DE102013202865A1 - Method for monitoring e.g. RAM of microcontroller to recognize address delay faults, involves writing data memory cell address into auxiliary memory accessed in operation and/or incorrectly evaluated data word into auxiliary memory - Google Patents

Abstract

The method involves writing an address of a cell of data memory (10) into an auxiliary memory (14) accessed in a preceding operation in addition to an address (30) of the data memory and/or incorrectly evaluated data word (24) into the auxiliary memory. An error detection process is performed by the data memory associated with an electronic circuit. The address of the data memory is only written into the auxiliary memory, where data words of the auxiliary memory are correctly evaluated by the error detection process. Independent claims are also included for the following: (1) a test program, which is executable on a computer, to implement a method for monitoring data memory (2) a computer storage medium for storing test program to implement a method for monitoring data memory (3) an auxiliary memory in a computer.

Description

State of the art

The invention relates to a method for monitoring a data memory in which erroneous data words stored in the data memory by means of an error detection method are recognized and / or corrected according to the preamble of claim 1.

The invention further relates to a test program for carrying out the method, a storage medium containing the test program, and an auxiliary memory.

Modern microcontrollers require data storage in the amount of several hundred kilobytes, for example, for static data storage (RAM, "random access memory"), or several megabytes, for example for the permanent storage of programs in so-called FLASH memories. Depending on the large storage volume or its technical realization, data errors are comparatively frequent or at least probable. Basically, there are two flaws: First, they are permanent faults in which even repeated read and write cycles bring no improvement. Secondly, in RAM memories, for example, due to alpha radiation, individual data errors may disappear again after a read / write cycle.

To improve data security, therefore, error correction methods (ECC) are frequently used. For example, one-bit errors (one-bit errors) can always be corrected, two-bit errors can always be detected, and multi-bit errors can usually be detected, but not always. However, the ECC method may evaluate some data words with multiple errors as a data word other than the original content with a bit error, and correct them accordingly incorrectly.

Application of an exemplary ECC method to randomly generated data words has shown that this ECC method, for example, rates 28 percent of a sequence of data words as valid data words with a single error, and the remaining 72 percent of the data words - relative to a particular ECC educational protocol Procedure - invalidated. In safety-critical applications, however, the requirements imposed by international standards are very high. For example, the Standard ISO 26262 , ASIL-D, that more than 99 percent of such randomly generated data words must be recognized as invalid.

For example, prior art advanced measures provide for increasing a number of check bits (so-called redundant bits) added to the data words to improve the correction or detection of data errors even with multi-bit errors. This costs an additional amount of memory elements of the data memory and makes it more expensive.

Furthermore, the ECC method can be carried out in two stages by successively applying a so-called inner coding (ECC) and an outer coding (EDC, CRC) to the data words. But this method is complex and expensive.

A method according to the preamble of claim 1 is known from DE 10 2010 031 282 A1 known.

Disclosure of the invention

The invention proposes an improvement of the aforementioned method in that one or more addresses of a data memory, under each of which a data word evaluated as faulty by an error detection method, are written into an auxiliary memory and made available to a test program, and that in addition to the Address of the data memory also a) an address of a cell of the data memory is written in the auxiliary memory, which has been accessed in a previous operation, and / or b) the data word evaluated as erroneous is written in the auxiliary memory. Hereinafter, the error detection method is also understood as a method which corrects errors (so-called error correction method). The method according to the invention has the advantage that the data words of a data memory can be protected particularly well against errors and / or defects without the data memory having to be enlarged or multistage error detection methods having to be used. Further, according to the present invention, considering an address of a cell of the data memory which has been accessed in a previous operation advantageously allows detection of "Address Delay Faults". With Address Delay Faults (also known as "address decoder delay fault"), a malfunction of the data memory occurs only when certain address transitions occur, whereas other address transitions do not result in errors. By virtue of the fact that, according to the invention, the address of a cell of the data memory which has been accessed in a preceding operation is also stored, the corresponding address transition can advantageously be reconstructed, and thus an address delay fault can be detected.

Alternatively or additionally, according to the invention, the data word evaluated as faulty is written into the auxiliary memory. This has the advantage, in particular in the case of non-variable (nonvolatile) memories, that the address transition leading to a fault does not have to be carried out in a subsequent connection test. For example, by repeatedly reading out the memory cell which has been identified as defective, an address decoder delay fault can be excluded. A comparison of this read-out value with the word stored by the alternative method according to the invention enables reliable recognition of this error pattern.

According to a further embodiment, the abovementioned variants a), b) can also be combined with one another, i. In addition to the address of the data memory according to variant a) also an address of a cell of the data memory is written to the auxiliary memory, which has been accessed in a previous operation, and according to variant b) the data word evaluated as erroneous is written into the auxiliary memory.

In a further embodiment, however, only one of the two variants a) or b) is particularly preferably used.

The invention is based on the consideration that today's data memories can store a very large number of data words, at the same time increasing the susceptibility to fugitive defects or permanent defects physically. In particular, the invention takes into account that volatile errors or permanent defects in data memories often only concern a single or a few memory lines or the data words stored therein. Thus, the usual provisions to improve data security prove to be unattended insofar as they require a cost that is proportional to the size of the data memory.

