Discriminating Between Soft Errors and Hard Errors in RAM

Memory checks detect both hard and soft errors. The application response to these different error types should differ because hard failures are caused by the circuit itself while soft errors are caused by some external particles that destroys the data but does not degrade the circuit functionality. A strong safety concept requires periodic self-checks of memory and logic to insure that the microcontroller system is operating correctly. As these checks verify that the memory element can be read and written, the tests are destructive to the memory contents; often then, these checks are run at ignition when failures can be checked prior to entering the safety algorithm. For RAM, the values stored in the memory are constantly changing, and the exact contents of this memory cannot be checked against some expected/known pattern. The memory requires some level of duplication for protection, provided that the source of the errors does not affect both memories in the same way. This duplication of the memory data can be accomplished through a fully redundant memory, ECC logic for the memory, or parity bits for the memory. Any of these items which check the memory’s data will detect hard failures as well as soft failures. In this context hard failures are errors that occur through process defects and/or circuit bugs – hard failures are repeatable with the correct sequence of actions within the microcontroller. Soft errors occur through no failure of the circuit or defect but due to an external source that causes the data to change. An example of a cause of soft errors is high energy atmospheric neutrons. This application report discusses how to distinguish hard and soft errors in protected RAM. Checking memory during the application is very valuable, and for non-volatile memory, the contents can be checked against a checksum or some other fixed reference. However, volatile memory has no fixed reference and so requires extra circuitry to allow an in-application memory check. • A redundant memory provides a full map of the exact data. The redundant memory map has a large penalty in terms of area; it allows an exact identification of every wrong data bit, but it is not possible to determine which memory map is correct. Redundant memory will never mask a failure and so catches every failing bit (not caused by a common source). The primary deficiencies in a fully redundant memory are 1) the inability to correct the failure and 2) a large area penalty. • Parity adds a parity bit for every n bits of memory; TI uses parity on the peripheral RAM – 1 bit of parity for every 8-bit word or every 32-bit word. The parity bit is a flag based upon whether the number of 1s in a word is even or odd. The parity flag is a simple 1-bit redundancy that allows for detection of any single bit failure; the key point is that any write operation is responsible for calculating and writing a new polarity flag. So, even though the RAM data is constantly changing, the polarity bit is changing in a synchronized way for valid write operations. The parity bit may catch multiple bit corruptions (in a word [1]) though it is only guaranteed to detect a single bit failure; parity provides detection for a single bit failure but cannot recover the correct data. SPNA109–July 2008 Discriminating Between Soft Errors and Hard Errors in RAM 1 Submit Documentation Feedback 3 Difference Between Hard and Soft Errors (and Quasi-Soft Errors) Difference Between Hard and Soft Errors (and Quasi-Soft Errors) www.ti. com • ECC adds several bits for every n bits of memory; TI uses 8 ECC bits for every 64-bit RAM word. With these ECC bits, any single or double bit error is detected; errors with more than 2 bits incorrect in the 64-bit word are not guaranteed to be detected. If the error is a single-bit error, the ECC can uniquely detect and correct the failure. Again, the fact that bits are spread along a row [1] has a large benefit in making the ECC-solution robust. Checking the memory of the device is intended to find all errors. However, the type of error – hard, soft, or quasi-soft – will play a large part in the application’s response to the error. Figure 1 and Figure 2 show a latching memory element. In Figure 1, data is driven onto the left port of the latch (and in SRAM, the complementary data is written onto the right port). The data is latched in the cross-coupled inverters which store the data until the next time data is written. Figure 2 shows the same cross-coupled inverters at a transistor-level. This basic scheme is common to SRAM cells and flip-flop designs. • A hard error is caused by a real error in the circuit – whether a design bug or a process defect. Because the hard error is related to a real circuit error, the circuit can be expected to fail repeatedly in the same manner. As an example, consider a highly resistive contact at the red X in Figure 2. When Data is driven high (and nData driven low), the latch is fully functional with both inverters driving at full strength. However, if Data is driven low (and nData driven high), the bottom inverter (driving Data) is weakened by the resistive contact and if the contact is resistive enough the latch will not hold the low value. Table 1. Results of Defect in Figure 2 Data Result Low Weakened latching – possibly failing High Good • In a soft error, the data is corrupted without any circuit error – in this discussion, a soft error is caused by a physical particle (e.g. alpha, neutron) passing through a critical volume of the device. The neutron may break the silicon nucleus into different atomic weight nucleons (spallation). These nucleons move in different directions, conserving mass-energy and momentum, and the moving, charged nucleons produce a wake of charge separation. This wake of charge separation may recombine or some of the separated charge may be captured by an active node of the circuitry. As an example, consider a neutron interacting with the drain node of the transistor driving Data in Figure 2 (shown with a green dot). Let one of the spallation nucleons pass through the critical volume near the drain of the nmos transistor so that the drain can capture some of the separated charge. – If Data is high and nData is low, then the drain node where the transistor passes through is biased high while the p-well is biased to ground. Figure 3 shows the voltage difference that can capture some of the separated negative charge into the drain of the transistor. This captured charge produces a pulse of current that can flip the voltage of the Data node from high to low. Once the Data node flips from high to low, it begins to drive the nData node from low to high. If the pulse of current lasts long enough to maintain the Data node low until nData is driven high, the latch has completely flipped and the stored data is lost. – Conversely, if Data is low and nData is high, then the drain node will be at nearly the same voltage as the p-well, and there is little voltage difference that can capture some of the separated charge. In the absence of an external voltage difference, the separated charges will simply recombine. Table 2. Results of Soft Error in Figure 2