EP1924916A2

EP1924916A2 - Memory arrangement and method for the operation thereof

Info

Publication number: EP1924916A2
Application number: EP06778041A
Authority: EP
Inventors: Thomas Kottke; Yorck Collani; Markus Ferch
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 2005-08-30
Filing date: 2006-07-28
Publication date: 2008-05-28
Also published as: JP4917604B2; WO2007025816A3; WO2007025816A2; JP2009506445A; RU2008111995A; US20090327838A1; CN101253485A; DE102005040916A1; KR20080037060A

Abstract

The invention relates to a memory arrangement which comprises a writable data memory (102) and means for recognising (103) an error in a data word, which is read from the data memory (102), and for correcting (101) the error and saving (101) the corrected data word to a new address in a free area of the data memory (102).

Description

R. 312169

Memory arrangement and method of operation therefor

State of the art

The present invention relates to a memory device having a writable data memory and means for detecting and correcting an error in a data word read from the data memory and an operating method for such a memory device.

In a writable data memory malfunctions can occur, which are expressed in the fact that one or more bits of a stored data word spontaneously change their value. If such a data store is used in a security-relevant application, e.g. in an engine control unit of a motor vehicle or the like. It is imperative to detect such malfunctions and take appropriate countermeasures to avoid dangerous malfunctions. In the simplest case, the countermeasures may be to terminate an application accessing the data store in a predetermined manner upon detection of a failure, so that an erroneous data value is no longer accessed and

Error controls are excluded due to the error. The application can then not be operated as long as the error in the data memory has not been rectified.

In order to avoid such an interruption of operation, it has been considered to store data words in a memory together with redundant information, by means of which not only a mistake of a data word can be recognized, but also this error can possibly be corrected. There are a variety of coding methods known that allow to detect and correct errors in a data word, the Reed-Solomon or Hamming codes are among the best known. Error-correcting codes can therefore be assumed to be known within the scope of the present description and will not be explained in detail. When an application accesses a cell of the memory and determines from the redundant information that the data word stored in that cell is faulty, the application may be provided with a corrected data word and the application may continue operating without the risk of misregistration.

The number of bit errors that can be corrected in a data word or in a block of data words coded together using an error correction code depends on the number of bits of redundant information generated for that data word or block. This means z. For example, if the bit count of the redundant information is sufficient to correct a single bit error in a data word or block, the operability of the application can be maintained only as long as no more than one bit error in the data word concerned or block occurs. Once a second bit error occurs, no correction is possible and the application must be terminated as described above.

Memory errors, however, tend to occur more often. That is, the probability of occurrence of an error in a memory bit is not the same everywhere, but is particularly high in the environment of an already existing error. To ensure reusability of the memory, even if a large number of bit errors occur close to each other, a large amount of redundant information is needed, which increases the required memory space and consequently the cost of the memory array.

Advantages of the invention

The present invention provides a method for operating a writable data memory or a memory arrangement having such a data memory, which makes it possible to ensure a high degree of availability of the data memory while keeping the space required for storing redundant information low.

The advantage is achieved in that, together with a data word, the redundant information associated with this data word is read from the data memory, the redundant information is used to check whether the data word is faulty, and if it is erroneous, the data word is not only corrected, but also to a new address in a free area of the data store. is written. Since a correct version of the data word is thus again present at the new address, any future errors occurring in this address can be corrected in the maximum number possible based on the redundant information. The reliability of the data memory is therefore not affected by the occurrence of individual bit errors as long as there is free memory area in which the contents of defective memory cells can be moved. Since, in most cases, the new address will be far from the original address of the misrecognized data word, the likelihood of further bit errors occurring at the new address is less than the original one, further improving security.

Conveniently, the reading order of the data words in the data store is altered to access the new address for reading the data word. This is particularly necessary if the data word represents a program instruction that must be executed in a predetermined relationship with other instructions.

In order to modify the reading order, at least one data word preceding it in the reading order may be written into the free area of the data memory together with the corrected data word so as to provide a reference at the original memory location of the latter. a jump command to be able to accommodate its new storage space.

After the corrected data word, a reference to a memory location can be written in the free area follows the original location of the corrected data word.

