSS</td><td> Low Speed Serial Interfaces</td><td> Low level controller for interfacing with the QA chips</td>

<td></td><td> GPIO</td><td> General Purpose IOs</td><td> General IO controller, with built-in Motor control unit, LED pulse units and de-glitch circuitry</td>

<td></td><td> ROM</td><td> Boot ROM</td><td> 16 KBytes of System Boot ROM code</td>

<td></td><td> ICU</td><td> Interrupt Controller Unit</td><td> General Purpose interrupt controller with configurable priority, and masking.</td>

<td></td><td> CPR</td><td> Clock, Power and Reset block</td><td> Central Unit for controlling and generating the system clocks and resets and powerdown mechanisms</td>

<td></td><td> PSS</td><td> Power Save Storage</td><td> Storage retained while system is powered down</td>

<td></td><td> USB</td><td> Universal Serial Bus Device</td><td> USB device controller for interfacing with the host USB.</td>

<td></td><td> ISI</td><td> Inter-SoPEC Interface</td><td> ISI controller for data and control communication with other SoPEC’s in a multiSoPEC system</td>

<td></td><td> SCB</td><td> Serial Communication Block</td><td> Contains both the USB and ISI blocks.</td>

<td> Print Engine Pipeline (PEP)</td><td> PCU</td><td> PEP controller</td><td> Provides external CPU with the means to read and write PEP Unit registers, and read and write DRAM in single 32-bit chunks.</td>

<td></td><td> CDU</td><td> Contone decoder unit</td><td> Expands JPEG compressed contone layer and writes decompressed contone to DRAM</td>

<td></td><td> CFU</td><td> Contone FIFO Unit</td><td> Provides line buffering between CDU and HCU</td>

<td></td><td> LBD</td><td> Lossless Bi-level Decoder</td><td> Expands compressed bi-level layer.</td>

<td></td><td> SFU</td><td> Spot FIFO Unit</td><td> Provides line buffering between LBD and HCU</td>

<td></td><td> TE</td><td> Tag encoder</td><td> Encodes tag data into line of tag dots.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td></td><td> TFU</td><td> Tag FIFO Unit</td><td> Provides tag data storage between TE and HCU</td>

<td></td><td> HCU</td><td> Halftoner compositor unit</td><td> Dithers contone layer and composites the bilevel spot 0 and position tag dots.</td>

<td></td><td> DNC</td><td> Dead Nozzle Compensator</td><td> Compensates for dead nozzles by color redundancy and error diffusing dead nozzle data into surrounding dots.</td>

<td></td><td> DWU</td><td> Dotline Writer Unit</td><td> Writes out the 6 channels of dot data for a given Printline to the line store DRAM</td>

<td></td><td> LLU</td><td> Line Loader Unit</td><td> Reads the expanded page image from line store, formatting the data appropriately for the bi-lithic printhead.</td>

<td></td><td> PHI</td><td> PrintHead Interface</td><td> Is responsible for sending dot data to the bilithic printheads and for providing line synchronization between multiple SoPECs. Also provides test interface to printhead such as temperature monitoring and Dead Nozzle Identification.</td>

9.4 Addressing scheme in SoPEC

SoPEC must address • 20 Mbit DRAM.

• PCU addressed registers in PEP.

• CPU-subsystem addressed registers.

SoPEC has a unified address space with the CPU capable of addressing all CPU-subsystem and PCU-bus accessible registers (in PEP) and all locations in DRAM. The CPU generates byte-aligned addresses for the whole of SoPEC.

bits are sufficient to byte address the whole SoPEC address space.

9.4.1 DRAM addressing scheme

The embedded DRAM is composed of 256-bit words. However the CPU-subsystem may need to write individual bytes of DRAM. Therefore it was decided to make the DIU byte addressable. 22 bits are required to byte address 20 Mbits of DRAM.

Most blocks read or write 256-bit words of DRAM. Therefore only the top 17 bits i.e. bits 21 to 5 are required to address 256-bit word aligned locations.

The exceptions are • CDU which can write 64-bits so only the top 19 address bits i.e. bits 21-3 are required.

• The CPU-subsystem always generates a 22-bit byte-aligned DIU address but it will send flags to the DIU indicating whether it is an 8, 16 or 32-bit write.

All DIU accesses must be within the same 256-bit aligned DRAM word.

9.4.2 PEP Unit DRAM addressing

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

PEP Unit configuration registers which specify DRAM locations should specify 256-bit aligned DRAM addresses i.e. using address bits 21:5. Legacy blocks from PEC1 e.g. the LBD and TE may need to specify 64-bit aligned DRAM addresses if these reused blocks DRAM addressing is difficult to modify. These 64-bit aligned addresses require address bits 21:3. However, these 64-bit aligned addresses should be programmed to start at a 256-bit DRAM word boundary.

Unlike PEC1, there are no constraints in SoPEC on data organization in DRAM except that all data structures must start on a 256-bit DRAM boundary. If data stored is not a multiple of 256-bits then the last word should be padded.

9.4.3 CPU subsystem bus addressed registers

The CPU subsystem bus supports 32-bit word aligned read and write accesses with variable access timings. See section 11.4 for more details of the access protocol used on this bus. The CPU subsystem bus does not currently support byte reads and writes but this can be added at a later date if required by imported IP.

9.4.4 PCU addressed registers in PEP

The PCU only supports 32-bit register reads and writes for the PEP blocks. As the PEP blocks only occupy a subsection of the overall address map and the PCU is explicitly selected by the MMU when a PEP block is being accessed the PCU does not need to perform a decode of the higherorder address bits. See Table 11 for the PEP subsystem address map.

9.5 SoPEC Memory Map

9.5.1 Main memory map

The system wide memory map is shown in Figure 14 below. The memory map is discussed in detail in Section 1111 Centra! Processing Unit (CPU).

9.5.2 CPU-bus peripherals address map

The address mapping for the peripherals attached to the CPU-bus is shown in Table 10 below. The MMU performs the decode of cpu_adr[21:12] to generate the relevant cpu_block_select signal for each block. The addressed blocks decode however many of the lower order bits of cpu_adr[11:2] are required to address all the registers within the block.

Table 10. CPU-bus peripherals address map

<td> Block_base</td><td> Address</td>

<td> ROM_base</td><td> 0x0000_0000</td>

<td> MMU_base</td><td> 0x0001_0000</td>

<td> TIM_base</td><td> 0x0001_1000</td>

<td> LSS_base</td><td> 0x0001_2000</td>

<td> GPIO_base</td><td> 0x0001_3000</td>

<td> SCB_base</td><td> 0x0001_4000</td>

<td> ICU_base</td><td> 0x0001_5000</td>

<td> CPR_base</td><td> 0x0001_6000</td>

<td> DIU_base</td><td> 0x0001_7000</td>

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

<td> PSS_base</td><td> 0x0001_8000</td>

<td> Reserved</td><td> 0x0001_9000 to 0x0001_FFFF</td>

<td> PCU_base</td><td> 0x0002_0000 to 0x0002_BFFF</td>

9.5.3 PCU Mapped Registers (PEP blocks) address map

The PEP blocks are addressed via the PCU. From Figure 14, the PCU mapped registers are in the range 0x0002_0000 to 0x0002_BFFF. From Table 11 it can be seen that there are 12 sub-blocks within the PCU address space. Therefore, only four bits are necessary to address each of the sub5 blocks within the PEP part of SoPEC. A further 12 bits may be used to address any configurable register within a PEP block. This gives scope for 1024 configurable registers per sub-block (the PCU mapped registers are all 32-bit addressed registers so the upper 10 bits are required to individually address them). This address will come either from the CPU or from a command stored in DRAM. The bus is assembled as follows:

· address[15:12] = sub-block address, • address[n:2] = register address within sub-block, only the number of bits required to decode the registers within each sub-block are used, • address[1:0] = byte address, unused as PCU mapped registers are all 32-bit addressed registers.

So for the case of the HCU, its addresses range from 0x7000 to 0x7FFF within the PEP subsystem or from 0x0002_7000 to 0x0002_7FFF in the overall system.

Table 11. PEP blocks address map

<td> Block_base</td><td> Address</td>

<td> PCU_base</td><td> 0x0002_0000</td>

<td> CDU_base</td><td> 0x0002_1000</td>

<td> CFU_base</td><td> 0x0002_2000</td>

<td> LBD_base</td><td> 0x0002_3000</td>

<td> SFU_base</td><td> 0x0002_4000</td>

<td> TE_base</td><td> 0x0002_5000</td>

<td> TFU_base</td><td> 0x0002_6000</td>

<td> HCU_base</td><td> 0x0002_7000</td>

<td> DNC_base</td><td> 0x0002^8000</td>

<td> DWU_base</td><td> 0x0002_9000</td>

<td> LLU_base</td><td> Ox0002_AOOO</td>

<td> PHI_base</td><td> OxOOQ2_BOOO to 0x0002_BFFF</td>

9.6 Buffer management in SoPEC

As outlined in Section 9.1, SoPEC has a requirement to print 1 side every 2 seconds i.e. 30 sides per minute.

9.6.1 Page buffering

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

Approximately 2 Mbytes of DRAM are reserved for compressed page buffering in SoPEC. If a page is compressed to fit within 2 Mbyte then a complete page can be transferred to DRAM before printing. However, the time to transfer 2 Mbyte using USB 1.1 is approximately 2 seconds. The worst case cycle time to print a page then approaches 4 seconds. This reduces the worst-case print speed to 15 pages per minute.

9.6.2 Band buffering

The SoPEC page-expansion blocks support the notion of page banding. The page can be divided into bands and another band can be sent down to SoPEC while we are printing the current band. Therefore we can start printing once at least one band has been downloaded.

The band size granularity should be carefully chosen to allow efficient use of the USB bandwidth and DRAM buffer space. It should be small enough to allow seamless 30 sides per minute printing but not so small as to introduce excessive CPU overhead in orchestrating the data transfer and parsing the band headers. Band-finish interrupts have been provided to notify the CPU of free buffer space. It is likely that the host PC will supervise the band transfer and buffer management instead of the SoPEC CPU.

If SoPEC starts printing before the complete page has been transferred to memory there is a risk of a buffer underrun occurring if subsequent bands are not transferred to SoPEC in time e.g. due to insufficient USB bandwidth caused by another USB peripheral consuming USB bandwidth. A buffer underrun occurs if a line synchronisation pulse is received before a line of data has been transferred to the printhead and causes the print job to fail at that line. If there is no risk of buffer underrun then printing can safely start once at least one band has been downloaded.

If there is a risk of a buffer underrun occurring due to an interruption of compressed page data transfer, then the safest approach is to only start printing once we have loaded up the data for a complete page. This means that a worst case latency in the region of 2 seconds (with USB1.1 ) will be incurred before printing the first page. Subsequent pages will take 2 seconds to print giving us the required sustained printing rate of 30 sides per minute.

A Storage SoPEC (Section 7.2.5) could be added to the system to provide guaranteed bandwidth data delivery. The print system could also be constructed using an ISI-Bridge chip (Section 7.2.6) to provide guaranteed data delivery.

The most efficient page banding strategy is likely to be determined on a per page/ print job basis and so SoPEC will support the use of bands of any size.

SoPEC Use Cases

10.1 Introduction

This chapter is intended to give an overview of a representative set of scenarios or use cases which SoPEC can perform. SoPEC is by no means restricted to the particular use cases described and not every SoPEC system is considered here.

In this chapter we discuss SoPEC use cases under four headings:

1) Normal operation use cases.

2) Security use cases.

3) Miscellaneous use cases.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

4) Failure mode use cases.

Use cases for both single and multi-SoPEC systems are outlined.

Some tasks may be composed of a number of sub-tasks.

The realtime requirements for SoPEC software tasks are discussed in “ 11 Central Processing Unit (CPU)” under Section 11.3 Realtime requirements.

10.2 Normal operation in a single SoPEC System with USB Host connection

SoPEC operation is broken up into a number of sections which are outlined below. Buffer management in a SoPEC system is normally performed by the host

10.2.1 Powerup

Powerup describes SoPEC initialisation following an external reset or the watchdog timer system reset.

A typical powerup sequence is:

) Execute reset sequence for complete SoPEC.

2) CPU boot from ROM.

3) Basic configuration of CPU peripherals, SCB and DIU. DRAM initialisation. USB Wakeup.

4) Download and authentication of program (see Section 10.5.2).

5) Execution of program from DRAM.

6) Retrieve operating parameters from PRINTER_QA and authenticate operating parameters.

7) Download and authenticate any further datasets.

10.2.2 USB wakeup

The CPU can put different sections of SoPEC into sleep mode by writing to registers in the CPR block (chapter 16). Normally the CPU sub-system and the DRAM will be put in sleep mode but the SCB and power-safe storage (PSS) will still be enabled.

Wakeup describes SoPEC recovery from sleep mode with the SCB and power-safe storage (PSS) still enabled. In a single SoPEC system, wakeup can be initiated following a USB reset from the SCB.

A typical USB wakeup sequence is:

) Execute reset sequence for sections of SoPEC in sleep mode.

2) CPU boot from ROM, if CPU-subsystem was in sleep mode.

3) Basic configuration of CPU peripherals and DIU, and DRAM initialisation, if required.

4) Download and authentication of program using results in Power-Safe Storage (PSS) (see Section 10.5.2).

5) Execution of program from DRAM.

6) Retrieve operating parameters from PRINTER_QA and authenticate operating parameters.

7) Download and authenticate using results in PSS of any further datasets (programs).

10.2.3 Print initialization

This sequence is typically performed at the start of a print job following powerup or wakeup:

) Check amount of ink remaining via QA chips.

2) Download static data e.g. dither matrices, dead nozzle tables from host to DRAM.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

3) Check printhead temperature, if required, and configure printhead with firing pulse profile etc. accordingly.

4) Initiate printhead pre-heat sequence, if required.

10.2.4 First page download

Buffer management in a SoPEC system is normally performed by the host.

First page, first band download and processing:

) The host communicates to the SoPEC CPU over the USB to check that DRAM space remaining is sufficient to download the first band.

2) The host downloads the first band (with the page header) to DRAM.

3) When the complete page header has been downloaded the SoPEC CPU processes the page header, calculates PEP register commands and writes directly to PEP registers or to DRAM.

4) If PEP register commands have been written to DRAM, execute PEP commands from DRAM via PCU.

Remaining bands download and processing:

) Check DRAM space remaining is sufficient to download the next band.

2) Download the next band with the band header to DRAM.

3) When the complete band header has been downloaded, process the band header according to whichever band-related register updating mechanism is being used.

10.2.5 Start printing ) Wait until at least one band of the first page has been downloaded.

One approach is to only start printing once we have loaded up the data for a complete page. If we start printing before the complete page has been transferred to memory we run the risk of a buffer underrun occurring because compressed page data was not transferred to SoPEC in time e.g. due to insufficient USB bandwidth caused by another USB peripheral consuming USB bandwidth.

2) Start all the PEP Units by writing to their Go registers, via PCU commands executed from DRAM or direct CPU writes. A rapid startup order for the PEP units is outlined in Table 12. Table 12. Typical PEP Unit startup order for printing a page.

<td> Step#</td><td> Unit</td>

<td> 1</td><td> DNC</td>

<td> 2</td><td> DWU</td>

<td> 3</td><td> HCU</td>

<td> 4</td><td> PHI</td>

<td> 5</td><td> LLU</td>

<td> 6</td><td> CFU, SFU, TFU</td>

<td> 7</td><td> CDU</td>

<td> 8</td><td> TE, LBD</td>

3) Print ready interrupt occurs (from PHI).

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

4) Start motor control, if first page, otherwise feed the next page. This step could occur before the print ready interrupt.

5) Drive LEDs, monitor paper status.

6) Wait for page alignment via page sensor(s) GPIO interrupt.

7) CPU instructs PHI to start producing line syncs and hence commence printing, or wait for an external device to produce line syncs.

8) Continue to download bands and process page and band headers for next page.

10.2.6 Next page(s) download

As for first page download, performed during printing of current page.

10.2.7 Between bands

When the finished band flags are asserted band related registers in the CDU, LBD, TE need to be re-programmed before the subsequent band can be printed. This can be via PCU commands from DRAM. Typically only 3-5 commands per decompression unit need to be executed. These registers can also be reprogrammed directly by the CPU or most likely by updating from shadow registers. The finished band flag interrupts the CPU to tell the CPU that the area of memory associated with the band is now free.

10.2.8 During page print

Typically during page printing ink usage is communicated to the QA chips.

) Calculate ink printed (from PHI).

2) Decrement ink remaining (via QA chips).

3) Check amount of ink remaining (via QA chips). This operation may be better performed while the page is being printed rather than at the end of the page.

10.2.9 Page finish

These operations are typically performed when the page is finished:

) Page finished interrupt occurs from PHI.

2) Shutdown the PEP blocks by de-asserting their Go registers. A typical shutdown order is defined in Table 13. This will set the PEP Unit state-machines to their idle states without resetting their configuration registers.

3) Communicate ink usage to QA chips, if required.

Table 13. End of page shutdown order for PEP Units.

<td> Step#</td><td> Unit</td>

<td> 1</td><td> PHI (will shutdown by itself in the normal case at the end of a page)</td>

<td> 2</td><td> DWU (shutting this down stalls the DNC and therefore the HCU and above)</td>

<td> 3</td><td> LLU (should already be halted due to PHI at end of last line of page)</td>

<td> 4</td><td> TE (this is the only dot supplier likely to be running, halted by the HCU)</td>

<td> 5</td><td> CDU (this is likely to already be halted due to end of contone band)</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td> 6</td><td> CFU, SFU, TFU, LBD (order unimportant, and should already be halted due to end of band)</td>

<td> 7</td><td> HCU, DNC (order unimportant, should already have halted)</td>

10.2.10 Start of next page

These operations are typically performed before printing the next page:

1) Re-program the PEP Units via PCU command processing from DRAM based on page header.

2) Go to Start printing.

10.2.11 End of document ) Stop motor control.

10.2.12 Sleep mode

The CPU can put different sections of SoPEC into sleep mode by writing to registers in the CPR block described in Section 16.

) Instruct host PC via USB that SoPEC is about to sleep.

2) Store reusable authentication results in Power-Safe Storage (PSS).

3) Put SoPEC into defined sleep mode.

10.3 Normal operation in a Multi-SoPEC System - ISIMaster SoPEC

In a multi-SoPEC system the host generally manages program and compressed page download to all the SoPECs. Inter-SoPEC communication is over the ISl link which will add a latency.

In the case of a multi-SoPEC system with just one USB 1.1 connection, the SoPEC with the USB connection is the ISIMaster. The ISI-bridge chip is the ISIMaster in the case of an ISI-Bridge SoPEC configuration. While it is perfectly possible for an ISISIave to have a direct USB connection to the host we do not treat this scenario explicitly here to avoid possible confusion.

In a multi-SoPEC system one of the SoPECs will be the PrintMaster. This SoPEC must manage and control sensors and actuators e.g. motor control. These sensors and actuators could be distributed over all the SoPECs in the system. An ISIMaster SoPEC may also be the PrintMaster SoPEC.

In a multi-SoPEC system each printing SoPEC will generally have its own PRINTER_QA chip (or at least access to a PRINTER_QA chip that contains the SoPEC’s SOPEC_id_key) to validate operating parameters and ink usage. The results of these operations may be communicated to the PrintMaster SoPEC.

In general the ISIMaster may need to be able to:

• Send messages to the ISISIaves which will cause the ISISIaves to send their status to the ISIMaster.

• Instruct the ISISIaves to perform certain operations.

As the ISl is an insecure interface commands issued over the ISl are regarded as user mode commands. Supervisor mode code running on the SoPEC CPUs will allow or disallow these commands. The software protocol needs to be constructed with this in mind.

The ISIMaster will initiate all communication with the ISISIaves.

SoPEC operation is broken up into a number of sections which are outlined below.

10.3.1 Powerup

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

Powerup describes SoPEC initialisation following an external reset or the watchdog timer system reset.

I ) Execute reset sequence for complete SoPEC.

2) CPU boot from ROM.

3) Basic configuration of CPU peripherals, SCB and DIU. DRAM initialisation USB Wakeup

4) SoPEC identification by activity on USB end-points 2-4 indicates it is the ISIMaster (unless the SoPEC CPU has explicitly disabled this function).

5) Download and authentication of program (see Section 10.5.3).

6) Execution of program from DRAM.

7) Retrieve operating parameters from PRINTER_QA and authenticate operating parameters.

