Non-volatile semiconductor memory with SCRAM hold cycle prior to SCRAM-to-E.sup.2 PROM backup transfer

A non-volatile memory system includes an SRAM and a backup store of E.sup.2 PROMs. In the event of a short duration power interruption, the memory system enters a hold mode in which data maintenance power is supplied to the SRAM by discharging a backup capacitor, and accessing of the SRAM by a host computer is halted. If the backup capacitor voltage does not fall below a threshold before power is restored, the hold mode is terminated and accessing by the host computer continues. If the backup capacitor voltage falls below the threshold, operating power is supplied to the SRAM, E.sup.2 PROM, and associated circuitry to download all data and row and column parity data into the E.sup.2 PROM by further discharging of the backup capacitor. Row parity and column parity information are accumulated by a bit-per-chip accumulation technique that allows convenient error correction on a "per chip" basis. Data is encrypted and decrypted on the basis of a fully erasable magnetic key.

BACKGROUND OF THE INVENTION 
The invention relates to non-volatile semiconductor memory systems 
including a volatile high speed SRAM (static random access memory), a 
non-volatile E.sup.2 PROM (electrically eraseable programmable read only 
memory) backup memory, and circuitry for transferring the contents of the 
SRAM to the E.sup.2 PROM in response to onset of a power interruption or 
failure. 
In the past, core memory systems have been widely used where non-volatile 
RAMs were required, since the ferrite cores used therein are inherently 
non-volatile. 
The technology for semiconductor memories has advanced rapidly, making 
semiconductor memories faster, more reliable, and less costly than core 
memories. However, in applications where non-volatile memory is required, 
the problems of volatility of available semiconductor RAM storage cells, 
the slow write speed and wear out factor of E.sup.2 PROM circuits that 
might otherwise be used as backup memories, the large amounts of power 
required to sustain data storage in available semiconductor RAMs and to 
effectuate transfer of data from such RAMs to E.sup.2 PROMs, and the 
difficulties of storing enough energy in a backup capacitor to effectuate 
RAM-to-E.sup.2 PROM downloading have combined to prevent semiconductor 
memories from being widely used where non-volatile memory performance is 
required. 
U. S. Pat. No. 4,591,782 (Germer, issued May 27, 1986) describes a 
non-volatile memory incorporated into an electric meter in which volatile 
semiconductor memory is used in conjunction with a backup capacitor and 
control circuitry. The control circuitry senses the onset of a power 
failure. The backup capacitor supplies power to effectuate transfer of 
some of the data from the volatile semiconductor memory to a non-volatile 
E.sup.2 PROM backup memory. The Germer patent deals with the problem of 
"wear out" of the E.sup.2 PROMs by not: immediately transferring data from 
the non-volatile storage to the E.sup.2 PROMs and instead waiting a fixed 
amount of time until a preset counter "times out". The backup capacitor 
has sufficient energy storage to maintain power to critical circuits for a 
long enough period after power failure to permit transfer of the entire 
contents of the volatile RAM to the non-volatile E.sup.2 PROM. When a 
momentary power outage causes the voltage of an unregulated DC power 
supply to fall below a first threshold, a counter is started, but normal 
operation of the system continues. If the unregulated DC voltage does not 
rise above a second threshold that is slightly higher than the first 
threshold before the counter times out, a processor initiates transfer of 
data from the voltatile RAM to the non-volatile E.sup.2 PROM. If the 
regulated supply voltage falls below a third threshold at which the 
processor is no longer able to reliably maintain its operating conditions, 
a reset signal is produced to reset the processor. The third threshold is 
set low enough that all data is safely transferred from the volatile RAM 
to the non-volatile E.sup.2 PROM before the reset signal is generated. 
There are several disadvantages of the Germer approach. The requirement of 
a backup timer and the circuitry using the three thresholds increases 
overall complexity and cost of the Germer system. The timeout period of 
the backup timer is constant, so if the current drawn by the E.sup.2 PROM 
and associated circuitry increases with age or if the storage capacity of 
the backup capacitors is degraded the timeout period of the timer may be 
inadequate and data may be lost. The constant duration timeout period does 
not permit maximum useage of the storage capacity of the backup capacitor, 
so unnecessary downloading and uploading may occur for short duration 
power losses even though the backup supply has the capacity to maintain 
integrity of data in the volatile RAM for the duration of the power loss. 
There exist devices called NOVORAMs that combine the functions of an SRAM 
and an E.sup.2 PROM on a single silicon chip. Data from the SRAM portion 
may be stored in the non-volatile E.sup.2 PROM portion prior to power 
loss. However, if power is removed prior to completion of data transfer 
from the SRAM portion to the E.sup.2 PROM portion, the correctness of data 
in the E.sup.2 PROM is indeterminate. 
It has been a common practice to encrypt data before storing it. Government 
approved encryption algorithms using a "key word" often are used. The 
encrypted data usually is stored in magnetic media. If there is a need to 
destroy the encrypted data, all of it must be erased from the magnetic 
media. In some cases, the amount of time required to erase the encrypted 
data from the magnetic media may be unacceptable. 
There is an unmet need for a non-volatile memory system which includes a 
volatile semiconductor RAM and a non-volatile backup memory to which data 
in the RAM is downloaded during power interruptions and from which data is 
uploaded into the RAM after power interruptions, wherein the number of 
downloading operations is minimized in accordance with the duration of 
power interruption, condition of a backup power source, and current drain 
of the entire memory system. 
SUMMARY OF THE INVENTION 
Accordingly, it is an object of the invention to provide an economical 
non-volatile semiconductor memory system that provides substantially 
faster performance, utilizes substantially less power, and occupies 
substantially less space than the closest prior non-volatile core memory 
systems. 
It is another object of the invention to provide reliable data retention in 
a high speed semiconductor random access read/write memory system in an 
environment in which intermittent short duration power failures are 
likely. 
It is another object of the invention to provide minimum degradation of an 
E.sup.2 PROM backup memory for a high speed semiconductor SRAM. 
It is another object of the invention to provide minimum duration of memory 
useage interruptions caused by short duration power interruptions, such as 
power interruptions caused by high electrical noise on an input power 
line. 
It is another object of the invention to provide an E.sup.2 PROM based 
backup system for a volatile RAM wherein downloading operations are 
avoided unless a backup power source is unable to safely supply enough 
power to effectuate such downloading. 
It is another object of the invention to provide a secure non-volatile 
memory system in which data stored in a non-volatile backup memory during 
a power interruption can be, in effect, very rapidly erased or made 
undecipherable. 