Alternatively, it is possible to create the free area into which the corrected data word is written, in an address range following the address of the data word identified as defective, by shifting the contents of memory cells whose addresses follow those of the data word recognized as being defective become.

Of course, instead of shifting the memory cells following the data word recognized as defective to create the free area, this can also be created by shifting the contents of memory cells whose addresses precede those of the data word identified as being defective In this case, a reference to a memory location following the original memory location of the corrected data word is written to the free area following the corrected data word.

In both cases it is expedient if the displacement of addresses far away from the address of the data word recognized as erroneous to its neighboring addresses proceeds progressively, so that data words outside of the memory do not have to be buffered at a location at which data loss, e.g. by turning off the one data processing system using the memory device according to the invention is possible.

For the same purpose, the displacement preferably comprises the copying of a data word from an original adapter. return to a new address, followed by overwriting the original address with another data word after copying. This ensures that at any time each data word is present at least once in the memory.

If the set of data words contains a reference to a data word that has been moved to the free area, ie in the case of program instructions, for. If, for example, a jump instruction is used for this data word, this reference should be determined and adapted to the new address of the data word.

If a shift of data words takes place before or after the data word recognized as erroneous, references to displaced data words in the non-shifted data words and relative references to non-displaced data words in the displaced data words should also be adapted to the shift, in order to continue to execute correctly the program instructions.

Because of the increased likelihood of errors occurring in close proximity to each other, it is always useful to check whether the data word recognized as erroneous is part of a block of multiple erroneous data words and, if necessary, to correct the entire block and write to the free area ,

Further features and advantages of the invention will become apparent from the following description of embodiments with reference to the accompanying figures. characters

1 shows a block diagram of a data processing system according to a first embodiment of the invention;

Fig. 2 illustrates the allocation of a program memory of the data processing system of Fig. 1 in which an error has occurred;

3 illustrates the allocation of the program memory after correction of the error according to a first embodiment of the method;

4 illustrates the memory occupancy during the correction according to a second embodiment of the method;

FIG. 5 illustrates the occupation after the correction according to the second embodiment; FIG. and

6 shows a block diagram of a second embodiment of the data processing system according to the invention.

As an example of a data processing system according to the invention, FIG. 1 shows a motor vehicle control unit as a block diagram. It comprises a processor 101, a flash memory 102, in which instructions of an application program to be executed by the processor 101 are stored, a memory monitoring circuit 103 associated with the flash memory 102, a read-write memory 104 as well various sensors 105 and not shown actuators for detecting or influencing operating parameters of a motor vehicle engine. The components 101 to 105 communicate via a common data and address bus 106. The width of the data bus may be 16 bits, for example. The number of bits of the memory cells of the flash memory is greater, it is here, for example 16 + 3 bits, with a 16-bit data word each containing a processor 1 to be processed by the program statement and the remaining 3 bits z. B. redundant information obtained by Reed-Solomon encoding of the data word, which allow the memory monitoring circuit 103 to detect the presence of a bit error in the data word.

The memory monitoring circuit 103 is connected to an interrupt input 107 of the processor 101 in order to trigger an interrupt of the processor 101 when an error in a data word of the flash memory 102 is detected. This high-priority interrupt breaks the application program, and the processor 101 reads the redundant bits to the data word recognized as erroneous, and performs decoding to correct the data word erroneously output from the memory 102, and carries the address at which the erroneous data word was read in a table. Subsequently, the application program is continued on the basis of the corrected data word.

Program instructions to be executed by the processor 101 in the event of an interrupt issued by the monitoring circuit 103 may be stored in the flash memory 102 as the application program. In this case, since the triggered by the monitoring circuit 103 interrupt is no longer executable, if the error or another error is in the program instructions of this interrupt, alternatively, another read only memory 108 may be provided for the program instructions of the interrupt, which unlike the flash memory 102 does not have to be overwritten by the processor 101 and the probability that a stored bit is erroneous is less than that of the flash memory 102.

