WO2001098872A2

WO2001098872A2 - A method of checking eeprom data with an embedded crc

Info

Publication number: WO2001098872A2
Application number: PCT/US2001/041063
Authority: WO
Inventors: Samuel E. Alexander; Ronald D. Salesky
Original assignee: Microchip Technology Incorporated
Priority date: 2000-06-22
Filing date: 2001-06-20
Publication date: 2001-12-27
Also published as: TW509840B; KR20020063159A; EP1295140A2; AU2001273605A1; CN1436308A; WO2001098872A3; JP2004501466A

Abstract

A method and apparatus for determining the integrity of data stored in a PROM device provides at least one holding latch connected to two sets of blocks. The first set of blocks contains data. The second set of blocks contains CRC information corresponding to the data in the first set of blocks. Upon reading the data from a first data block, the CRC information from the corresponding CRC block is also read. The data read is applied to the CRC algorithm to generate a current CRC value. The current CRC value is then compared to the CRC information obtained from the corresponding CRC block. The two CRC values are identical, the data is considered valid. Otherwise, the data is considered invalid.

Description

A METHOD OF CHECKING EEPROM DATA WITH AN EMBEDDED CRC

The present invention is related to computer memory. More specifically, the

present invention is related to a method and apparatus for checking the integrity of data

stored within an electronically erasable programmable read-only memory (EEPROM).

CRC has been an integral part of the computer industry for many years. The actual

algorithm is available freely on the Internet. A brief introduction to cyclic redundancy

checking (CRC) has been written by Mr. Ruffin Scott of ACI US, Inc. of San Jose,

California. His Technical Note 99-11 can be found at

http://www.acius.com/ACIDOC/CMU/CMU79909.HTM. Another introduction was

written by Mr. Eric-Paul Rebel and can be found at

h1ψ://utopia.lmoware.-nl/users/eprebel/Cornmunication/CRC/. What may, however, be the

best general introduction to CRC was written by Ross Williams at Rocksoft Pty Ltd. It's

called "A Painless Guide to CRC Error Detection Algorithms" which may be found at

ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt. All articles are incorporated

herein by reference.

Different methods exist to calculate a check number for binary data, to be able to

see if the data is not altered, for example, after being sent through some communication

channel. Cyclic Redundancy Check (CRC) is a common method for protecting binary data

that way. Different CRCs exist, which in the past has resulted in a naming scheme.

A CRC generator can be built as a piece of hardware as shown in Figure 1. The

specific generator polynomial is

that is initialized to OxFFFF. For

example, each bit (b) of the binary data is shifted into the CRC register after being XORed with the CRCs most significant bit. This part of the generator ensures the cyclical aspect

of CRC. The XOR result is inserted in CRC bit 5 and 12 too. During the processing of

bit b, all current CRC bits (modified or unmodified) are shifted one position to the left.

If a byte must be processed, all 8 bits must be processed one after another. The most

significant bit is processed first.

One can build a CRC generator in software, that is analogous to the hardware

solution. The solution processes each bit separately. Using the C programming language,

the source code could be:

unsigned short crc = OxFFFF; unsigned short temp; unsigned char byte = 0x5A; //just as an example unsigned short index; for (index = 0; index <= 7; index++)

{ temp = (crc >> 15) ^Λ (byte >> 7) ; crc <<= 1; if (temp) { crc ^Λ= 0x1021;

} byte <<= 1;

}

First, b XOR cl5 (the cyclical value) is calculated. Then the CRC bits are shifted to the left

(cO becomes 0). The cyclical value has to be processed in cO, c5 and cl2. If the cyclical

value equals 1, bits cO, c5 and cl2 are changed at the same moment by XORing the CRC

with value 0001 0000 0010 0001 (0x1021). If the cyclical value equals 0, the CRC should

be XORed with value 0000 0000 0000 0000. XORing the CRC with 0x0000 does not

change the CRC, and therefore it is skipped. Finally the next bit to be processed is

prepared. Read-only memory (ROM) is a simple type of memory with contents that cannot

be changed, even by loss of electrical power. The contents are programmed during the

manufacture and are inalterable afterwards. ROMs are used for very high volume control

applications where simplicity and low per-unit cost, gained from mass producing the

program within the memory chip, are critical.

Other common non-volatile memories are PROMs, EPROMs, and EEPROMs. A

programmable read-only memory (PROM) can be programmed by the user through an

irreversible process; once written, a PROM cannot be changed. An erasable PROM

(EPROM) allows the programming to be reversed by exposure to intense ultraviolet light.