Briefly described, and in accordance with one embodiment thereof, the 
invention provides a system that utilizes a volatile SRAM and a 
non-volatile backup store implemented by means of E.sup.2 PROMs in which 
data is transferred from the SRAMs to the E.sup.2 PROMs when the power is 
turned off or interrupted by using high voltage energy stored in a backup 
capacitor to provide operating power for at least a long enough period of 
time to effectuate reliable transfer of data from the SRAM to the E.sup.2 
PROM. Any drop in input power below a first threshold causes operation of 
the SRAM to be halted as soon as the present cycle of operation is 
finished. An internal power supply voltage applied to the SRAMs is reduced 
to a minimal maintenance level (e.g., 2 volts), and power to certain other 
circuitry in the system is cut off. The energy stored in the backup 
capacitor is monitored, and at a time when just enough energy plus a 
safety factor remains to download all of the data from the SRAM to the 
E.sup.2 PROM, a controller effectuates downloading of all the data in the 
SRAM to the E.sup. 2 PROM backup memory. A unique row-column parity 
accumulation and check system "scrubs" errors from data read out of the 
E.sup.2 PROM during an upload of data from the E.sup.2 PROM to the SRAM. 
More specifically, in the described embodiment of the invention, the backup 
capacitor voltage is charged up to and maintained at a selected level of 
approximately 100 volts while the external power supply is applied to the 
non-volatile memory system. Accessing of the SRAM by a host computer is 
halted while the backup capacitor is discharged to supply energy to 
maintain the reduced data maintenance voltage across the SRAM if the 
external supply voltage falls below the first threshold. Accessing of the 
SRAM by the host computer is resumed if the external power supply voltage 
rises above the first threshold before the backup capacitor voltage falls 
below a second threshold of approximately 85 volts. If the backup 
capacitor voltage falls below the second threshold, all of the data in the 
SRAM is downloaded to the E.sup.2 PROM while the backup capacitor is 
discharged to supply energy to maintain the internal power supply voltage 
at 5 volts during the entire downloading. The backup capacitor stores 
enough energy when the backup capacitor voltage is at 100 volts to both 
allow the halted condition to continue for at least one minute and also 
effectuate complete downloading of data from the SRAM to the E.sup.2 PROM. 
Power is removed from the E.sup.2 PROM during read or write memory 
accesses by the host computer and also when the 2 volt data maintenance 
voltage is being maintained on the SRAM. During downloading, row parity 
information and column parity information are accumulated and stored in 
the E.sup.2 PROM along with the data from the SRAM. The non-volatile 
memory system includes a plurality of integrated circuit SRAMs and a 
plurality of integrated circuit E.sup.2 PROMs, each of which is subdivided 
into a plurality of subsections. The downloading operation includes 
reading words in a first subsection of a first integrated circuit SRAM and 
transferring the read data into a corresponding subsection of a first 
integrated circuit E.sup.2 PROM, and also transferring the read data into 
corresponding words of a row parity accumulator and also into a column 
parity accumulator. The words in a first subsection of a second integrated 
circuit SRAM then are read and exclusively ORed with corresponding words 
of the row parity accumulator and the results replace corresponding words 
of the row parity accumulator. Each word of the first subsection also is 
exclusively ORed with the word in the column parity accumulator, and the 
result replaces the same prior word in the column parity accumulator. The 
contents of the row parity accumulator and the column parity accumulator 
then are transferred into a scratch pad section of the E.sup.2 PROM. The 
uploading operation includes reading the words in a first subsection of 
the first integrated circuit E.sup.2 PROM and transferring the read data 
into the first subsection of the SRAM, and also transferring the read data 
into corresponding words of the row parity accumulator and the column 
parity accumulator. The words in a first subsection of a second integrated 
circuit E.sup.2 PROM are read and exclusively ORed with the corresponding 
words of the row parity accumulator and the result replaces the same word 
of the row parity accumulator. The words in the first subsection of the 
second integrated circuit E.sup.2 PROM also are exclusively ORed with the 
contents of the column parity accumulator and the result replaces the 
contents of the column parity accumulator. The row parity data and the 
column parity data are compared with previously stored row parity data and 
column parity data written into the E.sup.2 PROM during a prior 
downloading operation. An error pattern is produced if a mismatch occurs, 
and data written into the SRAM is exclusively ORed with the error pattern 
to correct the data. The corrected data then is written into the SRAM.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
Referring to FIG. 1, memory system 1 includes a volatile RAM (Random Access 
Memory) section 2, which in the presently preferred embodiment of the 
invention includes CMOS static RAM cells. The SRAM cells preferably 
operate reliably to retain data with power supply voltages as low as 2 
volts, and operate at normal speeds with V.sub.DD, equal to +5 volts. SRAM 
2 is organized as 256k (actually 262,144) words each including 16 data 
bits and 6 bits of Hamming code data. 
SRAM 2 is accessed in response to control circuitry 22 and in conjunction 
with operation of error detection and correction circuitry 18. Control 
circuitry 22 generates addresses on bus 23 for accessing SRAM 2 and 
E.sup.2 PROM 8. Bus 23 also includes data conductors, a read conductor, 
and a write conductor. Bus 23 also includes 6 Hamming code conductors and 
2 parity bit conductors. Control circuitry 22 is coupled by bus 25 to data 
input/output circuitry 26, which receives address and control signals on 
conductors 28. Eighteen Data In conductors 30A and eighteen Data Out 
conductors 30B are connected to input/output unit 26. 
Power is supplied to SRAM 2 via a power bus from an energy storage circuit 
6 which contains circuitry shown in FIG. 2 to supply a steady internal 
input power during normal operating conditions and backup power during 
short duration power interruptions. External power bus 10 supplies input 
power at, for example, +5 volts, to energy storage circuit 6. 
Non-volatile memory system 1 also includes an E.sup.2 PROM 8. Bus 23 
includes conductors coupled to error detection and correction circuitry 20 
and control circuit 22. Error detection circuitry 18 includes standard 
Hamming code double bit detection, single bit correction circuitry to 
"scrub" errors from data read out of SRAM 2. Error detection and 
correction circuitry 20 includes row and column parity circuitry and 
correction circuitry which efficiently "scrubs" errors from data read out 
of E.sup.2 PROM 8. 
The non-volatile memory system 1 of FIG. 1 normally operates as an SRAM 
when the main power on conductor 10 is present. If there is a power 
interruption or failure, non-volatile energy system 1 acts as a backup 
memory that contains all of the data in SRAM 2 immediately before the 
interruption of input power 10. 