Fig. 2 shows schematically the use of the flash memory

102. The figure shows 16 memory cells, it being understood that the number of memory cells and the program instructions stored therein is many times greater in practice. To illustrate the invention, it is now assumed that of the 16 memory cells of the flash memory 102 shown, the cells 0 to 10 are occupied with program instructions Instrl to Instrll of an application to be executed by the processor 101, and that the remaining memory cells 11 to 15 are unoccupied. In the cells 6, 7 in each case a bit error has occurred, symbolized by italic inscription Instr7 or Instrδ.

According to a first embodiment of the method according to the invention, the processor 101 reads the program instructions in the flash memory 102, insofar as they do not contain jump instructions, in the order of ascending addresses. If the monitoring circuit 103 detects no error in the read program instructions, they are executed as read by the processor 101. If the monitoring circuit 103 recognizes a program instruction as faulty, that is to say for the first time with the instruction Instr7 in the case shown in FIG. 2, the monitoring circuit 103 outputs the above-mentioned te high-priority interrupt request to the processor 101, which causes them to carry out the correction of the incorrectly issued by the flash memory 102 instruction itself from the associated redundant information.

During execution of the high-priority interrupt, a second interrupt is triggered whose priority is lower than that of the first interrupt and also as the particular time-critical portions of the application program and which causes the processor 1 to correct the contents of the flash memory 2. This correction does not have to take place immediately after the error has been detected in the flash memory, since the system continues to run, as described above, correcting the error in each case in real time. Related to the specific application example of an engine control unit, this means that a correction to the contents of the flash memory 2 does not have to be made immediately after detection of the error, but can be postponed until an interruption of the application program required for error correction can be made safely, for. B. when the vehicle, in the wake of a motor control or in an IdIe task.

After the processor 1 has executed the corrected instruction Instr7, it addresses the Instrδ instruction, which in the present example is also assumed to be erroneous. The procedure described above is repeated: the error is corrected during a short-term interruption of the application program on the processor 1, the corrected instruction is executed, and the second interrupt is triggered with which the erroneous instruction is to be corrected later.

If at a later time a low prioritized part of the application program is executed, i. If the application program can be interrupted long enough to execute the second interrupt and correct the errors found in flash memory 102, the high-priority interrupts triggered on each error encountered will result in a list of failed memory cells. In the example case considered here, this comprises the memory cells 6 and 7 with the instructions Instr7 and Instrδ.

According to a first embodiment of the method according to the invention, in execution of the second interrupt, the processor 1 writes to the first free memory cell of the memory 102, in the present case the memory cell 11, the instruction Instrβ immediately preceding the instructions of the faulty memory cells 6, 7 corrected instructions Instr7 and Instrδ to the subsequent memory cells 12, 13 and a jump instruction to the following on the defective cells cell 8 in the memory cell 14. The instruction Instrβ in cell 5 is overwritten with a jump order to the cell 11.

The defective memory cells 6, 7 no longer need to be accessed. Also, since the content of these memory cells has been corrected before being transferred to the cells 12, 13, an error occurring in these new cells can be corrected in the same manner as described above if there is enough free space available.

A second embodiment of the method will be explained with reference to FIGS. 4 and 5. As the initial situation, it is assumed that, as shown in FIG. 3, the memory cells 6, 7 are defective. In order to take the defective memory cells out of service, n = 3 memory cells are needed. The number n is always greater by 1 than the number of consecutive defective cells because an extra cell is needed to accommodate a jump instruction therein. First, the processor 101 copies the n most recent instructions of the application program including the associated redundant information from the memory cells 8 to 10 into new, previously unoccupied memory cells 11 to 13, and the memory cells previously occupied by these instructions are released for rewriting. The released memory cells are respectively overwritten with the contents of the n preceding memory cells, which in turn are enabled. This is repeated until the defective memory cells 7, 8 and the immediately preceding memory cell 6 have been read and transferred to the subsequent memory cells, in this case cells 8 to 10. As described above for the application, a correction of the instructions read from cells 6 and 7 is carried out automatically under the control of the high-priority interrupt, so that cells 9 and 10 correct the instructions Instr7, Instrδ and the associated redundant information Form included. The memory cell 5 is now overwritten with a jump instruction to the new address of the instruction Instrβ, the cell 8. The method described with reference to FIGS. 4 and 5 assumes that a free memory area is present following the memory cells occupied by the application program, so that the totality of the instructions following the faulty memory cells can be shifted to higher addresses , Of course, there is also the analogous possibility of providing free memory cells before the cells occupied by the instructions of the application program and, in the case of an error, of shifting instructions whose address is lower than that of the defective cell or cells to lower addresses.

