WO2010128068A1

WO2010128068A1 - Method for protecting electronic circuits, and device and system implementing the method

Info

Publication number: WO2010128068A1
Application number: PCT/EP2010/056072
Authority: WO
Inventors: Samuel Evain; Valentin Gherman
Original assignee: Commissariat A L'energie Atomique Et Aux Energies Alternatives
Priority date: 2009-05-07
Filing date: 2010-05-05
Publication date: 2010-11-11
Also published as: FR2945393B1; FR2945393A1

Abstract

The invention relates to a method for protecting at least one electronic circuit processing digital data. A configuration (303, 304) for protecting against errors introduced into said data is deduced (300) from a cartography (302) representing the faults of said circuit, said protection configuration corresponding to the configuration of at least one encoder and one decoder, the encoder generating code words consisting of data bits to which redundancy bits are added, said redundancy bits being generated such that the errors resulting from the faults indicated by said cartography (302) are corrected when decoding said code words. The invention also relates to a device for configuring and protecting memory areas and to a digital interconnection system implementing the method.

Description

Method of protecting electronic circuits, device and system implementing the method

The invention relates to a method of protecting electronic circuits, a device and a system implementing the method.

It applies in particular to the fields of digital electronics and nanoscale technologies. The invention can be used, for example, in data storage or transmission systems.

In a digital system, the data, also called information, is usually transported and stored as binary values called bits. In such circuits, the errors appearing on the data may be transient, permanent or intermittent.

The transient errors are produced by interference with the environment or are generated by the radioactivity of certain impurities in the material composing said circuit.

In digital systems made using, for example, nanoscale-based circuits, permanent and intermittent errors resulting from hardware defects are a significant problem. Indeed, if these errors are not corrected or masked, they can produce operating errors and eventually system failure. A high density of hardware defects in a circuit results in a large number of permanent errors. Indeed, permanent errors are usually related to defects in the physical structure of the circuit that occurred during production or after aging. These problems must be taken into account when designing such systems and are highlighted in particular in S. Borkar's publication Designing Reliable Systems from Unreliable Components: The Challenges of Transistor Variability and Degradation, IEEE Micro 25, No. 6, 2005 pages 10 to 16.

To guarantee a certain level of integrity of the stored data or to increase the production efficiency, some systems electronic error correction codes, designated by the acronym ECC from the English expression "Error Correcting Code". Examples of ECC codes are given in the CL publication. Chen Y. Hsiao called Error-correcting codes for semiconductor memory applications: a state of the art review, Reliable Computer Systems - Design and Evaluation, Digital Press, 2 ^èmθ Edition, 1992, pages 771 -786, and in PK Publication LaIa entitled Self-Checking and Fault- Tolerant Design, San Francisco, CA: Morgan Kaufmann, 2001.

In digital systems implementing ECC codes, the data is encoded, for example when writing said data in a memory or before transmission for transmission. The encoding operation, also called encoding operation, leads to code words containing said data to which are added verification bits obtained according to the calculation rules represented in a matrix constructed for this encoding. This matrix is usually called the parity matrix.

In a second step, for example when reading a part of the stored contents or when receiving digital data after transmission, the code words are decoded in order to reproduce the original data. For this, a verification vector called syndrome is calculated. The latter is used to detect and correct potential errors appearing on codewords. If no error is detected, the coded word is considered correct. If an error that can be corrected is detected, the codeword is corrected. Finally, if an incorrect error is detected, it is reported.

Different types of ECC codes can be implemented. By way of example, the Hamming coding makes it possible to correct a single error. This correction capacity is called SEC acronym from the English expression "Single Error Correction". The extended Hamming coding is a Hamming code to which is added a parity bit on all the bits in order to allow the detection of double DED errors. This code is an example code that has a SEC-DED capability. The codes of this family are capable of correcting an error and detecting a multiple error impacting two bits of a codeword. A multiple error designates, in the rest of the description, an error on several bits of the same code word. Another code example with SEC-DED capability is Hsiao code.

There are also DEC-TED codes, which allow the correction of double errors as well as the detection of triple errors. The codes allowing the correction of multiple errors are very expensive in terms of calculation, and therefore in terms of performance, area and consumption. It is therefore difficult in practice to implement such a code systematically to protect the entire electronic memory. On the other hand, it is possible to use an SEC capacity code with the ability to correct some multiple errors. Indeed, the capacity of the coding is rarely used to its maximum. The number N of data bits in a codeword stored in a memory is usually a power of 2, i.e., N = 2 ⁿ with n integer. In the case of an SEC code, the number c of verification bits must fulfill the condition: 2 ^C -1> 2 ⁿ + c. If the data words to be protected are N = 32 bits, then c = 6 check bits are required. The difference Δ = 2 ^c -2 ⁿ -c-1 = 25 corresponds to the binary combinations not used by the syndromes allowing the detection of simple errors. Therefore, up to Δ different multiple errors can be detected and corrected. For double errors, for N + c = 38 bits, a total of 37x38 / 2 different double errors may appear. To correct all possible double errors in a code word with N = 32 bits of data, at least 10 check bits are required. However, if the number of multiple error groups to support is less than or equal to Δ, it is possible to correct them with only dc = 6 check bits.

ECC codes allowing the correction of single errors as well as the correction of a limited number of error pairs have notably been the subject of US Pat. No. 3,328,859 entitled Simplified partial double error correction using a single error correcting code.

Another type of ECC code allows the correction of a selection of double errors while having the ability to detect other double errors, as described in US Patent US3755779 entitled Error Correction System for single-error correction, related-double -error correction and unrelated-double-error-detection. These pairs of errors are chosen from such that they allow the correction of double errors on adjacent bits.

ECC codes offer a dynamic correction solution. The code

ECC can handle both permanent and / or transient faults. But, usually, when this solution is used to solve a permanent fault, it often loses its ability to correct transient and / or permanent faults appearing thereafter.

