GB2220091A - A memory error protection system - Google Patents

Abstract

A memory error protection system which can be used with a plurality of memory banks (M1, M2) each containing a plurality of DRAM devices, includes a memory control unit (top right); a pair of parity generators and checkers (GC1, GC2) which are associated with respective memory banks; a pair of bus isolators (B11, B12); and a data comparator (DC). Errors between bits of information stored in corresponding memory devices of the memory banks are detected and switching between memory banks can be achieved in order to ensure that only the correct data is output onto a memory data highway (MH). The memory error protection system is also capable of selecting appropriate levels of protection and switching between them, as required. The system can also be used to detect address violations, un-initialised variables or particular variable values (or ranges). <IMAGE>

Description

"A memory error protection system" The present invention relates to a memory error protection system primarily for use with dynamic random access memories (DRAM).

Modern memory systems can contain tens of millions of binary digits (bits) of information within a small number of memory devices (e.g. 10) at low cost. Due to the internal construction of these devices, each bit cell is susceptible to interference from stray electro-magnetic particles (e.g. alpha particles) and other sources of energy, both man made and natural.

This potential error generating problem is compounded in modern systems due to the large number of bits available, and the lower energy level required to upset any bit cell compared to that needed with earlier devices.

Computer systems are already known which use banks of dummy cells, one or more of which can be brought into operation in the event of failure of one or more of the memory cells in the main array.

Also well known are various types of "voting" schemes. The triple "voting" scheme for example parallels up the operation of the processors, logic and/or memory subsystem. The data is judged to be correct by a 2 to 1 majority. However, with this triple voting system only one bit error can be corrected at a time.

It is an object of the present invention to provide a memory error protection system which is capable of providing excellent protection at a relatively low cost compared with the known systems.

In its broadest aspect there is provided according to the present invention a memory error protection system for use with dynamic random access memories, said system including: at least two parallel memory banks; means for detecting an error between bits of information stored in at least two corresponding memory devices of the parallel memory banks; and means operable from the error detection means to switch between different memory banks in order to ensure that only the correct data is output onto a memory data highway.

The levels utilized in the above system are broadly as follows: Level 1. Byte Parity single bit error detection; Level 2. Double Redundancy (two copies of data and parity stored) single bit error correction, two bit ; error detection; Level 3. Quadruple Redundancy (four copies of data and parity stored) - four bit detection, three bit correction (not verified).

This type of memory error protection system is thus capable of selecting appropriate levels of protection required, each higher level of protection successively utilizing more memory storage as a trade off for increased level of protection.

In one preferred form there are two parallel memory banks. This provides a dynamically configurable system using a single duplicate store and parity which operates in the level 2 mode.

In another form there are four parallel memory banks, thus extending the system to a unique quadruple redundant system to give better fault coverage than with the triple voting system with parity referred to above.

It will be appreciated that the parity bit is, itself, a kind of syndrome derived check bit (a very simple one). The above system is thus combining straightforward redundancy and a syndrome check bit for each bank. In practice byte parity can be utilized to give two check bits per 16 words (i.e. each bank is 16 bits wide). One reason for doing this is because the central processor can separately read and write 8 bits at a time independently of the other half of the 16 bit word.

The means for detecting an error between bits of information stored in parallel memory banks, may comprise at least one comparator. In the case where there are n memory banks storing bits of information in parallel, there may be n-l comparators.

The means operable from the detection of an error between bits may comprise a plurality of bus isolators (or alternatively multiplexors and de-multiplexors),. each provided in a data highway between the main data highway and respective memory banks, said isolators being controlled from a control unit which is itself controlled from outputs of parity generators and checkers associated with the respective memory banks in addition to the outputs from the one or more comparators.

Additional protection may be provided by at least one plug-in module.

The present invention will now be described in greater detail by way of examples with reference to the accompanying drawings, wherein: Fig. 1 is a block diagram of one preferred form of memory error protection system providing level 2 protection; and Figs. 2A and 2B are is a block diagrams of another preferred form of memory error protection system providing level 3 and level 2 protection.