If the input power 10 falls below specification limits (typically 10% below 
a nominal V.sub.DD voltage of 5 volts), the system 1 goes into a "hold 
mode", reducing the sustaining power to SRAM 2 to approximately 2 volts 
and cutting off power via conductors 14 to control circuitry 22, 
input/output circuitry 26, and error correction and detection circuitry 18 
and 20. If the input power 10 does not then increase to a minimum 
specification level within a "hold" period which preferably is at least 
approximately one minute, control circuitry 22 (which along with SRAM 2 is 
being sustained by a backup capacitor in energy storage circuit 6) 
initiates downloading of data from SRAM 2 to E.sup.2 PROM 8 and applies 
the internal supply voltage to the components as needed to effectuate the 
downloading. 
More specifically, downloading is initiated if the voltage stored on the 
backup capacitor falls below the predefined threshold, typically about 80% 
below the nominal backup energy level. In this event, the controller 
circuit 22 applies full power from the energy storage circuit 6 to all or 
nearly all of the circuitry in FIG. 1 to effectuate downloading of the 
entire contents of SRAM 2 into E.sup.2 PROM 8. Controller circuit 22 
controls the sequence of all transfers of data between SRAM 2 and E.sup.2 
PROM 8. Controller circuit 22 also controls all I/O functions and built-in 
self test and housekeeping functions. 
The overall operation of non-volatile memory 1 can be more thoroughly 
understood by referring to the timing diagram of FIG. 5. In FIG. 5, 
numeral 32 designates an example of a waveform of the input voltage 
carried by conductor 10. Dotted line 33 represents a minimum input voltage 
threshold. Input power waveform 32 rises from an initial zero level up to 
a constant operating level, as indicated by numeral 32A. Data in E.sup.2 
PROM 8 then is "uploaded" into SRAM 2 during the interval 38B in the "Data 
Location" graph in FIG. 5. 
In the example of FIG. 5, the input voltage 10 then falls below the input 
voltage threshold at point 33A, as indicated by section 32B of waveform 
32. After being below the input voltage threshold 33 for a short period of 
time, which should be at least about one minute, the input voltage rises 
as indicated by numeral 32D to level 32E, crossing the input voltage 
threshold at point 33B and remaining at +5 volts for an indefinite period 
of time. Then the input voltage falls below the input voltage threshold at 
point 33C and remains low for an indefinite time, as indicated by numeral 
32F. 
In accordance with the present invention, the duration of section 32C of 
input voltage waveform 32 is short enough that non-volatile memory system 
1 goes into a "hold mode", which is a low power data maintenance mode, 
after finishing the present read or write cycle. However, the data of SRAM 
2 is not downloaded to E.sup.2 PROM 8 unless the backup voltage waveform 
35 falls below a "backup voltage threshold" designated by dotted line 36 
for more than the minimum hold time. 
The above mentioned backup voltage waveform 35 represents the voltage 
stored on backup capacitor 43 of FIG. 2 as a result of the input power 
interruptions shown in input voltage waveform 32. More specifically, input 
voltage waveform 32 causes backup voltage waveform 35 to rise as indicated 
by numeral 35A, crossing the backup voltage threshold 36 at point 36A and 
then leveling off as indicated by numeral 35B. The interruption of input 
power designated by section 32B of input voltage waveform 32 causes a very 
slow decay of backup voltage waveform 35 between points 35C and 35D. 
However, backup voltage waveform 35 does not fall below backup voltage 
threshold 36. When the input voltage waveform 32 then rises as indicated 
by numeral 32D, backup voltage waveform 35 rises from point 35D to its 
normal level 35E 
However, when input voltage waveform 32 is later interrupted as indicated 
by numeral 32F, backup voltage waveform 35 slowly decays from point 35F to 
the backup voltage threshold 36, as indicated at point 35G. This initiates 
downloading of data from SRAM 2 to E.sup.2 PROM 8, resulting in the 
further decay of backup voltage 35 between points 35G and 35H. 
Data Location graph 38 in FIG. 5 indicates the time intervals in which data 
is stored in the E.sup.2 PROM 8 and SRAM 2, uploaded from E.sup.2 PROM 8 
to SRAM 2, and downloaded from to SRAM 2 to E.sup.2 PROM 8. When both 
input voltage waveform 32 and backup voltage waveform 35 are above their 
respective thresholds 33 and 36 during initial powering up of non-volatile 
memory 1, the read/write waveform 40 is at a low level. The powering up 
operation typically takes approximately 3 seconds. Interval 38B designates 
the time during which data is being uploaded from E.sup.2 PROM 8 to SRAM 
2, and typically is approximately 250 milliseconds. Once the transfer is 
complete, then read/write waveform 40 undergoes transition 40A to level 
40B. While read/write waveform 40 is at level 40B, a host computer 120 
(FIG. 3) can perform ordinary read and write accesses to SRAM 2. 
Meanwhile, E.sup.2 PROM 8 and its associated row and column parity 
circuitry 20 are powered down by control unit 101 of FIG. 3A. 
FIG. 2 shows energy storage circuitry 6, which includes a voltage up 
converter 42 that performs the function of boosting the external 5 volt 
power supply voltage on conductor 10 to charge up a l,000 to 5,000 
microfarad backup capacitor 43 to approximately 100 volts to provide a 
backup voltage on backup capacitor terminal 65 to power the non-volatile 
memory system 1. 
The 100 volts produced on conductor 65 by backup capacitor 43 when it is 
fully charged then is converted back down to the internal 5 volt supply 
voltage on conductor 91 whenever the external 5 volt level on conductor 10 
is interrupted, by slowly discharging the energy stored in backup 
capacitor 43. Control circuit 101 (FIG. 3A) supplies separate control 
voltages to conductors 91A, 91B, and 91C to distribute the internal 5 volt 
supply voltage on conductor 91 to conductors 12, 14, and 16, respectively, 
by selectively turning on MOSFETs 97, 98, and 99. If MOSFET 97 is turned 
off, a three volt zener diode 92 maintains conductor 12 at 2 volts to 
provide standby power to SRAM 2. At this low voltage, all data is 
maintained in SRAM 2 in which the total current drawn by SRAM 2 is reduced 
to only about a miliampere. 