Another technique is to use spare resources, also called "spare resources" in English. The defective physical resources identified are then replaced by said backup resources. The term masking is also used in the following description and refers to the same technique. The defective resources are hidden in favor of non-defective backup resources. Unlike ECC codes, this solution is static and only fixes permanent errors.

Mixed approaches combining the use of ECC-based techniques with backup resource-based techniques exist in the state of the art and make it possible to tolerate a high density of permanent faults, as described in particular in the article by CH Stapper and Hsing-San Lee entitled Synergistic Fault-Tolerance for Memory Chips, IEEE Trans. Computers 41 (9), 1992, pages 1078-1087. This approach is used when producing digital memories, for example. It is then possible to know the distribution and the frequency of permanent errors resulting from hardware defects of a circuit and to set a goal in terms of correction capacity for handling transient errors. This data then makes it possible to determine the amount of backup resources needed and the type of ECC code adapted to said physical implementation. Thus, additional physical resources are needed for ECC code checking bits and backup resources. These additional resources are integrated in a system and therefore have a surface cost and are not always well adapted to the errors encountered. There is therefore a compromise difficult to find between the surface that one is ready to devote to the correction and the gain in performance what does this correction bring? In addition, the mixed approach is limited in its flexibility. Indeed, the choice of the quantity and the distribution of the additional physical resources corresponding to the backup resources and the check bits of the ECC code or codes is made during the design of the circuit and does not take into account the evolution of said circuit due in particular to aging. Indeed, new defects and therefore new permanent errors may appear over time, and the protection strategy chosen during the design may become unsuitable after a while.

An object of the invention is in particular to overcome the aforementioned drawbacks. For this purpose the invention relates to a method for protecting at least one electronic circuit processing digital data. An error protection configuration introduced on said data is deduced from a mapping representative of the faults of said circuit, said protection configuration corresponding to the configuration of at least one encoder and a decoder, the encoder generating codewords composed of data bits to which redundancy bits are added, these redundancy bits being generated in such a way that the errors resulting from the defects indicated by said mapping are corrected during the decoding of said codewords. The method comprises a step of determining the values that the elements comprising a programmable parity matrix H representative of the protection configuration take, said matrix being used to generate redundancy bits from digital data words, the elements of said matrix being selected so as to achieve correction capability to correct at least the permanent and intermittent errors resulting from electronic circuit failures indicated by the mapping.

A step determines, for example, whether an ECC type protection of the digital data is implemented, the ECC code being chosen such that its correction capacity is sufficient to correct at least the permanent and intermittent errors resulting from the defects indicated by the mapping. . According to one embodiment, the ECC code can be selected from SEC, SEC-DED, DEC-TED type codes, and having the ability to correct a targeted choice of simple and / or multiple errors.

Part of the elements of the parity matrix H is, for example, not programmable.

According to one aspect of the invention, a step of determining an HS matrix of multiple error syndromes, the columns of said matrix corresponding to syndromes of multiple errors resulting from defects identified in the electronic circuit. According to another aspect of the invention, the method includes a step of determining a MapME matrix that maps to each multiple error correction syndrome contained in the multiple error syndrom HS the location of the errors to be corrected.

The information used for programming the H, MapME and HS matrices can be stored in compressed form and then decompressed before being used.

The method comprises, for example, a step of updating the stored protection configuration.

The data words are, for example, encoded to form code words by adding check bits and spare bits to the data bits in accordance with the stored protection pattern.

The code words can be decoded by detecting and then correcting the errors taking into account the protection configuration that was used during the encoding of said data word.

According to one aspect of the invention, the method comprises a step of detecting defects of the circuit to be protected and of determining a fault map, the detection being carried out using one of the following methods: tests and observation of the protected circuit , statistics calculations.

The invention also relates to an electronic device for configuring and protecting memory areas, a memory area being represented by a matrix of memory cells, a data word that can be stored by line of said matrix, said memory area consisting of at least one main area and one resource area complementary, the main area being for storing the data words and the complementary resource area being for storing redundancy bits associated with the data words. The device comprises, for example, means for determining a protection configuration of the data words by using the method as described above from a mapping of the defects of the memory area, a portion of the complementary resource area being allocated to store check bits of one ECC type code and another portion of the supplementary resource area being allocated as backup resources.

The memory zone is, for example, included in the device. The subject of the invention is also a digital interconnection system composed of at least one source module comprising encoding means so as to generate codewords from useful data, of at least one destination module comprising means for decoding said code words, at least one interconnection network composed of electronic links and nodes, a portion of said links and said nodes being called complementary transmission resources and being used for transmitting the redundancy bits of code words, the code words being transmitted from the source modules to the destination modules using said network using transmission paths. The means for encoding, decoding and the use of the complementary transmission resources of the interconnection network are, for example, configured according to a given coding mode, a coding mode corresponding to the use of an ECC code and or backup electronic lines, said coding mode using the method as described above.

The invention has the particular advantage of allowing the configuration or / and reconfiguration of the resources used for the protection of the information stored or transmitted taking into account the specific distribution of faults in a circuit at the time of its production, its test, or during its exploitation. Other features and advantages of the invention will become apparent with the aid of the description which follows, given by way of illustration and without limitation, with reference to the appended drawings in which:

FIG. 1 gives an example of a codeword comprising a set of data bits and a set of redundancy bits associated with it in order to reinforce the reliability of the information represented by said data bits; FIG. 2 shows an example of a memory zone comprising additional resources intended to add redundancy to the stored data words; FIG. 3 illustrates the principle of the method according to the invention; FIG. 4 presents an example of an algorithm for allocating complementary resources; FIG. 5 gives an example of an electronic storage device implementing the method according to the invention; FIG. 6 shows an exemplary encoder structure that can be used to generate the redundancy bits associated with the data words to be stored; FIG. 7 gives an example of a configuration of a parity matrix H making it possible to combine both a SEC-DED type coding and the replacement of data columns by backup columns; FIG. 8 shows an exemplary decoder that can be used for reading stored and protected data; Figures 9 to 12 show a practical example of implementation of the invention for a given fault mapping; Figure 13 provides an example of a digital data interconnect system.

