Abstract:
To improve the availability of a data processing system despite possible memory errors, when reading a data word from a memory cell, the integrity of the data word is checked on the basis of redundant additional information, and if the data word turns out to be corrupted, an error correction procedure is performed in which the reliability performance of the memory cell is checked and, if the memory cell is found to be operational, its contents are restored.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention relates to a method for operating a data processing system and a data processing system which is designed for carrying out the operating method. 
       BACKGROUND INFORMATION 
       [0002]    Systems for digital data processing are increasingly used for controlling complex, safety-critical processes, in particular in the automobile industry. To ensure the safety of the users of such a system, i.e., a motor vehicle in which such a system is used, even in the event of malfunction, the occurrence of a malfunction must be recognized as rapidly as possible and, if necessary, suitable corrective measures must be taken. These corrective measures often depend on disabling the data processing system or at least those parts of the system which are affected by the malfunction. For example, German Published Patent Application No. 100 63 934 discloses a data processing system in the form of a network having a plurality of control units running a plurality of monitoring routines which trigger different shut-off strategies for control units of the network when an error is detected. The different shut-off strategies prevent the need for shutting off the entire network when an error is detected so that those components not affected by the error may continue to run. However, even the shut-off of individual components results in a limitation of the reliability performance of the network. 
         [0003]    German Published Patent Application No. 102 20 811 proposes the implementation of a flexible response to different types of errors which may occur in a data processing system with the aid of a modular monitoring method oriented toward the structure of the monitoring method being dependent on the system to be monitored. Adapting this method to a new application is therefore laborious. 
       SUMMARY 
       [0004]    Example embodiments of the present invention provide a method for operating a data processing system which is easily adaptable to data processing systems for different tasks and ensures high availability of the data processing system itself in the event that certain errors are detected in the system. 
         [0005]    These advantages are achieved in that a method for operating a data processing system includes the following steps
   a) reading of a data word from a memory cell;   b) checking of the integrity of the data word on the basis of redundant additional information; and   c) in the case in which the data word turns out to be corrupted, performing of an error handling procedure having the following steps:   d) checking of the reliability performance of the memory cell and, if the memory cell is found to be operational,   e) restoring of its contents.   
 
         [0011]    The method is independent of a weight content which the data word has for an application program running on the data processing system. It may therefore contain either a program instruction or also parameters. 
         [0012]    Restoration may be restoration to its original state or, if the data value is time-variable, also updating of the contents of the memory cell. 
         [0013]    When the contents of the memory cell have been restored, the data processing system may continue to perform its actual function; it is no longer necessary to shut off the data processing system or parts thereof. 
         [0014]    This property of the method is advantageous in particular in modern data processing systems which use memories having high integration density because in these memories the likelihood of spontaneous data loss due to the effect of particle radiation, in particular of alpha particles, increases as the dimensions of a memory cell affected by a radiation particle decrease. 
         [0015]    To check the reliability performance of the memory cell, preferably the following steps are performed: 
         [0000]    d1) writing to the memory cell;
 
d2) reading back of the memory cell written to; and
 
d3) comparing of the read-back data word with the one previously written to the memory cell.
 
         [0016]    If agreement is found in the comparison, it may be assumed that previous data loss of the memory cell was caused by a transient external effect and not by a defect of the memory cell itself, i.e., that the memory cell may continue to be used and the risk of repeat data loss is not greater in this case than for other cells of the memory. 
         [0017]    The data word written to the memory cell in step d1) is preferably the binary complement of the data word read in step a) because then a single write operation is sufficient for checking that each bit of the memory cell is capable of assuming the values 0 and 1. 
         [0018]    While it is also possible to write a predefined data word to the memory cell, two write-read-back and comparison operations each with binarily complementary data words would be required to verify the reliability performance of the memory cell. 
         [0019]    In an example embodiment, the contents of the memory cell may therefore be restored by writing the data word read in step a) back to the memory cell in step e). This is practicable if the data word being briefly corrupted may not have any safety-relevant effect on the system and it has been ensured that the possibly corrupted data word is corrected at a later point in time via an update. 
         [0020]    It is safer to update the contents of the memory cell in step e). This alternative is, however, more complicated to implement because procedures for updating the contents may be different from one memory cell to the other; the error handling procedure is therefore unable to handle all memory cells in the same manner. If periodic updating of the memory cell is provided anyway by an application running on the data processing system, it may be sufficient to simply discard the corrupted data value and wait for the update. 