According to the invention, therefore, those addresses of the data memory, among which a data word which has been evaluated as faulty by an error detection method, for example an ECC method, are written to an auxiliary memory and thus treated separately. As a result, the effort can be kept relatively small overall. The information stored in the auxiliary memory is advantageously provided to a test program and, for example, examined regularly by the test program. From this measures for increasing the data security of the data memory are derived, as described below with reference to a possible embodiment.

For the explanation of the term, the following is noted: The data memory is controlled via "addresses", each of which refers to a so-called memory line of the data memory. Each memory line of the data memory comprises a plurality of (physical) so-called memory locations, in each of which one-bit information, that is, a single data bit, is stored. The entirety of the data bits stored in a memory line is called a data word. In the memory lines or memory locations "errors" can occur, which are either "volatile errors" or "permanent defects". The auxiliary memory stores the addresses in a number N of "address registers", with further information being stored for each address register, which comprises, for example, a "document bit". By "data" is meant any information that can be stored in data stores.

According to an advantageous embodiment, it is provided that the error detection method is carried out essentially by means of an electronic circuit assigned to the data memory. Such an error detection method is embodied for example as so-called "Error Correction Coding" (ECC). This can advantageously be carried out by means of the electronic circuit, by which the data to be written into the data memory are supplemented by so-called redundant bits, which are recorded and evaluated during later reading, whereby specific errors or error patterns can be detected and / or corrected , This can save computing time and reduce costs if necessary.

An embodiment of the method provides that only those addresses are written into the auxiliary memory whose data words were evaluated by the error detection method as having a one-bit error. One-bit errors are particularly characteristic of both the occurrence of transient errors - that is, those errors which temporarily affect only a single write and read operation - as well as permanent defects in memory locations of the data memory. It is also possible for single-bit errors to use downstream system actions to ensure system-level security and reliability.

The management of the auxiliary memory is simplified if it is displayed for each address stored in the auxiliary memory, whether this address is valid. For example, a reserved address register, which thus contains a "valid" address, can be distinguished from an unoccupied, ie empty, address register by a "document bit" stored for each address in a simple manner. Thus, the auxiliary memory can be used particularly efficiently. That's why it's at initialization advantageous if these slip bits are set to invalid.

Furthermore, it is provided that upon detection of a faulty data word by the error detection method, first the valid addresses of the auxiliary memory are then examined to see whether the address of the incorrect data word has already been stored. If this is the case, the contents of the auxiliary memory are not changed. If, on the other hand, the address of the erroneous data word is not stored in the auxiliary memory, the storage takes place in an empty address register, with the associated document bit being set.

In particular, it is provided by the method that the data word whose address is stored in the auxiliary memory is examined by the test program, whether the data word has a one-bit error or a multi-bit error, and / or if the memory line of the data word has a defect, the one One-bit error or a multi-bit error corresponds, and / or whether an error of the memory line of the data word occurs temporarily or permanently, and / or which memory locations are affected within the memory line respectively. Thus, the data word or the memory line and the memory locations contained therein can be thoroughly examined, evaluated and possibly corrected. The details of this are described in more detail in the following sections with reference to an embodiment of the invention.

In particular, it may be provided to delete the corresponding address in the address register of the auxiliary memory or to reset the associated document bit in the event of a detected volatile error. It is also possible to dispense entirely with the use of slip bits, as long as unused address registers are completely filled with binary zeros.

The method may be differentiated depending on a type of the data memory when the test program executes a read-only test tuned to a failure memory in a volatile memory, and performs a failure test on a nonvolatile memory by means of a CRC-code checksum , For example, the distinction between single-bit errors and multi-bit errors in volatile memories can advantageously be carried out by means of a read-write test adapted to respective expected error patterns. In the case of non-volatile memories, this can be done by means of a CRC checksum method "Cyclic Redundancy Check", ie by a cyclic redundancy check over a larger data block.

A preferred embodiment of the method provides that a distinction is made between first correctly correctable errors, secondly incorrectly corrected or incorrectly recognized multi-bit errors and / or thirdly volatile errors or permanent defects. In particular, this is preferably done according to the invention by computer-aided procedures, that is based on software. In any case, "correctly correctable errors" are understood to mean single-bit errors on the basis of customary ECC variables. However, depending on the technical means used, multi-bit errors can also be understood. For these distinctions, therefore, no additional effort on electronic circuits is required, the method can work flexibly and is individually customizable.

In addition, it is provided that limit values are specified for an admissible number of one-bit errors and / or multi-bit errors and / or one-bit defects and / or multi-bit defects, and that a memory management response occurs if at least one limit value is exceeded. As a result, the method can be easily adapted to particular requirements, for example with regard to data security on the one hand and the availability of the data memory on the other hand. For example, even with a one-bit defect and / or individual multi-bit errors or multiple-bit defects - where multi-bit errors or multi-bit defects may not be corrected - a memory management response will occur which will be explained in more detail below.

