GB2243466A - Memory error detection - Google Patents

Abstract

In memory system 103 for use with a microprocessor 10 via a data bus 16, an address bus 15 and read and write lines 100 and 101, the data to be stored is monitored (by a discriminator 102 or software) to ensure that in each data byte written to the memory 14 a predetermined fixed number of bits is set. Memory 14 comprises storage cells which provide the memory function having a high energy storage state (SET) and a low energy storage state (CLEAR). Data corruption occurs by a mechanism of reversion from the clear state to the SET state, so discriminator 102 serves to indicate data corruption in read data if the number of bits set in retrieved data exceeds the predetermined value. <IMAGE>

Description

IMPROVEMENTS IN OR RELATING TO MEMORY SYSTEMS The present invention relates to memory systems and in particular to memory systems intended for data critical applications, that is applications in which a corruption of the data during storage and subsequent retrieval can have a potentially catastrophic effect on the overall system, a control system, for example, of which the memory system forms a part. Clearly in such circumstances it is important that stored data is protected from corruption or that if a corruption occurs it does not go undetected.

There are many examples of data critical applications in the automotive area, for example the storage of control parameters by the control system of an anti-lock braking system, or engine parameter storage by an ignition control system, all of which systems may be realised by a microcomputer controller comprising a microprocessor and associated memory. Factors which can cause a corruption of stored data include subjecting the semi-conductor devices of the system to extreme temperatures and electrical noise causing erratic or unpredictable behaviour.

Data storage in control systems may be permanent (control programs, for example), temporary (e.g. intermediate process parameters), or long-term (parameters to be carried forward to be retrieved at a later date, such as for example engine diagnostic parameters and performance parameters). For the permanent and temporary storage memory of respectively the Read-Only and Random-Access types may be used, and many semi-conductor devices of these types are readily available. Long-term storage devices include magnetic media such as disk and tape drives and are characterised by their re-programmability. Unfortunately such magnetism based storage devices are unsuitable or too costly in many applications. In the automotive arena, for example, inclusion of a disk drive in an engine controller would be prohibitively expense and unreliable in the very hostile physical and electrical environment.Use of long term storage is only possible in such an application if a low cost device, for example a semi-conductor device, can be used.

Long term semi-conductor storage devices are known and commonly referred to as Electrically Erasable/Programmable Read Only Memory and include a plurality of individually programmable memory cells, each typically comprising a field effect memory transistor having a floating (that is an electrically isolated) gate, storage being possible by virtue of switching the transistor between a first stable state (the natural state) in which the gate of the memory transistor is charged, and a second stable state in which the gate is discharged and relies upon being able to apply a reversible electric field to the thin oxide layer which typically isolates the floating gate from its substrate.A clear advantage of this stability is that non-volatile memory is provided which can survive a power supply disconnection enabling for example, the storage of information relating to average performance or total distance travelled in an automotive trip computer that is unpowered during parking or battery disconnection.

The erase operation of an EEPROM cell is performed by charging the floating gate so that the cell is in its natural or erased state (conventionally designated as a logical "1"). The program operation is performed by discharging the gate to the so-called programmed state (conventionally designated as a logical "0"). To achieve the program/erase operations, the memory cell typically includes an additional select transistor arrange in series with the memory transistor. For a fuller description of EEPROM memory cell structure and operation reference may be made to "Semi-conductor Memories" by Betty Prince and Gunnar Gundersen (Wiley, 1983), particularly pages 135 to 141. When data corruption occurs in such a device, the mechanism is that of reversion to the erased state ("1") of cells which have been programmed (to "0").

The structure of a typical EEPROM cell is compatible with that of microprocessor technology and EEPROM has been successfully integrated with a microprocessor to form a single device. An example of such a device is that manufactured by Motorola Inc. of Schaumburg, Illinois, USA under the designation MC68HCll, details of which are available in a data sheet published by the aforesaid manufacturer. In connection with such devices, it should be noted that the amount of EEPROM available in such an integrated microcomputer arrangement can be significantly less than that typically employed in larger systems based on separate processor and EEPROM devices.

Clearly, the corruption of the data stored in any of the memory associated with the processor of a control system is likely to cause a malfunction, but corruption of long-term storage data can be particularly problematic since, unlike corruption of program or register data, it is unlikely to lead to a manifest failure of the system as a whole. For example, suppose a diagnostic variable stored in EEPROM by the processor at the instant of an engine malfunction to be indicative of the failure becomes corrupted, then when the false information is subsequently read, much expenditure could be wasted in trying to solve a non-existent problem, whilst the real failure does untreated.Equally, if an engine running parameter, such as one used to make small variations in ignition timing to preserve performance as engine wear is encountered, is corrupted then not only will the engine run inefficiently, but the performance may actually be degraded. In this sense, such applications are datacritical.

