Method and device for monitoring an electronic circuit

State of the art

The invention relates to a method and a device for monitoring an electronic control, wherein control commands and / or data, in particular constants, are stored as code in at least one memory, wherein, during ongoing instruction accesses, the code, in particular the data, Data bus from which at least one memory is transmitted to a control unit with a specific word width, in particular to a processor for controlling operating sequences, according to the independent claims.

Prior art methods are known for monitoring electronic controls based on the cyclical calculation of a checksum over the entire or a part of the code area. This is to be recognized when the code has been changed; Whether by tuning or by loss of the storage element. The checksum calculation for the manipulation or data loss should be carried out at the start of the system in order to achieve the greatest possible security. However, this is not applicable due to the long periods resulting from a complete checksum calculation of more than 100 KB up to a few megabytes of code, since the startup behavior of the system would thereby be delayed and the customer would feel this as a defect.

In the case of running instruction accesses, ie in operation, a method is known by a hardware in order to prevent a loss of data in the problem of the batch loss of flash memory elements. In this method, with the corresponding hardware, also known as ECC (Error Check and Correction), there are not only memory cells which are necessary for storing the information, that is, for control commands and / or data, but also a number of memory cells With additional information which can be used to determine whether the information has changed in the cells for information storage. This is implemented by a hardware during running instruction accesses, ie during operation. Such a hardware is known, for example, from DE 3833713 A1 as well as from US Pat. No. 6,279,128 B1. As the name implies, this cor- rect information is sometimes used to correct corrupt data. However, in the case of the aforementioned method, the corresponding data are checked during operation, that is to say during running instruction accesses, so that the parts of the data or of the memory which are addressed less frequently or not at all by running instruction accesses are examined less frequently or not at all. The known method in the context of the abovementioned disclosure therefore does not guarantee the regular monitoring or checking of all the memory cells of a memory.

Furthermore, a property of modern flash memory is known as MarginRead. This function, as shown in DE 199 64 012 A1, determines whether the information in the memory cells is still sufficient in the normal mode, that is to say the normal operation, to enable a fault-free function of the control. For this purpose, the memory cells are not read out with the normal bit line load but with an increased load, or the cell current is measured. If the charge of the cell is still sufficient, the information is correctly read out. If not, the wrong information is read out. By reading the information again without applying the increased load and comparing the read values, it can be determined whether the charge is still sufficient. The reading of the information is always connected here with a checksum calculation for reading with MarginRead as well as for reading without MarginRead. If the checksums of both processes are the same, it can be assumed that there is sufficient charge from the memory cells. This means, however, that a time-consuming checksum calculation, as already indicated above, must also be carried out with the above-mentioned disadvantages.

The object of the invention is to provide a method and a device with which the monitoring or checking of all memory cells is possible cyclically by shortening the time for checking.

Advantages of the invention

The following solution enables the monitoring or checking of all memory cells cyclically and almost without delay, in particular before the start.

The invention relates to a method and a device for monitoring an electronic control, wherein control commands and / or data are stored as code in at least one memory, wherein, during ongoing instruction accesses, the code travels via a word line from the at least one memory to a control unit with a specific word width , In particular to a processor for controlling operating sequences, the word width comprising the code of a plurality of memory cells of the memory, and an additional information being formed and stored in the memory in addition to the code of a word width, and the entire code of the at least one memory being stored outside the current instruction accesses Is checked by selecting exactly one memory cell per word width and thereby activating the complete word line consisting of the code of a plurality of memory cells corresponding to the word width and the additional information, a test information being formed from the code of the complete word line and the test information being compared with the stored supplementary information becomes.