An electrically erasable PROM (EEPROM) is alterable by using a larger current to reset

the internal memory cells. EPROMs and EEPROMs are very useful because they can

survive power losses; however, they can be reprogrammed (written) only very slowly and

for a limited number of times. Further discussion of EEPROMs can be found in

"Nonvolatile Semiconductor Memory Technology, A Comprehensive Guide to

Understanding and Using NNSM Devices" by William D. Brown and Joe E. Brewer (IEEE

Press, Piscataway, ΝJ, 1998), pp. 37-39, 42-47, 67, 115-120, 129-133, 192-193, 309, and

352 and is incorporated herein by reference.

The operation of EEPROMs in a battery or battery-less environment can be

uncertain due to lack of good control of the programming high voltage. Consequently, the

chance of corrupted writing is greater than with well-controlled environments. It would

be desirable to know whether the data that was stored is corrupted. There is, therefore, a

need in the art for a method and apparatus for ensuring the integrity of data stored in a PROM.

The present invention solves the problems inherent in the prior art by providing at

least one holding latch connected to two sets of blocks. The first set of blocks contains

data. The second set of blocks contains CRC information corresponding to the data in the

first set of blocks. Upon reading the data from a first data block, the CRC information

from the corresponding CRC block is also read. The data read is applied to the CRC

algorithm to generate a current CRC value. The current CRC value is then compared to

the CRC information obtained from the corresponding CRC block. If the two CRC values

are identical, the data is considered valid. Otherwise, the data is considered invalid.

Depending upon the conclusion, an appropriate signal is issued.

Other and further objects, features and advantages will be apparent from the

following description of presently preferred embodiments of the invention, given for the

purpose of disclosure and taken in conjunction with the accompanying drawings.

Figure 1 illustrates CRC hardware of the prior art;

Figure 2 is a schematic diagram of the data blocks and CRC blocks of the present

invention;

Figure 3 is a flow diagram of the method of generating CRC values of the present

invention;

Figure 4 is a flow diagram of the method of writing verifiable information

according the present invention; and

Figure 5 is a flow diagram of the method of reading verifiable information

according to the present invention. The present invention applies to PROMs, to EPROMs, and to EEPROMs.

However, the present invention can be used on any memory type where it is desired to

know whether the data contained within the memory is the same as when it was it was

written, or if the data has been corrupted between the time it was written and the time it

was read.

Anti-Tearing Example for Writable EEPROM Based RFID Tags

The Anti-Tearing Problem:

The term anti-tearing refers to the act of tearing an electronic device from its power

source while it is in the middle of an operation. This problem is especially accentuated

with financial or secure transactions done by smart cards or any storage device where the

relevant account data is stored on the card itself and not in a central database. Bank account

data manipulated by ATM cards is stored in a bank database and not on the ATM card

itself. There would be no anti-tearing problem in this case since no data is changed on an

ATM card.

If one does not have a central database but a remotely stored database then certain

safeguards need to be in place to make sure data is received from and written to the

database correctly. These safeguards need to be aware of environmental conditions that are

present during the transaction and also between transactions. If these smart cards are placed

in a wallet or left in a car, they are subjected to pressure, torsion, temperature, shock, and

humidity elements. The integrity of the data contained in such a card cannot be assumed

to be correct after these stresses.

The present invention employs a CRC protection so that a later query of the contents can deteπnine if the data stored is the same as what was written originally or if

it has changed. This concept is widely used by the disk drive sector although it has not

been adopted for programmable read only memories until the advent of the present

invention.

EEPROM Operation:

An EEPROM state (0 or 1) is altered by applying high voltage to it for a certain

amount of time. A high voltage across a thin dielectric causes small amounts of charge to

tunnel through the thin oxide. When enough charge has passed through the oxide, the

resulting voltage change on the floating gate of the EEPROM will cause the digital data

state to be changed. The data state is read from the EEPROM by turning the cell on and

reading the cell current. A negative charge on the floating gate of an n channel cell will

cause no current to flow while a positive charge on the gate will cause current. The point

at which the data changes from 0 to 1 or vice versa is somewhat arbitrary and depends on

the current threshold measured in the sense amplifier.

One other aspect of EEPROM' s is the retention of their data. The charge can only

be retained on the floating gate for a finite amount of time - although this is usually

hundreds of years. For this reason, we would not want to stop programming a cell at the

first instant the EEPROM starts to read the correct value because, at a later time, some

cells may flip their state. Charge loss is accelerated by higher temperature and of course,

each cell will have a different charge loss propensity. Given this phenomenon of how an

EEPROM is programmed, it would be desirable to ensure that the EEPROM is

programmed well enough so that charge loss later in life will not invalidate its data. If a robust progr-imn-iing cycle cannot be guaranteed, then simply knowing at a later time if the

date is invalid or valid would be sufficient. The valid/invalid status is solved with the

present invention.

