DE102020207618A1 - Method for fault-tolerant storage of user data - Google Patents

Abstract

The invention relates to a method for fault-tolerant storage of user data on a non-volatile storage medium (110) on which write, read and delete processes can be carried out, comprising writing (12) the user data (120); determining (14) management information for the written user data; writing (16) a first administrative information copy (122) containing the determined administrative information, and determining and writing a first check value with which the validity of the first administrative information copy can be checked; and then writing (18) a second copy of management information (124) containing the determined management information, and determining and writing a second check value with which the validity of the second copy of the management information can be checked.

Description

The present invention relates to a method for fault-tolerant storage of useful data and to a computing unit and a computer program for its implementation.

State of the art

Control units in the automotive sector or in the area of industrial production systems not only have to save the program code of a control software, but also - during the runtime of the software - data in a non-volatile manner. For this purpose, non-volatile storage media (NVM, non-volatile memory), in particular EEPROMs or flash memories, are used. There are standards, e.g. of the AUTOSAR consortium, in which the functional scope of the software is specified, but not the way in which the data is organized on the hardware, i.e. on the storage medium.

In the case of control units used in the above-mentioned areas, it must be taken into account that every erasure or programming process of memory cells of the storage medium can be interrupted at any point in time if the voltage supply breaks down. This can lead to not or only weakly erased or programmed memory cells and thus to arbitrary data values when reading out. In particular, weakly programmed cells pose a challenge, as the data they contain can initially be valid for a while, but can then turn to an invalid data value (i.e. the stored data value can change unintentionally, e.g. a logical '1 'to a logical' 0 '). Aging effects, which occur more frequently due to the often high temperatures in the automotive or industrial environment, can also cause data values stored in individual memory cells to tilt.

Such data errors are particularly disadvantageous when a memory area is concerned in which management information is stored. Administrative information, which is stored in the form of so-called headers or footers, contains information about location and length or the current status (such as "deleted", defective "," ready "or" full ") of memory areas which contain the actual user data. In order to be able to recognize the validity of headers / footers and user data, these can be secured by check values or checksums - mostly cyclic redundancy checksums (CRC). If the check value of a header is incorrect, the corresponding administrative information is invalid and the user data blocks managed with it may not be used, i.e. their content is discarded. A data error in the memory area of the management information means that the user data managed with it can no longer be used.

Disclosure of the invention

According to the invention, a method for the fault-tolerant storage of useful data and a computing unit and a computer program for its implementation with the features of the independent claims are proposed. Advantageous refinements are the subject matter of the subclaims and the description below.

By writing two copies of management information on the storage medium, if one of the copies of management information is damaged, for example due to incompletely programmed memory cells or due to the aging effects of the memory cells, it is ensured that the user data can continue to be used, since the management information contained in the other management information copy is used be able. Damage, i.e. an invalidation, of an administrative information copy can be detected with the aid of the check value, which is then no longer correct.

The administrative information is information that enables access to the stored user data and / or relates to properties thereof. The administrative information includes, for example, information about the location and / or length of the stored user data or a check value with which the validity of the user data can be checked.

The user data are preferably written before the administrative information copies are written, so that if, for example, a power failure occurs while the user data is being written, the absence of an administrative information copy that is no longer written after the power failure indicates that the user data is in use are faulty and should therefore not be used.

The writing of the second management information copy is carried out (in terms of time) after the writing of the first management information copy. This is useful because if writing was done at the same time, a power failure would affect both copies of administrative information.

The two administrative information copies are preferably not written adjacent or consecutively to the storage medium in order to reduce the likelihood of a simultaneous Reduce damage. This means that they are written in such a way that they are stored spatially separated from one another on the storage medium, for example by using different "Wordlines".

The non-volatile storage medium is preferably an EEPROM, PCM (phase change random access memory), MRAM (magnetoresistive random access memory) or a flash memory. However, any other non-volatile storage media can also be used, e.g. an HDD (Hard Disk Drive) or an SSD (Solid State Drive). Unless otherwise specified, all write, read and delete operations mentioned in this application are carried out on the non-volatile storage medium without this being specifically mentioned (ie a process step “writing” is called “writing to the storage medium” or more precisely , to be understood as "writing to the non-volatile storage medium", "erasing" and "reading" are to be understood in the same way).

