Abstract:
A method for identifying erroneous data in at least one memory element, particularly a register, that includes at least one flip-flop that is intended to allow reliable detection of soft errors. To this end, writing of data to the at least one memory element involves at least one write security bit being produced from these data and stored in an associated security memory element, wherein at least one output security bit is computed from the data continuously in the same way as for writing and is compared with the corresponding write security bit.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is the U.S. National Phase Application of PCT International Application No. PCT/EP2014/078088, filed Dec. 16, 2014, which claims priority to German Patent Application No. 10 2013 226 407.0, filed Dec. 18, 2013, the contents of such applications being incorporated by reference herein. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The invention relates to an apparatus and a method for identifying erroneous data in at least one memory element, in particular a register, comprising at least one flip-flop. It furthermore relates to an apparatus to carry out a method of this type and an integrated circuit with an apparatus of this type. 
       BACKGROUND OF THE INVENTION 
       [0003]    The special feature of a register is that its data outputs always (and not, such as e.g. in the case of a RAM, only after addressing) show the stored datum and are often not only used for storage, but also define a hardware function, for example the baud rate of a timer, the protocol of a communication, etc. 
         [0004]    The term “soft errors” refers to errors that are not caused by physical damage, but through modification of the state of a bistable component due to external influences. Bistable components are, for example, flip-flops which can assume and also maintain two different states. 
         [0005]    Soft errors are normally caused by high-energy particles, for example also as part of the cosmic radiation or radioactive inclusions in the housing material which penetrate a semiconductor and strike there, this being referred to as a “Single Event Upset” (SEU). RAM modules, but also flip-flops, are typically affected. Known countermeasures are error-detecting and/or error-correcting codings of the data in the RAM, for example by means of Error Correcting Code (ECC). 
         [0006]    In the case of flip-flops, it is known as a protective measure to perform a majority decision. The flip-flop is triplicated and if all flip-flops do not have the same state, a “2 out of 3” or two-thirds majority decision is performed. Furthermore, radiation-resistant flip-flops are known which are less vulnerable but are also significantly larger than standard flip-flops. Other known methods use periodic reading (program-controlled) and rewriting of critical data. Periodic checking with CRC is similarly known, whereby each bit is serially polled periodically by means of e.g. a state machine and is incorporated in the calculation of a CRC sum. 
         [0007]    Flip-flops are normally used as basic elements for many types of registers which are used, in particular, in microcontrollers, but also in most other IC types, for storage of data. One application is e.g. the storage of calibration data for an analog circuit or of configuration data for adaptation to a specific task. 
         [0008]    In the case of registers which store variable data, the occurrence of the aforementioned errors means a temporary deviation in the calculation flow or control flow which can often be ignored in the system. A modification of the data in a configuration register or trim register is significantly more critical since, in registers of this type, the stored data are normally written once only after the system is switched on. In some instances, an error due to SEU will then remain until the system is switched off and may result in severe malfunctions. 
       SUMMARY OF THE INVENTION 
       [0009]    An aspect of the invention provides a method for detecting and controlling soft errors in a register. Furthermore, a corresponding apparatus and a corresponding integrated circuit are intended to be provided. 
         [0010]    In relation to the method, according to an aspect of the invention, when data are written to the at least one data memory element, at least one write security bit is generated from these data and is stored in an assigned security memory element, and wherein at least one output security bit is calculated continuously from the data in the same way as for writing and is compared with the corresponding write security bit. 
         [0011]    An aspect of the invention is based on the notion that the detection of soft errors is important, particularly when data are not written regularly but instead, particularly at the start of operation, are stored once only. Although these data are written once only, they may contain important information, for example configuration settings which are important for further operation. Errors in the data should be identified immediately following the occurrence or with a short latency. An implementation of majority decision units in which the data are written to some extent in a redundant manner to a plurality of memory modules requires large chip areas and high power consumption. The methods with periodic checking take up processing time. The more critical the error detection latency requirement, the longer the processing time. 
         [0012]    As has now been recognized, a reliable and resource-saving detection of soft errors is possible in that a number of security bits characterizing the data are already generated or calculated during the original writing of the data. These (output) security bits can be regenerated from the output data by means of combinatory logic in the same way, i.e. according to the same calculation rules, whereby a comparison with the writing of these bits reliably indicates the occurrence of soft errors in the absence of a correspondence. The occurrence of errors can therefore be detected immediately. This then enables a warning against the use of these data and/or direct correction of these data. 
         [0013]    According to an aspect of the invention, at least one security bit or output security bit is calculated from the data from the data memory element in the same way as with writing and is compared with the corresponding write security bit. An absence of correspondence indicates the interim occurrence of a soft error which expresses itself, for example, in one or more bit inversions. 
         [0014]    The writing of the data is advantageously initiated by a processor (CPU) or by a state machine or by a signal. 