8) Download and authenticate any further datasets (programs).

9) The initial dataset may be broadcast to all the ISISIaves.

10) ISIMaster master SoPEC then waits for a short time to allow the authentication to take place on the ISISIave SoPECs.

II ) Each ISISIave SoPEC is polled for the result of its program code authentication process.

12) If all ISISIaves report successful authentication the OEM code module can be distributed and authenticated. OEM code will most likely reside on one SoPEC.

10.3.2 USB wakeup

The CPU can put different sections of SoPEC into sleep mode by writing to registers in the CPR block [16]. Normally the CPU sub-system and the DRAM will be put in sleep mode but the SCB and power-safe storage (PSS) will still be enabled.

Wakeup describes SoPEC recovery from sleep mode with the SCB and power-safe storage (PSS) still enabled. For an ISIMaster SoPEC connected to the host via USB, wakeup can be initiated following a USB reset from the SCB.

A typical USB wakeup sequence is:

) Execute reset sequence for sections of SoPEC in sleep mode.

2) CPU boot from ROM, if CPU-subsystem was in sleep mode.

3) Basic configuration of CPU peripherals and DIU, and DRAM initialisation, if required.

4) SoPEC identification by activity on USB end-points 2-4 indicates it is the ISIMaster (unless the SoPEC CPU has explicitly disabled this function).

5) Download and authentication of program using results in Power-Safe Storage (PSS) (see Section 10.5.3).

6) Execution of program from DRAM.

7) Retrieve operating parameters from PRINTER_QA and authenticate operating parameters.

8) Download and authenticate any further datasets (programs) using results in Power-Safe Storage (PSS) (see Section 10.5.3).

9) Following steps as per Powerup.

10.3.3 Print initialization

This sequence is typically performed at the start of a print job following powerup or wakeup:

) Check amount of ink remaining via QA chips which may be present on a ISISIave SoPEC.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

2) Download static data e.g. dither matrices, dead nozzle tables from host to DRAM.

3) Check printhead temperature, if required, and configure printhead with firing pulse profile etc. accordingly. Instruct ISISIaves to also perform this operation.

4) Initiate printhead pre-heat sequence, if required. Instruct ISISIaves to also perform this operation

10.3.4 First page download

Buffer management in a SoPEC system is normally performed by the host.

) The host communicates to the SoPEC CPU over the USB to check that DRAM space remaining is sufficient to download the first band.

2) The host downloads the first band (with the page header) to DRAM.

3) When the complete page header has been downloaded the SoPEC CPU processes the page header, calculates PEP register commands and write directly to PEP registers or to DRAM.

4) If PEP register commands have been written to DRAM, execute PEP commands from DRAM via PCU.

Poll ISISIaves for DRAM status and download compressed data to ISISIaves.

Remaining first page bands download and processing:

) Check DRAM space remaining is sufficient to download the next band.

2) Download the next band with the band header to DRAM.

3) When the complete band header has been downloaded, process the band header according to whichever band-related register updating mechanism is being used.

Poll ISISIaves for DRAM status and download compressed data to ISISIaves.

10.3.5 Start printing ) Wait until at least one band of the first page has been downloaded.

2) Start all the PEP Units by writing to their Go registers, via PCU commands executed from

DRAM or direct CPU writes, in the suggested order defined in Table .

3) Print ready interrupt occurs (from PHI). Poll ISISIaves until print ready interrupt.

4) Start motor control (which may be on an ISISIave SoPEC), if first page, otherwise feed the next page. This step could occur before the print ready interrupt.

5) Drive LEDS, monitor paper status (which may be on an ISISIave SoPEC).

6) Wait for page alignment via page sensor(s) GPIO interrupt (which may be on an ISISIave SoPEC).

7) If the LineSyncMaster is a SoPEC its CPU instructs PHI to start producing master line syncs. Otherwise wait for an external device to produce line syncs.

8) Continue to download bands and process page and band headers for next page.

10.3.6 Next page(s) download

As for first page download, performed during printing of current page.

10.3.7 Between bands

When the finished band flags are asserted band related registers in the CDU, LBD and TE need to be re-programmed. This can be via PCU commands from DRAM. Typically only 3-5 commands per decompression unit need to be executed. These registers can also be reprogrammed directly by the

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

CPU or by updating from shadow registers. The finished band flag interrupts to the CPU, tell the CPU that the area of memory associated with the band is now free.

10.3.8 During page print

Typically during page printing ink usage is communicated to the QA chips.

1) Calculate ink printed (from PHI).

2) Decrement ink remaining (via QA chips).

3) Check amount of ink remaining (via QA chips). This operation may be better performed while the page is being printed rather than at the end of the page.

10.3.9 Page finish

These operations are typically performed when the page is finished:

1) Page finished interrupt occurs from PHI. Poll ISISIaves for page finished interrupts.

2) Shutdown the PEP blocks by de-asserting their Go registers in the suggested order in Table . This will set the PEP Unit state-machines to their startup states.

3) Communicate ink usage to QA chips, if required.

10.3.10 Start of next page

These operations are typically performed before printing the next page:

) Re-program the PEP Units via PCU command processing from DRAM based on page header.

2) Go to Start printing.

10.3.11 End of document ) Stop motor control. This may be on an ISISIave SoPEC.

10.3.12 Sleep mode

The CPU can put different sections of SoPEC into sleep mode by writing to registers in the CPR block [16], This may be as a result of a command from the host or as a result of a timeout.

) Inform host PC of which parts of SoPEC system are about to sleep.

2) Instruct ISISIaves to enter sleep mode.

3) Store reusable cryptographic results in Power-Safe Storage (PSS).

4) Put ISIMaster SoPEC into defined sleep mode.

10.4 Normal operation in a Multi-SoPEC System - ISISlave SoPEC

This section the outline typical operation of an ISISIave SoPEC in a multi-SoPEC system. The ISIMaster can be another SoPEC or an ISI-Bridge chip. The ISISIave communicates with the host either via the ISIMaster or using a direct connection such as USB. For this use case we consider only an ISISIave that does not have a direct host connection. Buffer management in a SoPEC system is normally performed by the host.

10.4.1 Powerup

Powerup describes SoPEC initialisation following an external reset or the watchdog timer system reset.

A typical powerup sequence is:

) Execute reset sequence for complete SoPEC.

2) CPU boot from ROM.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

3) Basic configuration of CPU peripherals, SCB and DIU. DRAM initialisation.

4) Download and authentication of program (see Section 10.5.3).

5) Execution of program from DRAM.

6) Retrieve operating parameters from PRINTER_QA and authenticate operating parameters.

7) SoPEC identification by sampling GPIO pins to determine ISIId. Communicate ISIId to ISIMaster.

8) Download and authenticate any further datasets.

10.4.2 ISI wakeup

The CPU can put different sections of SoPEC into sleep mode by writing to registers in the CPR block [16]. Normally the CPU sub-system and the DRAM will be put in sleep mode but the SCB and power-safe storage (PSS) will still be enabled.

Wakeup describes SoPEC recovery from sleep mode with the SCB and power-safe storage (PSS) still enabled. In an ISISIave SoPEC, wakeup can be initiated following an ISI reset from the SCB.

A typical ISI wakeup sequence is:

) Execute reset sequence for sections of SoPEC in sleep mode.

2) CPU boot from ROM, if CPU-subsystem was in sleep mode.

3) Basic configuration of CPU peripherals and DIU, and DRAM initialisation, if required.

4) Download and authentication of program using results in Power-Safe Storage (PSS) (see Section 10.5.3).

5) Execution of program from DRAM.

6) Retrieve operating parameters from PRINTER_QA and authenticate operating parameters.

7) SoPEC identification by sampling GPIO pins to determine ISIId. Communicate ISIId to ISIMaster.

8) Download and authenticate any further datasets.

10.4.3 Print initialization

This sequence is typically performed at the start of a print job following powerup or wakeup:

) Check amount of ink remaining via QA chips.

2) Download static data e.g. dither matrices, dead nozzle tables from ISI to DRAM.

3) Check printhead temperature, if required, and configure printhead with firing pulse profile etc. accordingly.

4) Initiate printhead pre-heat sequence, if required.

10.4.4 First page download

Buffer management in a SoPEC system is normally performed by the host via the ISI.

) Check DRAM space remaining is sufficient to download the first band.

2) The host downloads the first band (with the page header) to DRAM via the ISI.

3) When the complete page header has been downloaded, process the page header, calculate

PEP register commands and write directly to PEP registers or to DRAM.

4) If PEP register commands have been written to DRAM, execute PEP commands from DRAM via PCU.

Remaining first page bands download and processing:

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 ) Check DRAM space remaining is sufficient to download the next band.

2) The host downloads the first band (with the page header) to DRAM via the ISI.

3) When the complete band header has been downloaded, process the band header according to whichever band-related register updating mechanism is being used.

10.4.5 Start printing ) Wait until at least one band of the first page has been downloaded.

2) Start all the PEP Units by writing to their Go registers, via PCU commands executed from DRAM or direct CPU writes, in the order defined in Table .

3) Print ready interrupt occurs (from PHI). Communicate to PrintMaster via ISI.

4) Start motor control, if attached to this ISISIave, when requested by PrintMaster, if first page, otherwise feed next page. This step could occur before the print ready interrupt

5) Drive LEDS, monitor paper status, if on this ISISIave SoPEC, when requested by PrintMaster

6) Wait for page alignment via page sensor(s) GPIO interrupt, if on this ISISIave SoPEC, and send to PrintMaster.

7) Wait for line sync and commence printing.

8) Continue to download bands and process page and band headers for next page.

10.4.6 Next page(s) download

As for first band download, performed during printing of current page.

10.4.7 Between bands

When the finished band flags are asserted band related registers in the CDU, LBD and TE need to be re-programmed. This can be via PCU commands from DRAM. Typically only 3-5 commands per decompression unit need to be executed. These registers can also be reprogrammed directly by the CPU or by updating from shadow registers. The finished band flag interrupts to the CPU tell the CPU that the area of memory associated with the band is now free.

10.4.8 During page print

Typically during page printing ink usage is communicated to the QA chips.

1) Calculate ink printed (from PHI).

2) Decrement ink remaining (via QA chips).

3) Check amount of ink remaining (via QA chips). This operation may be better performed while the page is being printed rather than at the end of the page.

10.4.9 Page finish

These operations are typically performed when the page is finished:

) Page finished interrupt occurs from PHI. Communicate page finished interrupt to PrintMaster.

2) Shutdown the PEP blocks by de-asserting their Go registers in the suggested order in Table . This will set the PEP Unit state-machines to their startup states.

3) Communicate ink usage to QA chips, if required.

10.4.10 Start of next page

These operations are typically performed before printing the next page:

1) Re-program the PEP Units via PCU command processing from DRAM based on page header.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

2) Go to Start printing.

10.4.11 End of document

Stop motor control, if attached to this ISISIave, when requested by PrintMaster.

10.4.12 Powerdown

In this mode SoPEC is no longer powered.

) Powerdown ISISIave SoPEC when instructed by ISIMaster.

10.4.13 Sleep

The CPU can put different sections of SoPEC into sleep mode by writing to registers in the CPR block [16], This may be as a result of a command from the host or ISIMaster or as a result of a timeout.

) Store reusable cryptographic results in Power-Safe Storage (PSS).

2) Put SoPEC into defined sleep mode.

10.5 Security Use Cases

Please see the ‘SoPEC Security Overview’ [9] document for a more complete description of SoPEC security issues. The SoPEC boot operation is described in the ROM chapter of the SoPEC hardware design specification, Section 17.2.

10.5.1 Communication with the QA chips

Communication between SoPEC and the QA chips (i.e. INK_QA and PRINTER_QA) will take place on at least a per power cycle and per page basis. Communication with the QA chips has three principal purposes: validating the presence of genuine QA chips (i.e the printer is using approved consumables), validation of the amount of ink remaining in the cartridge and authenticating the operating parameters for the printer. After each page has been printed, SoPEC is expected to communicate the number of dots fired per ink plane to the QA chipset. SoPEC may also initiate decoy communications with the QA chips from time to time.

Process:

• When validating ink consumption SoPEC is expected to principally act as a conduit between the PRINTER_QA and INK_QA chips and to take certain actions (basically enable or disable printing and report status to host PC) based on the result. The communication channels are insecure but all traffic is signed to guarantee authenticity.

Known Weaknesses • All communication to the QA chips is over the LSS interfaces using a serial communication protocol. This is open to observation and so the communication protocol could be reverse engineered. In this case both the PRINTER_QA and INK_QA chips could be replaced by impostor devices (e.g. a single FPGA) that successfully emulated the communication protocol. As this would require physical modification of each printer this is considered to be an acceptably low risk. Any messages that are not signed by one of the symmetric keys (such as the SoPEC_id_key) could be reverse engineered. The imposter device must also have access to the appropriate keys to crack the system.

• If the secret keys in the QA chips are exposed or cracked then the system, or parts of it, is compromised.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

Assumptions:

[1] The QA chips are not involved in the authentication of downloaded SoPEC code

[2] The QA chip in the ink cartridge (INK_QA) does not directly affect the operation of the cartridge in any way i.e. it does not inhibit the flow of ink etc.

[3] The INK_QA and PRINTER_QA chips are identical in their virgin state. They only become a INK_QA or PRINTER_QA after their FlashROM has been programmed.

10.5.2 Authentication of downloaded code in a single SoPEC system

Process:

) SoPEC identification by activity on USB end-points 2-4 indicates it is the ISIMaster (unless the SoPEC CPU has explicitly disabled this function).

2) The program is downloaded to the embedded DRAM.

3) The CPU calculates a SHA-1 hash digest of the downloaded program.

4) The ResetSrc register in the CPR block is read to determine whether or not a power-on reset occurred.

5) If a power-on reset occurred the signature of the downloaded code (which needs to be in a known location such as the first or last N bytes of the downloaded code) is decrypted using the Silverbrook public bootOkey stored in ROM. This decrypted signature is the expected SHA-1 hash of the accompanying program. The encryption algorithm is likely to be a public key algorithm such as RSA. If a power-on reset did not occur then the expected SHA-1 hash is retrieved from the PSS and the compute intensive decryption is not required.

6) The calculated and expected hash values are compared and if they match then the programs authenticity has been verified.

7) If the hash values do not match then the host PC is notified of the failure and the SoPEC will await a new program download.

8) If the hash values match then the CPU starts executing the downloaded program.

9) If, as is very likely, the downloaded program wishes to download subsequent programs (such as OEM code) it is responsible for ensuring the authenticity of everything it downloads. The downloaded program may contain public keys that are used to authenticate subsequent downloads, thus forming a hierarchy of authentication. The SoPEC ROM does not control these authentications - it is solely concerned with verifying that the first program downloaded has come from a trusted source.

10) At some subsequent point OEM code starts executing. The Silverbrook supervisor code acts as an O/S to the OEM user mode code. The OEM code must access most SoPEC functionality via system calls to the Silverbrook code.

11) The OEM code is expected to perform some simple ‘turn on the lights’ tasks after which the host PC is informed that the printer is ready to print and the Start Printing use case comes into play.

Known Weaknesses:

• If the Silverbrook private bootOkey is exposed or cracked then the system is seriously compromised. A ROM mask change would be required to reprogram the bootOkey.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

10.5.3 Authentication of downloaded code in a multi-SoPEC system

10.5.3.1 ISIMaster SoPEC Process:

1) SoPEC identification by activity on USB end-points 2-4 indicates it is the ISIMaster.

2) The SCB is configured to broadcast the data received from the host PC.

3) The program is downloaded to the embedded DRAM and broadcasted to all ISISIave SoPECs over the ISI.

4) The CPU calculates a SHA-1 hash digest of the downloaded program.

5) The ResetSrc register in the CPR block is read to determine whether or not a power-on reset occurred.

6) If a power-on reset occurred the signature of the downloaded code (which needs to be in a known location such as the first or last N bytes of the downloaded code) is decrypted using the Silverbrook public bootOkey stored in ROM. This decrypted signature is the expected SHA-1 hash of the accompanying program. The encryption algorithm is likely to be a public key algorithm such as RSA. If a power-on reset did not occur then the expected SHA-1 hash is retrieved from the PSS and the compute intensive decryption is not required.

7) The calculated and expected hash values are compared and if they match then the programs authenticity has been verified.

8) If the hash values do not match then the host PC is notified of the failure and the SoPEC will await a new program download.

9) If the hash values match then the CPU starts executing the downloaded program.

10) It is likely that the downloaded program will poll each ISISIave SoPEC for the result of its authentication process and to determine the number of slaves present and their ISIIds.

) If any ISISIave SoPEC reports a failed authentication then the ISIMaster communicates this to the host PC and the SoPEC will await a new program download.

12) If all ISISlaves report successful authentication then the downloaded program is responsible for the downloading, authentication and distribution of subsequent programs within the multiSoPEC system.

13) At some subsequent point OEM code starts executing. The Silverbrook supervisor code acts as an O/S to the OEM user mode code. The OEM code must access most SoPEC functionality via system calls to the Silverbrook code.

14) The OEM code is expected to perform some simple ‘turn on the lights’ tasks after which the master SoPEC determines that all SoPECs are ready to print. The host PC is informed that the printer is ready to print and the Start Printing use case comes into play.

10.5.3.2 ISISIave SoPEC Process:

) When the CPU comes out of reset the SCB will be in slave mode, and the SCB is already configured to receive data from both the ISI and USB.

2) The program is downloaded (via ISI or USB) to embedded DRAM.

3) The CPU calculates a SHA-1 hash digest of the downloaded program.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

4) The ResetSrc register in the CPR block is read to determine whether or not a power-on reset occurred.

5) If a power-on reset occurred the signature of the downloaded code (which needs to be in a known location such as the first or last N bytes of the downloaded code) is decrypted using the Silverbrook public bootOkey stored in ROM. This decrypted signature is the expected SHA-1 hash of the accompanying program. The encryption algorithm is likely to be a public key algorithm such as RSA. If a power-on reset did not occur then the expected SHA-1 hash is retrieved from the PSS and the compute intensive decryption is not required.

6) The calculated and expected hash values are compared and if they match then the programs authenticity has been verified.

7) If the hash values do not match, then the ISISIave device will await a new program again

8) If the hash values match then the CPU starts executing the downloaded program.

9) It is likely that the downloaded program will communicate the result of its authentication process to the ISIMaster. The downloaded program is responsible for determining the SoPECs ISI Id, receiving and authenticating any subsequent programs.

10) At some subsequent point OEM code starts executing. The Silverbrook supervisor code acts as an O/S to the OEM user mode code. The OEM code must access most SoPEC functionality via system calls to the Silverbrook code.

) The OEM code is expected to perform some simple ‘turn on the lights’ tasks after which the master SoPEC is informed that this slave is ready to print. The Start Printing use case then comes into play.

Known Weaknesses • If the Silverbrook private bootOkey is exposed or cracked then the system is seriously compromised.

• ISI is an open interface i.e. messages sent over the ISI are in the clear. The communication channels are insecure but all traffic is signed to guarantee authenticity. As all communication over the ISI is controlled by Supervisor code on both the ISIMaster and ISISIave then this also provides some protection against software attacks.

10.5.4 Authentication and upgrade of operating parameters for a printer

The SoPEC IC will be used in a range of printers with different capabilities (e.g. A3/A4 printing, printing speed, resolution etc.). It is expected that some printers will also have a software upgrade capability which would allow a user to purchase a license that enables an upgrade in their printer’s capabilities (such as print speed). To facilitate this it must be possible to securely store the operating parameters in the PRINTER_QA chip, to securely communicate these parameters to the SoPEC and to securely reprogram the parameters in the event of an upgrade. Note that each printing SoPEC (as opposed to a SoPEC that is only used for the storage of data) will have its own PRINTER_QA chip (or at least access to a PRINTER_QA that contains the SoPEC’s SoPEC_id_key). Therefore both ISIMaster and ISISIave SoPECs will need to authenticate operating parameters.

Process:

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

1) Program code is downloaded and authenticated as described in sections 10.5.2 and 10.5.3 above.

2) The program code has a function to create the SoPEC_id_key from the unique SoPECJd that was programmed when the SoPEC was manufactured.

3) The SoPEC retrieves the signed operating parameters from its PRINTER_QA chip. The PRINTER_QA chip uses the SoPEC_id_key (which is stored as part of the pairing process executed during printhead assembly manufacture &amp; test) to sign the operating parameters which are appended with a random number to thwart replay attacks.