FIG. 1 gives an example of a code word comprising a set of data bits and a set of redundancy bits associated with it. A codeword 100 comprises a portion corresponding to the data bits 101 and a portion corresponding to the redundancy bits 102. The codeword of FIG. 1 may correspond, for example, to a code word stored in a memory or transmitted on an interconnection system.

A digital memory circuit makes it possible to store binary data in a memory area that can be represented, for example, by an array of memory cells comprising L words and C columns. At the intersection of each word with each column is a memory cell for storing a bit. In other words, a memory space of dimension LxC will make it possible to store L words of C bits. When the goal is to memorize words comprising C useful bits, it may be advantageous to add redundancy bits corresponding to backup resources or check bits if an ECC code is implemented or both if an approach mixed is chosen. In this case, each stored word comprises C data bits D ₁ , D ₂ ,..., D _c and k redundancy bits Ri, R ₂ ,..., Rk. In the matrix representing the total memory area, that is, where the data and redundancy are stored, C columns are allocated to the data and k columns are allocated for redundancy. It is also possible to use words as redundancy words. The convention used in this description is to use a matrix in which a line corresponds to a data word and / or a codeword. Nevertheless, another convention can be based on an alternative matrix representation which considers that a data word and / or a code word is stored per column and not per line. This second example of convention is not used in the rest of the description.

In the context of the invention, and as explained above, the redundancy columns correspond either to backup resources or to verification bits. The spare resource columns and check bit columns are grouped together without distinction. This grouping makes it possible, when allocating resources, to favor one of these solutions over the other, depending on the need. Indeed the verification columns will be more suitable for a dynamic correction, that is to say to correct transient errors. The spare columns are, for their part, better adapted for a static correction. It can also be chosen not to use one of the redundancy columns.

Figure 2 shows an exemplary memory area including additional resources for adding redundancy to the stored data words. As explained above, said memory area can be represented in the form of a matrix. The convention used in this description is to use a matrix in which a line corresponds to a data word and / or a codeword. A main memory area 200 is for storing the data and corresponds, in this example, to a matrix comprising L lines (words) 202 and 8 columns 201. As a result, up to 8 bits of data per word can be stored. Certain parts of the main memory area include defects symbolized by X 205 and inducing either an inability to store or a storage error for the bit of interest. In the example of the figure, 6 faults are represented. In the context of the invention, the physical architecture of the memory comprises memory resources complementary to those of the main memory area. These additional resources are additional columns 203 as well as additional words 204 adding to the main memory area. The quantity of complementary resources is, for example, fixed and is chosen at the time of the design of the digital circuit. The method according to the invention makes it possible, at the time of configuration of the digital memory, to best allocate the use of these additional resources taking into account the distribution of known defects. An advantage of the invention is that this protection configuration can be performed at different times in the life of the digital memory and thus take into account the material aging and the increase in the number of defects. Some of the additional resources can be used as verification bits to implement ECC code and another part can be used as backup resources. The spare resource columns and check bit columns are grouped together without distinction. This grouping makes it possible, when allocating resources, to favor one of these solutions over the other. according to the need. Indeed the verification columns will be better adapted for a dynamic correction, that is to say to correct transient errors. The spare columns are, for their part, better adapted for a static correction. It can also be chosen not to use one or more columns of redundancy.

The method according to the invention makes it possible to establish a protection strategy by distributing the additional resources while taking into account the fault distribution of the electronic circuit of which the memory is composed. On the other hand, the method makes it possible to reconfigure, automatically or not, the manner in which the complementary memory areas are used. Thus, if the distribution of defects changes, the protection strategy will be updated taking into account. For example, when there is no more than one error per word, a simple code with a SEC capability can be selected for corrections. Columns configured as spare columns can be used to replace columns that contain one or more defects, and spare words can be configured to replace words that contain one or more defects.

Still as an example, when there is more than one defect per word an ECC capacity code SEC-DED can not correct anymore. However, multiple word errors may be subject to special correction. Thus two pairs of localized errors can be corrected for example using a suitable ECC code. The method according to the invention makes it possible to adapt and configure the ECC code according to the errors to be corrected and may choose to configure in addition to spare columns and / or spare words among the additional resources.

Figure 3 illustrates the principle of the method according to the invention. The method according to the invention aims to determine the way in which the additional resources of an electronic memory are allocated taking into account the state of the circuits composing said memory, the aim being to implement a suitable protection strategy. The state of the circuits can be represented, for example, using a map 302 indicating the location of the defective memory cells as well as the location of the affected memory cells. This mapping can be determined by an observation, using tests, statistics or other means. The method according to the invention also uses configuration data 301 describing the structure of the memory area to be configured, such as, for example, the size of the memory area and the number of words and columns available for redundancy, as well as the test results of the zone that will contain said configuration, because it may also have defects that will force, that is to say freeze, part of the configuration. These input data 301, 302 are used by a succession of steps 300 to configure or reconfigure the allocation of additional resources and the correction capability of the ECC code if necessary. A protection configuration is thus obtained. The additional resources can be used as backup resources or as verification bits added to the data words so as to implement a suitable protection strategy. The protection configuration thus obtained corresponds to a set of parameters defining the ECC code 303, the allocation of the backup resources and the way in which they are used 304.

Figure 4 shows an example of an algorithm for allocating complementary resources. The result of the algorithm corresponds to a set of parameters making it possible to select the backup bits and the check bits among the set of redundancy bits. The value of the programmable elements of a parity matrix H is obtained.

The mapping of the defects of the area of memory or / and other defects is one of the entries of the algorithm. It can be obtained by observation, tests, statistics or other means.

The approach may be different depending on the chosen configuration strategy. A configuration strategy can be, for example, to correct transient errors in addition to permanent and intermittent errors. This strategy was chosen to illustrate the principle of the configuration of additional resources using the example of Figure 4. In order to have the ability to correct transient errors, it is possible to reserve nV bits of redundancy 400 so that they serve as verification bits for SEC or SEC-DED type protection, for example. Relief words are used to correct permanent errors. At first it is better to check 401 if a simple solution like the use of backup words is enough to deal with permanent errors. Otherwise, backup words are used to replace memory words with the most errors.