         [0015]    An absence of correspondence between the respective write security bit and the corresponding read security bit is preferably signaled to the processor. 
         [0016]    The signaling is preferably effected by setting at least one flag and/or interrupt. This is advantageously performed e.g. in a status register with or without an interrupt capability, and enables the system or the processor to initiate and carry out error-handling measures. 
         [0017]    In one preferred embodiment, due to an absence of correspondence between the calculated security bits or output security bits and the generated write security bit, i.e. on detection of an error that has occurred, the data are thus rewritten to the data memory element. This means that the procedure with which the data were originally written to the memory element is repeated by the processor or state machine. However, in contrast to known methods, this is not performed periodically, but only if required, i.e. if an error has occurred. In this way, the data are then—at least initially—available once more in error-free form for further procedures. 
         [0018]    The security bits are preferably parity bits and/or ECC bits. Parity bits characterize whether and how many “1” or “0” states are present in the data bits. In the case of even parity bits, an odd number of “1” states of the data corresponds to the value “1” of the parity bit; a “0” represents an even number of “1” bits of the data. This assignment is selected inversely in the case of odd parity bits. 
         [0019]    ECC (Error Correcting Code) bits are understood here to mean bits, or the method of generation thereof, which, at least to a restricted extent, allow not only the detection of errors but also the correction thereof by means of the ECC bits. Normally, 1-bit errors can be corrected immediately and 2-bit errors can be detected but not corrected. Multi-bit errors can be partially detected. The security bits can also be generated and written on the basis of other memory protection methods. 
         [0020]    In relation to the apparatus, the aforementioned object is achieved according to the invention with at least one logic unit in which a method described above is carried out. The method is preferably implemented through hardware and/or software in the at least one logic unit. The same logic unit can be provided to generate the security bits for writing and reading the data, or one logic unit can be provided in each case for each of the two procedures. The logic units may also be part of the processor or may be combined with the latter. 
         [0021]    In relation to the integrated circuit, the aforementioned object is achieved with at least one data memory element, at least one security memory element and an apparatus of this type. An integrated circuit of this type is preferably implemented in ICs with trimming of the parameters. (The component tolerances are often too great to achieve the required precision of a circuit. In such cases, components are aligned with one another, e.g. in the case of a voltage divider, one of a plurality of tapping points is selected.) A trimming is used in all measuring circuits, e.g. for sensor signals, valve current, but also power supply and comparators. A further possible use is the configuration for adapting the IC to an environment, e.g. vehicle type, wheel sensor type, monitoring thresholds of the on-board voltage, etc. 
         [0022]    In one preferred design, the data memory element comprises at least one flip-flop. 
         [0023]    The advantages of the invention lie in particular in that, due to the parallel writing of security bits during the writing of the data and a continuous monitoring of the data outputs, a resource-saving facility is created for detecting the occurrence of soft errors. By means of a continuous calculation of the security bits and a comparison with the originally written security bits, a warning against a further use of the erroneous data can be issued by means of a notification to the processor on detection of a discrepancy, as a result of which system malfunctions can be prevented. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0024]    An example embodiment of the invention is explained with reference to a drawing. In the drawing, in a strongly schematic representation: 
           [0025]      FIG. 1  shows a known configuration of three flip-flops with a majority decision circuit, 
           [0026]      FIG. 2  shows an integrated circuit with an apparatus for detecting erroneous data in at least one memory element, a data memory element and a security memory element in a first preferred embodiment, and 
           [0027]      FIG. 3  shows an integrated circuit in a second preferred embodiment. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0028]    Identical parts are denoted in all figures with the same reference numbers. 
         [0029]      FIG. 1  shows a register  2  for one bit. The register  2  is designed as a majority decision unit and comprises three flip-flops  6 ,  10 ,  14 , which are designed as D-flip-flops. The respective flip-flop  6 ,  10 ,  14  in each case comprises a data input D, a clock input Ck (“Clock”) and a data output Q. One of two stable states (for example characterized as “0” and “1”) is set by a processor (not shown) in each case in the three flip-flops  6 ,  10 ,  14  via a data line  20 , wherein the same state is set in each case in all three flip-flops  6 ,  10 ,  14 . The data bit is therefore stored, as it were, with triple redundancy or in triplicate. 
         [0030]    A majority decision logic unit  24  outputs the datum or bit stored in the register  2  implemented by the three flip-flops  6 ,  10 ,  14  in each case the state or the bit from the flip-flops  6 ,  10 ,  14  and makes a value available at an output A. Two cases can be distinguished here. In the case where the state of all three flip-flops  6 ,  10 ,  14  is identical, this state is made available at the output A. If two of the flip-flops  6 ,  10 ,  14  have a state which differs from the state of the third flip-flop  6 ,  10 ,  14 , the state which the two flip-flops  6 ,  10 ,  14  have is made available at the output A. As a result, a ⅔ majority decision is performed and the single flip-flop  6 ,  10 ,  14  with the differing value is, as it were, overruled. 