Voltage up converter 42 includes a regulator circuit 46, which may be 
implemented by means of a Motorola "Universal Switching Regulator 
Subsystem", part number UA78S40. Oscillator 46 contains a comparator 48 
and an oscillator 47. The output of oscillator 47 is connected to a pullup 
resistor and a coupling capacitor 51 and to the input of an amplifier. The 
amplifier includes NPN transistors 52, 55, and 57, diode 53, and resistors 
54, 56, and 58. This amplifier provides a 6-to-1 duty cycle pulse signal 
to the base of NPN transistor 60, producing current to charge inductor 61. 
When the transistor 60 is turned off, a back emf is generated across 
inductor 61, forward biasing diode 62. This causes the current in inductor 
61 to charge up capacitor 43. This operation continues with the same duty 
cycle until the voltage on conductor 65 reaches approximately 100 volts. 
The current flowing through inductor 61 also flows through a 0.1 ohm 
resistor 41A, the upper terminal of which is connected to +5 volt 
conductor 10. The other terminal of resistor 41A is connected to inductor 
61 and a control input of oscillator 47. Resistor 41A prevents excessive 
current from flowing through inductor 61 and transistor 60. When the 
backup capacitor voltage 65 has been charged to approximately 100 volts, a 
voltage divider circuit including resistors 66 and 67 produces a voltage 
that exceeds a reference voltage V.sub.REF applied to the non-inverting 
input of comparator 48. This stops oscillator 47 until the voltage on 
conductor 68 falls below V.sub.REF, effectively stretching out the duty 
cycle of the charging of backup capacitor 43. 
It should be noted that switch 49 initially is momentarily closed, charging 
conductor 91 to 5 volts, and thereby providing a 5 volt internal "jump 
start" supply voltage to all of the circuits in voltage down converter 
circuit 44. Voltage down converter circuit 44 includes an oscillator 71 
that produces a square wave output that is amplified and shaped by an 
amplifier including transistors 72, 73, and 77. This amplifier also 
includes resistors 74 and 76 and capacitor 75, and produces a square wave 
current pulse through the primary winding of transformer 80. The secondary 
winding of transformer 80 is connected between the gate and source of a 
MOSFET 83. The source of MOSFET 83 is connected to the cathode of a diode 
84, the anode of which is connected to ground. The secondary winding of 
transformer 80 produces a voltage pulse that turns MOSFET 83 on, causing 
current to flow from backup capacitor 43 through resistor 88, MOSFET 83, 
and inductor 69, charging up capacitor 89. When MOSFET 83 is turned off, a 
back emf across inductor 69 causes the induction current to continue 
flowing, forward biasing "catch" diode 84 and further charging up 
capacitor 89 and conductor 91. 
When the voltage on conductor 91 reaches 5 volts, a resistive divider 
circuit including resistors 63 and 64 causes the voltage on the inverting 
input of comparator 70 to exceed a reference voltage V.sub.REF applied to 
the non-inverting terminal thereof, halting oscillator 71. Backup 
capacitor 43 thus is gradually discharged as needed to maintain 5 volts on 
internal 5 volt conductor 91. 
Comparator 93 generates a "Input Power Okay" signal P.sub.INOK on conductor 
94 by sensing the input supply voltage on conductor 10 by means of a 
resistive divider circuit that applies a voltage to the non-inverting 
input of comparator 93. When V.sub.DD is less then +4.5 volts, P.sub.INOK 
goes from a "1" to a "0", initiating the above described "hold mode". 
When the backup voltage on conductor 65 is less than about 85% of its usual 
voltage of 100 volts, this causes a voltage divider to apply a voltage 
less than V.sub.REF to the non-inverting input of comparator 95, so that 
an "Energy Okay" signal E.sub.OK on conductor 96 goes from a "1" to a "0", 
initiating the downloading of data from SRAM 2 to E.sup.2 PROM 8. 
FIG. 3 illustrates the organization of SRAM 2, E.sup.2 PROM 8, and ASIC 
(Application Specific Integrated Circuit) device 115 that includes control 
circuit 22, Hamming code error detection and correction circuitry 18, row 
and column parity error detection and correction circuitry 20, and part of 
input/output circuit 26. ASIC 115 can be an XC3090 programmable logic gate 
array manufactured by XILINK. It can be programmed to a wide variety of 
configurations to establish various input/output formats that might be 
desirable for input/output circuitry 26. 
A 56 bit magnetic register 111 constitutes a "secure key" which is a 
completely eraseable 56 bit code that is read as a "seed" into an 
encryption/decryption circuit 112 (FIG. 3A) in ASIC 115 to automatically 
encrypt data being downloaded from SRAM 2 to E.sup.2 PROM 8 and 
automatically decrypt seed data when it is being uploaded from E.sup.2 
PROM 8 to SRAM 2. The 56 bit magnetic register, which can be fabricated of 
ferrite memory cores, can be erased and reset to contain a different 
"security key" in such a manner that the original key cannot be recovered, 
at least not at the present state-of-the-art. 
As those skilled in the art know, a fast, reliable erase of certain stored 
data may be required. It is known that E.sup.2 PROMs must be rewritten 
several times in order to reliably erase all evidence of the previously 
stored data. It is also known that E.sup.2 PROMs require very long write 
cycles. 
Therefore, there is a need for a much faster, more reliable means of 
effectively erasing data stored in an E.sup.2 PROM. The above described 
system allows an "effective erasing" of the contents of the E.sup.2 PROM 
so that the previously stored data becomes undecipherable in an extremely 
fast manner by simply erasing the contents of the magnetic register 111, 
which can be accomplished in about 10 microseconds. It also is known that 
without a secure key, the encrypted data that might be otherwise recovered 
from E.sup.2 PROM 8 cannot, as a practical matter, be deciphered, and 
hence can be "declassified", whereas, certain data that might be stored in 
non-volatile memory system 1 might otherwise have to be treated as 
"classified" or secret. 
As shown in FIG. 3, SRAM 2 includes sections 2A-1, 2A-2 . . . 2A-8, each of 
which is a 32,768 word (i.e., 32k) by 16 bit CMOS SRAM, such as an 
IDT71256L85LB, manufactured by Integrated Device Technology Corp., having 
its address inputs connected to address bus 28B. The data terminals of 
each of SRAMs 2A-1 . . . 2A-8 are connected to internal data bus 30A,B. A 
similar group of eight CMOS SRAMs 2B-1 . . . 2B-8 having address and data 
terminals connected to address bus 28B and the internal data bus 30A,B 
also is composed of identical 32k by 8 CMOS SRAMs; this group of SRAMs is 
used to store Hamming code data. Finally, SRAM 2 also includes an 
identical 32k word by 16 CMOS SRAM scratch pad memory 2C having its data 
terminals and address terminals connected to address bus 28B and the data 
bus 30A,B, respectively. The address terminals of the Hamming code data 
SRAMS 2B-1 . . . 2B-8 are connected by conductors 109A to ASIC 115. 