Referring first to Fig. 1, the memory error protection system for use with memory banks M1 and M2 each containing a plurality of DRAM devices, includes: a memory control unit MCU; a pair of parity generators and checkers GC1 and GC2 associated with respect memory banks M1 and M; a pair of bus isolators BI1 and BI2 and a data comparator DC.

The memory control unit MCU has input terminals I1, 12, I3, I4, I5, I6, I7 and output terminals 01, 02, 03, 04, 05 and 06, on which the following information is input to or output from the unit.

11 - Read/write input I2 - Memory select input I3 - Protection mode input I4 - Memory bank select input I5 - Parity generator and checker GC2 input 16 - Parity generator and checker GC1 input I7 - Data comparator DC input 01 - Status output 02 - Status output 03 - Isolator BI2 enable output 04 - Isolator BI2 direction output 05 - Isolator BI1 enable output 06 - Isolator BI1 direction output Bus isolators BI1 and BI2 are located in respective data highways DH1 and DH2 which are branched off a main memory data highway MH. The data comparator DC is connected between the two data highways DH1 and DH2.Each memory bank has two way communication with its respective parity generator and checker whose outputs are connected to respective inputs I6 and I5 of the memory control unit MCU The above described memory error protection system is treated as being two banks of memories with independent internal data highways. When functioning at level 1 implementation each bank is randomly accessible from the main memory, thus all memory capacity is available for external use. The comparator circuit DC is disabled. When level 2 protection is selected, one memory bank (bank M2) becomes a redundant store for memory bank Ml. Thus whenever a write to memory bank M1 occurs, the memory control unit MCU also arranges for the memory M2 to be written simultaneously with the same data.

When a read cycle is made to memory bank M1, the memory control unit MCU arranges to simultaneously read memory bank M2, but does not allow its data on to the main highway. Memory bank M1 and memory-bank M2's data are compared by the data comparator DC and the result of this comparison, together with the respective parity compare signals from the circuits GC1 and GC2 are used to determine what action is necessary by the memory control unit as will be evident from Table 1 given below.

Table 1 Parity Compare Parity Compare Comparator Action and Memory Bank Ml Memory Bank M2 Result Error Type.

Good Good Same No Action (No error).

Bad Good Difference Correctable Error (1 bit error) Bank 2 is assumed correct.

Good Bad Difference Correctable Error (1 Bit error) Bank 1 is assumed correct.

< -----------Any Anyother Combination----------- > Indeterminate Error (fatal error) cannot guarantee correction or diagnosis.

It should be noted that three or more bits in error produce an unpredictable action. For correctable errors, only, the appropriate memory bank which has been deduced as having the correct data, is selected onto the memory data highway MH, via the appropriate bus isolator.

Depending on memory access cycle times, it is possible to implement this scheme without slowing down any memory access cycles compared with a system without this protection mechanism. In fact this scheme is a potentially faster method than many conventional syndrome derived correction methods.

It should be noted that the actual decision to switch between levels, is effected by the supervisory program running on the central processor which selects the operating mode by setting some bits to the appropriate level in the output port. These bits drive signals which enter the memory control unit MCU. However, it is also possible for the protection mode to be switched by interpreting the memory address and other control signals output by the central processor and/or memory control unit for each memory cycle access by utilizing some other hardware, in addition to overall control by means of a program.

The memory control unit MCU is also responsible for:- (a) Informing the central processor of the nature of the error immediately after the read cycle has occurred.

(b) Depending on the implementation, it is a simple matter for the control circuit to arrange for the 'good' data (which is available on the memory data highway) to write back simultaneously with the CPU read cycle to the incorrect bank, thus permanently repairing the fault condition.

(c) As an alternative, since all memory is physically accessible by the central processor, it may be given to the processor to repair the fault by performing a similar operation to that described above using an exception handling sub-programme. Alternatively the fault may not need to be repaired at all at that time, since the correction mechanism will function for every read of the 'bad' data location.

It will thus be appreciated that the embodiment described in Fig. 1, is capable of switching between levels 1 and 2.