Wireless EEPROM Operation:

The problem of guaranteeing enough high voltage to program an EEPROM in a

card is made worse when the voltage and operating power comes from an RF field. There

is a convenience advantage of a proximity RF transaction card (herein called a tag) versus

one that requires physical electrical contact. Specifically, one doesn't have to surrender

their card to a machine and hope they get it back. Also, physical contact on the card cause

undue wear and is potentially damaging. The downside of RF transactions is that the field

strength at every point in an RF field is unknown and may be changing over time. A tag's

distance and orientation to the interrogator coil will determine the field strength. A tag may

be just entering or at the edge of the usable RF field. A tag may be moving throughout the

field or it may be leaving the field while trying to transact an operation. It is also possible

that field "nulls" can develop if there are multiple interrogator coils. The RF

environmental uncertainty, therefore, makes it difficult to ascertain whether the high

voltage and time was sufficient for the program operation to complete properly.

The present invention overcomes some of the above problems described above.

While methods to " qualify" a high voltage so that an EEPROM will not fail to program

has been the subject of prior art, those prior art methods do not lead to robust operations.

If one were to perform a pre-check to qualify the high voltage on the die before

programming, there would be no guarantee that the high voltage was sufficient for every cell during programming. The pre-check may work but the high voltage may have lapsed

during programming. Moreover, the pre-check can consume a significant amount of time.

If, for example, one wanted to perform a pre-check and a post-check on the high voltage,

it may help. However, that testing process highlights another uncertainty about the voltage

checking scheme: How do you know that the high voltage level and time were good

enough for a successful program of a particular cell? Because of process variations,

EEPROM cells vary even from bit to bit and the only way to truly know is to read the data

afterward. This has been a known problem on smart card integrated circuits - that of

deciding when the high voltage is good enough for programming. One safeguard of the

present invention is that after a program operation, the RF tag reads the EEPROM contents

back immediately after programming. If the interrogator doesn't get back the correct data

at transaction time, then an alert can sound so the person can be warned that the transaction

did not take place properly. This is fine for an immediate check but how does one make

sure the data read months later is the same as what was written presently? This problem

is solved by the present invention.

Turning now to the drawings. In the present invention, a memory is depicted as

having a data section and a corresponding CRC section for each block as shown in Figure

2. The preferred embodiment of the present invention is an EEPROM memory although

there could be other types of memory in alternate embodiments without departing from the

scope and spirit of the appended claims. Each data block (22, 24, 26, ... 28) has an

associated CRC block (32, 34, 36, ... 38, respectively). Also depicted are holding latches

that hold the data to be written to the memory. These latches are simply for holding the data to be written and are not really pertinent to the method of the present invention. Any

latch or their equivalent are useable with the present invention.

The generation of CRC values is illustrated in Figure 3. First, data 40 is sent

through a CRC calculator 42 which, in turn, generates the CRC value 44. In the preferred

embodiment, the CRC blocks will contain CRC values that are calculated while a write

command is being sent to the device. Thus, every time a data block is written to, the CRC

calculator will calculate a CRC value while the command is being sent and when the

programming actually occurs, the CRC is programmed into the CRC block associated with

a data block. This command generally contains the block data and the block address.

Consequently, a data block's corresponding CRC value will contain information relating

to the data in the block itself and also the address of the block.

A write operation will involve sending a command to the device that would place

the data to be written into the Holding Latches 12 while the CRC generator 42 is

calculating the CRC value 44 during the command. Note that the CRC value 44 being

calculated is for the entire write command that includes, typically, a write op code, a

memory address, and memory data. After the command is sent (which contains the data

and the block address) along with a check CRC of the transmission. If the resultant CRC

matches the check CRC, the resultant CRC is loaded into one or more holding latches

along with the block data. The entire holding latch data (data plus CRC values) are written

to the EEPROM at the same time.

The specific write operation is illustrated in Figure 4. First, data that is to be

written to the EEPROM is provided in step 404. Next, the CRC value is calculated in step 406 using the data provided. After that, the data is written to the data section of the data

block on the EEPROM, step 408. Finally, the CRC value is written to the CRC section of

the data block in step 410 and the process ends, step 412.

When the data block is read, the data block and associated CRC block are read.

The reading subsystem would have to calculate what should be in the CRC block and

decide if the CRC is correct. Consequently, to step through a read process, the reader

subsystem: 1) issues a read command; 2) reads the data block from the memory, both

normal data and the CRC value; 3) calculates the CRC for the write command that would

have written the data just read; and 4) compares the calculated CRC with the CRC value

read out of memory with a comparator. A comparator is a simple circuit known in the art

that compares two equivalently sized data. The comparator merely concludes whether the

two data are identical or not. A signal from the comparator can be used to signal other

circuitry that the data is valid or invalid.