In practice, an application program has jump instructions in large numbers. In order to ensure that the jump instructions remain correctly executable, it is necessary to identify them under the instructions of the application program and to correct them if necessary. In the case of the embodiment of the method explained with reference to FIG. 3, it is only necessary to correct jump instructions in the intact memory cells if they have the memory cells 6, 7 identified as defective as targets. Jump instructions to which this applies are replaced by corresponding jump instructions to the cells 12, 13.

In the case of the refinement explained with reference to FIGS. 4, 5, in addition to the jump instructions directed directly to the faulty cells 6, 7, further more must be corrected. For absolute jump instructions, ie jump instructions which have a program counter reading as an argument, it is checked whether this program counter reading is above or below the first faulty memory cell, in this case cell 6. If the destination is under- half, the jump command remains unchanged, it is above, it is increased by n. In the case of relative jump instructions, ie those whose argument is to be added to the current program counter reading in order to obtain the jump destination, it is checked whether the jump instruction and its jump destination lie on the same page or on different sides of the faulty memory cells. In the former case no correction is required, in the latter case the jump distance is increased by n.

Since the method of the invention does not require correction of a detected error in the flash memory 102 immediately after detection, but the correction can be deferred until an appropriate time, the method is well compatible with real-time applications that determine within given time limits Have to fulfill tasks. A delay resulting from the decoding of the contents of a faulty memory cell may nevertheless be disturbing for such an application. In order to minimize the likelihood that such a correction will be required, it may be expedient to successively read the program instructions stored in the flash memory 102 in a start-up phase of the application in which no strict real-time requirements have yet to be met To detect memory errors. If no memory error is detected, the application can then operate normally; however, if there is a memory error, it is possible to correct it before the real-time requests become stringent. With reference to the exemplary embodiment of an engine control unit, this means, for example, that a check for defective memory cells is always carried out when a user eg by turning on an ignition key expresses his desire to start the engine, and that an actual start of the engine is controlled by the engine control unit only after, if necessary, faulty storage cells have been corrected.

It is also expedient to carry out an operation in the wake of the control unit, i. in a limited period of time after the engine has been switched off, in which the control unit still remains active.

A second embodiment of a data processing system, which offers a further increased reliability compared to the embodiment of FIG. 1, is shown in FIG. In addition to the components described with reference to FIG. 1, this data processing system comprises a second processor 111, which is capable of accessing the flash memory via the bus 106 shared with the processor 101 or else via a second, own bus 102 of the processor 101. The processor 111 is a second one

Associated with flash memory 112 containing an application program for the processor 111. While in this embodiment, the memory monitoring circuit 103 associated with the flash memory 102 is connected to the processor 101 only to temporarily interrupt it in the event of an erroneous output of the flash memory 102, it triggers an interrupt at the second processor 111 which causes it to decode the erroneously output data word, to pass a corrected data word to the processor 101 and to note the address of the erroneous data word in a list and to trigger a second interrupt which, at a suitable later time, causes the cor- rectification of the memory 102 based on the list in an analogous manner as described above with reference to FIG. 3 or on Fig. 4, 5 described. In a symmetric manner, the processor 101 processes interrupts, which trigger a memory monitoring circuit 113 due to an error in the flash memory 112 of the second processor 111. Errors that occur in the instructions of the first interrupt in one of the two memories 102 or 112 can no longer cause the system to crash, since they are corrected by interrupt instructions stored in the other memory.

In the embodiments described above, the second interrupt may in each case be handled by the same processor 101 or 111, which has also handled the first interrupt. It is also conceivable, however, to have it treated by an external processor connected to the data processing system of FIG. 1 or FIG. 6 via a network connection, a mobile radio connection or the like. communicated.