Thus, according to a specific embodiment, a method and a device for monitoring an electronic control are provided by the fact that the complete data or code of an at least one memory is read in succession into the ECC unit which can be filled quickly by the memory and is automatically tested there Without the complete data or code having to be transferred to a processor in a time-consuming manner, wherein the ECC check width comprises the data of a plurality of memory cells of the memory and is a multiple of the read word width of the processor, and to the data of an ECC check width Is formed and stored in the memory, and the entire code / data area of ​​the at least one memory is checked outside of the ongoing instruction accesses in that, for each request of the processor for the content of a single memory cell, the ECC unit is read from the memory in full ECC test width including Wherein a test information is formed from the data of the complete ECC test width, and the test information is automatically compared in the ECC unit with the stored supplementary information. This advantageously makes it possible to evaluate the correctness of the entire memory content before the start of the motor, in particular In a motor vehicle, since the time required for this is substantially reduced. Expediently, in a particular embodiment, a current charge state is determined additionally in the case of the selected memory cell and / or the selected memory, and the latter is compared with a predefinable charge threshold or the stored memory threshold is changed by altering the bit line load by reading the data and test information . This means that, in the case of the selected memory cell, a current charge state is additionally determined, or the data with a modified threshold are read out, and the ECC unit checks the correctness of the data completely, without having to transmit all the data to be checked to the processor. By additionally using the just-mentioned margin read in the method according to the invention, additional incorrect information can then be concluded in the memory without further time expenditure since, in case of a loss of charge in the memory, the data or code and the additional information per ECC check width in the case of non-consistency in the ECC unit, which is not possible with the pure checksum method. If the cells are not charged correctly, the start can be prevented, and thus safety-critical states can be avoided due to faulty memory contents. This means that in principle, no comparison of the data or of the code must take place in the method according to the invention and the device on the processor, since the comparison to the additional information already takes place in the ECC unit.

Advantageously, it is therefore possible that the data processing is not carried out on the processor itself, but this test is carried out directly in the HW of the ECC unit without all data having to be transmitted to the processor via the data bus. Furthermore, in a particular embodiment, the processor does not process the test code from the memory to be tested, but from another fast memory, in particular from a code cache or a separate code RAM.

It is also advantageous that the selection of the memory cell of the respective word width is effected by repeatedly setting an increment starting from a starting address of a first memory cell, each additional memory cell being selected at a distance from the increment. Thus, in a particular embodiment, a method is obtained such that only the data of a selection of individual memory cells are requested by the processor and not all data of the memory, and outgoing from a start address of a first memory cell all further selections by repeatedly adding an increment to the start address in the Distance of the ECC test width. This also means that, in principle, no comparison of the data or of the code must take place in the method according to the invention and the device on the processor since the comparison to the additional information already takes place in the ECC unit. Furthermore, by the increment formation, the processor only needs to request the data of individual memory cells with an increment in the distance of the ECC test width and not all the data of the memory since the remaining ones are automatically transferred and checked from the memory into the ECC unit together with the requested ones. Thus, starting from a starting address of a first memory cell, only one memory cell per ECC test width has to be requested, the increment for accessing each additional memory cell corresponds to the ECC test width.

Expediently, an interrupt request is signaled to the processor by the ECC unit in case of inequality of the data of the code or the test information with the additional information, and an error is indicated.

It is also expedient that an error detected in this comparison is corrected immediately so that the electronic control can continue to work despite faulty data or codes.

Advantageously, when the margin read is used, ie when the predefinable charge threshold is reached or undershooted by the current charge state, a refreshing of the charge state of the respective memory cell or of all memory cells of the corresponding word line or of all memory cells of the memory can be carried out since the correct information can still be produced, Either by the ECC, or by changing the predeterminable charge threshold, or by combining both methods. Likewise, in this charge comparison, a future error can be concluded, as mentioned above, and there is the possibility to display a future error and at the same time the possibility of preventing this future error.

It is also expedient that the processor does not process the verification code from the memory to be tested, but from another fast memory, in particular from a cache or separate code RAM. This ensures that, on the one hand, only the intended data is checked in the ECC unit, and, on the other hand, the execution of the check code is still selected, especially when the MarginRead is used, if the predefined charging thresholds are no longer reached Processor could be sent if it were to refer to its instructions from the same memory.

Further advantages and advantageous configurations are evident from the description and the features of the claims.

drawing

The invention is explained in more detail below with reference to the figures shown in the drawing. FIG 1 shows a control device with hardware according to the invention. FIG. 2 shows a memory according to the invention with individual memory cells, and FIG FIG. 3, consisting of FIGS. 3a and 3b, illustrates the invention with reference to a specific exemplary embodiment in the form of a flow diagram.