A check value or checksum is to be understood as a value with the aid of which errors in the data (here the administrative information copies) can be recognized. When saving, this test value is determined or calculated from the data by means of a suitable function and is also saved. When the data is read later, the function is applied again to the data and it is thus recognized whether the test value has changed. The test value is typically stored together with the data and optionally the function is applied to the data and the test value stored together with it when reading. The function is normally applied to individual areas or blocks of data and a test value is calculated for each data area or block, so that the data are generally stored together with several test values. For the sake of simplicity, this application speaks of a check value with which the validity of an administrative information copy can be checked. However, this is to be understood in the sense of at least one check value, since the administrative information copies generally consist of several data blocks with associated several check values; in other words, the totality of these several check values of an administrative information copy forms the check value for the purposes of this application (this is particularly dependent on the check value used -Proceedings). A CRC value (CRC = Cyclic Redundancy Check) is preferably used as a check value in the context of a cyclic redundancy check, the calculation and use of which is known to the person skilled in the art.

The method can preferably include deleting the second administrative information copy, then deleting the first administrative information copy, and preferably deleting the useful data after deleting the first and second administrative information copies. As a result, user data can be deleted, and there is no need to explicitly delete the user data, since the deletion of the two administrative information copies already means that the user data is no longer used. In the case of the storage medium-dependent deletion of a storage area, for example, it is entered in an allocation table of the storage medium that the storage area is no longer occupied. Furthermore, the memory cells of the memory area can each be written with a predetermined value, which indicates that they are not occupied, or they can also be written with random values.

Furthermore, the method can preferably comprise one or more times the following steps: reading the first administrative information copy and the first check value, and checking the validity of the read first administrative information copy by means of the read first check value; Reading the second copy of management information and the second check value, and checking the validity of the read second copy of management information by means of the read second check value. According to this embodiment, the integrity of the stored management information can be checked. This can be done several times, i.e. at different times, for example with each control unit start or for certain events, e.g. when a fluctuation in the supply voltage is detected, and / or at certain time intervals, such as minutes, hours, days, weeks or the like. Depending on the result of the above-mentioned test steps, various steps can be carried out according to preferred embodiments of the method according to the invention.

If the read first and the read second administrative information copies are valid and identical, the method preferably comprises reading the user data using the first or the second administrative information copy. During read processes, the validity and equality of both administrative information copies is checked; if both are valid and identical, the user data is read. This ensures that the administrative information copies remain unchanged with every read process.

If, on the other hand, the two administrative information copies are not both valid and / or not identical, the administrative information copies can be repaired in addition or as an alternative to reading the user data in order to ensure that two valid and identical administrative information copies are available again, and accordingly themselves at a subsequent damage to one of the administrative information copies, the user data can still be used. The repair can take place within the framework of a reading process of user data or also within the framework of an independent repair process, which takes place, for example, every time a control device in which the storage medium is used is started or takes place regularly.

1. a) Lesen der Nutzdaten unter Verwendung der ersten Verwaltungsinformationskopie;
2. b) erneutes Schreiben der zweiten Verwaltungsinformationskopie, wobei die in der ersten Verwaltungsinformationskopie beinhalteten Verwaltungsinformationen verwendet werden, und erneutes Bestimmen und Schreiben des zweiten Prüfwerts, mit dem die Gültigkeit der erneut geschriebenen zweiten Verwaltungsinformationskopie geprüft werden kann.

Accordingly, the method preferably comprises, if the read first and the read second administrative information copies are valid and not identical, at least one, preferably both, of:

1. a) reading the user data using the first administrative information copy;
2. b) renewed writing of the second administrative information copy, the administrative information contained in the first administrative information copy being used, and renewed determination and writing of the second check value with which the validity of the newly written second administrative information copy can be checked.

According to this embodiment, both copies of management information are valid but not identical, which can occur, for example, if the content of two memory cells happens to change in such a way that the test value does not change. In this case, the second management information copy can be repaired using the first management information copy, since the first, older, management information copy is assigned a higher credibility. In the additional or alternative reading step, the first administrative information copy is used, with the aid of which the repair is carried out. Both the reading of the user data (step a)) and the repair of the stored administrative information (step b)) are preferably carried out, since a repair is carried out at the same time with every read access to the storage medium, i.e. identified errors as quickly as possible be resolved. The user data is preferably read before the second copy of the administrative information is written again and the second check value is determined and written again, i.e. step a) is preferably carried out before step b), so that the user data is available as quickly as possible.