Another possible modification is to design the monitoring circuit 103 to perform not only the detection of an error in a data word output from the memory 102, but also its decoding and correction without resorting to the processor 101 associated with the memory 102. The temporary interruption of the processor 101, which is required to prevent it from accepting a data word incorrectly output on the bus 106, can take place here in that the monitoring circuit 103 interrupts a clock signal supplied to the processor 101 as long as it requires. in order to correct the instruction erroneously output from the memory 102 and in turn to output it correctly to the bus 106. A failure the decoding as a result of an incorrectly stored in the memory 102 interrupt instruction is also excluded here. This refinement has the advantage of being able to correct errors not only in an instruction memory but also in a parameter memory.

The invention is also applicable to other types of data memories. Thus, as memory, e.g. a hard disk is used, on which the payload data is stored blockwise together with each block associated redundant information and in the event that based on the redundant information, an error is detected, the affected block is corrected, stored at another location of the hard disk surface and a block which, in the reading order of a file to which the blocks belong, precedes the erroneous block is referenced to the new location of the corrected block. The corrected block, in turn, may be referenced to a block subsequent to the reading order, so that the blocks may continue to be read in sequence even though they are not recorded locally contiguous on the disc surface.

Claims

R. 312169Patentansprüche

A method of operating a writable data memory (102) containing a set of data words (1-16) to be read in a read order and redundant information comprising, together with a data word (Instrl, ..., Instrll), that data word associated redundant information is read and is checked on the basis of redundant information, if the data word is incorrect and, if it is incorrect, the data word (Instr7, Instrδ) is corrected, characterized in that the corrected data word (Instr7, Instrδ) to a new Address (12, 13, 8.9) is written in a free area of the data memory (102).

2. The method according to claim 1, characterized in that further the reading order is changed to access to read the data word to the new address.

3. The method according to claim 2, characterized in that together with the corrected data word (Instr7, Instrδ) at least one preceding him in the reading order data word (Instrδ) is written in the free area of the data memory (102) and to the original memory location (5 ) of the at least one preceding data word (Instrβ) a reference to its new memory location (11) is entered.

4. The method of claim 2 or 3, characterized in that in the free area after the corrected data word (Instrδ) a reference to the original memory location (7) of the corrected data word (Instrδ) subsequent memory location (8) is written.

5. The method according to claim 3, characterized in that after detection of a data word (Instr7, Instrδ) as faulty the free area in a following to the address of the identified as incorrect data word address range (8, 9, 10) is created by the contents of memory cells (8-11) whose addresses follow those of the data word (Instr7, Instrδ) recognized as being defective.

6. The method according to claim 2, characterized in that after detection of a data word as faulty the free area in one of the address of the recognized as erroneous data word address range is created by the contents of memory cells whose addresses of the recognized as erroneous data word preceded by, and that in the free area following the corrected data word, a reference to a memory location subsequent to the original memory location of the corrected data word is written.

7. The method according to claim 5 or 6, characterized marked, that the displacement of far from the address of the data word detected to be erroneous data is carried out progressively to their closely adjacent addresses.

8. The method of claim 5, 6 or 7, characterized in that the shift comprises copying a data word from an original address to a new address and overwriting the original address with another data word after copying.

9. The method according to any one of the preceding claims, characterized in that the data words include program instructions, and in the set of data words references to each data word written in the free area are adapted.

10. The method according to claim 9 and one of claims 5 to 8, characterized in that in the non-shifted data words absolute and relative references to shifted data words and in the shifted data words relative references to non-shifted data words are adapted to the shift.

11. The method according to any one of the preceding claims, characterized in that it is checked whether the recognized as a defective data word (Instr7, Instrδ) is part of a block (6,7) with several erroneous Datenwör- tern and the entire block (6,7 ) and written in the free area.

12. Memory arrangement with a writable data memory (102), means for detecting (103) and correcting (101, 103, 111) an error in a data word read from the data memory (102), characterized in that it comprises means (101 111) for storing the corrected data word to a new address in a free area of the data memory (102).

A data processing system comprising a memory arrangement according to claim 12, characterized in that it comprises a first and a second processor (101, III), that the data memory (102) contains program instructions to be executed by the first processor (101) and that the second processor ( 111) forms the means for storing the corrected data word at the new address.