In an extreme case, engine damage could be caused if a stored control parameter were corrupted to a value that produced a severe ignition timing error. Firing with the inlet value open could give combustion right through the manifold to the carburetter.

Unfortunately, not only is such corruption of EEPROM data unlikely to be readily detectable, but the EEPROM itself is additionally vulnerable to corruption by virtue of the finite time taken to program and erase a memory cell. If there is a power supply voltage spike or other noise or disruption during a program or erase operation, then the state of the cell after the operation will be indeterminate with consequent corruption of the data stored.

Such corruption can occur even in normal operation. In automotive applications, for example it is common practice to hold the processor in a reset mode during power down so that potentially damaging spurious outputs cannot be generated as the power supply falls. The reset can be generated either by shutting down the engine or preferably by detection of a low supply voltage so that unexpected power supply disconnections and failures may be similarly dealt with. Reset can occur at any time. A reset which occurs before all memory cells have been erased on after memory cells have been erased but before the required cells have been programmed will cause data corruption.

In order to overcome the problem of data corruption, corruption prevention and detection algorithms are known. A characteristic of these algorithms is that redundant data is added to that to be stored to enable corruption detection. An example is the common "checksum" algorithm where extra data representing for example the total number of logical "1" bits in a block of data (be it a byte for a high resolution system, or an entire memory page for a low) is added to the total data to be stored. When the data is subsequently recovered, if the "checksum" data does not tally data corruption is indicated.Clearly the reliability of the arrangement increases with the degree of redundancy employed, up to the point where with some algorithms full error correction is possible if the significant amount of extra memory required for the redundancy and the storage of a program for executing the correction algorithm is available and the execution time overhead if the program is acceptable.

Unfortunately, in many situations such overheads cannot be tolerated in a limited resource integrated microcomputer system, for example, and the reliability of the system is compromised if the corruption detection is removed. This can rule out the use of these otherwise desirable systems in critical applications such as automotive engine control, anti-locking braking systems and active suspension systems.

In accordance with the present invention in a first aspect thereof a memory system includes means for storing a data byte, the byte comprising a plurality of data bits, each bit taking either a first logical state or a second logical state, and the number of bits taking the fist logical state in the byte being a predetermined number; the means having a plurality of cells arranged for bit storage, each cell having an erased state representative of the first logical state, and a programmed state representative of the second logical state; means for programming cells in accordance with the data to be stored; means for monitoring stored data bytes; and means for providing an output indicative of data corruption if the number of bits taking the fist logical state in the stored byte is not equal to the predetermined number.

Advantageously the predetermined number is selected to be half the byte size. In one form of the present invention the memory may be adapted for byte storage by erasure of all cells in which the byte is to be stored and subsequent programming of those cells which correspond to bits taking the second logical level.This form of the invention is particularly suitable for memory of the Electrically Erasable/Programmable Read Only Memory and derivative types, such as Flash Electrically Erasable/Programmable Read Only Memory In accordance with the present invention in a second aspect thereof a method of storing data in memory having a plurality of cells arranged for bit storage, each cell having an erased state representative of the first logical state, and a programmed state representative of the second logical state; includes the steps of writing a byte of data to the memory, the byte comprising a plurality of data bits, each bit taking either a first logical state or a second logical state, such that the number of bits taking the fist logical state in the byte being a predetermined number; and subsequently reading the byte; and providing an output indicative of data corruption if the number of bits taking the fist logical state in the read byte is not equal to the predetermined number.

In order that features and advantages of the present invention may be further appreciated embodiments will now be described with reference to the accompanying diagrammatic drawings of which Figure 1 represents a microcomputer system including a memory system in accordance with the present invention.

Fig 2 represents a flow chart of a read cycle incorporating the present invention, and Fig 3 represents a flow chart of a write cycle incorporating the present invention.

A microcomputer system 105 (Figure 1) includes a microprocessor 10 and an associated memory means 11, 12 and 14.

The arrangement comprises three types of memory, namely readonly memory 11 for the storage of the program and other fixed data, random access volatile memory 12 for the storage of temporary information and Electrically Erasable Programmable Read-Only Memory 14 for the storage of long-term data. Connecting the devices is an address bus 15 and data bus 16. The operation of the computer system is as follows.