• – Deaktivieren einer defekten Speicherzeile und/oder Zuweisen einer Ersatz- Speicherzeile;
• – Deaktivieren eines defekten Speicherzeilenbereichs und/oder Zuweisen eines Ersatz-Speicherzeilenbereichs;
• – Erzeugen einer Meldung, eines Alarms und/oder eines Fehlerbits;
• – Überführen des Datenspeichers und/oder eines dem Datenspeicher übergeordneten Systems in einen als sicher bewerteten Zustand.

The method is particularly useful when the memory management response involves at least one of the following:

• Deactivating a defective memory line and / or assigning a spare memory line;
• Deactivating a defective memory line area and / or assigning a spare memory line area;
• - generating a message, an alarm and / or an error bit;
• - Transferring the data memory and / or a parent of the data storage system in a evaluated as safe state.

This can be used to disable single or multiple memory lines detected as defective and to allocate spare memory lines or even spare memory areas. For this purpose, suitable methods are already known. Furthermore, a message or an alarm can be generated, which is important for example in safety-sensitive systems, such as in motor vehicles. If required, the data memory or the higher-level system or a sub-system can also be converted into a suitable and as safely evaluated state.

Regardless of the function of the test program, alternatively or additionally, the data memory and / or the superordinate system can be converted into the condition evaluated as safe by means of an overflow signal of the auxiliary memory.

According to the invention, it is further provided that the contents of the auxiliary memory can be saved in a non-volatile memory prior to switching off the data memory or of a system which is the parent of the data memory and can be reconstructed again after being switched on. Thus, the error history of a previous operation is maintained and can be advantageously used again after the subsequent power-on, for example, to quickly detect and eliminate localized errors or defects.

A supplement to the method is that volatile errors and / or permanent defects are counted and / or statistically evaluated. Thus, the test program may perform advanced and complementary operations to assess the usefulness of the data memory to which a conventional error detection circuit is incapable.

In addition, it is provided that a result of the count and / or the statistical evaluation is transmitted to a manufacturer of the data memory or the higher-level system. This transmission can take place by means of remote-acting diagnostic systems - as they are technically at least in preparation - and transmit, for example, the manufacturer of the motor vehicle and / or the manufacturer of the data memory early information on possible incipient problems.

The method works more efficiently when a functional test is performed after powering up and / or during operation of the data memory, and thereby addresses of the data memory that refer to memory lines that were evaluated as faulty during the functional test, in the Auxiliary memory are written. The functional test is preferably designed as a read-write test for volatile memories and as a read-only test for volatile memories. In this way, any existing procedures can advantageously be supplemented by the method, wherein according to the invention additional information is generated which can be used for an assessment of the data security in the data memory.

Furthermore, it is provided in connection with the read-write test that a first checksum is stored on those memory lines whose addresses are stored in the auxiliary memory, the first checksum is stored, in the further operation of the data memory regularly at least one more checksum on those Memory lines whose addresses have been stored in the auxiliary memory is formed, and the at least one further checksum is compared with the first checksum.

According to a preferred embodiment, the addresses used to form the first checksum are additionally backed up. These additionally secured addresses can then be used for the formation of the at least one further checksum. This ensures that the additional checksums can be formed independently of a current content of the auxiliary memory.

As a result, it is advantageously possible to subject individual memory lines or memory line areas, which are known to be unchangeable or changeable, to a regular test: After the start of operation and a certain operating time of the data memory and by carrying out the method according to the invention and optionally a read / write test in the auxiliary memory, the addresses of those memory lines which have been evaluated as having a one-bit error or Einbitdefekt. Such one-bit errors or one-bit defects are assumed to be correctable by the error detection. Depending on the respective embodiment of the error detection, any possibly correctable multi-bit errors or multiple-bit defects may possibly be dealt with in the same way. Then, via the data words of the addresses stored in the auxiliary memory-which are corrected correctly by means of error detection-a checksum is formed and stored, for example according to a CRC method. In this case, a secure storage may be useful, for example by means of a double storage. In addition, it is conceivable to additionally store the addresses of the auxiliary memory. Subsequently, a cyclical or periodically running check is performed in such a way that a checksum is formed via the addresses present in the auxiliary memory (or via the previously additionally stored addresses) and is compared with the checksum formed and stored after the start of operation. If the comparison does not match, an appropriate response can be made to the severity of the error. The advantage of this procedure is that the test takes a comparatively short time and can therefore also take place during the normal operation of the data memory or of the higher-level system. If further faulty memory lines or memory line areas have been detected during the tests, it may be useful to use the described cyclical or periodic review.

In this case, it may be useful if the read-write test is divided into memory line areas and if different memory line areas are subjected independently to the read-write test one after the other. This makes it possible to carry out the read-write test and the inventive treatment of the addresses and data words based thereon also during the active operation of the data memory. Optionally, for a given memory area, it is necessary to first make a backup copy of the content, then perform the read-write test on that area, and then copy the backup back into the area.