It is then verified 402 whether the transient error correction capability has been enabled, i.e., if nV is different from zero.

If the transient error correction capability is enabled, check bits have already been reserved for transient error correction. The programmable elements of the parity matrix H defining the error correction code are then determined 403 so that the resulting ECC code makes it possible to correct said transient errors.

A step 404 then makes it possible to check whether the corrections made are sufficient. If the found pattern is satisfactory, the search ends 412, in other words, the appropriate protection pattern is found. In addition, if transient error correction is not desired, i.e., if nV = 0, the ECC correction may be disabled. This deactivation then induces a gain in speed especially during the reading of the data.

If the corrections made are not sufficient, the bits of the redundancy columns which are not used as verification bits and which are not isolated either, can be used as backup bits. A word or column of redundancy is isolated when it has defects and is set aside. It is possible to assign 405 up to nS = nR-nl-nV spare columns to replace the bad payload bits where nR is the total number of redundancy bits, nV is the number of check bits present in a memory word, and ni corresponds to the numbers of isolated redundancy columns. A step then makes it possible to check whether the corrections made are sufficient 406.

If the configuration found is satisfactory, the search ends 412.

In the case where the configuration found is not satisfactory, a step reallocates one of the backup columns 407 so that it is used as a check bit in order to set up or increase the correction capability of the ECC coding (nS = nS-1 and nV = nR-nl-nS).

Following the reallocation step 407, a step 408 searches for a parity matrix H using nV check bits in order to be able to correct the remaining permanent errors and, if necessary, transient errors.

It is then checked 409 that the found configuration allows a satisfactory correction. If so, the search for the configuration is completed 412 successfully.

In the case where the correction capacity that the last found configuration can provide is not sufficient, the distribution of the redundancy bits is modified by recursively reducing 413 the number of spare bits. This reduction is made in favor of the check bits until a satisfactory configuration of the matrix H is found 412 or until it is no longer possible to reduce the number of spare columns 410 and therefore to increase the number of check bits, which means that the search for a satisfactory configuration ends on a failure.

FIG. 5 gives an example of an electronic storage device implementing the method according to the invention. The method described above allows the implementation of reconfigurable electronic storage devices. The reconfiguration makes it possible to adapt the stored data protection strategy taking into account the state and the quality of the circuits composing the device. This reconfiguration can be performed during device design or later.

The device 500 is composed, for example, of a memory area 501 comprising a main memory area for storing data words as well as additional resources for protecting said data against possible errors. The stored data can be read, and the possible errors corrected by means of a decoding circuit 502. New data can also be written in the memory area 501 and protected by the addition of redundancy bits by means of a encoding circuit 503. The manner in which the decoder 502 and the encoder 503 are configured depends on the protection strategy as determined by the method according to the invention. These two Thus, elements 508 are configured using stored configuration parameters 506, for example, within the device. Said configuration parameters can be updated so as to take account of the physical evolution of the memory zone and in particular the effects of aging on the circuits. For this, a module 504 controls the update of the device. It can, for example, perform tests 509 of the memory area 501 or take data input 510 to enable it to generate a map 513 of the defects of said memory area 501. It is also possible to consult the module containing the configuration parameters to verify that there is no error and if there are one or more errors the control module 504 may take this information into consideration in determining the appropriate configuration. This map can then be used by a configuration module 505 to determine in particular the parity matrix H and masking parameters 512, examples of the parity matrix H and these parameters are given later in the description. The matrix H and the rest of the configuration parameters are then stored 506 in a storage module. One or more of the control 504 and configuration 505 modules may be implemented inside or outside 51 1 of the electronic storage device 500.

FIG. 6 shows an example of an encoder structure that can be used to generate the redundancy bits associated with the data words to be stored. nR redundancy bits are associated with a word of nD data bits. The number nd of data bits is usually a power of 2.

A redundancy generation module 600 determines the value of the redundancy bits as a function of the value of the data bits. This operation is performed using a stored H programmable parity matrix 601 whose programmable elements were determined during the configuration or reconfiguration procedure of the memory. The value of the nR redundancy bits can be determined, for example, using the following expression: n D-l

R ₁ = ® {H Λ D i = 0, nR-1 (1)

in which :

Θ represents the exclusive OR operation; Λ represents the logical AND operation;

Ri represents the i ^θmθ redundancy bit with 0 <i <nR;

D _j represents the j ^θmθ data bit with 0 <j <nD;

Hy represents an element of the programmable parity matrix H, said matrix being of dimension nRx (nD + nR).

The module 601 for storing the programmable parity matrix H comprises, for example, registers in which the elements Hy of the matrix H are stored. These registers can be accessible from outside the memory controller containing the encoder. It is possible to implement these registers in a volatile memory of the RAM type or in a non-volatile memory of types EPROM, EEPROM or Flash, for example. The elements of the matrix H and the other configuration elements can also be programmed using other methods, for example using laser beams if only the permanent errors due to the defects appearing during the process are to be corrected. production of a storage or transmission circuit.

The parity matrix H is used for the implementation of an ECC code. To minimize the amount of information needed to program the H matrix, some Hy elements may not be freely programmable. By way of example, it is possible to fix the elements Hy for O <i <nR and nD <j <nD + nR, such that Hy = 1 if i = j-nD and Hy = O if i ≠ j without programming flexibility is significantly impacted. It is also possible for elements Hy and H _{mn to} be linked by a dependency relation to make it possible to compress the configuration information to be memorized. For example, Hy can be equal to the inverse of H _mn .