4) The SoPEC checks the signature of the operating parameters using its SoPEC_id_key. If this signature authentication process is successful then the operating parameters are considered valid and the overall boot process continues. If not the error is reported to the host PC.

5) Operating parameters may also be set or upgraded using a second key, the PrintEngineLicense_key, which is stored on the PRINTER_QA and used to authenticate the change in operating parameters.

Known Weaknesses:

It may be possible to retrieve the unique SoPECJd by placing the SoPEC in test mode and scanning it out. It is certainly possible to obtain it by reverse engineering the device. Either way the SoPECJd (and by extension the SoPECJd_key) so obtained is valid only for that specific SoPEC and so printers may only be compromised one at a time by parties with the appropriate specialised equipment. Furthermore even if the SoPECJd is compromised, the other keys in the system, which protect the authentication of consumables and of program code, are unaffected.

10.6 Miscellaneous Use Cases

There are many miscellaneous use cases such as the following examples. Software running on the SoPEC CPU or host will decide on what actions to take in these scenarios.

10.6.1 Disconnect / Re-connect of QA chips.

) Disconnect of a QA chip between documents or if ink runs out mid-document.

2) Re-connect of a QA chip once authenticated e.g. ink cartridge replacement should allow the system to resume and print the next document

10.6.2 Page arrives before print ready interrupt.

) Engage clutch to stop paper until print ready interrupt occurs.

10.6.3 Dead-nozzle table upgrade

This sequence is typically performed when dead nozzle information needs to be updated by performing a printhead dead nozzle test.

) Run printhead nozzle test sequence

2) Either host or SoPEC CPU converts dead nozzle information into dead nozzle table.

3) Store dead nozzle table on host.

4) Write dead nozzle table to SoPEC DRAM.

10.7 Failure Mode Use Cases

10.7.1 System errors and security violations

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

System errors and security violations are reported to the SoPEC CPU and host. Software running on the SoPEC CPU or host will then decide what actions to take.

Silverbrook code authentication failure.

) Notify host PC of authentication failure.

2) Abort print run.

OEM code authentication failure.

) Notify host PC of authentication failure.

2) Abort print run.

Invalid QA chip(s).

) Report to host PC.

2) Abort print run.

MMU security violation interrupt.

) This is handled by exception handler.

2) Report to host PC

3) Abort print run.

Invalid address interrupt from PCU.

) This is handled by exception handler.

2) Report to host PC.

3) Abort print run.

Watchdog timer interrupt.

) This is handled by exception handler.

2) Report to host PC.

3) Abort print run.

Host PC does not acknowledge message that SoPEC is about to power down.

) Power down anyway.

10.7.2 Printing errors

Printing errors are reported to the SoPEC CPU and host. Software running on the host or SoPEC CPU will then decide what actions to take.

Insufficient space available in SoPEC compressed band-store to download a band.

) Report to the host PC.

Insufficient ink to print.

) Report to host PC.

Page not downloaded in time while printing.

) Buffer underrun interrupt will occur.

2) Report to host PC and abort print run.

JPEG decoder error interrupt.

I ) Report to host PC.

CPU Subsystem

II Central Processing Unit (CPU)

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

11.1 Overview

The CPU block consists of the CPU core, MMU, cache and associated logic. The principal tasks for the program running on the CPU to fulfill in the system are:

Communications:

• Control the flow of data from the USB interface to the DRAM and ISI • Communication with the host via USB or ISI • Running the USB device driver

PEP Subsystem Control:

• Page and band header processing (may possibly be performed on host PC) • Configure printing options on a per band, per page, per job or per power cycle basis • Initiate page printing operation in the PEP subsystem • Retrieve dead nozzle information from the printhead interface (PHI) and forward to the host PC • Select the appropriate firing pulse profile from a set of predefined profiles based on the printhead characteristics • Retrieve printhead temperature via the PHI

Security:

• Authenticate downloaded program code • Authenticate printer operating parameters • Authenticate consumables via the PRINTER_QA and INK_QA chips • Monitor ink usage • Isolation of OEM code from direct access to the system resources

Other:

• Drive the printer motors using the GPIO pins • Monitoring the status of the printer (paper jam, tray empty etc.) • Driving front panel LEDs • Perform post-boot initialisation of the SoPEC device • Memory management (likely to be in conjunction with the host PC) • Miscellaneous housekeeping tasks

To control the Print Engine Pipeline the CPU is required to provide a level of performance at least equivalent to a 16-bit Hitachi H8-3664 microcontroller running at 16 MHz. An as yet undetermined amount of additional CPU performance is needed to perform the other tasks, as well as to provide the potential for such activity as Netpage page assembly and processing, RIPing etc. The extra performance required is dominated by the signature verification task and the SCB (including the USB) management task. An operating system is not required at present. A number of CPU cores have been evaluated and the LEON P1754 is considered to be the most appropriate solution. A diagram of the CPU block is shown in Figure 15 below.

11.2 Definitions of I/Os

Table 14. CPU Subsystem I/Os

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td> Port name</td><td> Pins</td><td> I/O</td><td> Description</td>

<td colspan="4"> Clocks and Resets</td>

<td> prst_n</td><td> 1</td><td> In</td><td> Global reset. Synchronous to pclk, active low.</td>

<td> Pclk</td><td> 1</td><td> In</td><td> Globa! clock</td>

<td colspan="4"> CPU to DIU DRAM interface</td>

<td> cpu_adr[21:2]</td><td> 20</td><td> Out</td><td> Address bus for both DRAM and peripheral access</td>

<td> cpu_dataout[31:0]</td><td> 32</td><td> Out</td><td> Data out to both DRAM and peripheral devices. This should be driven at the same time as the cpu_adr and request signals.</td>

<td> dram_cpu_data[255:0]</td><td> 256</td><td> In</td><td> Read data from the DRAM</td>

<td> cpu_diu_rreq</td><td> 1</td><td> Out</td><td> Read request to the DIU DRAM</td>

<td> diu_cpu_rack</td><td> 1</td><td> In</td><td> Acknowledge from DIU that read request has been accepted.</td>

<td> diu_cpu_rvalid</td><td> 1</td><td> In</td><td> Signal from DIU telling SoPEC Unit that valid read data is on the dram_cpu_data bus</td>

<td> cpu_diu_wdatavalid</td><td> 1</td><td> Out</td><td> Signal from the CPU to the DIU indicating that the data currently on the cpu_diu_wdata bus is valid and should be committed to the DIU posted write buffer</td>

<td> diu_cpu_write_rdy</td><td> 1</td><td> In</td><td> Signal from the DIU indicating that the posted write buffer is empty</td>

<td> cpu_diu_wdadr[21:4]</td><td> 18</td><td> Out</td><td> Write address bus to the DIU</td>

<td> cpu_diu_wdata[127:0]</td><td> 128</td><td> Out</td><td> Write data bus to the DIU</td>

<td> cpu_diu_wmask[15:0]</td><td> 16</td><td> Out</td><td> Write mask for the cpu_diu_wdata bus. Each bit corresponds to a byte of the 128-bit cpu_diu_wdata bus.</td>

<td colspan="4"> CPU to peripheral blocks</td>

<td> cpu_rwn</td><td> 1</td><td> Out</td><td> Common read/not-write signal from the CPU</td>

<td> cpu_acode[1:0]</td><td> 2</td><td> Out</td><td> CPU access code signals. cpu_acode[0] - Program (0) / Data (1 ) access cpu_acode[1] - User (0) / Supervisor (1) access</td>

<td> cpu_cpr_sel</td><td> 1</td><td> Out</td><td> CPR block select.</td>

<td> cpr_cpu_rdy</td><td> 1</td><td> In</td><td> Ready signal to the CPU. When cpr_cpu_rdy is high it indicates the last cycle of the access. For a write cycle this means cpu_dataout has been registered by the CPR block and for a read cycle this means the data on cpr_cpu_data is valid.</td>

<td> cpr_cpu_berr</td><td> 1</td><td> In</td><td> CPR bus error signal to the CPU.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td> cpr_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the CPR block</td>

<td> cpu_gpio_sel</td><td> 1</td><td> Out</td><td> GPIO block select.</td>

<td> gpio_cpu_rdy</td><td> 1</td><td> In</td><td> GPIO ready signal to the CPU.</td>

<td> gpio_cpu_berr</td><td> 1</td><td> In</td><td> GPIO bus error signal to the CPU.</td>

<td> gpio_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the GPIO block</td>

<td> cpu_icu_sel</td><td> 1</td><td> Out</td><td> ICU block select.</td>

<td> icu_cpu_rdy</td><td> 1</td><td> In</td><td> ICU ready signal to the CPU.</td>

<td> icu_cpu_berr</td><td> 1</td><td> In</td><td> ICU bus error signal to the CPU.</td>

<td> icu_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the ICU block</td>

<td> cpu_lss_sel</td><td> 1</td><td> Out</td><td> LSS block select.</td>

<td> lss_cpu_rdy</td><td> 1</td><td> In</td><td> LSS ready signal to the CPU.</td>

<td> lss_cpu_berr</td><td> 1</td><td> In</td><td> LSS bus error signal to the CPU.</td>

<td> lss_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the LSS block</td>

<td> cpu_pcu_sel</td><td> 1</td><td> Out</td><td> PCU block select.</td>

<td> pcu_cpu_rdy</td><td> 1</td><td> In</td><td> PCU ready signal to the CPU.</td>

<td> pcu_cpu_berr</td><td> 1</td><td> In</td><td> PCU bus error signal to the CPU.</td>

<td> pcu_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the PCU block</td>

<td> cpu_scb_sel</td><td> 1</td><td> Out</td><td> SCB block select.</td>

<td> scb_cpu_rdy</td><td> 1</td><td> In</td><td> SCB ready signal to the CPU.</td>

<td> scb_cpu_berr</td><td> 1</td><td> In</td><td> SCB bus error signal to the CPU.</td>

<td> scb_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the SCB block</td>

<td> cpu_tim_sel</td><td> 1</td><td> Out</td><td> Timers block select.</td>

<td> tim_cpu_rdy</td><td> 1</td><td> In</td><td> Timers block ready signal to the CPU.</td>

<td> tim_cpu_berr</td><td> 1</td><td> In</td><td> Timers bus error signal to the CPU.</td>

<td> tim_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the Timers block</td>

<td> cpu_rom_sel</td><td> 1</td><td> Out</td><td> ROM block select.</td>

<td> rom_cpu_rdy</td><td> 1</td><td> In</td><td> ROM block ready signal to the CPU.</td>

<td> rom_cpu_berr</td><td> 1</td><td> In</td><td> ROM bus error signal to the CPU.</td>

<td> rom_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the ROM block</td>

<td> cpu_pss_sel</td><td> 1</td><td> Out</td><td> PSS block select.</td>

<td> pss_cpu_rdy</td><td> 1</td><td> In</td><td> PSS block ready signal to the CPU.</td>

<td> pss_cpu_berr</td><td> 1</td><td> In</td><td> PSS bus error signal to the CPU.</td>

<td> pss_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the PSS block</td>

<td> cpu_diu_sel</td><td> 1</td><td> Out</td><td> DIU register block select.</td>

<td> diu_cpu_rdy</td><td> 1</td><td> In</td><td> DIU register block ready signal to the CPU.</td>

<td> diu_cpu_berr</td><td> 1</td><td> In</td><td> DIU bus error signal to the CPU.</td>

<td> diu_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the DIU block</td>

<td colspan="4"> Interrupt signals</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td> icu_cpu_ilevel[3:0]</td><td> 3</td><td> In</td><td> An interrupt is asserted by driving the appropriate priority level on icu_cpu_ilevel. These signals must remain asserted until the CPU executes an interrupt acknowledge cycle.</td>

<td></td><td> 3</td><td> Out</td><td> Indicates the level of the interrupt the CPU is acknowledging when cpujack is high</td>

<td> cpujack</td><td> 1</td><td> Out</td><td> Interrupt acknowledge signal. The exact timing depends on the CPU core implementation</td>

<td colspan="4"> Debug signals</td>

<td> diu_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the diu_cpu_data bus is valid debug data.</td>

<td> tim_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the tim_cpu_data bus is valid debug data.</td>

<td> scb_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the scb_cpu_data bus is valid debug data.</td>

<td> pcu_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the pcu_cpu_data bus is valid debug data.</td>

<td> lss_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the lss_cpu_data bus is valid debug data.</td>

<td> icu_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the icu_cpu_data bus is valid debug data.</td>

<td> gpio_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the gpio_cpu_data bus is valid debug data.</td>

<td> cpr_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the cpr_cpu_data bus is valid debug data.</td>

<td> debug_data_out</td><td> 32</td><td> Out</td><td> Output debug data to be muxed on to the GPIO &amp; PHI pins</td>

<td> debug_data_valid</td><td> 1</td><td> Out</td><td> Debug valid signal indicating the validity of the data on debug_data_out. This signal is used in all debug configurations</td>

<td> debug_cntrl</td><td> 33</td><td> Out</td><td> Control signal for each PHI bound debug data line indicating whether or not the debug data should be selected by the pin mux</td>

11.3 Realtime requirements

The SoPEC realtime requirements have yet to be fully determined but they may be split into three categories: hard, firm and soft

11.3.1 Hard realtime requirements

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

Hard requirements are tasks that must be completed before a certain deadline or failure to do so will result in an error perceptible to the user (printing stops or functions incorrectly). There are three hard realtime tasks:

• Motor control: The motors which feed the paper through the printer at a constant speed during printing are driven directly by the SoPEC device. Four periodic signals with different phase relationships need to be generated to ensure the paper travels smoothly through the printer. The generation of these signals is handled by the GPIO hardware (see section 13.2 for more details) but the CPU is responsible for enabling these signals (i.e. to start or stop the motors) and coordinating the movement of the paper with the printing operation of the printhead.

• Buffer management: Data enters the SoPEC via the SCB at an uneven rate and is consumed by the PEP subsystem at a different rate. The CPU is responsible for managing the DRAM buffers to ensure that neither overrun nor underrun occur. This buffer management is likely to be performed under the direction of the host.

• Band processing: In certain cases PEP registers may need to be updated between bands. As the timing requirements are most likely too stringent to be met by direct CPU writes to the PCU a more likely scenario Is that a set of shadow registers will programmed in the compressed page units before the current band is finished, copied to band related registers by the finished band signals and the processing of the next band will continue immediately. An alternative solution is that the CPU will construct a DRAM based set of commands (see section 21.8.5 for more details) that can be executed by the PCU. The task for the CPU here is to parse the band headers stored in DRAM and generate a DRAM based set of commands for the next number of bands. The location of the DRAM based set of commands must then be written to the PCU before the current band has been processed by the PEP subsystem. It is also conceivable (but currently considered unlikely) that the host PC could create the DRAM based commands. In this case the CPU will only be required to point the PCU to the correct location in DRAM to execute commands from.

11.3.2 Firm requirements

Firm requirements are tasks that should be completed by a certain time or failure to do so will result in a degradation of performance but not an error. The majority of the CPU tasks for SoPEC fall into this category including all interactions with the QA chips, program authentication, page feeding, configuring PEP registers for a page or job, determining the firing pulse profile, communication of printer status to the host over the USB and the monitoring of ink usage. The authentication of downloaded programs and messages will be the most compute intensive operation the CPU will be required to perform. Initial investigations indicate that the LEON processor, running at 160 MHz, will easily perform three authentications in under a second.

Table 15. Expected firm requirements

<td> Requirement</td><td> Duration</td>

<td> Power-on to start of printing first page [USB and slave SoPEC</td><td> ~ 8 secs ??</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

<td> enumeration, 3 or more RSA signature verifications, code and compressed page data download and chip initialisation]</td><td></td>

<td> Wake-up from sleep mode to start printing [3 or more SHA-1 / RSA operations, code and compressed page data download and chip reinitialisation</td><td> ~ 2 secs</td>

<td> Authenticate ink usage in the printer</td><td> ~ 0.5 secs</td>

<td> Determining firing pulse profile</td><td> ~ 0.1 secs</td>

<td> Page feeding, gap between pages</td><td> OEM dependent</td>

<td> Communication of printer status to host PC</td><td> ~ 10 ms</td>

<td> Configuring PEP registers</td><td> ??</td>

11.3.3 Soft requirements

Soft requirements are tasks that need to be done but there are only light time constraints on when they need to be done. These tasks are performed by the CPU when there are no pending higher priority tasks. As the SoPEC CPU is expected to be lightly loaded these tasks will mostly be executed soon after they are scheduled.

11.4 Bus Protocols

As can be seen from Figure 15 above there are different buses in the CPU block and different protocols are used for each bus. There are three buses in operation·.

11.4.1 AHB bus

The LEON CPU core uses an AMBA2.0 AHB bus to communicate with memory and peripherals (usually via an APB bridge). See the AMBA specification [38], section 5 of the LEON users manual [37] and section 11.6.6.1 of this document for more details.

11.4.2 CPU to DIU bus

This bus conforms to the DIU bus protocol described in Section 20.14.8. Note that the address bus used for DIU reads (i.e. cpu_adr(21:2)) is also that used for CPU subsystem with bus accesses while the write address bus (cpu_diu_wadr) and the read and write data buses (dram_cpu__data and cpu_diu_wdata) are private buses between the CPU and the DIU. The effective bus width differs between a read (256 bits) and a write (128 bits). As certain CPU instructions may require byte write access this will need to be supported by both the DRAM write buffer (in the AHB bridge) and the DIU. See section 11.6.6.1 for more details.

11.4.3 CPU Subsystem Bus

For access to the on-chip peripherals a simple bus protocol is used. The MMU must first determine which particular block is being addressed (and that the access is a valid one) so that the appropriate block select signal can be generated. During a write access CPU write data is driven out with the address and block select signals in the first cycle of an access. The addressed slave peripheral responds by asserting its ready signal indicating that it has registered the write data and the access can complete. The write data bus is common to all peripherals and is also used for CPU writes to the embedded DRAM. A read access is initiated by driving the address and select signals during the first cycle of an access. The addressed slave responds by placing the read data on its

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 bus and asserting its ready signal to indicate to the CPU that the read data is valid. Each block has a separate point-to-point data bus for read accesses to avoid the need for a tri-stateable bus. All peripheral accesses are 32-bit (Programming note: char or short C types should not be used to access peripheral registers). The use of the ready signal allows the accesses to be of variable length. In most cases accesses will complete in two cycles but three or four (or more) cycles accesses are likely for PEP blocks or IP blocks with a different native bus interface. All PEP blocks are accessed via the PCU which acts as a bridge. The PCU bus uses a similar protocol to the CPU subsystem bus but with the PCU as the bus master.

The duration of accesses to the PEP blocks is influenced by whether or not the PCU is executing commands from DRAM. As these commands are essentially register writes the CPU access will need to wait until the PCU bus becomes available when a register access has been completed. This could lead to the CPU being stalled for up to 4 cycles if it attempts to access PEP blocks while the PCU is executing a command. The size and probability of this penalty is sufficiently small to have any significant impact on performance.

In order to support user mode (i.e. OEM code) access to certain peripherals the CPU subsystem bus propagates the CPU function code signals (cpu_acode[1:0]). These signals indicate the type of address space (i.e. User/Supervisor and Program/Data) being accessed by the CPU for each access. Each peripheral must determine whether or not the CPU is in the correct mode to be granted access to its registers and in some cases (e.g. Timers and GPIO blocks) different access permissions can apply to different registers within the block. If the CPU is not in the correct mode then the violation is flagged by asserting the block’s bus error signal (block_cpu_berr) with the same timing as its ready signal (block_cpu_rdy) which remains deasserted. When this occurs invalid read accesses should return 0 and write accesses should have no effect.

Figure 16 shows two examples of the peripheral bus protocol in action. A write to the LSS block from code running in supervisor mode is successfully completed. This is immediately followed by a read from a PEP block via the PCU from code running in user mode. As this type of access is not permitted the access is terminated with a bus error. The bus error exception processing then starts directly after this - no further accesses to the peripheral should be required as the exception handler should be located in the DRAM.

Each peripheral acts as a slave on the CPU subsystem bus and its behavior is described by the state machine in section 11.4.3.1

11.4.3.1 CPU subsystem bus slave state machine

CPU subsystem bus slave operation is described by the state machine in Figure 17.This state machine will be implemented in each CPU subsystem bus slave. The only new signals mentioned here are the va!id_access and reg_available signals. The valid_access is determined by comparing the cpu_acode value with the block or register (in the case of a block that allow user access on a per register basis such as the GPIO block) access permissions and asserting valid_access if the permissions agree with the CPU mode. The reg_available signal is only required in the PCU or in blocks that are not capable of two-cycle access (e.g. blocks containing imported IP with different bus protocols). In these blocks the reg_available signal is an internal signal used to insert wait

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616 states (by delaying the assertion of block_cpu_rdy) until the CPU bus slave interface can gain access to the register.