In addition, it is provided that the error detection method or an electronic circuit implementing the error detection method is checked for proper functioning after switching on the data memory and / or during operation. In this way, it can be ensured that the error detection method, which constitutes a basis for the method according to the invention, operates error-free in itself.

The invention also relates to a test program executable on a computer and programmed to perform the method of the invention. In this case, "computer" is understood to mean all types of devices which comprise at least one program memory and a logic circuit accessing it. For example, computers, personal computers, control and / or regulating devices such as motor vehicles, state machines with Boolean logic, microprocessor systems, microcontrollers, intelligent USB storage devices "Universal Serial Bus", and the like.

The invention further relates to an auxiliary memory for carrying out the method. This can be designed as a separate unit or integrated into any existing storage systems or electronic circuits.

Hereinafter, numerous further embodiments of the invention will be described in successive brief descriptions. These may be important for the invention individually or in any combination.

For very safety-critical applications, it can be a measure to tolerate fugitive errors, but already trigger a reaction due to a single permanent one-bit defect, or to convert the data store or the higher-level system into a state evaluated as safe.

In contrast, for applications in which availability is of primary importance, it may be necessary to completely dispense with the use of the test program and to essentially limit error handling to error correction.

Volatile errors in the data memory can be corrected immediately after detection by the test program, or alternatively, a time can be waited during which the memory location in question remains under observation.

The test program may determine a rate of occurrence of the fugitive errors and perform additional tests and / or actions if the rate exceeds a threshold.

Before the data memory is shut down, the test program may attempt to rewrite as memory locations of a FLASH memory that have been incorrectly evaluated.

The test program can subdivide the data memory into several memory line areas and use such memory line areas for security-critical data contents, which are free from permanent defects.

The test program may associate detected one-bit errors and / or one-bit defects with its respective memory line area, and subject special memory sections subject to such errors to memory area ranges that are rated safety critical.

The following possible embodiments of the invention essentially relate to a method-specific test of the data memory in connection with the read-write test:
The read-write test which checks the data memory can be carried out by means of a special read-write test program or alternatively and at least partially by an electronic circuit. If the read-write test is carried out by means of a program-supported procedure, the auxiliary memory with addresses of faulty memory lines can already be triggered by carrying out the test.

In a read-only test of a non-volatile memory, for example a FLASH memory or ROM memory "Read Only Memory", checksums can be formed all over the data memory or over individual memory line areas. In addition, the error detection can be activated, it being possible to check which of the errors can be corrected by the error detection are. In addition, the addresses of the memory lines affected by errors can be written into the auxiliary memory and made available to the test program by the inventive method. Alternatively, even with deactivated error detection, the non-volatile data memory can be read and the result used for comparison.

In addition, it is conceivable to perform the read-write test or read-only test in such a way that each memory location of a memory line is accessed once with and once without the effect of the error detection, and that thereafter both results are compared. In order to detect possible errors in the redundant bits, a recalculation of the data words and the associated redundant bits can additionally be performed, and then the newly calculated redundant bits are compared with the redundant bits previously stored in the memory line.

It may be a goal of the read-write test to fill the auxiliary memory with the addresses of all the memory lines evaluated as faulty. Subsequently, in the case of detected and / or corrected errors which occur in memory lines whose addresses have not yet been present in the auxiliary memory, a new type of error can be concluded and suitable measures can be taken. This may possibly be initiated by a so-called interrupt, "interrupt", of the higher-level system, the interrupt being generated, for example, when a reference bit of the auxiliary memory is set during normal operation of the data memory.

The following possible embodiments of the invention essentially relate to a method-specific test of the data memory in connection with a check of the error detection for its functionality:
If a check of the fault detection is performed on their functionality, for example, after switching on the data memory or the higher-level system, a logic that checks for error detection - that is, an electronic circuit - can advantageously be tested during a general self-test of the data memory or of the higher-level system. As a result, the error detection test can be made even safer. Insofar as a respective embodiment makes it technically possible, the error detection and / or the logic that tests the error detection can be tested in a comparable manner not only at the start of operation but also during normal operation of the data memory. As an alternative to the checking logic, the error detection test can also be carried out by means of a special program part. Optionally, the test can only be performed in normal operation if the auxiliary memory is not empty.

In addition, the error detection can be checked by reading one or more intentionally erroneously written or known as erroneous data words from the data memory and the correction characteristics of the error detection are checked and / or evaluated.

In non-operationally writable memories, intentionally erroneous data words may be written to predetermined addresses, both single-bit errors and multi-bit errors. The functionality of the error detection can therefore be checked by accessing these addresses. It may be useful to remove these addresses from the read-only test of the data memory to avoid overflow of the auxiliary memory. After the test, the predetermined addresses in the auxiliary memory can be deleted again and the associated document bit can be reset.

In the case of a RAM memory or other types of data memories which can be written to during operation, the intentionally erroneous data words can also be generated by means of a program part during operation by separately generating and writing the data words and the associated redundant bits during a temporarily deactivated error detection. Thereafter, the error detection test is performed. It may make sense to limit this check to those memory lines that have not previously been rated as faulty. It may also be useful to delete or reset the predetermined addresses and the associated document bit after the test has expired.