A module of the encoder is a storage space of the spare words 602. Different strategies existing in the state of the art can be implemented, for example that described in the article by SE Schuster entitled Multiple word / bit A redundancy for semiconductor memories, IEEE Journal of Solid-State Circuits, vol. 13, no. 5, pp. 698-703, October 1978. The integration and use of this module 602 is optional. The choice to use such a module depends on the density of defects and the memory capacity of the protected storage systems. This module can be deactivated, for example after a production test, if it is necessary to tolerate transient errors and the density of production defects is low or zero. This decoupling makes it possible to improve the performance of the decoder and to optimize its power consumption.

An optional multiplexer 603 may be used to select the bitstream presented at the output of the encoder from two inputs. Said output may be the first input 604 of the multiplexer corresponding to the output of the generation module of the redundancy 600. In the case where the detected fault density is zero, the flow of the second input 605 corresponding to the data bits without addition of redundancy is presented as output. The width of the second input of the multiplexer 605 is, for example, adjusted to the width of the first input 604 and the output 606 by adding nR fixed bits to any value.

The configuration parameters may be transferred to the module 601 through the channel used for accessing the data bits 607 or a separate channel 608.

FIG. 7 gives an exemplary configuration of a parity matrix H making it possible to combine both a SEC-DED type coding and the replacement of the columns of data corresponding to the bits D13, D14 and D15 by spare columns. In this example, the matrix H is of dimension nRx (nD + nR) = 9x25. In this example, 6 check bits marked RO to R5 correspond to the verification bits of a SEC-DED code and three bits R6, R7 and R8 are used as backup resources. The three bits R6, R7 and R8 are also protected by the SEC-DED code. During decoding, the calculation of the error syndrome uses only the check bits RO to R5. When configuring the memory area and therefore the code construction, the matrix H must be determined, for example, such that the single and multiple correctable error syndromes are all different from each other. In addition, these syndromes must be different from detectable error syndromes to be uniquely identified.

Figure 8 shows an example of a decoder that can be used for reading stored and protected data. This decoder takes as input the data bits D_in stored in the main memory area and the redundancy bits R_in being associated with them and being stored in the complementary memory area. The decoder outputs the decoded payload. A module 804 of the decoder stores the programmable parity matrix H. This module may include the module 601 of the encoder presented previously also having the role of storing the parity matrix. Thus, both modules can share common or partially shared storage resources or have independent storage resources.

In order to be able to decode, this module must also have the ability to store masking information. Indeed, a column can be hidden, that is to say isolated, if it is defective. This masking information is for example MaskCol masking bits _j (0 <j <nD) and MaskLinβi (0 <i <nR). MaskLinβi is not used to hide a line (or word) from memory. Maskϋnβi refers to the rows of the matrix H. These masking bits can be defined by convention, for example, such that:

MaskCol _j takes the value 0 if the j ^θθ data bit is replaced by a redundancy bit;

MaskLinβi takes the value 1 if the i ^θmθ redundancy bit is used as a backup bit to replace a data bit.

In the context of the invention, replacing the j ^θmθ data bit by the i ^θmθ redundancy bit is decided at the time of the configuration or reconfiguration of the digital memory. In case of replacement decision, the selected values are therefore MaskCol _j = 0, MaskLinβj = 1 and Hy = 1.

The masking information MaskCol _j and MaskLinβi as well as the values taken by the elements Hy of the parity matrix H are then used. in particular by an emergency column control module 802 and a programmable error correction module 806.

The redundancy bits may also be defective. In this case, it is then possible to isolate one or more redundancy bits, that is to say one or more columns belonging to the complementary resources. If it is decided to isolate a bit i of redundancy, that is to say not to use it as a verification bit or as a backup bit, then the following values may for example be chosen: Hy = 0 for 0 <j <nD + nR-1 and MaskUnei = 1.

A module 802 for checking the spare columns takes as input the bits of the words to be read, that is to say, for each word, D_in data bits and R_in redundancy bits. As explained previously in the description, the columns allocated to store the data bits can be replaced by columns belonging to the complementary resources. This module has as output the data bits D_out and can implement any method of using the spare columns, as for example that presented in the M. Horiguchi article entitled Redundancy Techniques for High-Density DRAMs, IEEE Int. Conf. Innovative Systems Silicon, 1997, pages 22 to 29.

Another possible method is to use the stored information 803 of the programmable matrix H and to calculate each bit of data using, for example, the following expression:

V VnR-I, D = {_out D_IN A MαskCol Jv v [MaSkLiHe ₁ Λ R _ In ₁ AH); j = 0, nD-1 (2)

where: v represents the logical OR operation;

D_iri _j and R_irii indicate respectively the j ^θmθ bit of data, and the i ^θmθ of redundancy, at the input of the control module of the spare columns (0 <j <nD, 0 ≤ i <nR);

D_out _j represents the j ^θmθ bit of data at the output of the control module of the spare columns (0 <j <nD); MaskCol _j represents the masking bit corresponding to the j ^θmθ data bit at the input of the control module of the spare columns (0 <j <nD); MaskLinej represents the masking bit corresponding to the i ^θmθ redundancy bit at the input of the control module of the spare columns (0 <i <nR).

The backup word storage module 800 is the same as the backup word storage module 602 presented with the aid of FIG. 6. Its purpose is to store said backup words. The integration and use of this module is optional and depends on the density of defects and the memory capacity of the protected storage systems. This module can be disconnected, for example after a production test, if it is necessary to tolerate transient errors and if the density of defects is low or zero. This module is not necessary for the protection of an interconnection system.

A module 806 of the decoder implements the error correction. Depending on the chosen protection configuration and therefore the stored matrix H, correction of single errors and / or multiple errors can be performed. The detection of multiple uncorrected errors can also be performed by this module.

A conventional ECC code associates with each correctable and / or detectable error E a syndrome SE defined by nR bits. If E is a single corresponding to j ^θmθ data bit error and the syndrome is the same as j ^θmθ column of the matrix H. If E is a multiple error affecting multiple bits of data and / or check bits, the syndrome is SE obtained by means of the exclusive OR logic operation between the columns of the parity matrix H corresponding to the bits affected by said multiple error.