If the recently calculated CRC value (based upon the data that was read) does not

match the CRC value read from memory, then one of the following conditions has

occurred: 1) the data in the data block has been changed; 2) the CRC value stored in the

CRC block has changed; or 3) the device wrote the data into the wrong block. In any case,

the data is considered invalid and an appropriate signal is issued. For example, if the data

is considered valid, then a VALID signal can be issued, otherwise an INVALID signal may

be issued. Alternatively, a single signal may be issued only when the data is considered

valid. In that case, the circuitry would have to look for that signal and, if not forthcoming,

then consider the data to be invalid and handled accordingly. In yet another alternate embodiment, a single signal may be issued only when the data is invalid. In that case, the

circuitry would have to look for that signal and, if encountered, then consider the data to

be invalid and handled accordingly.

The read operation of the present invention is illustrated in Figure 5. Specifically,

the operation begins at step 504 where the data is read from the data section of the data

block of the EEPROM. Next, in step 506, the CRC value is read from the CRC section of

the data block that corresponds to the data section of the data block previously read. It will

be understood by those skilled in the art that the two read operations described above can

be reduced to a single read operation wherein a single data stream is read and then parsed

for a data component and a CRC component. In any event, a current CRC value is

calculated using the CRC calculator, step 508. A comparator is used to compare the

current CRC value (based on the data read) to the read CRC value (based on the data

written) in step 510. In step 512, it is determined if the two CRC values are identical (i.e.,

that the data is valid). If the test is positive (yes) then step 514 is executed, issuing a

VALID signal. Otherwise, execution branches to step 516 and an INVALID signal is

issued and the process ends, step 518. It will be understood by those skilled in the art that

alternate embodiments of the present invention may issue a signal only upon a valid data

determination (i.e., the CRC values are identical) or only upon an invalid data

determination (i.e. the CRC values are not identical) without departing from the spirit of

the invention.

The present invention, therefore, is well adapted to carry out the objects and attain

both the ends and the advantages mentioned, as well as other benefits inherent therein. While the present invention has been depicted, described, and is defined by reference to

particular preferred embodiments of the invention, such references do not imply a

limitation on the invention, and no such limitation is to be inferred. The invention is

capable of considerable modification, alternation, alteration, and equivalents in form and/or

function, as will occur to those of ordinary skill in the pertinent arts. The depicted and

described preferred embodiments of the invention are exemplary only, and are not

exhaustive of the scope of the invention. Consequently, the invention is intended to be

limited only by the spirit and scope of the appended claims, giving full cognizance to

equivalents in all respects.

Claims

1. A computer system having a verifiable programmable read only memory, said

computer system comprising:

at least one data block in said programmable read only memory, said data block

having a data section, said data section constructed and arranged to store data, said data

block -further having a CRC section, said CRC section corresponding to said data section,

said CRC section constructed and arranged to contain a CRC value;

a CRC calculator, said CRC calculator constructed and arranged to generate a

current CRC value based upon data read from said data section; and

a comparator, said comparator constructed and arranged to compare said current

CRC value to said CRC value stored in said CRC section;

wherein, a signal is issued if depending upon whether or not said current CRC

value is identical to said CRC value stored in said CRC block.

2. A computer system as in claim 1 wherein said programmable read only memory

is a PROM.

3. A computer system as in claim 1 wherein said programmable read only memory

is an EPROM.

4. A computer system as in claim 1 wherein said programmable read only memory

is an EEPROM.

5. A computer system as in claim 1 wherein said system further comprises a holding

latch connected to said data block and to said CRC block.

6. A method for verifying data read from a programmable read only memory, said method comprising the steps of:

a) reading data from a data section of a data block in said programmable read

only memory;

b) reading a CRC value from a CRC section of said data block, said CRC

section corresponding to said data section;

c) calculating a current CRC value with said data read from said data section;

d) comparing said current CRC value with said CRC value read from said data

block; and

e) issuing a signal responsive to said comparison of said current CRC

value and said CRC value read from said data block.

7. A method for writing verifiable data to a programmable read only memory,

said method comprising the steps of:

a) providing a data;

b) calculating a CRC value based upon said data;

c) writing said data to a data section of a data block of said programmable

read only memory; and

d) writing said CRC value to a CRC section of said data block.

8. A wireless radio frequency identification (RFID) system having an EEPROM

memory, said RFID system further comprising:

, at least one data block in said EEPROM memory, said data block having a data

section, said data section constructed and arranged to store data, said data block further

having a CRC section, said CRC section corresponding to said data section, said CRC section constructed and arranged to contain a CRC value;

a CRC calculator, said CRC calculator constructed and arranged to generate a

current CRC value based upon data read from said data section; and

a comparator, said comparator constructed and arranged to compare said current

CRC value to said CRC value stored in said CRC section;

wherein a signal is issued responsive to a comparison of said current CRC value

with said CRC value stored in said CRC block, said comparison is used to identify if

said data in said data block is valid.