Address buffer 26A buffers the 18 bit external address bus conductors 28A 
from the various internal address bus conductors 28B and 28C. Data buffers 
26B and 26C buffer the 18 external Data In conductors 30A and the 18 
external Data Out conductors 30B from the internal data bus conductors 
30A,B. 
E.sup.2 PROM 8 includes sections 8A-1 . . . 8A-8 organized identically (32k 
words by 16 bits) to data section 2A-1 . . . 2A-8 of SRAM 2. The address 
and data terminals of the E.sup.2 PROMs 8A-1 through 8A-8 are connected to 
the address bus conductors 28B and the data bus conductors 30A,B, 
respectively. E.sup.2 PROM 8 also includes an identical 32k word by 16 bit 
row parity memory 8B having its address and data conductors connected to 
address bus 28B and data bus 30A,B. Column parity and correction data and 
maintenance data section 8C of E.sup.2 PROM 8 also has its address and 
data terminals connected to address bus 28B and data bus 30A,B. 
FIG. 3A shows a block diagram representing the functional blocks 
"programmed" into ASIC 115 in order to accomplish the control, Hamming 
code generation, row and column parity generation, and checking functions 
needed to implement the error detection and correction circuits 18 and 20 
of FIG. 1. 
Address decode circuit 100 receives as inputs 28C the three external higher 
order addresses A15, A16, and A17 of address bus 28B. Address decode 
circuit 100 also receives address inputs 107A (A15-A17) produced by 
address generation circuit 107 in response to either upload sequence 
circuit 106 or download sequence circuit 10B. Address decode circuit 100 
generates nine SRAM chip select conductors 100A and ten E.sup.2 PROM chip 
select conductors 100B to effectuate the necessary chip select functions 
for downloading SRAM 2 into E.sup.2 PROM 8, uploading E.sup.2 PROM 8 into 
SRAM 2, and accessing of SRAM 2 by a host computer 120 via the 
input/output circuitry 26 of FIG. 1. 
Control circuit 101 receives P.sub.INOK and E.sub.OK on conductors 94 and 
96, upload control signals 106A from upload sequencing circuit 106, and 
download control signals 108A from download sequencing circuit 108. 
Download sequencer circuit 10B is an ordinary "state machine" circuit that 
receives control inputs 108A indicating that the input power has fallen 
below threshold 33 and that the backup capacitor voltage has fallen below 
threshold 36 (FIG. 5). By communicating back to control circuit 101 and 
address generator 107, data is transferred from the SRAM 2 to E.sup.2 PROM 
8 at the same time that row/column parity data is accumulated. At the 
completion of a 64 word transfer, the row/column parity controller 105 
transfers parity data into E.sup.2 PROM 8. This process is repeated 512 
times, until all data has been transferred from the SRAM 2 to the E.sup.2 
PROM 8. Control circuit 101 includes both a counter which counts 64 word 
blocks and the above-mentioned state machine. 
Upload sequencer 106 triggers control circuit 101 to generate the necessary 
timing to generate the read and write signals required for the downloading 
operation. 
Upload sequencer 106 is implemented similarly to download sequencer 108, to 
transfer data in opposite direction from the E.sup.2 PROM 8 to SRAM 2 
wherein both input power and the backup voltage exceed their respective 
thresholds 33 and 36 (FIG. 5). At the completion of each 64 word block 
transfer, the generated row/column parities are compared to the stored 
parities for the determination of the failure locations so that uploaded 
data can be corrected. 
Control circuit 101 receives data error information 102A from Data In 
parity check circuit 102, and also receives external read and external 
write signals and control signals on bus 101A. Control circuit 101 also 
receives control signals generated by host computer 120 on bus 101A. 
Control block 101 is configured to provide back plane timing signals and 
protocol and internal SRAM and E.sup.2 PROM timing. The timing element 
input is a delay line which is triggered by either an external cycle 
initiate trigger signal or an internal trigger stimulus. External trigger 
signals are the result of a request for read/write cycles from the host 
processor 120. Internal trigger signals result from internal requests for 
transfers, i.e., transferring data from SRAM 2 to E.sup.2 PROM 8 or vice 
versa. After an initial edge on the delay on a delay line following edges 
are produced by the conventional delay line circuitry at 25 nanosecond 
intervals, and suitable gain circuitry is provided to generate timing 
signals used to produce the sequence of handshaking required by the host 
computer 120, the setup timing, the hold times, and the access, read, and 
write timing signals required by SRAM 2 and E.sup.2 PROM 8 for an 
uploading or a downloading operation. Control circuit 101 also includes a 
mode sensing circuit which determines if a particular cycle is a read 
cycle or a write cycle. Once this information is latched, then the time 
sequence controlling data flow through the data input latch in block 102, 
the encryptor/decryptor circuit 112, the Hamming code generator 109, the 
Hamming comparator/corrector circuit 110, and the Data Out parity check 
circuit 104, and the column parity accumulator 103 can be processed. The 
control circuit 101 also provides feedback to the upload sequencer 106 and 
the download sequencer 108 allowing them to "bump" to the next address or 
sequence during the data transfers. 
Column parity accumulator 103 performs exclusive OR functions necessary to 
accumulate column parity, as subsequently explained with reference to FIG. 
4. 
More specifically, column parity accumulator 103 includes a 16 bit 
exclusive OR register, each bit of which may have the configuration shown 
in FIG. 6A, where i represents a particular bit of the lower and upper 
data bytes on data bus 30A,B. For each bit, if a particular logic level 
already is stored in the D type latch, and if the next value of the same 
bit loaded into the register is of the opposite logic level, a mismatch 
will be produced, and a "1" will appear on the output terminal 102C-i. 
Row/column parity accumulator control circuit 105 is used to control 
transfer of parity data from internal registers to scratch pad SRAM 2C, 
and then from scratch pad SRAM 2C into E.sup.2 PROM 8. During upload 
operations row/column parity accumulator control circuit 105 controls the 
comparison of generated parities to the previously stored parities and 
then helps effectuate correction of failed locations, as explained 
subsequently with reference to FIG. 4. 