Furthermore, it is possible to carry out the error detection test only if the data memory already has recognized faults or permanent defects, and to use only the memory lines which are evaluated as faulty.

In addition, it is possible to regularly perform the error detection test, each time using a different memory line area, such that in repeated tests, the entire data memory can essentially be detected by the test.

The following possible embodiments of the invention essentially relate to a method-specific test of the data memory in conjunction with a read-write test or a read-only test:
In addition, it is possible to perform a read-write test such that an original one Memory line area is selected - for example, in physical or logical proximity to a specific memory line - which is saved in a first step by copying into another free memory line area. Thereafter, in a second step, the original memory line area is checked by means of the read-write test. For non-writable embodiments of the data memory - for example FLASH memory or ROM memory - checksums can be formed over the memory line areas. At the end, the backed up data can be written back to the original memory line area if necessary.

Carrying out such a read-write test together with the method according to the invention for monitoring the data memory makes it possible to test the entire data memory within a certain period of time and thus also the addresses of all faulty memory lines within this time span present in the auxiliary memory.

• (A) Verwendung einer so genannten "Memory Management Unit", MMU, welche der weiter oben beschriebenen Speicherverwaltung funktional entspricht oder dieser zugehörig ist. Dabei werden jene Adressen, die in einem zu Betriebsbeginn erfolgten Schreib-Lese-Test bzw. Nur-Lese-Test Start-Up als fehlerhaft bewertet und in dem Hilfsspeicher abgespeichert wurden, der Speicherverwaltung bzw. der MMU mitgeteilt. Dadurch können diese – physikalischen – Adressen für eine weitere Verwendung auf einfache Weise gesperrt werden.
• (B) Schaltungsmäßige Trennung der betroffenen Bereiche: Es ist bekannt, einzelne Speicherzeilen und/oder Speicherzeilenbereiche eines Datenspeichers mittels Trennstellen, (integrierten) Sicherungen oder Schaltern gezielt auszublenden. Das erfindungsgemäße Verfahren kann mit einer solchen Ausblendung sinnvoll kombiniert werden, ähnlich wie zuvor im Abschnitt (A) beschrieben. Die im Hilfsspeicher gespeicherten Adressen können also zur Ausblendung verwendet werden. Dies kann beispielsweise während des Betriebs, während einer spezialisierten Betriebszeit oder manuell in einer Werkstatt erfolgen.
• (C) Programmtechnische Maßnahmen, so genannte "Lernende Software": Bei der Zuweisung von Speicherzeilen oder Speicherzeilenbereichen, "Speicherallokation", werden solche Adressen, die in dem Hilfsspeicher gespeichert sind, nicht mehr verwendet.

The following possible embodiments of the invention essentially relate to a method-specific test of the data memory in connection with a so-called memory suppression:
For this purpose, it is intended to no longer or only in exceptional cases use the addresses of the data memory stored in the auxiliary memory via the method. There are three ways to do this:

• (A) Use of a so-called "Memory Management Unit", MMU, which functionally corresponds to or is associated with the memory management described above. In this case, those addresses which were evaluated as being erroneous in a read-write test or read-only test start-up at the start of operation and stored in the auxiliary memory are communicated to the memory management or the MMU. As a result, these physical addresses can be easily blocked for further use.
• (B) Circuit separation of affected areas: It is known to hide individual memory lines and / or memory line areas of a data storage by means of separation points, (integrated) backups or switches targeted. The method according to the invention can be usefully combined with such blanking, similarly as described above in section (A). The addresses stored in the auxiliary memory can thus be used for blanking. This can for example be done during operation, during a specialized operating time or manually in a workshop.
• (C) Program measures, so-called "learning software": When allocating memory lines or memory line areas, "memory allocation", those addresses which are stored in the auxiliary memory are no longer used.

The following possible embodiment of the invention essentially relates to a method-specific test of the data memory in conjunction with a fault memory:
Before switching off the data memory or the higher-level system - which may be arranged, for example, in a motor vehicle - an entry about the contents of the auxiliary memory can be made in a fault memory. This can be used to log which addresses or memory lines were detected as faulty. Thus, important information can be saved for a workshop diagnosis, among other things.

The object of the invention is also achieved by a test program and a storage medium according to the independent claims. Advantageous developments are specified in subclaims. Further features of the invention are given in the following description of exemplary embodiments and in the drawings, wherein the features both in isolation and in different combinations may be important to the invention, without being explicitly referred to again. In the drawing show:

1 a block diagram of a data memory with a circuit for error detection and an auxiliary memory; and

2 a flowchart with method steps of the inventive method according to an embodiment.

1 shows a data store 10 with an error detection 12 and one to the error detection 12 connected auxiliary memory 14 , A vertical dashed line 16 differs in the drawing of 1 the previously known from the prior art part (left) of the inventive additional electronic circuit (right). Also in the right part of the drawing is a test program 18 shown, which among other things on the auxiliary memory 14 read and write access and process its information. This is by a double arrow 20 symbolically represented. If necessary, the test program 18 also on others in the area of the data memory 10 and error detection 12 access this information. A non-volatile memory 19 is via a bidirectional data connection 21 to the auxiliary memory 14 connected.