“New determination” of a test value can mean here and also in further embodiments a new calculation or an acceptance or copying of the respective other test value. In other words, in embodiments in which the second check value is determined again (like the one above), instead of a recalculation, the first check value contained in the first administrative information copy could also be adopted as the newly determined second check value (provided, of course, that the same calculation method, e.g. CRC sum , is used for the first and second test value). Similarly, in embodiments in which the first test value is determined again, the second test value could be adopted as the newly determined first test value instead of a recalculation.

• c) Lesen der Nutzdaten unter Verwendung der ersten Verwaltungsinformationskopie;
• d) erneutes Schreiben der zweiten Verwaltungsinformationskopie, wobei die in der ersten Verwaltungsinformationskopie beinhalteten Verwaltungsinformationen verwendet werden, und erneutes Bestimmen und Schreiben des zweiten Prüfwerts, mit dem die Gültigkeit der erneut geschriebenen zweiten Verwaltungsinformationskopie geprüft werden kann.

If exactly one of the administrative information copies is also invalid, the method preferably comprises: if the read first administrative information copy is valid and the read second administrative information copy is not valid, at least one, preferably both, of:

• c) reading the user data using the first administrative information copy;
• d) again writing the second administrative information copy, the administrative information contained in the first administrative information copy being used, and again determining and writing the second check value with which the validity of the newly written second administrative information copy can be checked.

• e) Lesen der Nutzdaten unter Verwendung der zweiten Verwaltungsinformationskopie;
• f) erneutes Schreiben der ersten Verwaltungsinformationskopie, wobei die in der zweiten Verwaltungsinformationskopie beinhalteten Verwaltungsinformationen verwendet werden, und erneutes Bestimmen und Schreiben des erstes Prüfwerts, mit dem die Gültigkeit der erneut geschriebenen ersten Verwaltungsinformationskopie geprüft werden kann.

Or, if the read second administrative information copy is valid and the read first administrative information copy is not valid, at least one, preferably both, of:

• e) reading the user data using the second administrative information copy;
• f) again writing the first administrative information copy, the administrative information contained in the second administrative information copy being used, and again determining and writing the first check value with which the validity of the newly written first administrative information copy can be checked.

The invalid administrative information copy is therefore repaired in each case with the aid of the valid administrative information copy, so that two valid and identical administrative information copies are again available. Here, too, both the reading of the user data (step c) or e)) and the repair of the stored administrative information (step d) or f)) are preferably carried out. Likewise, the reading step is preferably carried out before the second or first administrative information copy is written again and the second or first check value is determined and written again.

The method can furthermore preferably comprise: if the read first Management information copy and the read second management information copy are not valid: deletion of the first management information copy and, preferably subsequently, deletion of the second management information copy. If both copies of administrative information are invalid, that is to say changed, access to the associated user data is no longer possible; by deleting the administrative information copy, this is clearly recognizable for a control device that wants to access it. A deletion of the user data can optionally also be provided here.

A computing unit according to the invention, for example a control unit of a motor vehicle, is set up, in particular in terms of programming, to carry out a method according to the invention.

The implementation of a method according to the invention in the form of a computer program or computer program product with program code for performing all method steps is advantageous, since this causes particularly low costs, especially if an executing control device is used for other tasks and is therefore available anyway. Suitable data carriers for providing the computer program are, in particular, magnetic, optical and electrical memories, such as hard drives, flash memories, EEPROMs, DVDs, etc. A program can also be downloaded via computer networks (Internet, intranet, etc.).

Further advantages and embodiments of the invention emerge from the description and the accompanying drawing.

The invention is shown schematically in the drawing using exemplary embodiments and is described below with reference to the drawing.

Figure list

• 1 shows an exemplary write process of user data and management information according to the present invention;
• 2 shows an exemplary deletion process of user data and management information according to the present invention; and
• 3 shows an exemplary repair process of management information or reading process of user data according to the present invention.

Embodiment (s) of the invention

1 represents an exemplary writing process of user data and management information according to the present invention, here by way of example in a processing unit 100 (eg a control unit or a processor of a control unit) with a non-volatile storage medium 110 (e.g. a flash memory connected to it or integrated in it).

First in step 12th the user data to be written 120 on the storage medium 110 written.

In step 14th who step here 12th is shown below, but also before or at the same time as Step, depending on the type of management information 12th can take place, management information relating to the written useful data is determined, which in particular can include the location and length of the written useful data.