         [0021]    An alternative that is easy to use on any memory cell is that the redundant information contains error correction information (such as ECC) and the contents of the memory cell are corrected in step e) on the basis of the error correction information. 
         [0022]    Two or more of the above-described alternatives may be used jointly in a method in that the mode of performing step e) is selected on the basis of the address of the memory cell. 
         [0023]    If the memory cell is found not to be operational in step d), a routine accessing the memory cell should be terminated in order to avoid malfunctions of this routine that may jeopardize safety. 
         [0024]    If step a) is performed by a programmable circuit under the control of an application program, steps c) through e) are preferably performed within an interrupt of the application program. Access of the application program to the memory cell prior to restoration of the memory cell&#39;s contents is thus impossible. 
         [0025]    If the application program includes a real-time function and a data word is identified as corrupted during an access by the real-time function, an interrupt of the application program for checking the reliability performance of the memory cell, and possibly restoring its contents, may negatively affect the real-time function by delaying it. To prevent such a case whenever possible, the application program may include a background function which is interruptible by any real-time function and which performs step a) for a plurality of memory cells one immediately after the other. An aspect of the background function is therefore to read the memory cells so that an error in a memory cell is detected, if possible, during a non-time-critical access of the background function to the memory cell and may be corrected by an interrupt. It is not necessary for the background function to further process the read data words. 
         [0026]    The subject matter hereof is also a data processing system having a data memory and a program-controlled circuit which is programmed to carry out the above-described method. Such a data processing system may be a motor vehicle control unit in particular. 
         [0027]    Further features and advantages of example embodiments of the present invention are derived from the following description taking into account the appended drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0028]      FIG. 1  shows a block diagram of a data processing system according to an example embodiment of the present invention; 
           [0029]      FIG. 2  shows a flow chart of the operating method according to an example embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0030]      FIG. 1  schematically shows a data processing system in which an example embodiment of the present invention is implemented. The system includes a microprocessor  1 , a read-only memory  2 , a read-write memory  3 , and various sensors  4  and actuators which are connected to each other via a data bus  5  and an address bus. Sensors  4  and actuators are used for detecting and affecting performance parameters of a device to be controlled, for example, a motor vehicle engine. The manner in which the measured values generated by sensors  4  are processed by microprocessor  1  to activate the actuators is determined by an application program stored in area  6  of ROM  2 . 
         [0031]    Data bus  5  between memories  2 ,  3  and processor  1  has a width of 16 bits, for example. 
         [0032]    The width of read-write memory  3  is 1 bit greater than that of data bus  5 ; the additional bit is used for storing a parity bit for each 16-bit data word. Read-write memory  3  is shown in the figure divided into sections  3 - 0  through  3 - 16 , each of which receives one of bits  0  through  15  of each data word and the corresponding parity bit. Section  3 - 16  receiving the parity bit has a data input and data output which are connected to a parity controller  7 , which generates the correct parity bit for each data word to be written to read-write memory  3  and outputs it to section  3 - 16 , so that it is stored together with the data word, and calculates the parity of each data word read from the memory, comparing it with the parity read from section  3 - 16  at the same time. In the event of non-agreement, there is an error in memory  3 , and parity controller  7  generates an error signal which is supplied to an interrupt input  9  of microprocessor  1  via a line  8 . 
         [0033]    An error handling routine which is to be run by microprocessor  1  in the event of an error signal occurring at interrupt input  9  is stored in an area  10  of ROM  2 . The application program controls and/or regulates the engine via a loop executed in regular time intervals, in which it reads measuring results which were previously stored by sensors  4  at the addresses of memory  3  assigned to them, processes these measuring results and activates the actuators on the basis of the processing results. When this activation is completed and there is time left until the start of the next loop, the application program reads the individual memory locations of read-write memory  3 , not to further process the contents read, but only to enable parity controller  7  to check the correctness of the contents of the individual memory cells. While an interrupt triggered by parity controller  7  during control and regulation processing may result in a delay of time-critical tasks of microprocessor  1 , this is not the case in successive readings of the memory cells after the completion of the control and regulation tasks. The time during which this reading takes place represents the capacity reserve of microprocessor  1  and it may, if necessary, also be used for performing error handling without negatively affecting the other functions of the microprocessor. 