When reading from a register that is less than 32 bits wide the CPU subsystems bus slave should return zeroes on the unused upper bits of the block_cpu_data bus.

To support debug mode the contents of the register selected for debug observation, debug_reg, are always output on the block_cpu_data bus whenever a read access is not taking place. See section 11.8 for more details of debug operation.

11.5 LEON CPU

The LEON processor is an open-source implementation of the IEEE-1754 standard (SPARC V8) instruction set. LEON is available from and actively supported by Gaisler Research (www.gaisler.com).

The following features of the LEON-2 processor will be utilised on SoPEC:

• IEEE-1754 (SPARC V8) compatible integer unit with 5-stage pipeline • Separate instruction and data cache (Harvard architecture). 1 kbyte direct mapped caches will be used for both.

• Full implementation of AMBA-2.0 AHB on-chip bus

The standard release of LEON incorporates a number of peripherals and support blocks which will not be included on SoPEC. The LEON core as used on SoPEC will consist of: 1 ) the LEON integer unit, 2) the instruction and data caches (currently 1 kB each), 3) the cache control logic, 4) the AHB interface and 5) possibly the AHB controller (although this functionality may be implemented in the LEON AHB bridge).

The version of the LEON database that the SoPEC LEON components will be sourced from is LEON2-1.0.7 although later versions may be used if they offer worthwhile functionality or bug fixes that affect the SoPEC design.

The LEON core will be clocked using the system clock, polk, and reset using the prst_n_section[1] signal. The ICU will assert all the hardware interrupts using the protocol described in section 11.9.

The LEON hardware multipliers and floating-point unit are not required. SoPEC will use the recommended 8 register window configuration.

Further details of the SPARC V8 instruction set and the LEON processor can be found in [36] and [37] respectively.

11.5.1 LEON Registers

Only two of the registers described in the LEON manual are implemented on SoPEC - the LEON configuration register and the Cache Control Register (CCR). The addresses of these registers are shown in Table 16. The configuration register bit fields are described below and the CCR is described in section 11.7.1.1.

11.5.1.1 LEON configuration register

The LEON configuration register allows runtime software to determine the settings of LEONs various configuration options. This is a read-only register whose value for the SoPEC ASIC will be

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

0x1071_8C00. Further descriptions of many of the bitfields can be found in the LEON manual. The values used for SoPEC are highlighted in bold for clarity.

Table 16. LEON Configuration Register

<td> Field Name</td><td> bit(s)</td><td> Description</td>

<td> WriteProtection</td><td> 1:0</td><td> Write protection type. 00 - none 01 - standard</td>

<td> PCICore</td><td> 3:2</td><td> PCI core type 00 - none 01 - InSilicon 10-ESA 11 - Other</td>

<td> FPUType</td><td> 5:4</td><td> FPU type. 00 - none 01 - Meiko</td>

<td> MemStatus</td><td> 6</td><td> 0 - No memory status and failing address register present 1 - Memory status and failing address register present</td>

<td> Watchdog</td><td> 7</td><td> 0 - Watchdog timer not present (Note this refers to the LEON watchdog timer in the LEON timer block). 1 - Watchdog timer present</td>

<td> UMUL/SMUL</td><td> 8</td><td> 0 - UMUL/SMUL instructions are not implemented 1 - UMUL/SMUL instructions are implemented</td>

<td> UDIV/SDIV</td><td> 9</td><td> 0 - UMUL/SMUL instructions are not implemented 1 - UMUL/SMUL instructions are implemented</td>

<td> DLSZ</td><td> 11:10</td><td> Data cache line size in 32-bit words: 00-1 word 01-2 words 10- 4 words 11- 8 words</td>

<td> DCSZ</td><td> 14:12</td><td> Data cache size in kBbytes = 2^UUbZ. SoPEC DCSZ = 0.</td>

<td> ILSZ</td><td> 16:15</td><td> Instruction cache line size in 32-bit words: 00 -1 word 01-2 words 10- 4 words 11- 8 words</td>

<td> ICSZ</td><td> 19:17</td><td> Instruction cache size in kBbytes = 2^IUbz. SoPEC ICSZ = 0.</td>

<td> RegWin</td><td> 24:20</td><td> The implemented number of SPARC register windows -1. SoPEC value = 7.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

100

<td> UMAC/SMAC</td><td> 25</td><td> 0 - UMAC/SMAC instructions are not implemented 1 - UMAC/SMAC instructions are implemented</td>

<td> Watchpoints</td><td> 28:26</td><td> The implemented number of hardware watchpoints. SoPEC value = 4.</td>

<td> SDRAM</td><td> 29</td><td> 0 - SDRAM controller not present 1 - SDRAM controller present</td>

<td> DSU</td><td> 30</td><td> 0 - Debug Support Unit not present 1 - Debug Support Unit present</td>

<td> Reserved</td><td> 31</td><td> Reserved. SoPEC value = 0.</td>

11.6 Memory Management Unit (MMU)

Memory Management Units are typically used to protect certain regions of memory from invalid accesses, to perform address translation for a virtual memory system and to maintain memory page status (swapped-in, swapped-out or unmapped)

The SoPEC MMU is a much simpler affair whose function is to ensure that all regions of the SoPEC memory map are adequately protected. The MMU does not support virtual memory and physical addresses are used at all times. The SoPEC MMU supports a full 32-bit address space. The SoPEC memory map is depicted in Figure 18 below.

The MMU selects the relevant bus protocol and generates the appropriate control signals depending on the area of memory being accessed. The MMU is responsible for performing the address decode and generation of the appropriate block select signal as well as the selection of the correct block read bus during a read access. The MMU will need to support all of the bus transactions the CPU can produce including interrupt acknowledge cycles, aborted transactions etc. When an MMU error occurs (such as an attempt to access a supervisor mode only region when in user mode) a bus error is generated. While the LEON can recognise different types of bus error (e.g. data store error, instruction access error) it handles them in the same manner as it handles all traps i.e it will transfer control to a trap handler. No extra state information is be stored because of the nature of the trap. The location of the trap handler is contained in the TBR (Trap Base Register). This is the same mechanism as is used to handle interrupts.

11.6.1 CPU-bus peripherals address map

The address mapping for the peripherals attached to the CPU-bus is shown in Table 17 below. The MMU performs the decode of the high order bits to generate the relevant cpu_block_select signal. Apart from the PCU, which decodes the address space for the PEP blocks, each block only needs to decode as many bits of cpu_adr[11:2] as required to address all the registers within the block.

Table 17. CPU-bus peripherals address map

<td> Block_base</td><td> Address</td>

<td> ROM_base</td><td> 0x0000.0000</td>

<td> MMU base</td><td> 0x0001 0000</td>

<td></td><td></td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

101

<td> TIM_base</td><td> 0x0001_1000</td>

<td> LSS_base</td><td> 0x0001_2000</td>

<td> GPIO_base</td><td> 0x0001_3000</td>

<td> SCB_base</td><td> 0x0001_4000</td>

<td> ICU_base</td><td> 0x0001_5000</td>

<td> CPR_base</td><td> 0x0001_6000</td>

<td> DIU_base</td><td> 0x0001_7000</td>

<td> PSS_base</td><td> 0x0001_8000</td>

<td> Reserved</td><td> 0x0001_9000 to 0x0001_FFFF</td>

<td> PCU base</td><td> 0x0002 0000</td>

<td></td><td></td>

11.6.2 DRAM Region Mapping

The embedded DRAM is broken into 8 regions, with each region defined by a lower and upper bound address and with its own access permissions.

The association of an area in the DRAM address space with a MMU region is completely under software control. Table 18 below gives one possible region mapping. Regions should be defined according to their access requirements and position in memory. Regions that share the same access requirements and that are contiguous in memory may be combined into a single region. The example below is purely for indicative purposes - real mappings are likely to differ significantly from this. Note that the RegionBottom and RegionTop fields in this example include the DRAM base address offset (0x4000_0000) which is not required when programming the RegionNTop and RegionNBottom registers. For more details, see 11.6.5.1 and 11.6.5.2.

Table 18. Example region mapping

<td> Region</td><td> RegionBottom</td><td> RegionTop</td><td> Description</td>

<td> 0</td><td> 0x4000_0000</td><td> 0x4000_0FFF</td><td> Silverbrook OS (supervisor) data</td>

<td> 1</td><td> 0x4000_1000</td><td> 0x4000_BFFF</td><td> Silverbrook OS (supervisor) code</td>

<td> 2</td><td> 0x4000_C000</td><td> 0x4000_C3FF</td><td> Silverbrook (supervisor/user) data</td>

<td> 3</td><td> Ox4000_C400</td><td> Ox4000_CFFF</td><td> Silverbrook (supervisor/user) code</td>

<td> 4</td><td> 0x4026_D000</td><td> 0x4026_D3FF</td><td> OEM (user) data</td>

<td> 5</td><td> 0x4026_D400</td><td> 0x4026_DFFF</td><td> OEM (user) code</td>

<td> 6</td><td> Ox4027_EOOO</td><td> 0x4027_FFFF</td><td> Shared Silverbrook/OEM space</td>

<td> 7</td><td> 0x4000_D000</td><td> 0x4026_CFFF</td><td> Compressed page store (supervisor data)</td>

11.6.3 Non-DRAM regions

As shown in Figure 18 the DRAM occupies only 2.5 MBytes of the total 4 GB SoPEC address space. The non-DRAM regions of SoPEC are handled by the MMU as follows:

ROM (0x0000_0000 to 0x0000_FFFF): The ROM block will control the access types allowed. The cpu_acode[1:0] signals will indicate the CPU mode and access type and the ROM block will assert rom_cpu_berr if an attempted access is forbidden. The protocol is described in more detail in

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

102 section 11.4.3. The ROM block access permissions are hard wired to allow all read accesses except to the FuseChipID registers which may only be read in supervisor mode.

MMU Internal Registers (0x0001_0000 to 0x0001_0FFF): The MMU is responsible for controlling the accesses to its own internal registers and will only allow data reads and writes (no instruction fetches) from supervisor data space. All other accesses will result in the mmu_cpu_berr signal being asserted in accordance with the CPU native bus protocol.

CPU Subsystem Peripheral Registers (0x0001_1000 to 0x0001_FFFF): Each peripheral block will control the access types allowed. Every peripheral will allow supervisor data accesses (both read and write) and some blocks (e.g. Timers and GPIO) will also allow user data space accesses as outlined in the relevant chapters of this specification. Neither supervisor nor user instruction fetch accesses are allowed to any block as it is not possible to execute code from peripheral registers. The bus protocol is described in section 11.4.3.

PCU Mapped Registers (0x0002_0000 to 0x0002_BFFF): All of the PEP blocks registers which are accessed by the CPU via the PCU will inherit the access permissions of the PCU. These access permissions are hard wired to allow supervisor data accesses only and the protocol used is the same as for the CPU peripherals.

Unused address space (0x0002_C000 to 0x3FFF_FFFF and 0x4028_0000 to 0xFFFF_FFFF): All accesses to the unused portion of the address space will result in the mmu_cpu_berr signal being asserted in accordance with the CPU native bus protocol. These accesses will not propagate outside of the MMU i.e. no external access will be initiated.

11.6.4 Reset exception vector and reference zero traps

When a reset occurs the LEON processor starts executing code from address 0x0000_0000. A common software bug is zero-referencing or null pointer de-referencing (where the program attempts to access the contents of address 0x0000_0000). To assist software debug the MMU will assert a bus error everytime the locations 0x0000_0000 to 0x0000_000F (i.e. the first 4 words of the reset trap) are accessed after the reset trap handler has legitimately been retrieved immediately after reset.

11.6.5 MMU Configuration Registers

The MMU configuration registers include the RDU configuration registers and two LEON registers. Note that all the MMU configuration registers may only be accessed when the CPU is running in supervisor mode.

Table 19. MMU Configuration Registers

<td> Address offset from MMU_base</td><td> Register</td><td> tfbits</td><td> Reset</td><td> Description ;</td>

<td> 0x00</td><td> Region0Bottom[21:5 I</td><td> 17</td><td> 0x0_000 0</td><td> This register contains the physical address that marks the bottom of region 0</td>

<td> 0x04</td><td> Region0Top[21:5]</td><td> 17</td><td> 0xF_FFF F</td><td> This register contains the physical address that marks the top of region 0. Region 0 covers the</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

103

<td></td><td></td><td></td><td></td><td> entire address space after reset whereas all other regions are zero-sized initially.</td>

<td> 0x08</td><td> Regionl Bottom[21:5 l</td><td> 17</td><td> OxF_FFF F</td><td> This register contains the physical address that marks the bottom of region 1</td>

<td> OxOC</td><td> Region 1Top[21:5]</td><td> 17</td><td> 0x0_000 0</td><td> This register contains the physical address that marks the top of region 1</td>

<td> 0x10</td><td> Region2Bottom[21:5 ]</td><td> 17</td><td> OxF_FFF F</td><td> This register contains the physical address that marks the bottom of region 2</td>

<td> 0x14</td><td> Region3Top[21:5]</td><td> 17</td><td> 0x0_000 0</td><td> This register contains the physical address that marks the top of region 2</td>

<td> 0x18</td><td> Region3Bottom[21:5 I</td><td> 17</td><td> OxF_FFF F</td><td> This register contains the physical address that marks the bottom of region 3</td>

<td> 0x1 C</td><td> Region3Top[21:5]</td><td> 17</td><td> 0x0_000 0</td><td> This register contains the physical address that marks the top of region 3</td>

<td> 0x20</td><td> Region4Bottom[21:5 l</td><td> 17</td><td> OxF_FFF F</td><td> This register contains the physical address that marks the bottom of region 4</td>

<td> 0x24</td><td> Region4Top[21:5]</td><td> 17</td><td> 0x0_000 0</td><td> This register contains the physical address that marks the top of region 4</td>

<td> 0x28</td><td> Region5Bottom[21:5 l</td><td> 17</td><td> OxF_FFF F</td><td> This register contains the physical address that marks the bottom of region 5</td>

<td> 0x2C</td><td> Region5Top[21:5]</td><td> 17</td><td> O O X '° O O</td><td> This register contains the physical address that marks the top of region 5</td>

<td> 0x30</td><td> Region6Bottom[21:5 l</td><td> 17</td><td> 0xF_FFF F</td><td> This register contains the physical address that marks the bottom of region 6</td>

<td> 0x34</td><td> Region6Top[21:5]</td><td> 17</td><td> 0x0_000 0</td><td> This register contains the physical address that marks the top of region 6</td>

<td> 0x38</td><td> Region7Bottom[21:5 I</td><td> 17</td><td> 0xF_FFF F</td><td> This register contains the physical address that marks the bottom of region 7</td>

<td> 0x3C</td><td> Region7Top[21:5]</td><td> 17</td><td> 0x0_000 0</td><td> This register contains the physical address that marks the top of region 7</td>

<td> 0x40</td><td> RegionOControl</td><td> 6</td><td> 0x07</td><td> Control register for region 0</td>

<td> 0x44</td><td> Regionl Control</td><td> 6</td><td> 0x07</td><td> Control register for region 1</td>

<td> 0x48</td><td> Region2Control</td><td> 6</td><td> 0x07</td><td> Control register for region 2</td>

<td> Ox4C</td><td> Region3Control</td><td> 6</td><td> 0x07</td><td> Control register for region 3</td>

<td> 0x50</td><td> Region4Control</td><td> 6</td><td> 0x07</td><td> Control register for region 4</td>

<td> 0x54</td><td> Region5Control</td><td> 6</td><td> 0x07</td><td> Control register for region 5</td>

<td> 0x58</td><td> Region6Control</td><td> 6</td><td> 0x07</td><td> Control register for region 6</td>

<td> 0x5C</td><td> Region7Control</td><td> 6</td><td> 0x07</td><td> Control register for region 7</td>

<td> 0x60</td><td> RegionLock</td><td> 8</td><td> 0x00</td><td> Writing a 1 to a bit in the RegionLock register</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

104

<td></td><td></td><td></td><td></td><td> locks the value of the corresponding RegionTop, RegionBottom and RegionControl registers. The lock can only be cleared by a reset and any attempt to write to a locked register will result in a bus error.</td>

<td> 0x64</td><td> BusTimeout</td><td> 8</td><td> OxFF</td><td> This register should be set to the number of pclk cycles to wait after an access has started before aborting the access with a bus error. Writing 0 to this register disables the bus timeout feature.</td>

<td> 0x68</td><td> Exceptionsource</td><td> 6</td><td> 0x00</td><td> This register identifies the source of the last exception. See Section 11.6.5.3 for details.</td>

<td> 0x6C</td><td> DebugSelect</td><td> 7</td><td> 0x00</td><td> Contains address of the register selected for debug observation. It is expected that a number of pseudo-registers will be made available for debug observation and these will be outlined during the implementation phase.</td>

<td> 0x80 to 0x108</td><td> RDU Registers</td><td></td><td></td><td> See Table for details.</td>

<td> 0x140</td><td> LEON Configuration Register</td><td> 32</td><td> 0x1071_ 8 COO</td><td> The LEON configuration register is used by software to determine the configuration of this LEON implementation. See section 11.5.1.1 for details. This register is Readonly.</td>

<td> 0x144</td><td> LEON Cache Control Register</td><td> 32</td><td> 0x0000_ 0 000</td><td> The LEON Cache Control Register is used to control the operation of the caches. See section 11.6 for details.</td>

11.6.5.1 Region Top and RegionBottom registers

The 20 Mbit of embedded DRAM on SoPEC is arranged as 81920 words of 256 bits each. All region boundaries need to align with a 256-bit word. Thus only 17 bits are required for the

RegionNTop and RegionNBottom registers. Note that the bottom 5 bits of the RegionNTop and RegionNBottom registers cannot be written to and read as Ό’ i.e. the RegionNTop and RegionNBottom registers represent byte-aligned DRAM addresses

Both the RegionNTop and RegionNBottom registers are inclusive i.e. the addresses in the registers are included in the region. Thus the size of a region is (RegionNTop - RegionNBottom) +1 DRAM words.

If DRAM regions overlap (there is no reason for this to be the case but there is nothing to prohibit it either) then only accesses allowed by all overlapping regions are permitted. That is if a DRAM address appears in both Regionl and Region3 (for example) the cpu_acode of an access is

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

105 checked against the access permissions of both regions. If both regions permit the access then it will proceed but if either or both regions do not permit the access then it will not be allowed. The MMU does not support negatively sized regions i.e. the value of the RegionNTop register should always be greater than or equal to the value of the RegionNBottom register. If RegionNTop is lower in the address map than RegionNTop then the region is considered to be zero-sized and is ignored.

When both the RegionNTop and RegionNBottom registers for a region contain the same value the region is then simply one 256-bit word in length and this corresponds to the smallest possible active region.

11.6.5.2 Region Control registers

Each memory region has a control register associated with it. The RegionNControl register is used to set the access conditions for the memory region bounded by the RegionNTop and RegionNBottom registers. Table 20 describes the function of each bit field in the RegionNControl registers. All bits in a RegionNControl register are both readable and writable by design. However, like all registers in the MMU, the RegionNControl registers can only be accessed by code running in supervisor mode.

Table 20. Region Control Register

<td> Field Name V v .</td><td> bit(s)</td><td> Description</td>

<td> Supervisor Access</td><td> 2:0</td><td> Denotes the type of access allowed when the CPU is running in Supervisor mode. For each access type a 1 indicates the access is permitted and a 0 indicates the access is not permitted. bitO - Data read access permission bit1 - Data write access permission bit2 - Instruction fetch access permission</td>

<td> UserAccess</td><td> 5:3</td><td> Denotes the type of access allowed when the CPU is running in User mode. For each access type a 1 indicates the access is permitted and a 0 indicates the access is not permitted. bit3 - Data read access permission bit4 - Data write access permission bit5 - Instruction fetch access permission</td>

11.6.5.3 Exceptionsource Register

The SPARC V8 architecture allows for a number of types of memory access error to be trapped. These trap types and trap handling in general are described in chapter 7 of the SPARC architecture manual [36], However on the LEON processor only data_store_error and data_access_exception trap types will result from an external (to LEON) bus error. According to the SPARC architecture manual the processor will automatically move to the next register window (i.e. it decrements the current window pointer) and copies the program counters (PC and nPC) to two local registers in the

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

106 new window. The supervisor bit in the PSR is also set and the PSR can be saved to another local register by the trap handler (this does not happen automatically in hardware). The Exceptionsource register aids the trap handler by identifying the source of an exception. Each bit in the Exceptionsource register is set when the relevant trap condition and should be cleared by the trap handler by writing a ’T to that bit position.