In step 16 becomes a first copy of the management information, ie a first management information copy 122 , saved or written. A first check value, with which the validity of the first administrative information copy can be checked, is also determined and also stored (together with the first administrative information copy). Saving the first administrative information copy (step 16 ) should not take place until after the user data has been saved (step 12th ), so that if, for example, there is a power interruption while the user data is being saved, the management information is not written to the storage medium and, if the user data is attempted to be read, it can be seen that the user data cannot be completely available, as the related administrative information is missing.

In step 18th becomes a second copy of the management information, ie a second management information copy 124 , saved or written. A second check value, with which the validity of the second administrative information copy can be checked, is also determined and also stored (together with the second administrative information copy). This step 18th (Saving the second administrative information copy and the second check value) expediently takes place after step 16 (Saving the first administrative information copy and the first check value) instead. When storing the second administrative information copy 124 it is preferably ensured that this is stored in an area of the memory that differs from the area in which the first administrative information copy 122 is stored, is spatially separated (as shown), so that the likelihood that an error occurring in the memory will affect both copies of management information is reduced.

Overall it is made through the sequence of steps 12-18 ensures that errors, e.g. Power failures can be detected during the write process because no or only incomplete (ie invalid) administrative information copies are available. Only if at least one valid administrative information copy is available, the associated user data are regarded as valid and can be used.

2 shows an exemplary deletion process of user data and management information according to the present invention. First, in step 22nd the second copy of management information is deleted. In step 24 the first administrative information copy is deleted. These two steps are preferably carried out in the order given, but it is also possible for the two steps to be carried out in reverse order.

After the two administrative copies of information have been deleted, the optional step 26th the user data is deleted. In principle, the steps during the deletion process are carried out in reverse order to the steps during the write process, so it is ensured that any incompletely deleted user data (e.g. in the event of a power failure during the deletion process) are recognized as inadmissible and unusable, since the associated administrative information is already recognized beforehand have been deleted. Correspondingly can step 26th optionally also omitted, since after the two administrative information copies have been deleted, the associated user data are recognized as inadmissible (since no administrative information copy is available) and their use can be prevented.

3 represents an exemplary repair process for management information or a read process for user data that includes a repair process. A repair process for management information can run as an independent process (for example when starting a control unit, at regular intervals or at times when the computing power of the control unit and the storage medium is not used for any other purpose) to find and repair errors in the administrative information copies, or take place together with a read process of user data, i.e. during read access to the user data, the integrity of the administrative information copies is checked at the same time and the administrative information copies are checked if possible repaired.

Doing so in step 32 the first management information copy and the first check value and in step 36 read the second copy of management information and read the second check value. In step 34 the validity of the first administrative information copy is checked using the first check value, and in step 38 the validity of the second administrative information copy is checked using the second check value. With these steps 32 - 38 can, as far as possible (the checking of an administrative information copy clearly cannot take place before reading the same), can be deviated from the sequence shown in the figure, or individual steps can also take place simultaneously.

In step 40 the following cases are distinguished depending on the validity of the first and second management information copies: both management information copies are valid, both management information copies are invalid, or one management information copy is valid while the other management information copy is invalid.

If both copies of the management information are valid, step 42 distinguished as to whether the two management information copies are identical or not. If both copies of management information are identical, if it is a read operation in step 44 continue reading the user data, using the first or the second copy of the management information (which are identical). If it is purely a repair process, nothing further needs to be done or the check of the next data set of user data and associated administrative information can be continued (Note: In general, several different data sets of user data with respective administrative information are stored and checked).

If both management information copies are valid but not identical, one of the two management information copies is rewritten using the other management information copy. To do this, see step 48 the second administrative information copy is rewritten, the administrative information contained in the first administrative information copy being used, ie the newly written second administrative information copy contains the administrative information contained in the first administrative information copy; in other words, the second administrative information copy is overwritten, so to speak, with the first administrative information copy. The second check value is also redefined and rewritten so that the validity of the newly written second administrative information copy can be checked with it. In addition, in step 46 the associated user data can be read, using the management information contained in the first management information copy.

The step of reading 46 the payload can be after or before the step 48 of rewriting the second copy of management information. It is preferred that reading step before step 48 (Overwrite) is performed. Step 46 or step 44 (both reading the user data) before step 42 , discriminating whether or not the two copies of management information are identical, can be performed. This is where the reading step 44 , 46 preferably carried out as early as possible so that the useful data are available as early as possible.