Overall, the scheme of the 1 both circuit-based elements ("hardware") and computer-aided procedures ("software"). The error detection 12 (ECC, "Error Correction Coding") is in the present case designed as an electronic circuit. Furthermore, in the 1 be shown divided into several electronic components or housed in total on only one element together ("one-chip solution").

The data store 10 is bidirectional with error detection 12 connected. An inner data path 22 leads in the data memory 10 to be stored or stored data words 24 which is in error detection 12 with associated redundant bits 26 were supplemented. The data words 24 each comprise several bits in any but fixed number. An outer data path 28 leads the data words 24 without the redundant bits 26 a memory management 29 bidirectional too. Likewise will be addresses 30 the data store 10 for managing the data stored therein from memory management 29 fed. In this case, each address has 30 to an associated memory line 33 of the data memory 10 that is, the memory line 33 includes storage locations 35 each one bit in a number that is at least the length of the data word 24 plus the respectively associated redundant bits 26 equivalent.

The memory management 29 can also provide information with the test program 18 and may be implemented as an electronic circuit and / or as a computer-aided procedure. However, this is not explained in detail here. A bidirectional arrow 31 connects to a higher-level system (not shown). The higher-level system is, for example, a control and / or regulating device of a motor vehicle, a computer (PC), a microcontroller, a data mass memory or the like. This is in the 1 but not shown.

A first exit 32 the error detection 12 outputs information when multi-bit errors are detected and / or corrected. A second exit 34 outputs information when one-bit errors are detected and / or corrected and, among other things, results in the auxiliary memory 14 in the form of the address 30 to. An overflow signal 37 is generated when the total number N of address registers 36 with valid addresses 30 is filled, and thus all associated document bits 38 are set. A flag 39 indicates a new address 30 currently in the auxiliary memory 14 was written. The flag 39 For example, it can be used to trigger a temporary program interrupt called Interrupt.

The auxiliary memory 14 contains a number N of address registers 36 , which together with a respectively associated document bit 38 are stored. The top address register in the drawing 36 and the top slip bit 38 are identified by their reference numerals. The number N is the highest in the auxiliary memory 14 storable number of entries. The auxiliary memory 14 In addition, a second number N ', wherein, for example, N' = N, can have additional address registers in order to receive further data, in particular further addresses. Alternatively or additionally, the auxiliary memory 14 additionally also a third number N ", where, for example, N" = N, have further address registers in order to receive further data, in particular further addresses or data words, etc.

If the error detection 12 detects and corrects a one-bit error, then the address 30 of the affected data word 24 with all in auxiliary memory 14 stored valid addresses 30 compared. "Valid" is an address 30 in the auxiliary memory 14 then if the associated slip bit 38 is set, that is, for example, has the binary value "1". Unless this address 30 already in the auxiliary memory 14 is stored, there is no further reaction. Is the address on the other hand 30 not yet in the auxiliary memory 14 stored, it will be in the auxiliary memory 14 in an empty address register 36 saved. An empty (not "valid") address register 36 can be recognized by the fact that the associated document bit 38 is not set, that is, for example, has the binary value "0". After saving the address 30 in the address register 36 becomes its associated document bit 38 set.

Advantageously, according to the invention in addition to the address 30 the data store is also an address of a cell of the data store 10 in the auxiliary memory 14 written that was accessed in a previous operation (= variant a)). For this purpose, a corresponding area (not shown) of the auxiliary memory 14 provided, for example, the aforementioned N 'many other address registers. That is, an entry in the auxiliary memory 14 may advantageously be the address described above 30 of the data word affected by an error 24 contain, if necessary, the document bit 38 , as well as an address of a cell of the data memory 10 that was accessed in a previous operation. Here, "previous operation" means one immediately before the access to the address 30 Access operation was performed on the data store 10 , eg a previous error check of a different address than the address currently being checked 30 of the data memory 10 ,

Due to the fact that according to the invention in addition to the address 30 also the address of a cell of Data memory, which has been accessed in a previous operation is stored, advantageously the corresponding address transition can be reconstructed and thus an address delay fault can be detected. Alternatively or additionally, according to the invention, the data word evaluated as faulty is transferred to the auxiliary memory 14 written (= variant b)). For this purpose, a corresponding area (not shown) of the auxiliary memory 14 provided, for example, the aforementioned N 'many or N''many other address registers. This has the advantage, in particular in the case of non-variable (nonvolatile) memories, that the address transition leading to a fault does not have to be carried out in a subsequent connection test. For example, by repeatedly reading out the memory cell which has been identified as defective, an address decoder delay fault can be excluded. A comparison of this read-out value with the word stored by the alternative method according to the invention enables reliable recognition of this error pattern.

According to a further embodiment, the abovementioned variants a), b) can also be combined with one another, ie in addition to the address of the data memory, according to variant a), an address of a cell of the data memory is also stored in the auxiliary memory 14 written, which has been accessed in a previous operation, and according to variant b), the data word evaluated as erroneous is written to the auxiliary memory 14 written.