When it is required to load data to the microprocessor 10 the relevant address is first output by the microprocessor on the address bus 15 and the relevant memory device (11, 12 or 14) selected by enabling the relevant chip select output (on CS1 CSII or CSIII) to drive the chip select input of the relevant device via respectively lines 17, 18 or 19. Depending on the nature of the transfer, a read or a write, either read line 100 or the write line 101 is selected. In this way data transfer for both storage and retrieval of data in the memory devices is possible.

The address bus 15 and the data bus 16 together with the read and write lines 100 and 101 are additionally connected to a discriminator means 102. An additional input to the discriminator 102 is provided by the chip select line 17 of the EEPROM 14. The arrangement is thus such that the discriminator 102 may monitor activity on the address and data busses whenever memory device 14 is selected.

The operation of the memory arrangement will now be considered in more detail with particular reference EEPROM device 14.

When it is desired to read data from the memory device 14 the desired address from which the data is to be read its first loaded by the microprocessor 10 on to the address bus 15. The appropriate chip select output (cos1, line 17,) is next enabled to enable the chip select input of the memory device 14. The read line 100 is then enabled and the memory device 14 responds by outputting the relevant data on to the data bus 16 which then may be loaded into the processor 10. A read operation of the memory device 14 has thereby performed. It will be appreciated that the various operations which make up the read cycle are controlled by a system clock (not shown) connected to all the devices of the system. It will further be appreciated that as hereinbefore described the read cycle requires a plurality of system clock cycles for its complete operation.

The write operation is similar except that it requires more system clock cycles because a longer procedure has to be implemented within the memory device 14. When chip select input of the memory device 14 is enabled together with the write input firstly all the memory cells making up the desired address are charged as hereinbefore described to erase the data contained, that is all memory cells at the desired address are written with a 1. On the next system clock cycle the data on the data bus is written to the address of memory device 14 by discharging those memory cells at that address which are to be programmed with a zero. When this has happened the write operation to the memory device 14 is complete.It will be apparent that during this write operation the data to be stored is open to corruption if the write operation should fail to be completed due for example to a power down reset, in that having written at least some of the memory cells to a "1" not all of the cells that will have been written to a "0". Hence the state of each cell is indeterminate, and the data must be considered corrupted.

Solutions such as battery back up are not practical in highly cost sensitive applications such as automotive, and in any case leakage corruptions may still occur.

In accordance with the present invention the data which may be loaded to the memory device 14 is restricted to that data wherein the number of bits to be written with a "1" is a predetermined value. To ensure that no data which violates this condition is written to the memory device 14 the descriminator 102 is activated by the write line 100 whenever the memory device 14 is selected. The discriminator 102 then monitors the data bus 16 to check that the data does not violate the aforesaid condition. If it does an error output is given at 104. The address at which the violation occurred may also be loaded to the discriminator 102 or alternatively output 104 may be used to drive an interrupt routine in the microprocessor 10 so that action may be taken to avoid the violation.

Since no data which violates the condition can be stored in the memory device 14, the check performed by discriminator 102 is equally valid when the data is read. To this end, the discriminator 102 receives read line input 100 and an output is produced at 104 if the condition is violated to indicate that the data retrieved is corrupted data. As before this enables the processor 10 to take appropriate action, for example using a default value in place of the data value retrieved.

The data corruption detection provided by the embodiment described above will now be considered in more detail.

It will be recalled that in order to write to a EEPROM cell, the cell is firstly erased to a 1 and then programmed to a "0" if that is the data to be stored. This cycle is followed even if the cell was initially in the programmed state. Data corruption can occur if the write operation is interrupted. This will leave bits in the erased (1) state which should have been programmed to a "0". Thus data can be corrupted by a cell which should be programmed being erased, but not vice versa. Because of the energy storage nature of the memory cells this is equally true of other corruption mechanisms.

such as leakage due to temperature wherein a programmed cell can become erased. Hence, provided the data written to the memory is restricted to bytes having a fixed number of erased bits, discriminator 102 will serve to indicate data corruption simply by counting the number of set bit in the retrieved data and comprising the counted value with the predetermined value. If the count exceeds the fixed number, corruption has occurred.

Clearly, the largest number of allowable byte values occurs when the fixed number is half the number of the available bits.

Thus for a byte of 8 bits the number of allowable combinations (n) is given by: N= 8! = 8 x 7 x 6 x 5 = 70 (8-4)!x4! 4 x 3 x 2 Although the number of allowable byte values has been restricted compaired with the 256 normally available, this is not a limitation in many applications. In automotive diagnostics, for example, 70 different failures could be individually coded into a single byte. Typically, perhaps 15 codes are used at present, so that the invention provides the important advantage that low cost EEPROM base controllers may now be utilised without reliability compromise since data corruption may be detected. Even if a different code is assigned to all failures likely to be coded, not all of which would be possible in a given application, then it is likely that the total provided by a single byte would still prove adequate.If the codes available are not the codes required, then a translation may easily be performed, for example in a look-up table.