The principle according to the invention of programmable resources dedicated to memory protection requires that the syndromes be memorized. Syndromes corresponding to simple errors do not need additional memory cells. Because the simple error syndromes correspond to the columns of the H parity matrix, only the multiple error SE syndromes require additional registers. The contents of these registers form a distinct matrix HS which is called matrix of multiple error syndromes. The matrix HS is of dimension nRxnHS, where nR is the total number of redundancy bits and nHS is a parameter dependent on the number of multiple errors to be corrected. The NHS parameter is chosen, for example, when designing the digital memory. By construction, the maximum limit of NHS is nHS≤2 ^nR - ^nR -nD-1. Each column of the matrix HS can thus store the syndrome of a multiple error.

In the error correction module 806, a syndrome S is calculated from the data bits Diri _j (0 <j <nD) and redundancy bits Ririj (0 <i <nR) arriving at the input of said module , using, for example, the following expression:

nD-1 FnR + nD-1, /

S, = © K ΛD.inJ; i = 0, nR-1 (3)

Syndrome S must be compared with the syndromes stored in the columns of matrices H and HS. These comparisons can be made using, for example, the following expressions:

BHFHp ₁ = "A [MaSkLiHe ₁ v (H _I) S S,)]; j = 0, nD - 1 (4) BitFlip _k =" A [MaSkLiHe ₁ v (HS _A S S,)]; k = 0, nHS - 1 (5)

in which :

Θ represents the inverted exclusive OR operation;

BitFlip _j is a signal which takes the value 1 only if the syndrome S corresponds to the i ^θmθ column of H;

BitFlipk is a signal that takes the value 1 only if the syndrome S corresponds to the k ^lθmθ column of HSk.

To optimize the computational performance it is necessary, for example, that the expressions (4) and (5) are implemented by submodules dedicated to each of the signals BitFlip _j and BitFlip _k .

The data bits D_out _j (0 <j <nD) presented at the output of the correction module 806 can be calculated using the following expression: D_out _j = D_in _J θ | ΛBitFlipJ I; j = 0, nD-1 (6)

In which :

D_iri _j represents the j ^θmθ bit of data at the input of the module (O <j <nD); D_out _j represents the j ^θmθ data bit at the output of the module Y30 (0 <j <nD);

MapSE _j is a parameter taking the value 1 only if the simple error whose syndrome is defined by the column ^jth of the matrix H is likely to affect the bit D_out _j (0 <j <nD); MapME _jk is a parameter taking the value 1 only if the multiple error whose syndrome is defined by the k ^θmθ column of the matrix HS is likely to affect the bit D_out _j (0 <k <nHS).

For example, several rules can be followed to fill the matrices H and HS:

if a column k of the matrix HS is not used for storage of a syndrome corresponding to a multiple error, then all the MapME bits _jk with 0 <j <nD are set to zero;

if a column j of the matrix H does not correspond to a simple error likely to affect the ^data bit, then the MapSE _j bit is set to zero;

- if the MapSE _j bit is zero and the data bit ^θmθ j is not replaced by a redundancy bit, then all the bits of the j ^θmθ column of the matrix H may be set to zero. In this case, a way to avoid the use of the MapSE bits and to make the decoder more robust is to force the BitFlip signals to zero if all the bits of the syndrome obtained by the expression (3) are equal to zero. All bits of the unused columns of the HS matrix can also be set to zero.

The MapME bits _jk (0 <j <nD, 0 <k <nHS) may require a large storage capacity. Indeed, nDxnHS memory cells are required. This cost can be reduced by hard-coding a subset of the MapME bits _jk . The choice of this subset implies that a compromise must be made between the choice of the surface of the circuit and the coverage of faults. The information used for programming the H, MapME, HS matrices can be stored in compressed form and then decompressed before being used.

A first multiplexing module 805 makes it possible to select one or more of the inputs of the correction module 806 from the outputs of the control modules of the spare columns 802, the spare word storage space 800 and the input of the decoder 801. that is, the bits Dj n and R_in.

A second multiplexing module 807 makes it possible to select the bits transmitted at the output of the decoder out of the bits available at the output of the control modules of the spare columns 802, the storage space of the backup words 800 and the input bits of the 801 decoder.

Figures 9 to 12 show a practical example of implementation of the invention for a given fault mapping.

Figure 9 shows an example of distribution of defects in a memory area whose words have a width of 9 + 1 6 bits. The lines represent the stored words. The stored words comprise 1 6 data bits D0 to D15 associated with 9 redundancy bits RO to R8, this redundancy being able to correspond to backup bits or to verification bits. Only words with defects have been represented. The locations of the circuit faults are indicated by 'X'. It appears that two columns 900, 901 are defective, the first being the data column D1 1900 and the second the redundancy column R8 901. For example, it may be decided to use column R7 904 as a backup resource to replace column D1 1. In addition to the defects on columns R8 and D1 1, 5 words 902 contain 2 additional defects involving double errors, and many other words 903 contain one. The five double errors 902 lead to five syndromes SO, S1, S2, S3 and S4 during decoding.

When choosing the protection strategy to correct errors caused by circuit faults, it is important to take into account the that an SEC correction is not sufficient to correct more than one error per word. Concerning the implementation of a correction of double errors, this requires a number of verification bits greater than the 9 verification bits available. In addition, this type of correction is not sufficient to process the stored words comprising more than 2 errors.

Column replacement correction is also not feasible because the defects affect a large number of different columns. With regard to word substitution correction, this would require the replacement of all defective words with relief words. This solution can not be envisaged in a systematic way.

A mixed approach implementing several of the techniques mentioned above makes it possible to optimize the error correction efficiency.

It appears that the use of a SEC-DED code with in addition the ability to correct a limited number of multiple errors is a solution adapted to the distribution of defects given in the example of Figure 9. The choice of this type of protection can be done using an algorithm of the type shown in FIG. 4. An example of a parity matrix associated with such a type of code while allowing the use of backup resources is explained by relying on the figure 10.

Figure 10 shows an example of a parity matrix. In the same figure are also represented the masking parameters MaskCol and

MaskLine. These are determined in order to make it possible to correct the five multiple errors resulting from the defects as presented with the example of FIG. 9.