DESCRIPTION OF THE EXEMPLARY EMBODIMENTS

FIG. 1 shows an electronic controller or a control device 100 in which a memory 102 and a control unit 101, in particular a processor, are contained. Control unit and memory with ECC hardware are connected to each other via a bidirectional data bus 107. Reference numerals 104, 105 and 106 designate first means which carry out the comparison of the test information with the additional information, which thus largely corresponds to the ECC hardware. Charging test means are illustrated by 108, by means of which the margin read can be activated, ie the charge state of the memory cell can be tested. 110 shows interrupting means which trigger an error reaction upon detection of an error, in particular, even an interrupt, an interrupt. The processing unit of the interrupt in the processor is indicated by 111. To illustrate the individual aspects of the invention, all the means are shown separately. However, these means can also be present in a block, ie integrated, in the processor or in the memory unit 102 itself, but also externally and only connected to the processor and the memory. Furthermore, errors can be displayed, for example by a display means, which is connected to the processor via a connection, in particular.

When reading an information, in particular a memory cell of the memory array 103 as data, the intermediate buffer 105 of the ECC unit 106 is loaded from the memory via the fast bi-directional connection 104 in the full ECC test data width including the additional information, for example, 64 bits data + 8 bits of additional information And the error check and correction function is performed on the data in ECC test data width by the ECC hardware, here 106. If the ECC detects an error, an interrupt is triggered to the CPU, ie, to the interrupt processing unit 111 or the processor total 101.

To explain the method, the memory in FIG. 2 is shown again in detail. Included therein are memory cells 200 and 201. The memory cells 200 contain, in this case, control commands and / or data as code, that is to say as binary information, for example, always as 8-bit byte as byte B1, B2, B3, B5, etc. In this particular example, the additional information Z1, Z2, Z3, and so forth. If a memory cell is activated, for example B1, a data word of the complete word width, in our example 32 bits, ie 4 bytes, is read out via the connection line 104. If the additional information and the data or codes are in the same memory, the information from the memory cells B1, B2, B3 and the additional information storage cell Z1 is read out in this manner, for example with 32 bits, with four by 8 bits, with a 32-bit connection line In a single transfer. Said ECC hardware 106 can then perform the error check and possible correction in a single access over the entire ECC test width in the ECC intermediate buffer 105. The additional information, in this case, for example, Z1, can be formed and evaluated with the aid of different methods, which according to the respective method requires corresponding ECC hardware 106. In addition to the Cyclic Redundancy Check CRC, any other method, such as Hemming code, Berger code, summation, in particular parity bit formation, etc., is possible and predetermined according to the invention. Depending on the method selected, the additional information may comprise one or more memory cells. Likewise, the additional information does not have to follow the respective data memory cells as always, but can also be stored in a separate memory area of ​​the memory array 103, but also in a separate memory. Important is only a direct allocation of the corresponding memory cells with the data to be tested and the corresponding additional information. Then, in addition to the normal word width, the additional information of the ECC hardware could also be supplied via separate lines, in contrast to the example where the additional information is contained in the word width transmitted by the memory array itself. It is essential that a complete checksum calculation in the processor in the sense of a recording of each individual memory cell is not necessary but that a complete test is possible by a single access in the ECC hardware without the need to transfer all the data to be tested to the processor. The word width of 32 bits is arbitrarily selected. Of course, any other word width such as 8, 16, 24 bits or else an individually selected other word width can also be used. If, for example, a 64-bit ECC check width is used, 64 bits of data and the 8 bits for the ECC are read simultaneously, and the ECC check is performed as soon as the processor requests only parts of it. Thus, the read request from the processor of, for example, 16 or 32 bits of a memory area is sufficient to evaluate the correctness of a 64-bit group. The processor itself can ignore the supplied data without further comparison. This is possible for the reason, if incorrect data was read, an interrupt, ie an interrupt, would be triggered by the ECC unit. Thus, 256 bits of information memory, ie data, and 32 bit ECC information could also be testable in one step.