• – Deaktivieren eine defekten Speicherzeile 33 und/oder Zuweisen einer Ersatz- Speicherzeile 33;
• – Deaktivieren eines defekten Speicherzeilenbereichs und/oder Zuweisen eines Ersatz-Speicherzeilenbereichs;
• – Erzeugen einer Meldung, eines Alarms und/oder eines Fehlerbits;
• – Überführen des Datenspeichers 10 und/oder des dem Datenspeicher 10 übergeordneten Systems in einen als sicher bewerteten Zustand.

Within specified time intervals or at certain times, the test program is regularly 18 run through. This process is presently through the memory management 29 triggered. For each in the auxiliary memory 14 stored valid address 30 examines the test program 18 whether that by the respective address 30 designated data word 24 actually has only a single bad bit. If, however, in a data word 24 a multi-bit error or multi-bit defect and / or in multiple data words 24 a number of one-bit errors or one-bit defects by the test program 18 is discovered, each predetermined reactions can take place. These reactions may include:

• - Disable a defective memory line 33 and / or assigning a spare memory line 33 ;
• Deactivating a defective memory line area and / or assigning a spare memory line area;
• - generating a message, an alarm and / or an error bit;
• - Transfer of the data memory 10 and / or the data store 10 higher-level system into a state assessed as safe.

Regardless of the function of the test program 18 may alternatively or additionally by means of the overflow signal 37 of the auxiliary memory 14 , the data store 10 and / or the higher-level system are converted into a state evaluated as safe, because it can be assumed that the data memory 10 altogether no longer works reliably enough and is thus useless.

The distinction between one-bit errors and multi-bit errors can be made in volatile memory (RAM) by means of a read-on test adapted to the respective expected error pattern, for example at the start of operation or during normal operation of the data memory 10 is carried out. In the case of non-volatile memories (FLASH), this can be done by means of a CRC checksum method (Cyclic Redundancy Check).

Unless the data store 10 is executed as volatile memory, examines the test program 18 In addition, whether an error or an error pattern permanently in a respective memory line 33 of the data memory 10 is present ("defect"), or whether the error or the error pattern occurred only briefly. The latter becomes the associated address register 36 emptied by its slip bit 38 is reset. Furthermore, the test program 18 Check for correctly corrected one-bit errors or one-bit defects or incorrectly detected or incorrectly corrected multi-bit errors or multi-bit defects. In addition, the test program 18 detected errors of the data word 24 correct if necessary, and also perform an error count or create an error statistic.

Furthermore, it is possible to make the triggering of the reaction (s) dependent on predefinable conditions and predefinable limit values. For example, it is possible to predetermine a minimum number of possible one-bit defects, from which a response corresponding to the significance of the error is triggered.

The non-volatile memory 19 is via a bidirectional data connection 21 to the auxiliary memory 14 connected and has the task of the contents of the auxiliary memory 14 before switching off the data memory 10 or the higher-level system and after switching on again in the auxiliary memory 14 to reconstruct.

2 shows in a flowchart, for example by means of a computer program executable process steps of a possible embodiment of the method according to the invention. Alternatively or in addition to processing by a computer or by a control unit, logic circuits may be involved.

The procedure starts in a start block 50 , In a query block 52 it is checked if a one-bit error from the error detection 12 currently detected and / or corrected. If false, becomes a query block 54 branched.

If a one-bit error from error detection 12 currently detected and / or corrected is in a block 56 the address associated with the single bit error 30 of the data memory 10 detected. In a query block 58 will check if this address 30 already in the auxiliary memory 14 is present. If applicable, at the 2 underlying embodiment no further response and it becomes the query block 52 Branched back.

If the address 30 but not yet in the auxiliary memory 14 is present, becomes a block 60 branched. There will be this address 30 in an empty address register 36 of the auxiliary memory 14 written and the associated document bit 38 set. If necessary, others can be left in the auxiliary memory 14 present addresses 30 be moved and / or sorted. The procedure is then in the query block 54 continued.

In the query block 54 It checks if there are conditions to the test program 18 to start. If false, becomes the block 52 Branched back. If applicable, will be in a block 62 the test program 18 started. It then becomes the query block 52 branches back and the procedure continues.

It is understood that in the 2 shown procedure is only exemplary. Further embodiments include in particular the embodiments described in the independent claims. Furthermore, it can be provided that the procedure is started, stopped or aborted by the higher-level system. This is in the 2 but not shown in detail.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102010031282 A1 [0008]

Cited non-patent literature

• Standard ISO 26262 [0005]

Claims (23)