If both copies of administrative information are not valid, step 50 the first and second copies of management information are deleted. Optional in step 52 continue to delete the associated user data. However, this can also be omitted, since the associated user data can already be recognized as invalid when the administrative information copies are deleted.

If one of the two management information copies is valid and the other is invalid, the invalid management information copy is overwritten by the invalid one. Thereby, if the first management information copy is valid and the second management information copy is invalid, in step 58 the second management information copy is rewritten, the management information contained in the first management information copy being used, that is to say the rewritten second management information copy contains the management information contained in the first management information copy. The second check value is also redefined and rewritten so that the validity of the newly written second administrative information copy can be checked with it. Optionally, in step 56 the user data are read, the first administrative information copy, ie the administrative information contained therein, being used. This reading step is preferred over the step 58 of overwriting, but can also be carried out after or at the same time as this.

On the other hand, if the first copy of management information is invalid and the second copy of management information is valid, step 62 the first administrative information copy is rewritten, the administrative information contained in the second administrative information copy being used, that is to say the newly written first administrative information copy contains the administrative information contained in the second administrative information copy. Likewise, the first check value is newly determined and rewritten so that the validity of the newly written second administrative information copy can be checked with it. Optionally, in step 60 the user data are read, the second administrative information copy, ie the administrative information contained therein, being used. This reading step is preferred over the step 62 of overwriting, but can also be carried out after or at the same time as this.

Claims (12)

A method for fault-tolerant storage of user data on a non-volatile storage medium (110) on which write, read and delete operations can be carried out, comprising Writing (12) the user data (120); Determining (14) management information for the written user data; Writing (16) a first administrative information copy (122) which contains the determined administrative information, and determining and writing a first check value with which the validity of the first administrative information copy can be checked; and then Writing (18) a second administrative information copy (124) which contains the determined administrative information, and determining and writing a second check value with which the validity of the second copy of the administrative information can be checked. Procedure according to Claim 1 comprising deleting (22) the second copy of management information (124); thereafter deleting (24) the first administrative information copy (122); and preferably deleting (26) the user data (120) after deleting the first administrative information copy. Method according to one of the preceding claims, comprising one or more times: Reading (32) the first administrative information copy (122) and the first check value and checking (34) the validity of the read first administrative information copy by means of the read first check value; and Reading (36) the second administrative information copy (124) and the second check value and checking the validity (38) of the read second administrative information copy by means of the read second check value. Procedure according to Claim 3 comprising, if the read first management information copy (122) is valid and the read second management information copy (124) is not valid, reading (56) the user data (120) using the first management information copy; and / or rewrite (58) the second copy of the management information, the in the first Management information copy contained management information are used, and again determining and writing the second check value with which the validity of the rewritten second management information copy can be checked. Method according to one of the Claims 3 or 4th comprising, if the read second management information copy (124) is valid and the read first management information copy (122) is not valid, reading (60) the user data (120) using the second management information copy; and / or rewriting (62) the first administrative information copy, wherein the administrative information contained in the second administrative information copy is used, and again determining and writing the first check value with which the validity of the rewritten first administrative information copy can be checked. Method according to one of the Claims 3 until 5 comprising, if the read first and the read second management information copies (122, 124) are valid and identical, reading (44) the user data (120) using the first or the second management information copy. Method according to one of the Claims 3 until 6th comprising, if the read first and second management information copies (122, 124) are valid and not identical, reading (46) the user data (120) using the first management information copy; and / or rewriting (48) the second administrative information copy, wherein the administrative information contained in the first administrative information copy is used, and again determining and writing the second check value with which the validity of the rewritten second administrative information copy can be checked. Method according to one of the Claims 3 until 7th comprising, if the read first administrative information copy (122) and the read second administrative information copy (124) are not valid, deleting (50) the first administrative information copy and the second administrative information copy and preferably deleting (52) the user data. Method according to one of the preceding claims, wherein the administrative information includes information about the location and / or length of the stored user data or a checksum with which the validity of the user data can be checked. Computing unit (100) which is set up to carry out all method steps of a method according to one of the preceding claims. Computer program that causes a processing unit (100) to perform all method steps of a method according to one of the Claims 1 until 9 to be carried out when it is executed on the processing unit. Machine-readable storage medium with a computer program stored thereon Claim 11 .

Images