Data In parity check circuit 102 latches data from internal data bus 30A,B, 
performs a parity check on the 18 bits on data bus 30A,B, generates a data 
error signal on conductor 102A if an error is detected, and makes the 
latched data available to column parity accumulator 103 via conductors 
102C or to encryptor/decryptor circuit 112 if it is presently enabled. If 
encryptor/decryptor circuit 112 is presently disabled, Data In parity 
check circuit 102 makes the latched data available to bus 112A, and hence 
to Hamming code generator 109 and Hamming comparator/corrector circuit 
110. The parity check is a dual byte parity check which involves exclusive 
ORing of the first data byte D0, D1 . . . D7 with the first (lower byte) 
parity bit D8 and logically ORing that with the exclusive OR of the second 
byte of data D9, D10 . . . D16 and the second (upper byte) parity bit 
which is D17. This expression produces the data error signal on conductor 
102, as indicated by the following equation: 
EQU DATA ERROR=(D0 .sym. D1 .sym. --- .sym. D7 .sym. D8).sym.(D9 .sym. D10 
.sym. --- .sym. D16 .sym. D17) 
Data Out parity generator 104 receives 16 bits of data via bus 103A from 
column parity accumulator 103 and generates the parity bits D8 and D17 for 
the lower and upper bytes of data, respectively. It receives corrected 
data from Hamming comparator/corrector 110 via bus 110C, and also performs 
the function of driving data bus 30A,B. The following equations show that 
lower parity bit D8 is the exclusive OR of the lower data bits D0, D1 . . 
. D7 on corrected data bus 110C, and upper parity bit D17 is the exclusive 
OR of bits D9 through D16 on corrected data bus 110C: 
EQU D8=D0 .sym. D1 .sym. --- .sym. D7 
EQU D17=D9 .sym. D10 .sym. --- .sym. D16 
Encryptor/decryptor circuit 112 receives an enable/disable signal on 
conductor 101D from controller 101 to perform an encryption/decryption 
function during downloading and uploading. Encryptor/decryptor circuit 112 
is bypassed during accessing of SRAM 2 by host computer 120. 
Encryptor/decryptor circuit 112 receives a 56 bit "security key" from 
fully eraseable 56 bit magnetic register 111 serially via conductor 111A. 
During upload or download operations the encrypted/decrypted output is 
supplied on bus 112A to Hamming code generator 109 and Hamming 
comparator/corrector 110. The encrypted data stored in E.sup.2 PROM 8 can 
be very quickly made un-decryptable, and hence "effectively erased", by 
merely erasing the security key word from magnetic register 111. 
Encryptor/decryptor circuit 112 could be implemented by using a Western 
Digital WD2001/WD2002 encryption/decryption devices which are designed to 
encrypt and decrypt 64-bit blocks of data using the algorithms specified 
in the Federal Information Processing Data Encryption Standard No. 46 
using a 56 bit user-specified key to produce a 64-bit cipher text word. 
Alternately, the publicly known algorithm can be programmed into the ASIC 
115, which is the applicant's preferred embodiment. The Western Digital 
Corporation June, 1984 Communication Products Handbook provides a detailed 
explanation and an application note. 
Hamming code generator 109 receives the 16 bits of latched data present on 
bus 112A and generates 6 bits of Hamming data on bus 109A. This is an 
entirely standard function that can be readily implemented by those 
skilled in the art from any text on Hamming codes. The Hamming code 
equations are well known and can be implemented using commercially 
available circuits or by programming ASIC 115 to exclusive OR the latched 
and encrypted data bits on bus 112A. 
Hamming comparator/corrector circuit 110 receives both the 16 bits of 
latched data on bus 112A and also receives the 6 bits of Hamming data 
supplied on bus 109A by Hamming code generator 109 or read out of Hamming 
data section 2B of SRAM 2. Hamming code generator 109 regenerates the 
Hamming codes. The Hamming data that is regenerated is compared to the 
Hamming data that was previously stored. Based on this comparison, a bit 
pattern is generated that can then be exclusively ORed with incorrect data 
to produce the corrected data on bus 110C. FIG. 6B indicates the 
implementation of Hamming comparator/corrector 110. 
Maintenance control circuit 150 performs the function of error logging. 
Data Out parity check circuit 104 produces two parity bits which are 
included with the two byte of corrected data to internal data bus 30A,B. 
The corrected data and its two parity bits can be read via buffer 26C by 
host computer 120. If the present data has in fact been corrected, it is 
also rewritten into SRAM 2 by applying a write command to SRAM 2 in order 
to write the corrected data into the present address (which still is 
available on address bus 28B). 
A normal write operation by host computer 120 includes addressing SRAM 2 
via address bus 28A to generate the chip addresses on internal address bus 
28B and the necessary SRAM chip select signals on conductors 100A. The 
data to be written is applied to Data Input conductors 30A, including 16 
bits of data and two parity bits. This data is latched into Data In parity 
check circuit 102 and stripped of the parity bits. The data is input via 
bus 112A to Hamming code generator 109 to produce the corresponding 
Hamming codes on Hamming bus 109A. Then the Hamming data on bus 109A is 
written into SRAM section 2B, and the data on data bus 30A,B is written in 
SRAM section 2A. 
A normal read operation by bus host computer 12 includes addressing SRAM 2 
via address bus 28A to generate the chip addresses on internal address bus 
28B and the necessary SRAM chip select signals on conductors 100A. The 
data read from SRAM 2 is latched into Data In parity check circuit 102, 
bypasses the encryptor/decryptor 112, and is applied to Hamming code 
generator 109. The generated Hamming codes are compared to the previously 
stored Hamming codes in block 110, which detects data errors and supplies 
corrected data on bus 110C. Two parity bits are added to the corrected 
data by Data Out parity check circuit 104. The corrected data and the 
Hamming data on six bit Hamming data bus 109A then are simultaneously 
written into the presently addressed word of sections 2A and 2B, 
respectively, of SRAM 2 by means of a write command. 
The addresses of any errors detected by Hamming comparator/correction 
circuit 110 are stored in the scratch pad section 2C of SRAM 2 along with 
a count of how many times an error has occurred at that address of SRAM 2 
in response to maintenance control circuit 150. 
A downloading operation occurs when both a P.sub.INK signal and an E.sub.OK 
is received by control circuit 101, indicating both loss of input voltage 
10 below the input power threshold 33 and loss of the backup voltage 65 
below energy threshold 36 (FIG. 5). 
However, if only the P.sub.INOK signal has been received, control circuit 
101 puts the non-volatile memory system 1 into the above-mentioned "hold 
mode" and turns off MOSFET 91A. (MOSFET 91C already will be off.) Then 
operating power will be absent from E.sup.PROM 8, and SRAM 2 will be 
powered by a 2 volt standby voltage produced on conductor 12 by 3 volt 
zener diode 92 in FIG. 2, maintaining all of the data in SRAM 2 with a 
very low current drain. If the input voltage on conductor 10 returns 
before the E.sub.OK signal is received, the P.sub.INOK signal disappears. 