Table 21. Exceptionsource Register

<td> Field Name</td><td> bit(s)</td><td> Description</td>

<td> DramAccessExcptn</td><td> 0</td><td> The permissions of an access did not match those of the DRAM region it was attempting to access. This bit will also be set if an attempt is made to access an undefined DRAM region (i.e. a location that is not within the bounds of any RegionTop/RegionBottom pair)</td>

<td> PeriAccessExcptn</td><td> 1</td><td> An access violation occurred when accessing a CPU subsystem block. This occurs when the access permissions disagree with those set by the block.</td>

<td> UnusedAreaExcptn</td><td> 2</td><td> An attempt was made to access an unused part of the memory map</td>

<td> Locked W riteExcptn</td><td> 3</td><td> An attempt was made to write to a regions registers (RegionTop/ Bottom/Control) after they had been locked.</td>

<td> ResetHandlerExcptn</td><td> 4</td><td> An attempt was made to access a ROM location between 0x0000_0000 and 0x0000_000F after the reset handler was executed. The most likely cause of such an access is the use of an uninitialised pointer or structure.</td>

<td> TimeoutExcptn</td><td> 5</td><td> A bus timeout condition occurred.</td>

11.6.6 MMU Sub-block partition

As can be seen from Figure 19 and Figure 20 the MMU consists of three principal sub-blocks. For clarity the connections between these sub-blocks and other SoPEC blocks and between each of the sub-blocks are shown in two separate diagrams.

11.6.6.1 LEON AHB Bridge

The LEON AHB bridge consists of an AHB bridge to DIU and an AHB to CPU subsystem bus bridge. The AHB bridge will convert between the AHB and the DIU and CPU subsystem bus protocols but the address decoding and enabling of an access happens elsewhere in the MMU. The AHB bridge will always be a slave on the AHB. Note that the AMBA signals from the LEON core are contained within the ahbso and ahbsi records. The LEON records are described in more detail in section 11.7. Glue logic may be required to assist with enabling memory accesses, endianness coherency, interrupts and other miscellaneous signalling.

Table 22. LEON AHB bridge I/Os

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

107

<td> Port name</td><td> Pins</td><td> I/O</td><td> Description</td>

<td> Global SoPEC signals</td><td></td><td></td><td></td>

<td> prst_n</td><td> 1</td><td> In</td><td> Global reset. Synchronous to pclk, active low.</td>

<td> pclk</td><td> 1</td><td> In</td><td> Global clock</td>

<td colspan="4"> LEON core to LEON AHB signals (ahbsi and ahbso records)</td>

<td> ahbsi.haddr[31:0]</td><td> 32</td><td> In</td><td> AHB address bus</td>

<td> ahbsi. hwdata[31:0]</td><td> 32</td><td> In</td><td> AHB write data bus</td>

<td> ahbso.hrdata[31:0]</td><td> 32</td><td> Out</td><td> AHB read data bus</td>

<td> ahbsi.hsel</td><td> 1</td><td> In</td><td> AHB slave select signal</td>

<td> ahbsi. hwrite</td><td> 1</td><td> In</td><td> AHB write signal: 1 - Write access 0 - Read access</td>

<td> ahbsi.htrans</td><td> 2</td><td> In</td><td> Indicates the type of the current transfer: 00 - IDLE 01 - BUSY 10-NONSEQ 11 -SEQ</td>

<td> ahbsi.hsize</td><td> 3</td><td> In</td><td> Indicates the size of the current transfer: 000 - Byte transfer 001 - Halfword transfer 010 - Word transfer 011 - 64-bit transfer (unsupported?) 1xx - Unsupported larger wordsizes</td>

<td> ahbsi.hburst</td><td> 3</td><td> In</td><td> Indicates if the current transfer forms part of a burst and the type of burst: 000 - SINGLE 001 - INCR 010-WRAP4 011 -INCR4 100-WRAP8 101 -INCR8 110-WRAP16 111 -INCR16</td>

<td> ahbsi.hprot</td><td> 4</td><td> In</td><td> Protection control signals pertaining to the current access: hprot[0] - Opcode(O) / Data(1 ) access hprot[1] - User(0) / Supervisor access hprot[2] - Non-bufferable(O) / Bufferable(1 ) access (unsupported)</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

108

<td></td><td></td><td></td><td> hprot[3] - Non-cacheable(O) / Cacheable access</td>

<td> ahbsi.hmaster</td><td> 4</td><td> In</td><td> Indicates the identity of the current bus master. This will always be the LEON core.</td>

<td> ahbsi.hmastlock</td><td> 1</td><td> In</td><td> Indicates that the current master is performing a locked sequence of transfers.</td>

<td> ahbso.hready</td><td> 1</td><td> Out</td><td> Active high ready signal indicating the access has completed</td>

<td> ahbso.hresp</td><td> 2</td><td> Out</td><td> Indicates the status of the transfer: 00 - OKAY 01 - ERROR 10-RETRY 11 - SPLIT</td>

<td> ahbso.hsplit[15:0]</td><td> 16</td><td> Out</td><td> This 16-bit split bus is used by a slave to indicate to the arbiter which bus masters should be allowed attempt a split transaction. This feature will be unsupported on the AHB bridge</td>

<td colspan="3"> Toplevel/ Common LEON AHB bridge signais</td><td></td>

<td> cpu_dataout[31:0]</td><td> 32</td><td> Out</td><td> Data out bus to both DRAM and peripheral devices.</td>

<td> cpu_rwn</td><td> 1</td><td> Out</td><td> Read/NotWrite signal. 1 = Current access is a read access, 0 = Current access is a write access</td>

<td> icu_cpu_ilevel[3:0]</td><td> 4</td><td> In</td><td> An interrupt is asserted by driving the appropriate priority level on icu_cpujlevel. These signals must remain asserted until the CPU executes an interrupt acknowledge cycle.</td>

<td> cpu_icuJlevel[3:0]</td><td> 4</td><td> In</td><td> Indicates the level of the interrupt the CPU is acknowledging when cpujack is high</td>

<td> cpujack</td><td> 1</td><td> Out</td><td> Interrupt acknowledge signal. The exact timing depends on the CPU core implementation</td>

<td> cpu_start_access</td><td> 1</td><td> Out</td><td> Start Access signal indicating the start of a data transfer and that the cpu_adr, cpu_dataout, cpu_rwn and cpu_acode signals are all valid. This signal is only asserted during the first cycle of an access.</td>

<td> cpu_ben[1:0]</td><td> 2</td><td> Out</td><td> Byte enable signals.</td>

<td> dram_cpu_data[255:0]</td><td> 256</td><td> In</td><td> Read data from the DRAM.</td>

<td> diu_cpu_rreq</td><td> 1</td><td> Out</td><td> Read request to the DIU.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

109

<td> diu_cpu_rack</td><td> 1</td><td> In</td><td> Acknowledge from DIU that read request has been accepted.</td>

<td> diu_cpu_rvalid</td><td> 1</td><td> In</td><td> Signal from DIU indicating that valid read data is on the dram_cpu_data bus</td>

<td> cpu_diu_wdatavalid</td><td> 1</td><td> Out</td><td> Signal from the CPU to the DIU indicating that the data currently on the cpu_diu_wdata bus is valid and should be committed to the DIU posted write buffer</td>

<td> diu_cpu_write_rdy</td><td> 1</td><td> In</td><td> Signal from the DIU indicating that the posted write buffer is empty</td>

<td> cpu_diu_wdadr[21:4]</td><td> 18</td><td> Out</td><td> Write address bus to the DIU</td>

<td> cpu_diu_wdata[127:0]</td><td> 128</td><td> Out</td><td> Write data bus to the DIU</td>

<td> cpu_diu_wmask[15:0]</td><td> 16</td><td> Out</td><td> Write mask for the cpu_diu_wdata bus. Each bit corresponds to a byte of the 128-bit cpu_diu_wdata bus.</td>

<td colspan="4"> LEON AHB bridge to MMU Control Block signals</td>

<td> cpu_mmu_adr</td><td> 32</td><td> Out</td><td> CPU Address Bus.</td>

<td> mmu_cpu_data</td><td> 32</td><td> In</td><td> Data bus from the MMU</td>

<td> mmu_cpu_rdy</td><td> 1</td><td> In</td><td> Ready signal from the MMU</td>

<td> cpu_mmu_acode</td><td> 2</td><td> Out</td><td> Access code signals to the MMU</td>

<td> mmu_cpu_berr</td><td> 1</td><td> In</td><td> Bus error signal from the MMU</td>

<td> dram_access_en</td><td> 1</td><td> In</td><td> DRAM access enable signal. A DRAM access cannot be initiated unless it has been enabled by the MMU control unit.</td>

Description:

The LEON AHB bridge must ensure that all CPU bus transactions are functionally correct and that the timing requirements are met. The AHB bridge also implements a 128-bit DRAM write buffer to improve the efficiency of DRAM writes, particularly for multiple successive writes to DRAM. The

AHB bridge is also responsible for ensuring endianness coherency i.e. guaranteeing that the correct data appears in the correct position on the data buses (hrdata, cpu_dataout and cpu_mmu_wdata) for every type of access. This is a requirement because the LEON uses big-endian addressing while the rest of SoPEC is little-endian.

The LEON AHB bridge will assert request signals to the DIU if the MMU control block deems the access to be a legal access. The validity (i.e. is the CPU running in the correct mode for the address space being accessed) of an access is determined by the contents of the relevant RegionNControl register. As the SPARC standard requires that all accesses are aligned to their word size (i.e. byte, half-word, word or double-word) and so it is not possible for an access to traverse a 256-bit boundary (as required by the DIU). Invalid DRAM accesses are not propagated to the DIU and will result in an error response (ahbso.hresp = Ό1’) on the AHB. The DIU bus protocol

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

110 is described in more detail in section 20.9. The DIU will return a 256-bit dataword on dram_cpu_data[255:0] for every read access.

The CPU subsystem bus protocol is described in section 11.4.3. While the LEON AHB bridge performs the protocol translation between AHB and the CPU subsystem bus the select signals for each block are generated by address decoding in the CPU subsystem bus interface. The CPU subsystem bus interface also selects the correct read data bus, ready and error signals for the block being addressed and passes these to the LEON AHB bridge which puts them on the AHB bus. It is expected that some signals (especially those external to the CPU block) will need to be registered here to meet the timing requirements. Careful thought will be required to ensure that overall CPU access times are not excessively degraded by the use of too many register stages.

11.6.6.1.1 DRAM write buffer

The DRAM write buffer improves the efficiency of DRAM writes by aggregating a number of CPU write accesses into a single DIU write access. This is achieved by checking to see if a CPU write is to an address already in the write buffer and if so the write is immediately acknowledged (i.e. the ahbsi.hready signal is asserted without any wait states) and the DRAM write buffer updated accordingly. When the CPU write is to a DRAM address other than that in the write buffer then the current contents of the write buffer are sent to the DIU (where they are placed in the posted write buffer) and the DRAM write buffer is updated with the address and data of the CPU write. The DRAM write buffer consists of a 128-bit data buffer, an 18-bit write address tag and a 16-bit write mask. Each bit of the write mask indicates the validity of the corresponding byte of the write buffer as shown in Figure 21 below.

The operation of the DRAM write buffer is summarised by the following set of rules:

1) The DRAM write buffer only contains DRAM write data i.e. peripheral writes go directly to the addressed peripheral.

) CPU writes to locations within the DRAM write buffer or to an empty write buffer (i.e. the write mask bits are all 0) complete with zero wait states regardless of the size of the write (byte/halfword/word/ double-word).

) The contents of the DRAM write buffer are flushed to DRAM whenever a CPU write to a location outside the write buffer occurs, whenever a CPU read from a location within the write buffer occurs or whenever a write to a peripheral register occurs.

) A flush resulting from a peripheral write will not cause any extra wait states to be inserted in the peripheral write access.

5) Flushes resulting from a DRAM accesses will cause wait states to be inserted until the DIU posted write buffer is empty. If the DIU posted write buffer is empty at the time the flush is required then no wait states will be inserted for a flush resulting from a CPU write or one wait state will be inserted for a flush resulting from a CPU read (this is to ensure that the DIU sees the write request ahead of the read request). Note that in this case further wait states will also be inserted as a result of the delay in servicing the read request by the DIU.

11.6.6.1.2 DIU interface waveforms

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

111

Figure 22 below depicts the operation of the AHB bridge over a sample sequence of DRAM transactions consisting of a read into the DCache, a double-word store to an address other than that currently in the DRAM write buffer followed by an ICache line refill. To avoid clutter a number of AHB control signals that are inputs to the MMU have been grouped together as ahbsi.CONTROL and only the ahbso.HREADY is shown of the output AHB control signals.

The first transaction is a single word load (’LD’). The MMU (specifically the MMU control block) uses the first cycle of every access (i.e. the address phase of an AHB transaction) to determine whether or not the access is a legal access. The read request to the DIU is then asserted in the following cycle (assuming the access is a valid one) and is acknowledged by the DIU a cycle later. Note that the time from cpu_diu_rreq being asserted and diu_cpu_rack being asserted is variable as it depends on the DIU configuration and access patterns of DIU requestors. The AHB bridge will insert wait states until it sees the diu_cpu_rvalid signal is high, indicating the data (’LD 1 ’) on the dram_cpu_data bus is valid. The AHB bridge terminates the read access in the same cycle by asserting the ahbso.HREADY signal (together with an OKAY’ HRESP code). The AHB bridge also selects the appropriate 32 bits (’RDT) from the 256-bit DRAM line data (’LDT) returned by the DIU corresponding to the word address given by A1.

The second transaction is an AHB two-beat incrementing burst issued by the LEON acache block in response to the execution of a double-word store instruction. As LEON is a big endian processor the address issued (Ά2’) during the address phase of the first beat of this transaction is the address of the most significant word of the double-word while the address for the second beat (’A3’) is that of the least significant word i.e. A3 = A2 +4. The presence of the DRAM write buffer allows these writes to complete without the insertion of any wait states. This is true even when, as shown here, the DRAM write buffer needs to be flushed into the DIU posted write buffer, provided the DIU posted write buffer is empty. If the DIU posted write buffer is not empty (as would be signified by diu_cpu_write_rdy being low) then wait states would be inserted until it became empty. The cpu_diu_wdata buffer builds up the data to be written to the DIU over a number of transactions (’BDT and ’BD2’ here) while the cpu_diu_wmask records every byte that has been written to since the last flush - in this case the lowest word and then the second lowest word are written to as a result of the double-word store operation.

The final transaction shown here is a DRAM read caused by an ICache miss. Note that the pipelined nature of the AHB bus allows the address phase of this transaction to overlap with the final data phase of the previous transaction. All ICache misses appear as single word loads (’LD’) on the AHB bus. In this case we can see that the DIU is slower to respond to this read request than to the first read request because it is processing the write access caused by the DRAM write buffer flush. The ICache refill will complete just after the window shown in Figure 22.

11.6.6.2 CPU Subsystem Bus Interface

The CPU Subsystem Interface block handles all valid accesses to the peripheral blocks that comprise the CPU Subsystem.

Table 23. CPU Subsystem Bus Interface I/Os

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

112

<td> Port name</td><td> Pins</td><td> I/O</td><td> Description</td>

<td> Global SoPEC signals</td><td></td><td></td><td></td>

<td> prst_n</td><td> 1</td><td> In</td><td> Global reset. Synchronous to pclk, active low.</td>

<td> pclk</td><td> 1</td><td> In</td><td> Global clock</td>

<td> Toplevel/Common CPU Su</td><td colspan="2"> Dsystem Bus</td><td> nterface signals</td>

<td> cpu_cpr_sel</td><td> 1</td><td> Out</td><td> CPR block select.</td>

<td> cpu_gpio_sel</td><td> 1</td><td> Out</td><td> GPIO block select.</td>

<td> cpu_icu_sel</td><td> 1</td><td> Out</td><td> ICU block select.</td>

<td> cpu_lss_sel</td><td> 1</td><td> Out</td><td> LSS block select.</td>

<td> cpu_pcu_sel</td><td> 1</td><td> Out</td><td> PCU block select.</td>

<td> cpu_scb_sel</td><td> 1</td><td> Out</td><td> SCB block select.</td>

<td> cpu_tim_sel</td><td> 1</td><td> Out</td><td> Timers block select.</td>

<td> cpu_rom_sel</td><td> 1</td><td> Out</td><td> ROM block select.</td>

<td> cpu_pss_sel</td><td> 1</td><td> Out</td><td> PSS block select.</td>

<td> cpu_diu_sel</td><td> 1</td><td> Out</td><td> DIU block select..</td>

<td> cpr_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the CPR block</td>

<td> gpio_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the GPIO block</td>

<td> icu_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the ICU block</td>

<td> lss_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the LSS block</td>

<td> pcu_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the PCU block</td>

<td> scb_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the SCB block</td>

<td> tim_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the Timers block</td>

<td> rom_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the ROM block</td>

<td> pss_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the PSS block</td>

<td> diu_cpu_data[31:0]</td><td> 32</td><td> In</td><td> Read data bus from the DIU block</td>

<td> cpr_cpu_rdy</td><td> 1</td><td> In</td><td> Ready signal to the CPU. When cpr_cpu_rdy is high it indicates the last cycle of the access. For a write cycle this means cpu__dataout has been registered by the CPR block and for a read cycle this means the data on cpr_cpu_data is valid.</td>

<td> gpio_cpu_rdy</td><td> 1</td><td> In</td><td> GPIO ready signal to the CPU.</td>

<td> icu_cpu_rdy</td><td> 1</td><td> In</td><td> ICU ready signal to the CPU.</td>

<td> lss_cpu_rdy</td><td> 1</td><td> In</td><td> LSS ready signal to the CPU.</td>

<td> pcu_cpu_rdy</td><td> 1</td><td> In</td><td> PCU ready signal to the CPU.</td>

<td> scb_cpu_rdy</td><td> 1</td><td> In</td><td> SCB ready signal to the CPU.</td>

<td> tim_cpu_rdy</td><td> 1</td><td> In</td><td> Timers block ready signal to the CPU.</td>

<td> rom_cpu_rdy</td><td> 1</td><td> In</td><td> ROM block ready signal to the CPU.</td>

<td> pss_cpu_rdy</td><td> 1</td><td> In.</td><td> PSS block ready signal to the CPU.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

113

<td> diu_cpu_rdy</td><td> 1</td><td> In</td><td> DIU register block ready signal to the CPU.</td>

<td> cpr_cpu_berr</td><td> 1</td><td> In</td><td> Bus Error signal from the CPR block</td>

<td> gpio_cpu_berr</td><td> 1</td><td> In</td><td> Bus Error signal from the GPIO block</td>

<td> icu_cpu_berr</td><td> 1</td><td> In</td><td> Bus Error signal from the ICU block</td>

<td> lss_cpu_berr</td><td> 1</td><td> In</td><td> Bus Error signal from the LSS block</td>

<td> pcu_cpu_berr</td><td> 1</td><td> In</td><td> Bus Error signal from the PCU block</td>

<td> scb_cpu_berr</td><td> 1</td><td> In</td><td> Bus Error signal from the SCB block</td>

<td> tim_cpu_berr</td><td> 1</td><td> In</td><td> Bus Error signal from the Timers block</td>

<td> rom_cpu_berr</td><td> 1</td><td> In</td><td> Bus Error signal from the ROM block</td>

<td> pss_cpu_berr</td><td> 1</td><td> In</td><td> Bus Error signal from the PSS block</td>

<td> diu_cpu_berr</td><td> 1</td><td> In</td><td> Bus Error signal from the DIU block</td>

<td colspan="4"> CPU Subsystem Bus Interface to MMU Control Block signals</td>

<td> cpu_adr[19:12]</td><td> 8</td><td> In</td><td> Toplevel CPU Address bus. Only bits 19-12 are required to decode the peripherals address space</td>