Referring now to Figs. 2A and 2B, the memory error protection system disclosed in this embodiment is capable of switching between levels 1, 2 and 3 and is thus a logical extension to the embodiment shown in Fig. 1. As shown the system utilizes four memory banks M1 to M4, three data comparators DC1 to #DC3, four bus isolators BI1 to BI4 and four parity generators and checkers GC1 to GC4, as well as. a memory control unit MCU which provided with additional inputs and outputs to the various circuits as appropriate.

The memory control unit MCU has input terminals ; I1-I13 and output terminals 01-011 on which the following information is input to or output from the unit.

Il - Read/write input I2 - Memory select input I3 - Bank high input I4 - Bank low input 15 - Protection mode input I6 - Protection mode input 17 - Parity generator and checker GC4 input IS - Parity generator and checker GC3 input I9 - Parity generator and checker GC2 input I10 - Parity generator and checker GC1 input Ill - Data comparator DC3 input I12 - Data comparator DC2 input I13 - Data comparator DCl input 01 - Status output 02 - Status output 03 - Status output 04 - Isolator BI4 enable output 05 - Isolator BI4 direction output 06 - Isolator BI3 enable output 07 - Isolator BI3 direction output 08 - Isolator BI2 enable output 09 - Isolator BI2 direction output 010 - Isolator BI1 enable output 011 - Isolator BI1 direction output The inputs/outputs on the left hand side of the memory control unit MCU all correct with the various circuits of Fig. 2A listed above. The inputs/outputs on the right hand side of the memory control unit MCU originate from the central processor and its associated address decoder.

The four memory banks M1 to M4 may be configurated in the form set out in Table 2 given below.

Table 2 Memory Memory Memory Memory Configuration Effective Bank 4 Bank 3 Bank 2 Bank 1 Memory Size Parity Parity Parity Parity Four banks of Total memory Only Only Only Only Level 1 capacity of 4 Parity Parity Level 2 Level 2 Part level 2 Total memory Only Only part parity capacity of 3 Level 2 Level 2 Parity Parity Part level 2 Total memory Only Only part parity capacity of 3 Level 3 Level 3 Level 3 Level 3 All Level 3 Total memory capacity of I Level 2 Level 2 Level 2 Level 2 Two banks of Total memory Level 2 capacity of 2 Referring to the above Table 2, it will be seen that in the level 3 mode, a write cycle to memory bank M1 is duplicated to the other three memory banks simultaneously. On reading, a three way comparison takes place by means of the data comparators DC1 and DC3.This information along with the individual parity information supplied by the respective circuits GC1 to GC4, determines which data is selected onto the main data highway MH by means of the selection of the appropriate data isolator DI1 to DI4 through the memory control unit MCU.

Under certain error bit circumstances it may be necessary for the memory control unit MCU to make further comparisons between other pairs of memory banks. This action may delay the overall read cycle, since the main data highway is used as a common source for one half of the comparison under this circumstance. The delay can be reduced by modifying the circuit to utilize a greater number of comparators. The circuit can be arranged to perform a write back operation as described previously.

It will be appreciated the level 3 quadruple redundant scheme gives improved error coverage when compared to conventional triple voting schemes as used in some computer systems. The whole system is inherently configurable for any level of protection, unlike the dedicated triple voting system.

As shown in Figs. 2A and 2B, the level 3 protection system may be provided as a plug-in module to the level 2 protection system disclosed in Fig. 1 embodiment.

In addition, one may build-in or plug-in additional modules to provide even higher levels of protection should this prove necessary in the future.

It will be appreciated from the above description that the memory error protection system provides a great deal of flexibility of operation. Thus by utilizing appropriate control signals the memory system may be operating at any one of the three levels and may be changed while the system is in operation. Thus the system can either maximize on DRAM capacity available to the system, or data integrity. It is normally also necessary to change level when the processor is performing certain sections of- the error recovery and initialize operations.