Method for monitoring a data memory ( 10 ), in which by means of an error detection method in memory lines ( 33 ) of the data memory ( 10 ) stored erroneous data words ( 24 ) and / or corrected, where an address ( 30 ) of the data memory ( 10 ) under which a data word (erroneous) evaluated by the error detection method ( 24 ) is stored in an auxiliary memory ( 14 ) and a test program ( 18 ), characterized in that in addition to the address ( 30 ) of the data memory ( 10 ) a. an address of a cell of the data store ( 10 ) in the auxiliary memory ( 14 ) written to in a previous operation and / or b. the data word evaluated as faulty ( 24 ) in the auxiliary memory ( 14 ) is written. A method according to claim 1, characterized in that the error detection method essentially by means of a data memory ( 10 ) associated electronic circuit is performed. Method according to claim 1 or 2, characterized in that only such addresses ( 30 ) in the auxiliary memory ( 14 ) whose data words ( 24 ) were evaluated as correctable by the error detection method. Method according to at least one of the preceding claims, characterized in that for each in the auxiliary memory ( 14 ) stored address ( 30 ) is displayed, whether this address ( 30 ) is valid. Method according to at least one of the preceding claims, characterized in that upon detection of a faulty data word ( 24 ) by the error detection method first the valid addresses ( 30 ) to see if the address ( 30 ) of the erroneous data word ( 24 ) is already stored. Method according to at least one of the preceding claims, characterized in that the data word ( 24 ) whose address ( 30 ) in the auxiliary memory ( 14 ) is stored by the test program ( 18 ) is examined to see if the data word ( 24 ) has a one-bit error or a multi-bit error, and / or if the memory line ( 33 ) of the data word ( 24 ) has a defect that corresponds to a one-bit error or a multi-bit error, and / or an error of the memory line ( 33 ) of the data word ( 24 ) occurs temporarily or permanently, and / or which storage locations ( 35 ) within the memory line ( 33 ) are affected. Method according to at least one of the preceding claims, characterized in that the test program ( 18 ) performs in a volatile memory "RAM" matched to expected failure mechanisms write-read test. Method according to at least one of the preceding claims, characterized in that the test program ( 18 ) performs an error test on a non-volatile memory using a checksum of a CRC encoding. Method according to at least one of the preceding claims, characterized in that a distinction is made between firstly correctly correctable errors, secondly incorrectly corrected or incorrectly recognized multi-bit errors and / or thirdly volatile errors or permanent defects. Method according to at least one of the preceding claims, characterized in that limit values are specified for an admissible number of one-bit errors and / or multi-bit errors and / or one-bit defects and / or multi-bit defects, and that a response of the memory management occurs when at least one limit value is exceeded. A method according to claim 10, characterized in that the response of the memory management comprises at least one of the following measures: - deactivating a defective memory line ( 33 ) and / or assign a spare memory line; Deactivating a defective memory line area and / or assigning a spare memory line area; - generating a message, an alarm and / or an error bit; - transfer of the data memory ( 10 ) and / or a data memory ( 10 ) superior system in a state evaluated as safe. Method according to at least one of the preceding claims, characterized in that the content of the auxiliary memory ( 14 ) before switching off the data memory ( 10 ) or one of the data memories ( 10 ) higher-level system in a non-volatile memory ( 19 ) and reconstructed after switching it on again. Method according to at least one of the preceding claims, characterized in that the test program ( 18 ) detected errors of the data word ( 24 ) Getting corrected. Method according to at least one of the preceding claims, characterized in that volatile errors and / or permanent defects are counted and / or evaluated statistically. A method according to claim 14, characterized in that a result of the counting and / or the statistical evaluation to a manufacturer of the data memory ( 10 ) or the higher-level system. Method according to at least one of the preceding claims, characterized in that after switching on and / or during operation of the data memory ( 10 ) a functional test of the data memory is performed, and that addresses ( 30 ) of the data memory ( 10 ), which are stored on memory lines ( 33 ), which were evaluated as faulty during the function test, into the auxiliary memory ( 14 ) to be written. Method according to claim 16, characterized in that via memory lines ( 33 ), whose addresses ( 30 ) in the auxiliary memory ( 14 ), a first checksum is formed, and the first checksum is stored, preferably the addresses used to form the first checksum ( 30 ) are additionally secured, and that in the further operation of the data memory ( 10 ) at least one more checksum over memory lines ( 33 ), whose addresses ( 30 ) in the auxiliary memory ( 14 ) or their addresses ( 30 ) are additionally formed, is formed, and the at least one further checksum is compared with the first checksum. Method according to at least one of the preceding claims, characterized in that the functional test is divided into memory line areas, and that different memory line areas are independently subjected to the functional test successively. Method according to at least one of the preceding claims, characterized in that the error detection method or an electronic circuit implementing the error detection method after switching on the data memory ( 10 ) and / or during operation to verify that it is functioning properly. Use of the method according to one of the preceding claims for the detection of address delay faults. Test program ( 18 ) executable on a computer, characterized in that it is programmed to perform a method according to any one of claims 1 to 20. Storage medium for a computer, characterized in that it has a test program ( 18 ) is stored for use in a method according to one of claims 1 to 20. Auxiliary memory ( 14 ) in a computer, characterized in that the auxiliary memory ( 14 ) Interfaces to address ( 30 ) of a data memory ( 10 ) and / or data words ( 24 ) and / or information on their classification and a test program ( 18 ) and that the auxiliary memory is used in carrying out the method according to at least one of claims 1 to 20.

Images