SRAM 2 and all of control circuitry 22 are supplied by the normal 5 volt 
levels, and normal read and write operations by host computer 120 are 
continued. 
If the E.sub.OK signal is received while P.sub.INOK is present, control 
circuit 101 triggers download sequencer 108 via one of conductors 108A to 
download the data of SRAM 2 into E.sup.2 PROM 8. Download sequencer 108 
triggers address generation circuit 107 by means of one of conductors 
108B, causing address generation circuit 107 to generate addresses A15-A17 
of SRAM 2, causing address decode circuit 100 to generate the 
corresponding chip select signals on ten conductors 100A to select one of 
the SRAM chips 2A-1, 2A-2, etc. at a time. Download sequencer 108 also 
causes address decode circuit 100 to generate chip select signals 100B to 
select corresponding E.sup.2 PROM chips 8A-1, 8A-2, etc. one at a time, 
and also causes data at each address to be read from SRAM 2, input to data 
in parity check circuit 102 and applied via 16 conductors 102C to column 
parity accumulator 103. Address generator 107 also generates addresses 
A0-A14 in response to download sequencer. 
At the same time, the data on internal data bus 30A,B is written into the 
same location of E.sup.2 PROM 8 and also is written into the scratch pad 
section 2C of SRAM 2 to accumulate row parity data under the control of 
row/column parity control circuit 105, as subsequently described with 
reference to FIG. 4. The accumulated row parity and column parity then are 
written into corresponding locations of scratch pad memory 2C and row 
parity section 8B of E.sup.2 PROM 8 after scanning of a "row" is complete. 
At the end of the download cycle, all of the data and all of the 
associated row and column parity bits from SRAM 2 have been loaded into 
corresponding locations of E.sup.2 PROM 8. 
An uploading operation is initiated when the P.sub.INOK and E.sub.OK 
signals disappear, indicating the return of input voltage on conductor 10 
to a value above input voltage threshold 33 and indicating that backup 
voltage 65 has increased above threshold 36. When that happens, control 
circuit 101 generates a signal on one of conductors 106A causing upload 
sequencer 106 to produce signals on conductors 106B that trigger address 
generator 107. Address generator 107 produces addresses A15-A17 signals on 
conductors 107A which are decoded by address decode circuit 100 to 
generate SRAM chip select signals 100A and corresponding E.sup.2 PROM chip 
select signals 100B to access corresponding locations of E.sup.2 PROM 8 
and SRAM 2 as necessary to upload data from E.sup.2 PROM 8 back to SRAM 2. 
Address generator circuit 107 also generates the addresses A0-A14 on 
conductors 28B in response to upload sequencer 106. 
Data read from the accessed location of E.sub.2 PROM 8 appears on internal 
data bus 30A,B. The row parity and column parity are accumulated. The row 
and column parity are checked against the corresponding row and column 
parity for the previous downloading stored in E.sub.2 PROM section 8B. If 
a mismatch is found, an error exists in the data transferred to SRAM 2 at 
the mismatch address. An error pattern identifying the mismatch is 
exclusively ORed in column parity accumulator 103 with the erroneous data 
in the SRAM, and the corrected data is rewritten into SRAM 2. More 
specifically, the corrected data is uploaded into the present address of 
the selected one of SRAM sections 2A-1, 2A-2, . . . 2A-8 by applying a 
write command to it. The corrected data on data bus 30A,B also is used by 
Hamming generator 109 to generate correct Hamming codes which are stored 
at the same address of SRAM section 2B. The above process is repeated 
until all of the data in E.sub.2 PROM 8 has been read out, parity checked, 
corrected if necessary, corresponding Hamming codes have been generated, 
the corrected data has been stored in a corresponding one of SRAM sections 
2A-1, 2A-2, . . . 2A-8, and the Hamming data has been stored in a 
corresponding section 2B of SRAM 2. 
If a data error is detected by data in parity check circuit 102 at the 
present address, data in parity check circuit 102 produces a data error 
signal on conductor 102A. This data error signal may be read by host 
computer 120 to inform it that the present data contains an error. 
Next, the row parity accumulation technique and column parity accumulation 
technique and corresponding error correction technique of the present 
invention will be described with reference to FIG. 4. 
In FIG. 4, numerals 8A-1, 8A-2 . . . 8A-8 show three-dimensional 
representations of sections of E.sup.2 PROM 8 as described above. Each 
section such as 8A-1 is subdivided into 512 64 word by 16 bit subsections. 
For example, section 8A-1 includes 512 subsections such as subsection 129, 
which includes 64 words such as 125 and 128 each having 16 bits. 
Similarly, section 8A-2 of E.sup.2 PROM 8 includes 512 subsections 131 
each having 64 16 bit words, such as word 130. Similarly, section 8A-8 
includes 512 64 word subsections 136. 
Although not shown in FIG. 4, sections 2A-1, 2A-2 . . . 2A-8 of SRAM 2 also 
each are similarly subdivided into 512 64 word by 16 bit subsections. Row 
parity accumulation and column parity accumulation are accomplished for 
SRAM 2 by scanning SRAM 2 in precisely the same fashion as for E.sup.2 
PROM 8. 
In FIG. 4 scratch pad RAM 2C includes a single 64 word by 16 bit "row 
parity accumulator" subsection 132, which includes 64 16 bit words such as 
133, 134, etc. Individual corresponding bits of all of the above 64 word 
by 16 bit subsections of E.sup.2 PROM sections 8A-1 . . . 8A-8, SRAM 
subsections 2A-1 . . . 2A-8, and 64 word by 16 bit subsection 132 of 
scratch pad 2C of SRAM 2 are addressed by the same group of address 
conductors of address bus 28B. 
"Column parity accumulator" register 103 of ASIC 115 of FIG. 3C is shown in 
FIG. 4 for convenience. 
The group of 64 word by 16 bit subsections 129, 131 . . . 136 of E.sup.2 
PROM 8 (or a similar row of subsections of SRAM 2) is referred to herein 
as a "row" for the purpose of describing scanning of E.sup.2 PROM 8 or 
SRAM 2 to accumulate row and column parities during an upload operation or 
a download operation of non-volatile memory system 1. In FIG. 4, exclusive 
OR gates 126, 127, and 137 are shown to assist in describing the functions 
of exclusive ORing corresponding bits on a "bit per chip" basis during 
"row" scanning to accumulate row and column parity, in accordance with the 
present invention. 