MaskLine takes the value 0 on the first 7 lines indicating that the bits RO to R6 are used for an ECC type correction.

MaskCol takes the value 0 in the twelfth column. It appears therefore that D1 1 is replaced. 8 ^θmθ row of the matrix, that is to say its last line shows that the redundancy bit R7 replaces the data bit D11, that is to say, the column of the area complementary memory corresponding to the redundancy bit R7 is used as backup resource.

On 9 ^θmθ row of the matrix, that is to say its last line, it appears that the defective redundancy bit R8 has no dependencies with other bits of the code word, it is isolated. It is assumed in this example that no hotline is available.

In order to be able to correct multiple errors, an HS matrix is chosen. Its columns correspond to the syndromes of the multiple errors to correct. This matrix is presented with reference to FIG.

Figure 11 gives an example of a matrix of multiple error syndromes HS. In order to be able to correct the five multiple errors resulting from the defects as presented with the example of FIG. 9, an HS matrix comprising at least five columns is necessary. For the example, an HS matrix with eight columns is defined. The example of FIG. 11 is determined as a function of the parity matrix of FIG.

In this example, the last two rows of the matrix HS are not used and are filled with zeros since only the first seven redundancy bits are used as verification bits according to the configuration of FIG. 10. Thus, the first five bits of each column of the HS matrix can memorize a multiple error syndrome that it is desired to recognize in order to correct the erroneous bits associated with this multiple error syndrome.

The multiple error syndrome SO is the XOR between the D3 error syndrome and the D12 error syndrome.

The multiple error syndrome S1 is the XOR between the error syndrome of D6 and the error syndrome of R4.

The multiple error syndrome S2 corresponds to the XOR between the R2 error syndrome and the R6 error syndrome. The multiple error syndrome S3 corresponds to the XOR between the error syndrome of D3 and the error syndrome of D9.

The multiple error syndrome S4 corresponds to the XOR between the error syndrome of D1 1 and the error syndrome of D13.

Columns S5 to S7 are not used. In order to be able to correct the double errors associated with the syndromes SO, S1, S2, S3 and S4 previously explained, the first five columns 1 100 of the matrix HS correspond to these five syndromes and the remaining columns 1 101 which are not used are filled with zeros.

Figure 12 shows an example of a MapME multi-error correction matrix. For each multiple error correction syndrome contained in the multiple error syndrome matrix HS, then a MapME correction matrix of the associated bits must be configured. Some elements can be fixed in the implementation in order to find the best compromise between flexibility and complexity of implementation. These elements, denoted Z, are fixed hard, for example at 0, and are not programmable. The rest is programmable to 1 or 0. In this matrix, we see for example that the syndrome of multiple SO errors will be associated corrections of D3 and D12.

The redundancy bits are not corrected in this example, but this can be done in the same way as for the data bits.

In addition, all elements of the MapSE bit vector are set to logical level 1 to support the correction of all simple errors.

The protection strategy associated with the H, HS and MapME matrices and the MapSE bit vector thus fulfills its performance-enhancing role and provides a SEC-DED capability on all words. It is therefore involved in improving the reliability of the electronic system. There may be multiple possible configurations to respond to multiple error cases. The choice of the number of data bits and redundancy is made during the design of the programmable device and can be arbitrary.

It is interesting to note that errors can be hidden. It is therefore necessary in this case to treat the syndromes corresponding to all the error combinations of each group of multiple errors. For example, a triple error affecting 3 data bits D1, D2, D3 may be in the form of 3 simple errors or 3 double errors D1, D2; D1, D3; D2, D3 or a triple error D1, D2, D3. The number of multiple error syndromes then increases rapidly. Programming can also be simplified. Several configuration items can be programmed by one or a few stored bits. This thus makes it possible to compress the configuration data and thus reduce the corresponding corresponding memory area.

Figure 13 gives an example of a digital data interconnect system. In this example, two source modules 1300, 1301 generate 8-bit code words. These source modules correspond, for example, to modules included in one or more electronic chips, said sources notably comprising encoding means so as to be able to generate code words from the useful data words by adding redundancy to them. . The codewords may be transmitted to different destination modules 1302, 1303 including decoding means, i.e., means for detecting and correcting errors based on the redundancy information associated with the payload. These modules can be positioned in the same chip as that containing one of the sources or in a different chip. When the source and destination modules are implemented in the same chip, the code words are transmitted, for example, using an interconnection network internal to said chip, this network being usually designated by the English expression. Saxon "Network on Chip". When the source and destination modules are positioned in different chips, the code words then take an external interconnection network usually designated by the English expression "Off-Chip Network". The example of the figure shows a case where two source modules 1300, 1301 can transmit code words to two destination modules 1302, 1303 by means of an interconnection network that can be internal or external. This interconnection network is composed of different sets of electronic links 1317, 1318, 1319, 1320, 1321 and nodes 1304, 1305 making it possible to configure the path taken by the code words of one or the other source module. 1300, 1301 to reach either destination module 1302, 1303.

An interconnection system is therefore a system consisting of at least one data source module comprising encoding means, at least one destination module comprising decoding means, and at least one interconnection network composed in particular of electronic links and at least one node, said interconnection system making it possible to transmit codewords generated by one or more source modules to one or more destination modules. The electronic links are for example composed of one or more electronic lines, some for transmitting the data bits and others the redundancy bits, the latter being qualified in the following description of additional transmission resources. The electronic lines comprising the additional transmission resources may be, depending on the coding mode chosen, either electronic lines associated with the checking bits of an ECC code, or electronic backup lines replacing faulty electronic lines. The nodes perform bit routing in ways to route the codewords to the targeted destination module (s). The redundancy bits are transmitted using complementary transmission resources implemented within the interconnection network. The use of these additional resources is chosen taking into account the errors introduced by the different transmission links and / or the nodes. Thus the choice of a coding mode, that is to say the choice to use a given ECC code and / or backup electronic lines, is made according to the defects detected in the interconnection system.