         [0031]    Disadvantageous aspects of the design of a register of this type are the large number of components and the associated space usage and power consumption. 
         [0032]      FIG. 2  shows an integrated circuit  30  according to an aspect of the invention with a main processor (CPU) or a state machine or the like  34  and a data memory element  38  which is designed as a register  42 . The register  42  is designed as a 32-bit register and comprises a multiplicity of flip-flops. In contrast to the circuits discussed in connection with  FIG. 1 , each bit is now represented by a single flip-flop. The register  42  may alternatively also be designed with a multiplicity of writable and readable memory locations. Furthermore, the integrated circuit  30  comprises a data line  62 . 
         [0033]    The integrated circuit  30  is enabled to detect soft errors which are caused, for example, by the incidence of high-energy radiation on the corresponding data memory element  38 . Due to the ionizing effect of the radiation, a bit inversion, for example, takes place in the register, i.e. the state of a bit is inverted. In contrast to hard errors, soft errors cause no damage to the components, but ensure a modification of their internal state. Depending on which location or number the inverted bit represents, a numerical value represented in the register  2 , for example, can change drastically or, with corresponding representation, may even change its sign, which may result in severe malfunctions in systems in which the numerical value characterizes an important or relevant quantity. 
         [0034]    In addition to the data memory element  38 , the integrated circuit  30  therefore has a security memory element  46  to detect soft errors. If data are written to the data memory element by the main processor  34  or a state machine via a data line  36 , security bits are written to the security memory element  46  by a logic unit  50 . The security bits may be one or more parity bits or ECC bits. 
         [0035]    The data stored in the register  42  are calculated by a logic unit  54  in the same way that the logic unit  50  calculated the security bits, from the data stored in the data memory element  38 , and are compared with the security bits stored in the security memory element  46 . The logic units  50  and  54  can also be combined into a common logic unit and/or can be combined with the main processor  34 /a state machine. An apparatus  56  for detecting soft errors is implemented by them. 
         [0036]    In the case where an absence of correspondence is established between the security bits produced or generated during the writing of the data and those calculated from the current register data, the logic unit  54  transmits a signal to the main processor  34  via a data line  58 . This signal may comprise the setting of a flag or an interrupt. This enables a response in the integrated circuit  30  to the erroneous data. The data are preferably regenerated or determined once more by the main processor  34  and are rewritten to the register  42  and the error is thus repaired. In a different implementation, the data (e.g. calibration data) can be reloaded from a read-only memory. Alternatively, the main processor  34  can also emit a warning indicating that a reliable operation of the system cannot be guaranteed and/or can instigate emergency measures such as, for example, a system reset, an emergency shutdown or similar. 
         [0037]    An integrated circuit  30  in a second preferred embodiment is shown in  FIG. 3 . Here, the logic unit  50  generates ECC bits, i.e. bits corresponding to an error-correcting algorithm, during the writing of data to the register  42 . The ECC bits allow not only the detection but also the correction of errors. In the present example embodiment, this correction is carried out by the logic unit  54 , which then makes the corrected data available on the data line  58 . This means that a correction of the data is also carried out along with the detection of errors. In this case also, it can be provided that the data are rewritten to the register if an error is detected. In addition, this configuration can also tolerate “hard” errors to some extent. 
         [0038]    The integrated circuit  30  according to  FIG. 2 or 3  is advantageously used, for example, to protect configuration data in microcontroller peripheral modules, e.g. frequency dividers for clock generators, acquisition values, SPI baud rate, CAN temporal bit clocking, etc. 
         [0039]    It can furthermore be used advantageously to protect calibration data in analog ICs. Here, for example, 500 to 1000 bits can be used to trim the parameters. These data are written to a read-only memory during production and are then transferred into flip-flops after the voltage has been switched on or following a reset. Said flip-flops can then be checked continuously for deviations with a few bits. A similar procedure is possible with configuration data in the IC. In contrast to calibration, the configuration is defined in the application. Examples of this are thresholds of comparators, protocols for wheel sensors, etc. 
       REFERENCE NUMBER LIST 
       [0000]    
       
           2  Register 
           6  Flip-flop 
           10  Flip-flop 
           14  Flip-flop 
           20  Data line 
           24  Majority decision logic 
           30  Integrated circuit 
           34  Main processor 
           36  Data line 
           38  Data memory element 
           42  Register 
           46  Security memory element 
           50  Logic unit 
           54  Logic unit 
           56  Apparatus 
           58  Data line 
           62  Data line 
         D Data input 
         Ck Clock input 
         Q Data output 
         A Output