It will be appreciated that EEPROM 14 and discriminator 102 constitute a memory system 103 in which corrupt data on the data bus 16 appearing during a read cycle may be detected to be disregarded. In the example of engine diagnostics, straightforward remedial action which may be fallen in the event of a corruption indication is to immediately overwrite the corrupted location with the code for no fault, on the basis that the previous fault, if not falsely indicated, will reoccur to be successfully stored and retrieved at a late time.

Although the embodiment of the present invention described above involves a hardware discriminator 102 the present invention may be implemented by means of software embodied in the program of the microprocessor 10 for example. In this arrangement, the discriminator is not required but instead the read and write operations to memory device 14 are performed by special subroutines which implement the invention. A read of data from memory cell 14 is done by means of the sub-routine 27 (figure 2).

When a read request 20 is received the data bus is first loaded with the relevant address and read 21 in the normal way. The number of set bits, that is the number of erased bits, in the downloaded value is counted 22 and if it is greater than the fixed value data corruption is indicated at 24. If the condition at 23 is satisfied the downloaded value is returned as a valid value for the data read from the memory cell 14 at the required address.

For write operation 30 (Fig 3), a validity check must be performed on the data to be written to ensure that the condition of the predetermined number of bits in the data to be stored is met.

This may be achieved by a simple counting of the set bits in a way similar to that described above for the read operation. Generally, the data to be written is unlikely to meet the condition and one way of accommodating such data is to apply a transformation, after checking the data is within the range that can be validly transformed. In engine diagnostics, for example, the data to be stored as a diagnostic variable when an engine malfunction is detected is selected from a predefined set of values stored in read only memory. When a write operation 31 is required this value to be stored is first loaded (32) and the validity of the data assessed 33 by checking that its within a predefined range of values that can be applied for example to a 4 out of 8 transformation algorithm for an eight bit byte. If the data is invalid an error flag is set 34, otherwise the transformation proceeds 35, for example by means of a look up table stored in ROM. Following transformation the data may be written 36 by means of a normal EEPROM write cycle as previously described. Following the write, a read request 37 (that is the subroutine of Fig 2) is performed immediately to confirm a successful write before continuing 38.

It will be appreciated that the present invention provides a memory system wherein data corruption is indicated, meaning that corrupted data does not go on to disrupt data critical applications.

This is achieved without the memory and large execution time overheads of error correction algorithms. This increased level of confidence permits the use of for example integrated microprocessor EEPROM in data critical applications.

Claims (7)

1. The matter for which the applicant seeks protection is:1. A memory system including means for storing a data byte, the byte comprising a plurality of data bits, each bit taking either a first logical state or a second logical state, and the number of bits taking the fist logical state in the byte being a predetermined number; the means having a plurality of cells arranged for bit storage, each cell having an erased state representative of the first logical state, and a programmed state representative of the second logical state; means for programming cells in accordance with the data to be stored; means for monitoring stored data bytes; and means for providing an output indicative of data corruption if the number of bits taking the fist logical state in the stored byte is not equal to the predetermined number.
2. 2. A memory system as claimed in claim 1 and wherein the predetermined number is selected to be half the byte size.
3. 3. A memory system as claimed in claim 1 or claim 2 and wherein the memory is adapted for byte storage by erasure of all cells in which the byte is to be stored and subsequent programming of those cells which correspond to bits taking the second logical level.
4. 4. A method of storing data in memory having a plurality of cells arranged for bit storage, each cell having an erased state representative of the first logical state, and a programmed state representative of the second logical state; including the steps of writing a byte of data to the memory, the byte comprising a plurality of data bits, each bit taking either a first logical state or a second logical state, such that the number of bits taking the fist logical state in the byte being a predetermined number; and subsequently reading the byte; and providing an output indicative of data corruption if the number of bits taking the fist logical state in the read byte is not equal to the predetermined number.
5. 5. A method of storing data in memory as claimed in claim 4 and wherein the step of writing a byte to memory includes the steps of erasing of all cells in which the byte is to be stored and the subsequent step of programming of those cells which correspond to bits taking the second logical level.
6. 6. A memory system or method of storing data in memory as claimed in claims 1, 2 or 3 or claims 4 or 5 and wherein the memory is Electrically Erasable/Programmable Read Only Memory.
7. 7. A memory system or method of storing data in memory substantially as herein described with reference to the drawings.