The implementation of the encoding mode chosen makes it possible to correct the errors occurring on the coded word transported in particular because of the electronic links or the nodes which may have defects. In addition, crossing a path with multiple links and / or nodes implies that the errors accumulate from link to link (or / and nodes to nodes).

For example, a code word transmitted by the first source module 1300 may take a first path 1314 to reach the first destination module 1302. For this, the code word is, for example, transmitted in a first set of links 1317 introducing an error on the eighth bit 1306, then a second set of links 1320 introducing an error on the seventh bit 1309, the two sets being connected by a node 1305. The received code word 131 1 by the destination module can thus cumulate two errors on the seventh and / or eighth bits. The encoding mode set This path must therefore be configured to at least correct the two simple errors and the double error they are part of.

To reach the second destination module 1303 from the first source module 1300, another path 1315 is used by the codewords. This path is composed of three sets of links, the first

1317 introducing an error on the eighth bit 1306, the second 1319 not introducing an error 1308 and the third 1321 introducing an error on the third bit 1310. The received codeword 1312 by the second destination module 1303 can be assigned by one of the simple errors or the double error corresponding to the two simple errors. The encoding mode implemented for this path must therefore be configured to at least correct the three combinations of errors.

Another example of transmission of a data word is illustrated. To reach the second destination module 1303 starting from the second source module 1301, a path 1316 composed of at least two sets of links is used by the code words, the first set

1318 can introduce two errors on the first and sixth bits of the word 1307, the second set 1321 can introduce an error 1310 on the third bit. The received codeword 1313 by the second destination module 1303 may have one of three simple errors, a double error corresponding to a pair of simple errors or a triple error formed by the three simple errors. The mode of coding implemented must therefore take this into account. By knowing the paths, that is to say the links borrowed by a word to go from a source module to a destination module, and their faults it is possible to deduce what are the simple and multiple errors that can occur and therefore to choose the most appropriate coding mode and the configurations of the encoders and decoders included in the source and destination modules.

A source module or a destination module may be a memory as described above in the description. It can be implemented, therefore, a double protection, both at the storage of the given words, but also at the level of their transmission.

Claims

1 - A method of protecting at least one electronic circuit processing digital data characterized in that a protection configuration (303, 304) against the errors introduced on said data is deduced (300) from a cartography (302) representative faults of said circuit, said protection configuration corresponding to the configuration of at least one encoder and a decoder, the encoder generating codewords composed of data bits to which redundancy bits are added, these redundancy bits being generated from so that the errors resulting from the defects indicated by said map (302) are corrected during the decoding of said code words, said method comprising a step of determining the values that the elements comprising a programmable parity matrix H represent representative of the configuration protection, said matrix being used to generate redundancy bits from digital data words, the elements of said matrix being chosen so as to reach a correction capacity making it possible to correct at least the permanent and intermittent errors resulting from the defects of the electronic circuit indicated by the cartography.

2- Method according to claim 1 characterized in that a step determines whether an ECC type protection of the digital data is implemented, the ECC code being chosen such that its correction capacity is sufficient to correct at least the permanent errors and intermittent resulting from the defects indicated by the map.

3- Method according to claim 2 characterized in that the ECC code is selected from SEC, SEC-DED, DECED, type codes and having the ability to correct a targeted choice of simple and / or multiple errors. - Method according to any one of the preceding claims characterized in that a part of the elements of the parity matrix H is not programmable. Method according to any one of the preceding claims, characterized in that it comprises a step of determining an HS matrix of multiple error syndromes, the columns of said matrix corresponding to the syndromes of the multiple errors resulting from the defects identified in FIG. electric circuit. - Method according to claim 5 characterized in that it comprises a step of determining a MapME matrix corresponding to each syndrome of multiple error correction contained in the matrix of multiple error syndromes HS the location of the errors to be corrected . - Method according to any one of the preceding claims characterized in that it comprises a step of updating the stored protection configuration. - Method according to any one of the preceding claims characterized in that the information used for programming the H, MapME, HS matrices are stored in compressed form, said information being decompressed before being used. Method according to one of the preceding claims, characterized in that the data words are encoded to form code words by adding check bits and spare bits to the data bits in accordance with the stored protection pattern. . - Method according to claim 9 characterized in that the codewords are decoded by detecting and then correcting the errors taking into account the protection configuration that was used during the encoding of said data word. - Method according to any one of the preceding claims, characterized in that it comprises a step of detecting defects of the circuit to be protected and of determining a map of the defects, the detection being carried out using one of the following methods: tests and observation of the protected circuit, calculations of statistics. - An electronic device for configuring and protecting memory areas, a memory area (501) being represented by an array of memory cells, a data word that can be stored per line of said matrix, said memory area being composed of at least one main area and one complementary resource area, the main area for storing the data words and the additional resource area for storing redundancy bits associated with the data words, said device being characterized in that it comprises means for determining a protection configuration of the data words (505) by using the method according to any one of claims 1 to 1 1 from a mapping of the defects of the memory area (513), a portion of the complementary resource area being allocated to store check bits of an ECC type code (303) and a another portion of the complementary resource area being allocated as backup resources (304). - Device according to claim 12 characterized in that the memory zone (501) is included in the device. Digital interconnect system consisting of at least one source module (1300, 1301) comprising encoding means for generating code words from payload data, at least one destination module (1302, 1303) ) comprising means for decoding said code words, of at least one interconnection network consisting of electronic links (1317, 1318, 1319, 1320, 1321) and nodes (1304, 1305), a portion of said links and said links nodes being called complementary transmission resources and being used to transmit the redundancy bits of the code words, the code words being transmitted from the source modules to the destination modules using said network using transmission paths, said interconnection system being characterized in that the means for encoding, decoding and the use of the complementary transmission resources of the interconnection network are configured according to a coding mode given, a coding mode corresponding to the use of an ECC code and / or backup electronic lines, said coding mode using the method according to any one of claims 1 to 1 1.