First, the row and column parity accumulation will be described for an 
uploading of data stored in E.sup.2 PROM 8 into SRAM 2. The first step in 
the scanning procedure is to sequentially read the contents of the first 
word 125 in subsection 129. That entire word 125 is stored in the first 
word 133 of SRAM scratch pad subsection 132. Word 125 also is written into 
column parity accumulator 103. Next, the second word 128 of subsection 129 
is written into a second word 134 of scratch pad subsection 132, and is 
exclusively ORed with the contents of column parity accumulator 103 as 
indicated by Exclusive OR gate 137. The results replace the previous 
contents of column parity accumulator 103. The next step is to repeat the 
above process for the third 16 bit word and all subsequent 16 bit words of 
subsection 129. At this point, all of the data in subsection 129 has been 
transferred to scratch pad section 132, and the column parity for section 
129 has been accumulated in column parity accumulator 103. 
Then the above process is repeated for section 8A-2, except that each bit 
in each word of subsection 131 is exclusively ORed with the corresponding 
bit in scratch pad subsection 132 and the results are loaded into scratch 
pad subsection 132. The accumulated column parity then is written into the 
first word 142 of another 64 word by 16 bit subsection 141 of scratch pad 
RAM 2C. Meanwhile, column parity is accumulated for section 131 in column 
parity accumulator 103. Exclusive OR gate 126 illustrates the exclusive 
ORing of corresponding bits in first word 125 (after it is transferred to 
scratch pad subsection 132) with the corresponding bits in word 130 of 
subsection 131 and storing the results in word 133 of scratch pad 
subsection 132. Exclusive OR gate 127 represents the last such exclusive 
ORing in the first "row". When the entire "row" consisting of subsections 
129, 131 . . . 136 has been scanned, the row parity for the entire "row" 
has been accumulated in scratch pad subsection 132, and the column 
parities for each of those subsections has been accumulated in the first 
eight words of scratch pad subsection 141. 
Then the contents of subsection 132 of row parity accumulator subsection 
132 and the contents of column parity accumulator subsection 141 are 
compared with corresponding row parity and column parity stored during the 
previous downloading operation into sections 8B and 8C, respectively, of 
E.sup.2 PROM 8. Simultaneously, all of the data being scanned and read out 
of E.sup.2 PROM 8 is being written into corresponding locations of SRAM 2. 
Whenever a mismatch is found between the present row and column parity and 
the row and column parity stored in sections 8B and 8C of E.sup.2 PROM 8 
during the previous downloading operation, that row and column parity is 
exclusively ORed with the data just read out of the corresponding location 
of E.sup.2 PROM section 8A to correct the data. The result of that 
exclusive ORing represents a two-dimensional map of any erroneous bit 
positions. The third dimension information needed to locate the error 
precisely is derived from the exclusive ORing of the column parity 
information in subsection 141 with previously stored column parity 
information from the previous downloading operation. The result of that 
exclusive ORing represents the erroneous bit positions in the columns of 
the "row" 129, 131 . . . 136 being scanned. It is necessary to match bit 
positions in the "row error pattern" and "column error pattern" in order 
to properly locate the erroneous bit. This is performed by testing these 
row and column error patterns for each of the sections 8A-1, 8A-2 . . . 
until a match is found. 
Once the location of the error is found so as to produce a row-column bit 
position match, that match is exclusively ORed with the data in the SRAM 
at the identified location to correct the erroneous data. The row-column 
bit match is obtained by logically ANDing the row error pattern and the 
column error pattern to produce the "correction data" which then is 
exclusively ORed with the erroneous data from the SRAM at the identified 
address. 
The above "row" scanning procedure during uploading allows corrected data 
for an entire section such as 8A-1, 8A-2 etc. to be conveniently corrected 
if necessary and uploaded into SRAM 2, because all of the wrong row and 
column parity data corresponding to that chip can be stored in sections 8B 
and 8C and used to correct the erroneous bits. The above scanning 
procedure is particularly advantageous in view of the probable failure 
modes of SRAM chips, since if there is a failure in one bit of an SRAM 
chip, the probability of another failure in another bit of the same chip 
is high. 
For downloading, the scanning procedure is identical except that in FIG. 4, 
E.sup.2 PROM sections 8A-1, 8A-2 . . . 8A-8 are replaced by SRAM sections 
2A-1, 2A-2 . . . 2A-8. The same scratch pad subsections 132 and 141 and 
the same column parity accumulator 103 are used for both uploading and 
downloading. However, the accumulated row parity data in scratch pad 
subsection 132 and the accumulated column parity data accumulated in 
scratch pad section 141 are not used to locate and correct errors during 
downloading, but are simply stored in E.sup.2 PROM sections 8B and 8C at 
the end of scanning of each "row". The row and column parity data is then 
available for error correction during the next uploading operation, as 
described above. 
Appendix 1 attached hereto shows how ASIC 115 can be programmed to produce 
the configuration of FIG. 3B. 
The above-described non-volatile memory system provides a plug-in 
replacement for a core memory system providing the advantages of 
non-volatility, and is capable of providing substantially faster access 
times and cycle times than a comparable core memory. Reliability is 
greatly increased over that of a core memory system because of the use of 
integrated circuit components and attendant reduction in the number of 
solder connections. The amount of power dissipated is much less than that 
of a comparable core memory, resulting in much less generation of heat and 
thermal stressing of components and component connections. This 
contributes greatly to long term reliability. The described error 
detection and correction techniques further increase the reliability of 
the described memory system over a core memory system replaced thereby. 
Problems associated with the wear-out phenomena of with E.sup.2 PROMs are 
avoided. The hold mode duration is automatically "self-adjusting" to meet 
variations in energy stored in the backup capacitor and current drain by 
circuitry that discharges the backup capacitor during a power interruption 
due to aging, temperature changes, etc. The secure key using a ferrite 
core register as a completely erasable security key for encryption and 
decryption of data provides the advantage of a secure system which can 
allow confidential data to be more conveniently "declassified". 
While the invention has been described with reference to a particular 
embodiment thereof, those skilled in the art will be able to make the 
various modifications to the described embodiment of the invention without 
departing from the true spirit and scope of the invention. For example, 
certain very high capacitance double layer low voltage capacitors could be 
used which are not charged to a boosted-up voltage. Alternatively, certain 
kinds of batteries might be used instead of a backup capacitor.