<td> peri_access_en</td><td> 1</td><td> In</td><td> Enable Access signal. A peripheral access cannot be initiated unless it has been enabled by the MMU Control Unit</td>

<td> peri_mmu_data[31:0]</td><td> 32</td><td> Out</td><td> Data bus from the selected peripheral</td>

<td> peri_mmu_rdy</td><td> 1</td><td> Out</td><td> Data Ready signal. Indicates the data on the peri_mmu_data bus is valid for a read cycle or that the data was successfully written to the peripheral for a write cycle.</td>

<td> peri_mmu_berr</td><td> 1</td><td> Out</td><td> Bus Error signal. Indicates a bus error has occurred in accessing the selected peripheral</td>

<td colspan="4"> CPU Subsystem Bus Interface to LEON AHB bridge signals</td>

<td> cpu_start_access</td><td> 1</td><td> In</td><td> Start Access signal from the LEON AHB bridge indicating the start of a data transfer and that the cpu_adr, cpu_dataout, cpu_rwn and cpu_acode signals are all valid. This signal is only asserted during the first cycle of an access.</td>

Description:

The CPU Subsystem Bus Interface block performs simple address decoding to select a peripheral and multiplexing of the returned signals from the various peripheral blocks. The base addresses used for the decode operation are defined in Table . Note that access to the MMU configuration 5 registers are handled by the MMU Control Block rather than the CPU Subsystem Bus Interface block. The CPU Subsystem Bus Interface block operation is described by the following pseudocode:

masked_cpu_adr = cpu_adr[17:12]

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

114 case (masked_cpu_adr) when TIM_base[17:12] cpu_tim_sel = peri_access_en signal will have the peri_mmu_data = tim_cpu_data block selects // The peri_access_en // timing required for peri_mmu_rdy = tim_cpu_rdy peri_mmu_berr = tim_cpu_berr all_other_selects = 0 // Shorthand to ensure other cpu_block_sel signals // remain deasserted when LSS_base[17:12] cpu_lss_sel = peri_access_en peri_mmu_data = lss_cpu_data peri_mmu_rdy = lss_cpu_rdy peri_mmu_berr = lss_cpu_berr all_other_selects = 0 when GPIO_base[17:12] cpu_gpio_sel = peri_access_en peri_mmu_data = gpio_cpu_data peri_mmu_rdy = gpio_cpu_rdy peri_mmu_berr = gpio_cpu_berr all other selects = 0 when SCB_base[17:12] cpu_scb_sel = peri_access_en peri_mmu_data = scb_cpu_data peri_mmu_rdy = scb_cpu_rdy peri_mmu_berr = scb_cpu_berr all_other_selects = 0 when ICU_base[17:12] cpu_icu_sel = peri_access_en peri_mmu_data = icu_cpu_data peri_mmu_rdy = icu_cpu_rdy peri_mmu_berr = icu_cpu_berr all_other_selects = 0 when CPR_base[17:12] cpu_cpr_sel = peri_access_en peri_mmu_data = cpr_cpu_data peri_mmu_rdy = cpr_cpu_rdy peri_mmu_berr = cpr_cpu_berr all_other_selects = 0

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

115 when ROM_base[17:12] cpu_rom_sel = peri_access_en peri_mmu_data = rom__cpu_data peri_mmu_rdy = rom._cpu._rdy peri_mmu_berr = rom_cpu_berr all_other_selects = 0 when PSS_base [17:12] cpu_jpss_sel = peri_access_en peri_mmu_data = pss__cpu_data peri_mmu_rdy = pss_cpu_rdy peri_mmu_berr = pss_cpu_berr all_other_selects = 0 when DIU_base[17:12] cpu_diu__sel = peri_access_en peri_mmu_data = diu_cpu_data peri_mmu_rdy = diu_cpu_rdy peri_mmu_berr = diu_cpu_berr all_other_selects = 0 when PCU_base[17:12] cpu_pcu_sel = peri_access_en peri_mmu_data = pcu_cpu_data peri_mmu_rdy = pcu_cpu_rdy peri_mmu_berr = pcu_cpu_berr all_other_selects = 0 when others all_block_selects = 0 peri_mmu_data = 0x00000000 peri_mmu_rdy = 0 peri_mmu_berr = 1 end case

11.6.6.3 MMU Control Block

The MMU Control Block determines whether every CPU access is a valid access. No more than one cycle is to be consumed in determining the validity of an access and all accesses must terminate with the assertion of either mmu_cpu_rdy or mmu_cpu_berr. To safeguard against stalling the CPU a simple bus timeout mechanism will be supported.

Table 24. MMU Control Block I/Os

<td> Port name</td><td> Pins</td><td> I/O</td><td> Description</td>

<td colspan="4"> Global SoPEC signals</td>

<td> prst_n</td><td> 1</td><td> In</td><td> Global reset. Synchronous to pclk, active low.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

116

<td> pclk</td><td> 1</td><td> In</td><td> Global clock</td>

<td colspan="4"> Toplevel/Common MMU Control Block signals</td>

<td> cpu_adr[21:2]</td><td> 22</td><td> Out</td><td> Address bus for both DRAM and peripheral access.</td>

<td> cpu_acode[1:0]</td><td> 2</td><td> Out</td><td> CPU access code signals (cpu_mmu_acode) retimed to meet the CPU Subsystem Bus timing requirements</td>

<td> dram_access_en</td><td> 1</td><td> Out</td><td> DRAM Access Enable signal. Indicates that the current CPU access is a valid DRAM access.</td>

<td colspan="2"> MMU Control Block to LEON A</td><td colspan="2"> HB bridge signals</td>

<td> cpu_mmu_adr[31:0]</td><td> 32</td><td> In</td><td> CPU core address bus.</td>

<td> cpu_dataout[31:0]</td><td> 32</td><td> In</td><td> Toplevel CPU data bus</td>

<td> mmu_cpu_data[31:0]</td><td> 32</td><td> Out</td><td> Data bus to the CPU core. Carries the data for all CPU read operations</td>

<td> cpu_rwn</td><td> 1</td><td> In</td><td> Toplevel CPU Read/notWrite signal.</td>

<td> cpu_mmu_acode[1:0]</td><td> 2</td><td> In</td><td> CPU access code signals</td>

<td> mmu_cpu_rdy</td><td> 1</td><td> Out</td><td> Ready signal to the CPU core. Indicates the completion of all valid CPU accesses.</td>

<td> mmu_cpu_berr</td><td> 1</td><td> Out</td><td> Bus Error signal to the CPU core. This signal is asserted to terminate an invalid access.</td>

<td> cpu_start_access</td><td> 1</td><td> In</td><td> Start Access signal from the LEON AHB bridge indicating the start of a data transfer and that the cpu_adr, cpu_dataout, cpu_rwn and cpu_acode signals are all valid. This signal is only asserted during the first cycle of an access.</td>

<td> cpujack</td><td> 1</td><td> In</td><td> Interrupt Acknowledge signal from the CPU. This signal is only asserted during an interrupt acknowledge cycle.</td>

<td> cpu_ben[1:0]</td><td> 2</td><td> In</td><td> Byte enable signals indicating which bytes of the 32bit bus are being accessed.</td>

<td colspan="4"> MMU Control Block to CPU Subsystem Bus Interface signals</td>

<td> cpu_adr[17:12]</td><td> 8</td><td> Out</td><td> Toplevel CPU Address bus. Only bits 17-12 are required to decode the peripherals address space</td>

<td> peri_access_en</td><td> 1</td><td> Out</td><td> Enable Access signal. A peripheral access cannot be initiated unless it has been enabled by the MMU Control Unit</td>

<td> peri_mmu_data[31:0]</td><td> 32</td><td> In</td><td> Data bus from the selected peripheral</td>

<td> peri_mmu_rdy</td><td> 1</td><td> In</td><td> Data Ready signal. Indicates the data on the peri_mmu_data bus is valid for a read cycle or that the data was successfully written to the peripheral for a write cycle.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

117

<td> peri_mmu_berr</td><td> 1</td><td> In</td><td> Bus Error signal. Indicates a bus error has occurred in</td>

<td></td><td></td><td></td><td> accessing the selected peripheral</td>

Description:

The MMU Control Block is responsible for the MMU’s core functionality, namely determining whether or not an access to any part of the address map is valid. An access is considered valid if it is to a mapped area of the address space and if the CPU is running in the appropriate mode for that address space. Furthermore the MMU control block must correctly handle the special cases that are: an interrupt acknowledge cycle, a reset exception vector fetch, an access that crosses a 256bit DRAM word boundary and a bus timeout condition. The following pseudocode shows the logic required to implement the MMU Control Block functionality. It does not deal with the timing relationships of the various signals - it is the designer’s responsibility to ensure that these relationships are correct and comply with the different bus protocols. For simplicity the pseudocode is split up into numbered sections so that the functionality may be seen more easily.

It is important to note that the style used for the pseudocode will differ from the actual coding style used in the RTL implementation. The pseudocode is only intended to capture the required functionality, to clearly show the criteria that need to be tested rather than to describe how the implementation should be performed. In particular the different comparisons of the address used to determine which part of the memory map, which DRAM region (if applicable) and the permission checking should all be performed in parallel (with results ORed together where appropriate) rather than sequentially as the pseudocode implies.

PS0 Description: This first segment of code defines a number of constants and variables that are used elsewhere in this description. Most signals have been defined in the I/O descriptions of the MMU sub-blocks that precede this section of the document. The post_reset_state variable is used later (in section PS4) to determine if we should trap a null pointer access.

PS0:

const UnusedBottom = 0x002AC000 const DRAMTop = Ox4027FFFF const UserDataSpace = bOl const UserProgramSpace = bOO const SupervisorDataSpace = bll const SupervisorProgramSpace = blO const ResetExceptionCycles = 0x2 cpu__adr_peri_masked [5 : 0] = cpu_mmu_adr[17:12] cpu_adr_dram_masked[16:0] = cpu_mmu_adr &amp; 0x003FFFE0 if (prst_n == 0) then // Initialise everything cpu_adr = cpu_mmu_adr[21:2] peri_access_en = 0

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

118 dram_access_en = 0 mmu_cpu_data = peri_mmu_data mmu_cpu_rdy = 0 mmu_cpu_berr = 0 post_reset_state = TRUE access_initiated = FALSE cpu_access_cnt = 0 // The following is used to determine if we are coming out of reset for the purposes of // reset exception vector redirection. There may be a convenient signal in the CPU core // that we could use instead of this.

if ((cpu_start_access == 1) AND (cpu_access_cnt &lt;

ResetExceptionCycles) AND (clock_tick == TRUE)) then cpu_access_cnt = cpu_access_cnt +1 else post_reset_state = FALSE

PS1 Description: This section is at the top of the hierarchy that determines the validity of an access. The address is tested to see which macro-region (i.e. Unused, CPU Subsystem or DRAM) it falls into or whether the reset exception vector is being accessed.

PSI:

if (cpu_mmu_adr &gt;= UnusedBottom) then

<td> // The access is to an invalid area of the address space. See section PS2</td>

<td> elsif ((cpu_mmu_adr &gt; DRAMTop) AND (cpu_mmu_adr &lt;</td>

<td> UnusedBottom)) then</td>

<td> // We are in the CPU Subsystem/PEP Subsystem address</td>

<td> space. See section PS3</td>

// Only remaining possibility is an access to DRAM address space // First we need to intercept the special case for the reset exception vector elsif (cpu_mmu_adr &lt; 0x00000010) then // The reset exception is being accessed. See section PS4

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

119

<td> elsif ((cpu_adr_dram_masked</td><td> &gt;=</td><td> RegionOBottom)</td><td> AND</td>

<td> ( cpu_adr_dram__masked &lt; =</td><td></td><td></td><td></td>

<td> RegionOTop) ) then</td><td></td><td></td><td></td>

<td> // We are in RegionO. See</td><td> section</td><td> PS5</td><td></td>

<td> elsif ((cpu_adr_dram_masked</td><td> &gt;=</td><td> RegionNBottom)</td><td> AND</td>

(cpu_adr_dram_masked &lt;=

RegionNTop) ) then // we are in RegioriN // Repeat the RegionO (i.e. section PS5) logic for each of Regionl to Region7 else // We could end up here if there were gaps in the DRAM regions peri_access_en = 0 dram_access_en = 0 mmu_cpu_berr = 1 // we have an unknown access error, most likely due to hitting mmu_cpu_rdy = 0 // a gap in the DRAM regions // Only thing remaining is to implement a bus timeout function. This is done in PS6 end

PS2 Description: Accesses to the large unused area of the address space are trapped by this section. No bus transactions are initiated and the mmu_cpu_berr signal is asserted.

PS2:

elsif (cpu_mmu_adr &gt;= UnusedBottom) then peri_access_en = 0 // The access is to an invalid area of the address space dram_access_en = 0 mmu_cpu_berr = 1 mmu_cpu_rdy = 0

PS3 Description: This section deals with accesses to CPU Subsystem peripherals, including the MMU itself. If the MMU registers are being accessed then no external bus transactions are required. Access to the MMU registers is only permitted if the CPU is making a data access from supervisor mode, otherwise a bus error is asserted and the access terminated. For non-MMU accesses then transactions occur over the CPU Subsystem Bus and each peripheral is responsible for determining whether or not the CPU is in the correct mode (based on the cpu_acode signals) to be permitted

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

120 access to its registers. Note that all of the PEP registers are accessed via the PCU which is on the CPU Subsystem Bus.

PS3:

elsif ((cpu_mmu_adr &gt; DRAMTop) AND (cpu_mmu_adr &lt;

UnusedBottom)) then // We are in the CPU Subsystem/PEP Subsystem address space cpu_adr = cpu_mmu_adr[21:2] if (cpu_adr_peri_masked == MMU_base) then // access is to local registers peri_access_en = 0 dram access en = 0 if (cpu_acode == SupervisorDataSpace) then for (i=0; i&lt;26; i++) { if ((i == cpu_mmu_adr[6:2]) then addressed register if (cpu_rwn == 1) then mmu_cpu_data[16: 0] = MMURegti] is one of the mmu_cpu_rdy = 1 in Table // selects the // MMUReg[i] /1 registers mmu_cpu_berr = 0 else // write cycle

MMUReg[ i ] = cpu_dataoût[16:0] mmu_cpu_rdy = 1 mmu_cpu_berr = 0 else // there is no register mapped to this address mmu_cpu_berr = 1 // do we really want a bus_error here as registers mmu_cpu_rdy = 0 // are just mirrored in other blocks else // we have an access violation mmu_cpu_berr = 1 mmu_cpu_rdy = 0 else // access is to something else on the CPU Subsystem

Bus

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

121 peri_access_en = 1 dram_access_en = 0 mmu_cpu_data = peri_mmu_data mmu_cpu_rdy = peri_mmu_rdy mmu_cpu_berr = peri_mmu__berr

PS4 Description: The only correct accesses to the locations beneath 0x00000010 are fetches of the reset trap handling routine and these should be the first accesses after reset. Here we trap all other accesses to these locations regardless of the CPU mode. The most likely cause of such an access will be the use of a null pointer in the program executing on the CPU.

PS4:

elsif (cpu_mmu_adr &lt; 0x00000010) then if (post_reset_state == TRUE)) then cpu_adr = cpu_mmu_adr[21:2] peri_access_en = 1 dram_access_en = 0 mmu_cpu_data = peri_mmu_data mmu_cpu_rdy = peri_mmu_rdy mmu_cpu_berr = peri_mmu_berr else // we have a problem (almost certainly a null pointer) peri_access_en = 0 dram_access_en = 0 mmu_cpu_berr = 1 mmu_cpu_rdy = 0

PS5 Description: This large section of pseudocode simply checks whether the access is within the bounds of DRAM RegionO and if so whether or not the access is of a type permitted by the RegionOControl register. If the access is permitted then a DRAM access is initiated. If the access is not of a type permitted by the RegionOControl register then the access is terminated with a bus error.

PS5:

elsif ((cpu_adr_dram_masked &gt;= RegionOBottom) AND (cpu_adr_dram_masked &lt;=

RegionOTop) ) then // we are in RegionO cpu_adr = cpu_mmu_adr[21:2] if (cpu_rwn == 1) then

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

122 if ((cpu_acode == SupervisorProgramSpace AND

RegionOControl[2] == 1))

<td colspan="2"> OR (cpu_acode</td><td> ==</td><td> UserProgramSpace AND</td>

<td> RegionOControl[5] ==</td><td> 1)) then</td><td></td><td></td>

<td></td><td> //</td><td> this</td><td> is a valid instruction</td>

<td> fetch from RegionO</td><td></td><td></td><td></td>

<td></td><td> //</td><td> The</td><td> dram_cpu_data bus goes</td>

<td> directly to the LEON</td><td></td><td></td><td></td>

<td></td><td> //</td><td> AHB</td><td> bridge which also handles</td>

the hready generation peri_access_en = 0 dram_access_en = 1 mmu_cpu_berr = 0

<td colspan="2"> elsif ((cpu_acode ==</td><td> SupervisorDataSpace</td><td> AND</td>

<td> RegionOControl[0]</td><td> == 1)</td><td></td><td></td>

<td> OR</td><td> (cpu_acode ==</td><td> UserDataSpace</td><td> AND</td>

<td> RegionOControl[3]</td><td> == 1)) then</td><td></td><td></td>

<td></td><td></td><td> // this is a</td><td> valid</td>

read access from RegionO peri_access_en = 0 dram_access_en = 1 mmu_cpu_berr = 0 else violation peri_access_en = 0 dram_access_en = 0 mmu_cpu_berr = 1 mmu_cpu_rdy = 0 // we have an access else // it is a write access

<td colspan="2"> if ((cpu_acode ==</td><td> SupervisorDataSpace</td><td> AND</td>

<td> RegionOControl[1]</td><td> == 1)</td><td></td><td></td>

<td> OR</td><td> (cpu_acode</td><td> == UserDataSpace</td><td> AND</td>

<td> RegionOControl[4]</td><td> == 1)) then</td><td></td><td></td>

<td></td><td></td><td> // this is a</td><td> valid</td>

write access to RegionO peri_access_en = 0 dram_access_en = 1 mmu_cpu_berr = 0

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

123 else // we have an access violation peri_access_en = 0 dram_access_en = 0 mmu_cpu_berr = 1 mmu_cpu_rdy = 0

PS6 Description: This final section of pseudocode deals with the special case of a bus timeout. This occurs when an access has been initiated but has not completed before the BusTimeout number of pclk cycles. While access to both DRAM and CPU/PEP Subsystem registers will take a variable number of cycles (due to DRAM traffic, PCU command execution or the different timing required to access registers in imported IP) each access should complete before a timeout occurs. Therefore it should not be possible to stall the CPU by locking either the CPU Subsystem or DIU buses. However given the fatal effect such a stall would have it is considered prudent to implement bus timeout detection.

PS6:

// Only thing remaining is to implement a bus timeout function.

if ((cpu_start_access == 1) then access_initiated = TRUE timeout_countdown = BusTimeout if ((mmu_cpu_rdy == 1 ) OR (mmu_cpu_berr ==1 )) then access_initiated = FALSE peri_access_en = 0 dram_access_en = 0 if ((clock_tick == TRUE) AND (access_initiated == TRUE) AND (BusTimeout 1= 0)) if (timeout_countdown &gt; 0) then timeout_countdown-else // timeout has occurred peri_access_en = 0 // abort the access dram_access_en = 0 mmu_cpu_berr = 1 mmu_cpu_rdy = 0

11.7 LEON Caches

The version of LEON implemented on SoPEC features 1 kB of ICache and 1 kB of DCache. Both caches are direct mapped and feature 8 word lines so their data RAMs are arranged as 32 x 256-bit

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

124 and their tag RAMs as 32 x 30-bit (itag) or 32 x 32-bit (dtag). Like most of the rest of the LEON code used on SoPEC the cache controllers are taken from the Ieon2-1.0.7 release. The LEON cache controllers and cache RAMs have been modified to ensure that an entire 256-bit line is refilled at a time to make maximum use out of the memory bandwidth offered by the embedded DRAM organization (DRAM lines are also 256-bit). The data cache controller has also been modified to ensure that user mode code cannot access the DCache contents unless it is authorised to do so. A block diagram of the LEON CPU core as implemented on SoPEC is shown in Figure 23 below. In this diagram dotted lines are used to indicate hierarchy and red items represent signals or wrappers added as part of the SoPEC modifications. LEON makes heavy use of VHDL records and the records used in the CPU core are described in Table 25. Unless otherwise stated the records are defined in the iface.vhd file (part of the LEON release) and this should be consulted for a complete breakdown of the record elements.