It may prove desirable in some systems to connect the protection level signals to part of the central processor units's (CPU) address decoding and control circuitry. This would permit for example only part of a pair of memory banks to be used as level 2 store, the rest being used at level 1. When used in conjunction with a memory management unit (MMU) for translating logical to physical memory space addresses, the memory mapping for the different protection modes could be organised so as to ease the dislocation in physical memory address space caused by the address derived protection level operations.

The overall system can make use of any data bus widths, but would typically apply from 8 to 64 bits wide.

The basic level 2 system described above with reference to Fig. 1 is cheap to produce in terms of extra control logic since most computer systems have their memory devices arranged in banks as shown, and it is common practice to include parity protection circuitry even in low cost machines. It is therefore simple to provide in a design and may never be utilized since the second bank can be utilized as a conventional level 1 store.

However, if the level 2 facility is enabled, the system is potentially faster than its syndrome derived counterparts.

Finally, the level 3 system described with reference to Figs. 2A and 2B will achieve better results than the standard, or standard and parity triple voting g system.

Two applications for the memory error protection system are as follows: Application (1): One form of usage is to generate an error signal (e.g. a CPU interrupt or a bus error condition) whenever certain address locations are accessed by the processor (or other bus masters). This address violation facility can be used to check that the program under development/test is conforming to its specification for only accessi#ng memory 'belonging' to it.

With a level 2 system this is accomplished by using the second bank of memory (i.e. the image) not to store redundant copies of the data in the first bank but to store control data which is coded such that a suitable control program (or additional hardware) can interpret the legal status of an access to the primary (first) memory bank. The second bank is initially switched into a special mode whereby it is not written in parallel with the first bank as in normal level 2 operation, but is always read at.

the time a read or a write cycle is taking place to the first bank. The result of the read to the second bank enables the control hardware to check if an address error signal should be generated. The error signal could be simply induced in a conventional level 2 system by forcing an incorrect parity bit for the byte(s) corresponding to the protected address(es) in the second memory bank. Since the processor has direct access to bank 2 (by switching to mode 1 operation) a master control program can easily set up the addresses it wishes to protect in advance of running the program under test.

With a small additional amount of hardware the content of each control byte stored in the second bank could be compared with the cycle's access mode (e.g. Read, Write, Supervisor Program, Supervisor Data, User Program etc) and a more selective error signal could be determined. Of course without this additional comparator hardware the error signal is less selective, but the processor can itself under control of the error interrupt program go and check the access type against the allowable range coded into the byte of bank 2. This assumes that the processor can save its current cycle status on receipt of the error signal (so that it has both values to compare). For instance a Motorola M68000 Processor can do this by use of the bus error signal input. Alternatively, a latch can be provided in hardware to store the control signals existing at the time the access was made.This is then used by the error handling program to determine if the access was permissible.

The basic address catching capability of the above idea is possible within the scope of level 1 (by using the 'parity' bit of bank 1 as the access control flag to generate the address error signal) - no control byte is possible and normal parity operation would be disabled.

The level three system may use its four redundant memory banks as follows: Bank 1 and Bank 2 and Bank 3 - Normal redundant operation utilizing triple redundan'cy and parity.

Bank 4 - Control information for address error generation parity bit is used as acces control flag.

In fact the above configuration would be suitable for production unit as well as for program development to further enhance the integrity of the overall system, by providing address access monitoring in addition to a triple redundancy store.

The above permutated idea can be applied to level 2 by using banks' 2 parity bit as the access violation flag whilst still maintaining redundant data in bank 2 (instead of control bytes) and enabling normal parity operation in bank 1. There is some loss of data integrity since parity is no longer held for bank 2, thus only single bit error detection and correction is possible; not double bit detection as before.

Returning to the level 3 system with 4 banks of memory, an alternate configuration may be to utilize bank one for normal level 1 operation and use the other 3 banks to generate individual parity errors depending on the cycle type. For instance bank 2 could be set to signal an error on an access when a processor user#program write occurs, bank 3 could signal when a user program read occurs and bank 4 could signal when a non CPU access occurs. This configuration has the advantage that it would not require much extra hardware to implement since bank 2,3,4 are only making alternate use of the 'parity' bit for error generation.

