Keeping output pin low while unpowered or unconfigured

[SimonRichter]

This is kind of a FAQ here, but I've seen a lot of conflicting information in the forum.

I'm still selecting which brand and family to use, and while most of my requirements are relatively benign, I have one that is absolutely important: a set of the FPGA's outputs will control FETs that, through a long chain of connected components, will turn on a few kilowatts of machinery, so I need to absolutely make sure that these pins stay off unless explicitly commanded. So this will be a very conservative design.

The Cyclone series seems to have "weak" pull-ups connected to all I/O pins during configuration that I would have to override with an external pull-down that still needs to be weak enough that I can override it with the regular output drivers.

The minimum value for the pull-ups is given as 8 kOhm, so if I wanted to reliably stay below 0.6V, I'd have to use an 1.4kOhm pull-down. Driving up to 3.3V against that would give a current of 2mA, which the CycloneIV can deliver in either LVTTL or LVCMOS mode. LVTTL mode doesn't guarantee me a H voltage above 2.4V, which is awfully close for reliably switching the FET, while LVCMOS mode gives me a good voltage, but is listed with a maximum drive strength of 2 mA, so I'd be cutting it awfully close there.

For the CycloneV, I have an option to drive outputs with up to 16mA, which would relax that quite a bit, but the datasheet only lists typical (25kOhm) values for the pull-ups, not min/max values, so it is more difficult to select conservative values for the pull-down here.

A possible option I could see would be to dedicate an I/O bank to "must be activated later" pins, and supply the VccIO pins in that bank only after configuration has completed. A primitive design would probably use CONF_DONE to switch another FET that turns on the delayed VccIO, is there a way to derive an initial reset state for this pin that will not glitch during transition to user mode?

Last but not least: have I missed something glaringly obvious here?

[ak6dn]

Whenever I have had a requirement to do this I just add an external passive pulldown/pullup resistor, as appropriate, of a value that holds the signal level to a correct value when the FPGA is unconfigured/unpowered, and can be overridden by an actively driven output.

I have never had an issue using this approach.

[SimonRichter]

Yes, that is what I want, so I filled in actual resistor values that would fit these criteria (in a worst-case scenario), and I'm rather unhappy with how far away the signal levels are from the supply rails, how little tolerance I have for the resistor values and how much drive current I need in the FPGA -- so I'm wondering if I've overlooked something.

I get much better values for normal operation if I calculate with the typical rather than minimum resistance of the internal pull-up, but if in series production I happen to get an FPGA with a stronger pull-up, I end up with a board that will activate the FET during the configuration phase, which is not the safe state of the machine as a whole, so I wouldn't sign off on that as production ready.

[ak6dn]

The CycloneV electrical datasheet (version 2016.06.10) lists the pullup value as 25Kohm +/- 10% over PVT (note 17 on page).