Table 25. Relevant LEON records

<td> Record Name</td><td> Description</td>

<td> rfi</td><td> Register File Input record. Contains address, datain and control signals for the register file.</td>

<td> rfo</td><td> Register File Output record. Contains the data out of the dual read port register file.</td>

<td> ici</td><td> Instruction Cache In record. Contains program counters from different stages of the pipeline and various control signals</td>

<td> ico</td><td> Instruction Cache Out record. Contains the fetched instruction data and various control signals. This record is also sent to the DCache (i.e. icol) so that diagnostic accesses (e.g. Ida/sta) can be serviced.</td>

<td> dci</td><td> Data Cache In record. Contains address and data buses from different stages of the pipeline (execute &amp; memory) and various control signals</td>

<td> dco</td><td> Data Cache Out record. Contains the data retrieved from either memory or the caches and various control signals. This record is also sent to the ICache (i.e. dcol) so that diagnostic accesses (e.g. Ida/sta) can be serviced.</td>

<td> iui</td><td> Integer Unit In record. This record contains the interrupt request level and a record for use with LEONs Debug Support Unit (DSU)</td>

<td> iuo</td><td> Integer Unit Out record. This record contains the acknowledged interrupt request level with control signals and a record for use with LEONs Debug Support Unit (DSU)</td>

<td> mcii</td><td> Memory to Cache Icache In record. Contains the address of an Icache miss and various control signals</td>

<td> mcio</td><td> Memory to Cache Icache Out record. Contains the returned data from memory and various control signals</td>

<td> mcdi</td><td> Memory to Cache Dcache In record. Contains the address and data of a</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

125

<td></td><td> Dcache miss or write and various control signals</td>

<td> mcdo</td><td> Memory to Cache Dcache Out record. Contains the returned data from memory and various control signals</td>

<td> ahbi</td><td> AHB In record. This is the input record for an AHB master and contains the data bus and AHB control signals. The destination for the signals in this record is the AHB controller. This record is defined in the amba.vhd file</td>

<td> ah bo</td><td> AHB Out record. This is the output record for an AHB master and contains the address and data buses and AHB control signals. The AHB controller drives the signals in this record. This record is defined in the amba.vhd file</td>

<td> ahbsi</td><td> AHB Slave In record. This is the input record for an AHB slave and contains the address and data buses and AHB control signals. It is used by the DCache to facilitate cache snooping (this feature is not enabled in SoPEC). This record is defined in the amba.vhd file</td>

<td> crami</td><td> Cache RAM In record. This record is composed of records of records which contain the address, data and tag entries with associated control signals for both the ICache RAM and DCache RAM</td>

<td> cramo</td><td> Cache RAM Out record. This record is composed of records of records which contain the data and tag entries with associated control signals for both the ICache RAM and DCache RAM</td>

<td> iline_rdy</td><td> Control signal from the ICache controller to the instruction cache memory. This signal is active (high) when a full 256-bit line (on dram_cpu_data) is to be written to cache memory.</td>

<td> dline_rdy</td><td> Control signal from the DCache controller to the data cache memory. This signal is active (high) when a full 256-bit line (on dram_cpu_data) is to be written to cache memory.</td>

<td> dram_cpu_data</td><td> 256-bit data bus from the embedded DRAM</td>

11.7.1 Cache controllers

The LEON cache module consists of three components: the ICache controller (icache.vhd), the DCache controller (dcache.vhd) and the AHB bridge (acache.vhd) which translates all cache misses into memory requests on the AHB bus.

In order to enable full line refill operation a few changes had to be made to the cache controllers. The ICache controller was modified to ensure that whenever a location in the cache was updated (i.e. the cache was enabled and was being refilled from DRAM) all locations on that cache line had their valid bits set to reflect the fact that the full line was updated. The iline_rdy signal is asserted by the ICache controller when this happens and this informs the cache wrappers to update all locations 10 in the idata RAM for that line.

A similar change was made to the DCache controller except that the entire line was only updated following a read miss and that existing write through operation was preserved. The DCache controller uses the dline_rdy signal to instruct the cache wrapper to update all locations in the ddata RAM for a line. An additional modification was also made to ensure that a double-word load

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

126 instruction from a non-cached location would only result in one read access to the DIU i.e. the second read would be serviced by the data cache. Note that if the DCache is turned off then a double-word load instruction will cause two DIU read accesses to occur even though they will both be to the same 256-bit DRAM line.

The DCache controller was further modified to ensure that user mode code cannot access cached data to which it does not have permission (as determined by the relevant RegionNControl register settings at the time the cache line was loaded). This required an extra 2 bits of tag information to record the user read and write permissions for each cache line. These user access permissions can be updated in the same manner as the other tag fields (i.e. address and valid bits) namely by line refill, STA instruction or cache flush. The user access permission bits are checked every time user code attempts to access the data cache and if the permissions of the access do not agree with the permissions returned from the tag RAM then a cache miss occurs. As the MMU evaluates the access permissions for every cache miss it will generate the appropriate exception for the forced cache miss caused by the errant user code. In the case of a prohibited read access the trap will be immediate while a prohibited write access will result in a deferred trap. The deferred trap results from the fact that the prohibited write is committed to a write buffer in the DCache controller and program execution continues until the prohibited write is detected by the MMU which may be several cycles later. Because the errant write was treated as a write miss by the DCache controller (as it did not match the stored user access permissions) the cache contents were not updated and so remain coherent with the DRAM contents (which do not get updated because the MMU intercepted the prohibited write). Supervisor mode code is not subject to such checks and so has free access to the contents of the data cache.

In addition to AHB bridging, the ACache component also performs arbitration between ICache and DCache misses when simultaneous misses occur (the DCache always wins) and implements the Cache Control Register (CCR). The Ieon2-1.0.7 release is inconsistent in how it handles cacheability: For instruction fetches the cacheability (i.e. is the access to an area of memory that is cacheable) is determined by the ICache controller while the ACache determines whether or not a data access is cacheable. To further complicate matters the DCache controller does determine if an access resulting from a cache snoop by another AHB master is cacheable (Note that the SoPEC ASIC does not implement cache snooping as it has no need to do so). This inconsistency has been cleaned up in more recent LEON releases but is preserved here to minimise the number of changes to the LEON RTL. The cache controllers were modified to ensure that only DRAM accesses (as defined by the SoPEC memory map) are cached.

The only functionality removed as a result of the modifications was support for burst fills of the ICache. When enabled burst fills would refill an ICache line from the location where a miss occurred up to the end of the line. As the entire line is now refilled at once (when executing from DRAM) this functionality is no longer required. Furthermore more substantial modifications to the ICache controller would be needed if we wished to preserve this function without adversely affecting full line refills. The CCR was therefore modified to ensure that the instruction burst fetch bit (bit16) was tied low and could not be written to.

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

127

11.7.1.1 LEON Cache Control Register

The CCR controls the operation of both the I and D caches. Note that the bitfields used on the SoPEC implementation of this register are based on the LEON v1.0.7 implementation and some bits have their values tied off. See section 4 of the LEON manual for a description of the LEON 5 cache controllers.

Table 26. LEON Cache Control Register

<td> Field Name</td><td> bit(s)</td><td> Description</td>

<td> ICS</td><td> 1:0</td><td> Instruction cache state: 00 - disabled 01 - frozen 10 - disabled 11 - enabled</td>

<td> Reserved</td><td> 13:6</td><td> Reserved. Reads as 0.</td>

<td> DCS</td><td> 3:2</td><td> Data cache state: 00 - disabled 01 - frozen 10 - disabled 11 - enabled</td>

<td> IF</td><td> 4</td><td> ICache freeze on interrupt 0 - Do not freeze the ICache contents on taking an interrupt 1 - Freeze the ICache contents on taking an interrupt</td>

<td> DF</td><td> 5</td><td> DCache freeze on interrupt 0 - Do not freeze the DCache contents on taking an interrupt 1 - Freeze the DCache contents on taking an interrupt</td>

<td> Reserved</td><td> 13:6</td><td> Reserved. Reads as 0.</td>

<td> DP</td><td> 14</td><td> Data cache flush pending. 0 - No DCache flush in progress 1 - DCache flush in progress This bit is Readonly.</td>

<td> IP</td><td> 15</td><td> Instruction cache flush pending. 0 - No ICache flush in progress 1 - ICache flush in progress This bit is Readonly.</td>

<td> IB</td><td> 16</td><td> Instruction burst fetch enable. This bit is tied low on SoPEC because it would interfere with the operation of the cache wrappers. Burst refill functionality is automatically provided in SoPEC by the cache wrappers.</td>

<td> Reserved</td><td> 20:17</td><td> Reserved. Reads as 0.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

128

<td> Fl</td><td> 21</td><td> Flush instruction cache. Writing a 1 this bit will flush the ICache. Reads as 0.</td>

<td> FD</td><td> 22</td><td> Flush data cache. Writing a 1 this bit will flush the DCache. Reads as 0.</td>

<td> DS</td><td> 23</td><td> Data cache snoop enable. This bit is tied low in SoPEC as there is no requirement to snoop the data cache.</td>

<td> Reserved</td><td> 31:24</td><td> Reserved. Reads as 0.</td>

11.7.2 Cache wrappers

The cache RAMs used in the Ieon2-1.0.7 release needed to be modified to support full line refills and the correct IBM macros also needed to be instantiated. Although they are described as RAMs throughout this document (for consistency), register arrays are actually used to implement the cache RAMs. This is because IBM SRAMs were not available in suitable configurations (offered configurations were too big) to implement either the tag or data cache RAMs. Both instruction and data tag RAMs are implemented using dual port (1 Read &amp; 1 Write) register arrays and the clocked write-through versions of the register arrays were used as they most closely approximate the single port SRAM LEON expects to see.

11.7.2.1 Cache Tag RAM wrappers

The itag and dtag RAMs differ only in their width - the itag is a 32x30 array while the dtag is a 32x32 array with the extra 2 bits being used to record the user access permissions for each line. When read using a LDA instruction both tags return 32-bit words. The tag fields are described in Table 27 and Table 28 below. Using the IBM naming conventions the register arrays used for the tag RAMs are called RA032X30D2P2W1R1 M3 for the itag and RA032X32D2P2W1R1 M3 for the dtag. The ibm_syncram wrapper used for the tag RAMs is a simple affair that just maps the wrapper ports on to the appropriate ports of the IBM register array and ensures the output data has the correct timing by registering it. The tag RAMs do not require any special modifications to handle full line refills.

Table 27. LEON Instruction Cache Tag

<td> Field Name</td><td> bit(s)</td><td> Description</td>

<td> Valid</td><td> 7:0</td><td> Each valid bit indicates whether or not the corresponding word of the cache line contains valid data</td>

<td> Reserved</td><td> 9:8</td><td> Reserved - these bits do not exist in the itag RAM. Reads as 0.</td>

<td> Address</td><td> 31:10</td><td> The tag address of the cache line</td>

Table 28. LEON Data Cache Tag

<td> Field Name</td><td> bit(s)</td><td> Description</td>

<td> Valid</td><td> 7:0</td><td> Each valid bit indicates whether or not the corresponding word of the cache line contains valid data</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

129

<td> URP</td><td> 8</td><td> User read permission. 0 - User mode reads will force a refill of this line 1 - User mode code can read from this cache line.</td>

<td> UWP</td><td> 9</td><td> User write permission. 0 - User mode writes will not be written to the cache 1 - User mode code can write to this cache line.</td>

<td> Address</td><td> 31:10</td><td> The tag address of the cache line</td>

11.7.2.2 Cache Data RAM wrappers

The cache data RAM contains the actual cached data and nothing else. Both the instruction and data cache data RAMs are implemented using 8 32x32-bit register arrays and some additional logic to support full line refills. Using the IBM naming conventions the register arrays used for the tag RAMs are called RA032X32D2P2W1R1 M3. The ibm_cdram_wrap wrapper used for the tag RAMs is shown in Figure 24 below.

To the cache controllers the cache data RAM wrapper looks like a 256x32 single port SRAM (which is what they expect to see) with an input to indicate when a full line refill is taking place (the line_rdy signal). Internally the 8-bit address bus is split into a 5-bit lineaddress, which selects one of the 32 256-bit cache lines, and a 3-bit wordaddress which selects one of the 8 32-bit words on the cache line. Thus each of the 8 32x32 register arrays contains one 32-bit word of each cache line. When a full line is being refilled (indicated by both the line_rdy and write signals being high) every register array is written to with the appropriate 32 bits from the linedatain bus which contains the 256-bit line returned by the DIU after a cache miss. When just one word of the cache line is to be written (indicated by the write signal being high while the line_rdy is low) then the wordaddress is used to enable the write signal to the selected register array only - all other write enable signals are kept low. The data cache controller handles byte and half-word write by means of a read-modify-write operation so writes to the cache data RAM are always 32-bit.

The wordaddress is also used to select the correct 32-bit word from the cache line to return to the LEON integer unit.

11.8 Realtime Debug Unit (RDU)

The RDU facilitates the observation of the contents of most of the CPU addressable registers in the SoPEC device in addition to some pseudo-registers in realtime. The contents of pseudo-registers, i.e. registers that are collections of otherwise unobservable signals and that do not affect the functionality of a circuit, are defined in each block as required. Many blocks do not have pseudoregisters and some blocks (e.g. ROM, PSS) do not make debug information available to the RDU as it would be of little value in realtime debug.

Each block that supports realtime debug observation features a DebugSelect register that controls a local mux to determine which register is output on the block’s data bus (i.e. block_cpu_data). One small drawback with reusing the blocks data bus is that the debug data cannot be present on the same bus during a CPU read from the block. An accompanying active high block_cpu_debug_valid signal is used to indicate when the data bus contains valid debug data and when the bus is being

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

130 used by the CPU. There is no arbitration for the bus as the CPU will always have access when required. A block diagram of the RDU is shown in Figure 25.

Table 29. RDU I/Os

<td> Port name</td><td> Pins</td><td> I/O</td><td> Description</td>

<td> diu_cpu_data</td><td> 32</td><td> In</td><td> Read data bus from the DIU block</td>

<td> cpr_cpu_data</td><td> 32</td><td> In</td><td> Read data bus from the CPR block</td>

<td> gpio_cpu_data</td><td> 32</td><td> In</td><td> Read data bus from the GPIO block</td>

<td> icu_cpu_data</td><td> 32</td><td> In</td><td> Read data bus from the ICU block</td>

<td> lss_cpu_data</td><td> 32</td><td> In</td><td> Read data bus from the LSS block</td>

<td> pcu_cpu_debug_data</td><td> 32</td><td> In</td><td> Read data bus from the PCU block</td>

<td> scb_cpu_data</td><td> 32</td><td> In</td><td> Read data bus from the SCB block</td>

<td> tim_cpu_data</td><td> 32</td><td> In</td><td> Read data bus from the TIM block</td>

<td> diu_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the diu_cpu_data bus is valid debug data.</td>

<td> tim_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the tim_cpu_data bus is valid debug data.</td>

<td> scb_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the scb_cpu_data bus is valid debug data.</td>

<td> pcu_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the pcu_cpu_data bus is valid debug data.</td>

<td> lss_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the lss_cpu_data bus is valid debug data.</td>

<td> icu_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the icu_cpu_data bus is valid debug data.</td>

<td> gpio_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the gpio_cpu_data bus is valid debug data.</td>

<td> cpr_cpu_debug_valid</td><td> 1</td><td> In</td><td> Signal indicating the data on the cpr_cpu_data bus is valid debug data.</td>

<td> debug_data_out</td><td> 32</td><td> Out</td><td> Output debug data to be muxed on to the PHI/GPIO/other pins</td>

<td> debug_data_valid</td><td> 1</td><td> Out</td><td> Debug valid signal indicating the validity of the data on debug_data_out. This signal is used in all debug configurations</td>

<td> debug_cntrl</td><td> 33</td><td> Out</td><td> Control signal for each debug data line indicating whether or not the debug data should be selected by the pin mux</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

131

As there are no spare pins that can be used to output the debug data to an external capture device some of the existing I/Os will have a debug multiplexer placed in front of them to allow them be used as debug pins. Furthermore not every pin that has a debug mux will always be available to carry the debug data as they may be engaged in their primary purpose e.g. as a GPIO pin. The RDU therefore outputs a debug_cntrl signal with each debug data bit to indicate whether the mux associated with each debug pin should select the debug data or the normal data for the pin. The DebugPinSell and DebugPinSel2 registers are used to determine which of the 33 potential debug pins are enabled for debug at any particular time.

As it may not always be possible to output a full 32-bit debug word every cycle the RDU supports the outputting of an n-bit sub-word every cycle to the enabled debug pins. Each debug test would then need to be re-run a number of times with a different portion of the debug word being output on the n-bit sub-word each time. The data from each run should then be correlated to create a full 32bit (or whatever size is needed) debug word for every cycle. The debug_data_valid and pclk_out signals will accompany every sub-word to allow the data to be sampled correctly. The pclk_out signal is sourced close to its output pad rather than in the RDU to minimise the skew between the rising edge of the debug data signals (which should be registered close to their output pads) and the rising edge of pclk_out.

As multiple debug runs will be needed to obtain a complete set of debug data the n-bit sub-word will need to contain a different bit pattern for each run. For maximum flexibility each debug pin has an associated DebugDataSrc register that allows any of the 32 bits of the debug data word to be output on that particular debug data pin. The debug data pin must be enabled for debug operation by having its corresponding bit in the DebugPinSel registers set for the selëcted debug data bit to appear on the pin.

The size of the sub-word is determined by the number of enabled debug pins which is controlled by the DebugPinSel registers. Note that the debug_data_valid signal is always output. Furthermore debug_cntri[0] (which is configured by DebugPinSell) controls the mux for both the debug_data_valid and pclk_out signals as both of these must be enabled for any debug operation. The mapping of debug_data_out[n] signals onto individual pins will take place outside the RDU. This mapping is described in Table 30 below.

Table 30. DebugPinSel mapping

<td> bit# ·</td><td> Pin ’ ;</td>

<td> DebugPinSell</td><td> phi frclk. The debug data valïd signal will appear on this pin when enabled. Enabling this pin also automatically enables the phi_readl pin which will output the pclk_out signal</td>

<td> DebugPinSel2(0-31 )</td><td> gpio[0...31]</td>

Table 31. RDU Configuration Registers

<td> Address offset from</td><td> Register</td><td> ftbits</td><td> Reset</td><td> Description</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

132

<td> MMU_base</td><td></td><td></td><td></td><td></td>

<td> 0x80</td><td> DebugSrc</td><td> 4</td><td> 0x00</td><td> Denotes which block is supplying the debug data. The encoding of this block is given below. 0-MMU 1 - TIM 2- LSS 3- GPIO 4- SCB 5- ICU 6- CPR 7- DIU 8- PCU</td>

<td> 0x84</td><td> DebugPinSel 1</td><td> 1</td><td> 0x0</td><td> Determines whether the phijfclk and phi_readl pins are used for debug output. 1 - Pin outputs debug data 0 - Normal pin function</td>

<td> 0x88</td><td> DebugPinSel 2</td><td> 32</td><td> 0x000 0_000 0</td><td> Determines whether a pin is used for debug data output. 1 - Pin outputs debug data 0 - Normal pin function</td>

<td> 0x8C to 0x108</td><td> DebugDataSr c[31:0]</td><td> 32x5</td><td> 0x00</td><td> Selects which bit of the 32-bit debug data word will be output on debug_data_out[N]</td>

11.9 Interrupt Operation

The interrupt controller unit (see chapter 14) generates an interrupt request by driving interrupt request lines with the appropriate interrupt level. LEON supports 15 levels of interrupt with level 15 as the highest level (the SPARC architecture manual [36] states that level 15 is non-maskable but we have the freedom to mask this if desired). The CPU will begin processing an interrupt exception when execution of the current instruction has completed and it will only do so if the interrupt level is higher than the current processor priority. If a second interrupt request arrives with the same level as an executing interrupt service routine then the exception will not be processed until the executing routine has completed.