The advantage of the above-mentioned method is obvious: Because the processor does not have to calculate a checksum separately as in the prior art, the read accesses to the memory can be directly following one another, which would mean for the example just mentioned that, CRC method, the following time is required: 3 clocks to read 32 bits, then add the 32 bits to the checksum, which in turn requires 3 clocks, and evaluate the whole 2 times by 64 bits. This would have the effect that (3 + 6) x 2 = 12 bars would be necessary as a time minimum for calculating the checksum. For the method according to the invention, which is illustrated in detail again in FIG. 3, only the first three clocks, just 32 bits, would be required. This results in a shortening in the example given by at least 75%.

This results in the use of the ECC for the rapid verification of the entire memory content as opposed to methods based on the evaluation of the information of each memory location or memory cell by an execution unit.

The process itself is now shown in detail again in FIG. 3 consisting of FIGS. 3a and 3b. For this purpose, the start of the method is shown in block 300 of FIG. 3a. In block 301, the initialization takes place, which means that, for example, the start address and the end address are set and the above-mentioned increment is determined. The optimum increment is specified by the ECC check width of the ECC hardware since a complete ECC check width is always loaded and evaluated by the ECC, but this is in each case a multiple of the read word width which is transmitted to the processor.

In block 302, the margin read, that is to say the charge threshold method, is optionally switched on. For this purpose, the memory cells, in particular the selected memory cells, are read out not with the normal bit line load but with an increased load, or the cell current is measured. If the charge of the cells is still sufficient, the information is correctly read out. If not, the incorrect information is read, which is automatically noticed and signaled by the ECC unit. The possible switching on or switching-on of this optional additional method, that is, of the margin reads, can now also be performed in block 302.

In block 303, the address is set equal to the start address. At block 304, the query is then made as to whether the read address is less than or equal to the set end address. If this is the case, the contents of the address are requested by the memory in block 305. In parallel, the ECC unit now requests the data for the entire ECC check width from the memory, optionally with activated MarginRead, which has the advantage that errors occurring in the future can also be detected.

In the event of a fault, the ECC unit interrupts the test program on the processor and activates the interrupt service routines from block 308 according to FIG. 3b by means of the interrupt unit. In block 309, the error can be indicated, reported, or corrected. In this case, a distinction can be made again, not shown here, whether the error already exists or will occur in the future. Depending on this, different error responses can occur. When the predefined charge threshold is reached or subtracted in the margin read by the current charge state, the charging state of the respective memory cell or all memory cells of a word line or of all memory cells of the entire memory is updated as a correction, for example. A display of this error can then be realized, for example, via a display unit. However, a detected error can also be stored in a fault memory and read out later. In response to such an error, the fault may be corrected once, or the changeover to an emergency operation, or the indication of the fault and the termination of the starting process, depending on how critically the fault is classified. This means that different priority classes can be assigned to the errors; Either specified by a table or depending on which and how many error detection mechanisms, ie ECC check and margin read, only ECC check or only margin read of the errors were detected.

After the error handling is completed, the interrupt servicer routine is terminated at block 310 and the execution of the interrupted test program is continued in block 306, where the current address is then reassigned with address plus increment. Without further processing of the delivered data, a return is now made in block 304. Here, the address, which is now incremented by the increment, checks whether this address is smaller than or equal to the end address. If this is still the case, the block 305, 306 and 304 remain in the loop just mentioned; Otherwise, when the end address is reached, the end of the method is executed in block 307.

Thus, according to the above method, the electronic control is monitored by means of the device shown, which contains means which, outside the ongoing instruction accesses, check the entire data of the at least one memory by requesting precisely one memory cell from the processor per ECC test width, And the means thereby loading the complete data per ECC test width including the additional information into the ECC intermediate buffer, wherein test means are included in the ECC unit which form test information from the data per ECC test width and compare the test information with the stored additional information , As is performed, for example, in the means 106. Likewise, test means 108 are included for the margin read which determine a current charge state or read the data with a changed threshold in the selected memory cell of the respective word line. Interrupting means are included as fault-response possibilities which, in the event of inequality of the test information and of the additional information and / or on reaching or lowering the predefinable charge threshold by the current charge state, trigger an interruption,

By means of the method according to the invention and the device according to the invention, in the case of an electronic control system for controlling operating sequences, in particular in the case of a vehicle, but also with other devices or devices, a test of the entire memory area, So that, on the one hand, the cyclic test is always possible before the start and, on the other hand, the testing of all memory cells is possible and thus results in a safety assurance without compromises.