Application (2): One common problem facing software developers is in the use of program variables which are un-initialized (i.e. they are incorrectly used by the program before they are set to an initial value). These program errors can be apparent quickly or, can take a long time (e.g. months) to appear. This is because the value they may initially hold is arbitrary, and depends on the history of that memory location (i.e. what it was last used for by this or another program).

The level 1, 2 and 3 system can provide a simple way to detect these un-initialized variables at run-time.

The basic solution uses no extra hardware since it uses the inherent self-test capability of the system.

To implement this application the programmer simply uses a control program to initially set the parity bits of the locations used to hold the program variables to an incorrect value (by using the systems self-test mode allowing the parity to be set inverted to that of normal operation). When the program under test runs under normal level 1, 2 or 3 operation, any write to the program variable area will re-set the appropriate parity bit to the correct value, thus any subsequent read will not create a parity error (unless a real parity error occurs). Un-initialized variables are read before they are written to, therefore a program read to one of these locations will generate a parity error.

The program developer can then use this error information generated by the system to display the location of the variable, and with a suitable processor (such as the Motorola M68000) also display the location in the program (the program counter) that accessed the un-initialized variable, (alternatively additional hardware can be used to capture this extra information if it is vital).

An extension to this principle is possible in level 2 and level 3 modes of operation which would allow the developer to detect a condition either when a variable reaches a certain value or becomes not equal to a predetermined value (upon reading by the program). This is by means of the data comparison logic built into the level 2 and 3 systems. The level 3 system having 4 banks of memory could by suitable arrangement of comparators allow the selective detection of ranges of values and accessing modes, for example: Bank 1 - normal program/variable store Bank 2 - lower limit values Bank 3 - Upper limit values Bank 4 - Access mode permissions (e.g. Supervisor/User) This application of the level 3 system would typically be of use in specialized development equipment such as in-circuit emulators, but also could be implemented in a conventional level 3 computer at very little cost increase over the basic system, especially if the control and comparator logic could be implemented in semi-custom IC form.

Claims (11)

CLAIMS:

1. A memory error protection system for use with dynamic random access memories, said system including: at least two parallel memory banks; means for detecting an error between bits of information stored in at least two corresponding memory devices of the parallel banks; and means operable from the error detection means to switch between different memory banks in order to ensure that only the correct data is output onto a memory data highway.

2. A memory error protection system according to claim 1, wherein means are provided to select between different levels of protection.

3. A memory error protection system according to claim 2, wherein the levels of protection utilized are: Level 1. Byte Parity single bit error detection; Level 2. Double Redundancy (two copies of data and parity stored) single bit error correction, two bit error detection; Level 3. Quadruple Redundancy (four copies of data and parity stored) - four bit detection, three bit correction (not verified).

4. A memory error protection system according to claim 1, wherein there are two memory banks.

5. A memory error protection system according to claim 4, wherein a data comparator is provided between data highway associated with respective memory banks and two parity generators and checkers are associated with respective memory banks and connectable to a memory control unit which determines what action (if any) is necessary as a result of the comparison by the comparator and the outputs of the two parity generators and checkers.

6. A memory error protection system according to claim 5, wherein two bus isolators are provided in respective data highways between a main data highway and respective memory banks.

7. A memory error protection system according to claim 1, wherein there are n memory banks, n being an integer greater than 2.

8. A memory error protection system according to claim 7, wherein n-l data comparators are provided between data highways associated with adjacent memory banks, and n parity generators and checkers are associated with respective memory banks and connectable to a memory control unit which determines what action (if any) is necessary as a result of the comparison by the n-1 comparators and the outputs of the n parity generators and checkers.

9. A memory error protection system according to claim 8, wherein n bus isolators are provided in respective data highways between a main data highway and respective memory banks.

10. A memory error protection system according to any one of the preceding claims 7 to 9, where n = 4.

11. A memory error protection system constructed substantially as herein described with reference to and as illustrated in Fig. 1 or Figs. 2A and 2B of the accompanying drawings.