When an interrupt trap occurs the LEON hardware will place the program counters (PC and nPC) into two local registers. The interrupt handler routine is expected, as a minimum, to place the PSR register in another local register to ensure that the LEON can correctly return to its pre-interrupt state. The 4-bit interrupt level (irl) is also written to the trap type (tt) field of the TBR (Trap Base Register) by hardware. The TBR then contains the vector of the trap handler routine the processor will then jump. The TBA (Trap Base Address) field of the TBR must have a valid value before any interrupt processing can occur so it should be configured at an early stage.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

133

Interrupt pre-emption is supported while ET (Enable Traps) bit of the PSR is set This bit is cleared during the initial trap processing. In initial simulations the ET bit was observed to be cleared for up to 30 cycles. This causes significant additional interrupt latency in the worst case where a higher priority interrupt arrives just as a lower priority one is taken.

The interrupt acknowledge cycles shown in Figure 26 below are derived from simulations of the LEON processor. The SoPEC toplevel interrupt signals used in this diagram map directly to the LEON interrupt signals in the iui and iuo records. An interrupt is asserted by driving its (encoded) level on the icu_cpu_ilevel[3:0] signals (which map to iui.irl[3:0J). The LEON core responds to this, with variable timing, by reflecting the level of the taken interrupt on the cpu_icu_ilevel[3:0] signals (mapped to iuo.irl[3:0]) and asserting the acknowledge signal cpujack (iuo.intack).7he interrupt controller then removes the interrupt level one cycle after it has seen the level been acknowledged by the core. If there is another pending interrupt (of lower priority) then this should be driven on icu_cpu_ilevel[3:0] and the CPU will take that interrupt (the level 9 interrupt in the example below) once it has finished processing the higher priority interrupt. The cpu_icu_ilevel[3:0] signals always reflect the level of the last taken interrupt, even when the CPU has finished processing all interrupts.

11.10 BootOperation

See section 17.2 for a description of the SoPEC boot operation.

11.11 Software Debug

Software debug mechanisms are discussed in the “SoPEC Software Debug” document [15],

Serial Communications Block (SCB)

12.1 Overview

The Serial Communications Block (SCB) handles the movement of all data between the SoPEC and the host device (e.g. PC) and between master and slave SoPEC devices. The main components of the SCB are a Full-Speed (FS) USB Device Core, a FS USB Host Core, a InterSoPEC Interface (ISI), a DMA manager, the SCB Map and associated control logic. The need for these components and the various types of communication they provide is evident in a multi-SoPEC printer configuration.

12.1.1 Multi-SoPEC systems

While single SoPEC systems are expected to form the majority of SoPEC systems the SoPEC device must also support its use in multi-SoPEC systems such as that shown in Figure 27. A SoPEC may be assigned any one of a number of identities in a multi-SoPEC system. A SoPEC may be one or more of a PrintMaster, a LineSyncMaster, an ISIMaster, a StorageSoPEC or an ISISIave SoPEC.

12.1.1.1 ISIMaster device

The ISIMaster is the only device that controls the common ISI lines (see Figure 30) and typically interfaces directly with the host. In most systems the ISIMaster will simply be the SoPEC connected to the USB bus. Future systems, however, may employ an ISI-Bridge chip to interface between the host and the ISI bus and in such systems the ISI-Bridge chip will be the ISIMaster. There can only be one ISIMaster on an ISI bus.

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

134

Systems with multiple SoPECs may have more than one host connection, for example there could be two SoPECs communicating with the external host over their FS USB links (this would of course require two USB cables to be connected), but still only one ISIMaster.

While it is not expected to be required, it is possible for a device to hand over its role as the ISIMaster to another device on the ISI i.e. the ISIMaster is not necessarily fixed.

12.1.1.2 PrintMaster device

The PrintMaster device is responsible for co-ordinating all aspects of the print operation. This includes starting the print operation in all printing SoPECs and communicating status back to the external host. When the ISIMaster is a SoPEC device it is also likely to be the PrintMaster as well. There may only be one PrintMaster in a system and it is most likely to be a SoPEC device.

12.1.1.3 LineSyncMaster device

The LineSyncMaster device generates the Isync pulse that all SoPECs in the system must synchronize their line outputs with. Any SoPEC in the system could act as a LineSyncMaster although the PrintMaster is probably the most likely candidate. It is possible that the LineSyncMaster may not be a SoPEC device at all - it could, for example, come from some OEM motor control circuitry. There may only be one LineSyncMaster in a system.

12.1.1.4 Storage device

For certain printer types it may be realistic to use one SoPEC as a storage device without using its print engine capability - that is to effectively use it as an ISI-attached DRAM. A storage SoPEC would receive data from the ISIMaster (most likely to be an ISI-Bridge chip) and then distribute it to the other SoPECs as required. No other type of data flow (e.g. ISISIave -&gt; storage SoPEC -&gt; ISISIave) would need to be supported in such a scenario. The SCB supports this functionality at no additional cost because the CPU handles the task of transferring outbound data from the embedded DRAM to the ISI transmit buffer. The CPU in a storage SoPEC will have almost nothing else to do.

12.1.1.5 ISISIave device

Multi-SoPEC systems will contain one or more ISISIave SoPECs. An ISISIave SoPEC is primarily used to generate dot data for the printhead IC it is driving. An ISISIave will not transmit messages on the ISI without first receiving permission to do so, via a ping packet (see section 12.4.4.6), from the ISIMaster

12.1.1.6 ISI-Bridge device

SoPEC is targeted at the low-cost small office / home office (SoHo) market. It may also be used in future systems that target different market segments which are likely to have a high speed interface capability. A future device, known as an ISI-Bridge chip, is envisaged which will feature both a high speed interface (such as High-Speed (HS) USB, Ethernet or IEEE1394) and one or more ISI interfaces. The use of multiple ISI buses would allow the construction of independent print systems within the one printer. The ISI-Bridge would be the ISIMaster for each of the ISI buses it interfaces to.

12.1.1.7 External host

The external host is most likely (but is not required) to be, a PC. Any system that can act as a USB host or that can interface to an ISI-Bridge chip could be the external host. In particular, with the

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

135 development of USB On-The-Go (USB OTG), it is possible that a number of USB OTG enabled products such as PDAs or digital cameras will be able to directly interface with a SoPEC printer.

12.1.1.8 External USB device

The external USB device is most likely (but is not required) to be, a digital camera. Any system that can act as a USB device could be connected as an external USB device. This is to facilitate printing in the absence of a PC.

12.1.2 Types of communication

12.1.2.1 Communications with external host

The external host communicates directly with the ISIMaster in order to print pages. When the ISIMaster is a SoPEC, the communications channel is FS USB.

12.1.2.1.1 External host to ISIMaster communication

The external host will need to communicate the following information to the ISIMaster device:

• Communications channel configuration and maintenance information • Most data destined for PrintMaster, ISISIave or storage SoPEC devices. This data is simply relayed by the ISIMaster • Mapping of virtual communications channels, such as USB endpoints, to ISI destination

12.1.2.1.2 ISIMaster to external host communication

The ISIMaster will need to communicate the following information to the external host:

• Communications channel configuration and maintenance information • All data originating from the PrintMaster, ISISIave or storage SoPEC devices and destined for the external host. This data is simply relayed by the ISIMaster

12.1.2.1.3 External host to PrintMaster communication

The external host will need to communicate the following information to the PrintMaster device:

• Program code for the PrintMaster • Compressed page data for the PrintMaster • Control messages to the PrintMaster • Tables and static data required for printing e.g. dead nozzle tables, dither matrices etc.

• Authenticatable messages to upgrade the printer’s capabilities

12.1.2.1.4 PrintMaster to external host communication

The PrintMaster will need to communicate the following information to the external host:

• Printer status information (i.e. authentication results, paper empty/jammed etc.) • Dead nozzle information • Memory buffer status information • Power management status • Encrypted SoPECJd for use in the generation of PRINTER_QA keys during factory programming

12.1.2.1.5 External host to ISISIave communication

All communication between the external host and ISISIave SoPEC devices must be direct (via a dedicated connection between the external host and the ISISIave) or must take place via the

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

136

ISIMaster. In the case of a SoPEC ISIMaster it is possible to configure each individual USB endpoint to act as a control channel to an ISISIave SoPEC if desired, although the endpoints will be more usually used to transport data. The external host will need to communicate the following information to ISISIave devices over the comms/ISI:

• Program code for ISISIave SoPEC devices • Compressed page data for ISISIave SoPEC devices • Control messages to the ISISIave SoPEC (where a control channel is supported) • Tables and static data required for printing e.g. dead nozzle tables, dither matrices etc.

• Authenticatable messages to upgrade the printer’s capabilities

12.1.2.1.6 ISISIave to external host communication

All communication between the ISISIave SoPEC devices and the external host must take place via the ISIMaster. The ISISIave will need to communicate the following information to the external host over the comms/ISI:

• Responses to the external host’s control messages (where a control channel is supported) • Dead nozzle information from the ISISIave SoPEC.

• Encrypted SoPECJd for use in the generation of PRINTER_QA keys during factory programming

72.1.2.2 Communication with external USB device

12.1.2.2.1 ISIMaster to External USB device communication • Communications channel configuration and maintenance information.

12.1.2.2.2 External USB device to ISIMaster communication • Print data from a function on the external USB device.

72.7.2.3 Communication over ISl

12.1.2.3.1 ISIMaster to PrintMaster communication

The ISIMaster and PrintMaster will often be the same physical device. When they are different devices then the following information needs to be exchanged over the ISl:

• All data from the external host destined for the PrintMaster (see section 12.1.2.1.4). This data is simply relayed by the ISIMaster

12.1.2.3.2 PrintMaster to ISIMaster communication

The ISIMaster and PrintMaster will often be the same physical device. When they are different devices then the following information needs to be exchanged over the ISl:

• All data from the PrintMaster destined for the external host (see section 12.1.2.1.4). This data is simply relayed by the ISIMaster

12.1.2.3.3 ISIMaster to ISISIave communication

The ISIMaster may wish to communicate the following information to the ISISIaves:

• All data (including program code such as ISIId enumeration) originating from the external host and destined for the ISISIave (see section 12.1.2.1.5). This data is simply relayed by the ISIMaster • wake up from sleep mode

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

137

12.1.2.3.4 ISISIave to ISIMaster communication

The ISISIave may wish to communicate the following information to the ISIMaster:

• All data originating from the ISISIave and destined for the external host (see section 12.1.2.1.6). This data is simply relayed by the ISIMaster

12.1.2.3.5 PrintMaster to ISISIave communication

When the PrintMaster is not the ISIMaster all ISI communication is done in response to ISI ping packets (see 12.4.4.6). When the PrintMaster is the ISIMaster then it will of course communicate directly with the ISISIaves. The PrintMaster SoPEC may wish to communicate the following information to the ISISIaves:

• Ink status e.g. requests for dotCount data i.e. the number of dots in each color fired by the printheads connected to the ISISIaves • configuration of GPIO ports e.g. for clutch control and lid open detect • power down command telling the ISISIave to enter sleep mode • ink cartridge fail information

This list is not complete and the time constraints associated with these requirements have yet to be determined.

In general the PrintMaster may need to be able to:

• send messages to an ISISIave which will cause the ISISIave to return the contents of ISISIave registers to the PrintMaster or • to program ISISIave registers with values sent by the PrintMaster

This should be under the control of software running on the CPU which writes messages to the ISI/SCB interface.

12.1.2.3.6 ISISIave to PrintMaster communication

ISISIaves may need to communicate the following information to the PrintMaster:

• ink status e.g. dotCount data i.e. the number of dots in each color fired by the printheads connected to the ISISIaves • band related information e.g. finished band interrupts • page related information i.e. buffer underrun, page finished interrupts • MMU security violation interrupts • GPIO interrupts and status e.g. clutch control and lid open detect • printhead temperature • printhead dead nozzle information from SoPEC printhead nozzle tests • power management status

This list is not complete and the time constraints associated with these requirements have yet to be determined.

As the ISI is an insecure interface commands issued over the ISI should be of limited capability e.g. only limited register writes allowed. The software protocol needs to be constructed with this in mind. In general ISISIaves may need to return register or status messages to the PrintMaster or ISIMaster. They may also need to indicate to the PrintMaster or ISIMaster that a particular interrupt

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

138 has occurred on the ISISIave. This should be under the control of software running on the CPU which writes messages to the ISI block.

12.1.2.3.7 ISISIave to ISISIave communication

The amount of information that will need to be communicated between ISISIaves will vary considerably depending on the printer configuration. In some systems ISISIave devices will only need to exchange small amounts of control information with each other while in other systems (such as those employing a storage SoPEC or extra USB connection) large amounts of compressed page data may be moved between ISISIaves. Scenarios where ISISIave to ISISIave communication is required include: (a) when the PrintMaster is not the ISIMaster, (b) QA Chip ink usage protocols, (c) data transmission from data storage SoPECs, (d) when there are multiple external host connections supplying data to the printer.

12.1.3 SCB Block Diagram

The SCB consists of four main sub-blocks, as shown in the basic block diagram of Figure 28.

12.1.4 Definitions of I/Os

The toplevel I/Os of the SCB are listed in Table 32. A more detailed description of their functionality will be given in the relevant sub-block sections.

Table 32. SCB I/O

<td> Port name</td><td> s</td><td> I/O</td><td> Description</td>

<td> Clocks and Resets</td><td colspan="3"></td>

<td> prst_n</td><td> 1</td><td> In</td><td> System reset signal. Active low.</td>

<td> Pclk</td><td> 1</td><td> In</td><td> System clock.</td>

<td> usbclk</td><td> 1</td><td> In</td><td> 48MHz clock for the USB device and host cores. The cores also require a 12MHz clock, which will be generated locally by dividing the 48MHz clock by 4.</td>

<td> isi_cpr_reset_n</td><td> 1</td><td> Out</td><td> Signal from the ISI indicating that ISI activity has been detected while in sleep mode and so the chip should be reset. Active low.</td>

<td> usbd_cpr_reset_n</td><td> 1</td><td> Out</td><td> Signal from the USB device that a USB reset has occurred. Active low.</td>

<td> USB device IO transceiver</td><td></td><td></td><td></td>

<td> signals</td><td></td><td></td><td></td>

<td> usbd_ts</td><td> 1</td><td> Out</td><td> USB device IO transceiver (BUSB2_PM) driver three-state control. Active high enable.</td>

<td> usbd_a</td><td> 1</td><td> Out</td><td> USB device IO transceiver (BUSB2_PM) driver data input.</td>

<td> usbd_se0</td><td> 1</td><td> Out</td><td> USB device IO transceiver (BUSB2_PM) single-ended zero input. Active high.</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

139

<td> usbd_zp</td><td> 1</td><td> In</td><td> USB device IO transceiver (BUSB2_PM) D+ receiver output.</td>

<td> usbd_zm</td><td> 1</td><td> In</td><td> USB device IO transceiver (BUSB2_PM) Dreceiver output.</td>

<td> usbd_z</td><td> 1</td><td> In</td><td> USB device IO transceiver (BUSB2_PM) differential receiver output.</td>

<td> usbd_pull_up_en</td><td> 1</td><td> Out</td><td> USB device pull-up resistor enable. Switches power to the external pull-up resistor, connected to the D+ line that is required for device identification to the USB. Active high.</td>

<td> usbd_vbus_sense</td><td> 1</td><td> In</td><td> USB device VBUS power sense. Used to detect power on VBUS. NOTE: The IBM Cu11 PADS are 3.3V, VBUS is 5V. An external voltage conversion will be necessary, e.g. resistor divider network. Active high.</td>

<td> USB host IO transceiver</td><td></td><td></td><td></td>

<td> signals</td><td></td><td></td><td></td>

<td> usbh_ts</td><td> 1</td><td> Out</td><td> USB host IO transceiver (BUSB2_PM) driver three-state control. Active high enable</td>

<td> usbh_a</td><td> 1</td><td> Out</td><td> USB host IO transceiver (BUSB2_PM) driver data input.</td>

<td> usbh_seO</td><td> 1</td><td> Out</td><td> USB host IO transceiver (BUSB2_PM) singleended zero input. Active high.</td>

<td> usbh_zp</td><td> 1</td><td> In</td><td> USB host IO transceiver (BUSB2_PM) D+ receiver output.</td>

<td> usbh_zm</td><td> 1</td><td> In</td><td> USB host IO transceiver (BUSB2_PM) Dreceiver output.</td>

<td> usbh_z</td><td> 1</td><td> In</td><td> USB host IO transceiver (BUSB2_PM) differential receiver output.</td>

<td> us bh_over_cu rrent</td><td> 1</td><td> In</td><td> USB host port power over current indicator. Active high.</td>

<td> usbh_power_en</td><td> 1</td><td> Out</td><td> USB host VBUS power enable. Used for port power switching. Active high.</td>

<td> CPU Interface</td><td colspan="3"></td>

<td> cpu_adr[n:2]</td><td> n-1</td><td> In</td><td> CPU address bus.</td>

<td> cpu_dataout[31:0]</td><td> 32</td><td> In</td><td> Shared write data bus from the CPU</td>

<td> scb_cpu_data[31:0]</td><td> 32</td><td> Out</td><td> Read data bus to the CPU</td>

<td> cpu_rwn</td><td> 1</td><td> In</td><td> Common read/not-write signal from the CPU</td>

<td> cpu_acode[1:0]</td><td> 2</td><td> In</td><td> CPU Access Code signals. These decode as</td>

CA 02508141 2005-06-01

WO 2004/050369

PCT/AU2003/001616

140

<td></td><td></td><td></td><td> follows: 00 - User program access 01 - User data access 10 - Supervisor program access 11 - Supervisor data access</td>

<td> cpu_scb_sel</td><td> 1</td><td> In</td><td> Block select from the CPU. When cpu_scb_sel is high both cpu_adr and cpu_dataout are valid</td>

<td> scb_cpu_rdy</td><td> 1</td><td> Out</td><td> Ready signal to the CPU. When scb_cpu_rdy is high it indicates the last cycle of the access. For a write cycle this means cpu_dataout has been registered by the SCB and for a read cycle this means the data on scb_cpu_data is valid.</td>

<td> scb_cpu_berr</td><td> 1</td><td> Out</td><td> Bus error signal to the CPU indicating an invalid access.</td>

<td> scb_cpu_debug_valid</td><td> 1</td><td> Out</td><td> Signal indicating that the data currently on scb_cpu_data is valid debug data</td>

<td> Interrupt signals</td><td></td><td></td><td></td>

<td> dmajcujrq</td><td> 1</td><td> Out</td><td> DMA interrupt signal to the interrupt controller block.</td>

<td> isijcujrq</td><td> 1</td><td> Out</td><td> ISI interrupt signal to the interrupt controller block.</td>

<td> usbJeu Jrq[1:0]</td><td> 2</td><td> Out</td><td> USB host and device interrupt signals to the ICU. Bit 0 - USB Host interrupt Bit 1 - USB Device interrupt</td>

<td> DIU interface</td><td></td><td></td><td></td>

<td> scb_diu_wadr[21:5]</td><td> 17</td><td> Out</td><td> Write address bus to the DIU</td>

<td> scb_diu_data[63:0]</td><td> 64</td><td> Out</td><td> Data bus to the DIU.</td>

<td> scb_diu_wreq</td><td> 1</td><td> Out</td><td> Write request to the DIU</td>

<td> diu_scb_wack</td><td> 1</td><td> In</td><td> Acknowledge from the DIU that the write request was accepted.</td>

<td> scb_diu_wvalid</td><td> 1</td><td> Out</td><td> Signal from the SCB to the DIU indicating that the data currently on the scb_diu_data[63:0] bus is valid</td>

<td> scb_diu_wmask[7:0]</td><td> 7</td><td> Out</td><td> Byte aligned write mask. A 1 in a bitfield of scb_diu_wmask[7:0r means that the corresponding byte will be written to DRAM.</td>

CA 02508141 2005-06-01

WO 2004/050369 PCT/AU2003/001616

141

<td> scb_diu_rreq</td><td> 1</td><td> Out</td><td> Read request to the DIU.</td>

<td> scb_diu_radr[21:5]</td><td> 17</td><td> Out</td><td> Read address bus to the DIU</td>

<td> diu_scb_rack</td><td> 1</td><td> In</td><td> Acknowledge from the DIU that the read request was accepted.</td>

<td> diu_scb_rvalid</td><td> 1</td><td> In</td><td> Signal from the DIU to the SCB indicating that the data currently on the diu_data[63:0] bus is valid</td>

<td> diu_data[63:0]</td><td> 64</td><td> In</td><td> Common DIU data bus.</td>

<td> GPIO interface</td><td colspan="3"></td>

<td> isi_gpio_dout[3:0]</td><td> 4</td><td> Out</td><td> ISI output data to GPIO pins</td>