         [0034]      FIG. 2  is a flow chart of an error handling procedure of microprocessor  1  triggered by an interrupt of parity controller  7 . Step S 0  designates a read step of contents [M] of a memory cell having address M in a register R of microprocessor  1 , in which parity controller  7  identifies a parity error. The error signal subsequently output by parity controller  7  results in an interrupt of the application program being executed by microprocessor  1  and in the execution of an error handling procedure in whose first step S 1  the contents of register R are replaced by their binary complement inv(R). In step S 2  the contents of register R are written to the memory cell having address M. 
         [0035]    When the identified parity error has been caused by a defective bit of the memory cell which may assume only one of the two possible logical values, the write procedure of step S 2  for this bit remains without effect. 
         [0036]    In step S 3  the contents [M] of memory cell M are read again and compared to register R. If the memory cell actually has a corrupted bit, non-agreement is identified and the method branches off to step S 4 , in which the application program or at least separable portions of this program which access memory cell M are terminated. 
         [0037]    When agreement is found in step S 3 , it may be assumed that the parity error is caused by spontaneous information loss in a bit of memory cell M, for example, due to the effect of ionizing radiation, and indicates no permanent defect of memory cell M. In this case memory cell M may continue to be used. 
         [0038]    The manner in which the contents of memory cell M are to be restored is then decided in step S 5 . The way this is to be done may differ depending on the meaning of the data word stored in memory cell M and may be determined at the time the application program is developed, for example, in the variables of the application program which are stored in the address areas associated with the type of error handling and are to be handled the same way in the event of an error. 
         [0039]    When an error in the variables stored in memory cell M may be tolerated, for example, because the variable is regularly recalculated on the basis of the measuring results of sensors  4  and a briefly corrupted value of the variables may not result in safety-relevant miscontrol, it is sufficient if the method branches off to step S 6  in which, however, the register is inverted and subsequently in step S 7  memory cell M is overwritten with the value thus obtained. Memory cell M then has the same contents again as in step S 0 . While there is a high probability of these contents being corrupted, as long as the error does not affect the most significant bits, it is at least a better approximation of the correct value than an arbitrarily defined constant. 
         [0040]    It is also possible to replace a value of a memory cell determined to be corrupted with a predefined value such as 0x0000 or 0xFFFF which is recognized as invalid by the application program accessing the corresponding memory cell. The appropriate response to the error may then be left to the application program and it may turn out to be different depending on which values other variables currently have or the phase of the application program from which the defective memory cell was accessed. 
         [0041]    There may be another group of memory cells whose contents may be remeasured by sensors  4  or recalculated without major effort in the event of an error. Routines for recalculating or measuring these values are, in general, part of the application program. A table T(M) in ROM  2  provides a start address A of a routine for each memory cell M of this type, via which contents [M] may be recalculated or measured. This address A is ascertained in step S 8 , and a jump to it is performed in step S 9  to execute the corresponding routine and restore [M]. 
         [0042]    There may be another group of memory cells M in which the risk associated with the use of a corrupted value is unacceptably high, so that simple restoration of [M] via steps S 6 , S 7  is out of the question, and which are inaccessible even for rapid redetermination via steps S 8 , S 9 . These may include variables obtained by averaging over a longer period, or discrete variables whose effects do not continuously change with their numerical value. When the memory cell which triggered the parity error belongs to this group, a warning signal is output to a user in step S 10  to prompt him to restart the data processing system, and subsequently the method goes to step S 4  in which functions using memory cell M are blocked until the correct contents of M are restored by a system reboot. 
         [0043]    Another possibility is to make backup copies of certain variables so that, when defective memory cell M contains such a variable, its backup copy S may be simply read and written back to memory cell M (S 11 ). 
         [0044]    An example embodiment of the present invention may include further options for correcting contents of a memory cell identified as corrupted or also a subset of the above-described options. In the simplest case, decision step S 5  may also be omitted and only a single option may be provided. 
         [0045]    According to an example embodiment of the present invention, memory  3  has not only one redundant bit  3 - 16  for each data word, but multiple bits, whose contents are determined from the associated data word with the aid of an error correction code such as a Reed-Solomon code, and the redundant bits are addressable by microprocessor  1 , so that the microprocessor may also read them. In the example embodiment of  FIG. 1 , parity controller  7  is used for identifying errors in the read data words on the basis of the redundant bits it receives simultaneously with each data word and for triggering an interrupt of processor  1  in the event of an error. During such an interrupt—or as one of the plurality of possible options available in step S 5  of this interrupt for eliminating the memory error—processor  1  reads the redundant bits for the corrupted data word, corrects the corrupted data word on the basis of these bits, and writes it back to the memory cell affected by the error.