JP2005503624A - Electronic brake system memory error detection method, computer system and use thereof - Google Patents

Abstract

The invention comprises at least one central processing unit (1) and at least one data bus (30) connected to the central processing unit and storage elements (4, 20, 60, 70), the storage element comprising The present invention relates to a computer system (50) comprising at least one program memory (15, 20) and one or more inspection data memories (16, 60, 70). This test data memory forms part (16, 60) of program memory (4, 20) and / or part (70) of separately arranged storage elements. At least one test data generator (3, 5, 8, 90) for evaluating and / or storing data (80) supplied to the data bus and / or for generating test data (130, 140, 160) , 100). The present invention relates to a method for detecting an error while accessing a program memory (4, 20). According to this method, the inspection data generated using the data to be protected is additionally stored in a column, and the error detection device (3, 6, 8, 90, 100) is connected to the data bus (30). And / or access the address bus (21) alone and / or the error detector follows the bus traffic initiated by the central processing unit (1) and collects data.

Description

【Technical field】
[0001]
The invention relates to a computer system according to the preamble of claim 1, a method according to the preamble of claim 8 and the use of the computer system according to claim 17.
[Background]
[0002]
Electronic control devices for automobile brakes always take on many functions of the brake system in the course of technological development. In the past, only the ABS function was electronically controlled and coordinated, but in today's “by-wire” brake systems, the entire braking function is controlled by the electronic controller. Accordingly, there is an increasing need for highly reliable electronic vehicle control devices.
[0003]
Known electronic vehicle controllers typically include a microprocessor system that is program-controlled to handle complex functions. Further, it is known that when test data is generated when data is stored in a RAM memory, the reliability of the microprocessor system described at the beginning is improved.
[0004]
The reliability of an automotive computer system is improved by storing a parity bit for each data row in the same memory unit or in a separate memory unit when reading the flash memory by a microprocessor according to U.S. Pat. . During memory access, a parity bit is similarly generated and compared with the stored test data for error checking.
[0005]
Protecting data row by row in the data memory by storing parity bits allows detection of individual errors in small sized blocks (half words / words), but enormous storage Need. The need for storage for the parity memory is disadvantageous for modern processors, depending on the area to be protected, for reasons of processing speed.
[Patent Document 1]
DE10109449
DISCLOSURE OF THE INVENTION
[Problems to be solved by the invention]
[0006]
Accordingly, it is an object of the present invention to provide a computer system and method that enables reliable memory access and at the same time achieves high processing speed and small chip area.
[Means for Solving the Problems]
[0007]
The present invention proposes a computer system according to claim 1 and a method according to claim 8.
[0008]
Unlike the protection by the parity bit, the method according to the present invention that generates the check data for each column (for example, the protection by the checksum as in the CRC method and the ECC method) greatly reduces the chip area. The method described in parentheses above is particularly suitable for protecting large data blocks and is therefore advantageous for the present invention. The ratio of inspection data is in the range of about 10 ^-8 or less.
[0009]
Preferably, the inspection data is generated according to the CRC method or the ECC method during the inspection for each column.
[0010]
In order to generate inspection data for each column, it is necessary to read out a plurality of data rows, for example, to read out all the data rows of one memory block. Thus, column inspection, unlike the above-described line check, cannot be easily performed simultaneously during reading.
[0011]
The test data generator according to the present invention provides the advantage that the data in the program memory can be read at high speed.
[0012]
In the memory access, an error is preferably detected by the inspection data comparison device. This inspection data comparison device compares inspection data generated during reading with stored inspection data. Upon detection of an error, a particularly suitable safety function (fail-safe), for example, switching of the brake system to an emergency driving state is started.
[0013]
Advantageously, check data is generated by a parity generator column by column and / or row using a check data generator. This parity generator is in particular connected to the data bus of the computer system.
[0014]
In the method according to the invention, the program memory is protected by an error detection device. The error detection device alone or controlled by software accesses the data bus and / or address bus. Similarly, single access can be assisted by software. Further, the error detector can follow the bus traffic leaving the central processing unit and the data collected during the tracking can be used for error detection.
[0015]
Advantageously, the above method for detecting errors is a combination of software methods and hardware means. This has the advantage that the memory can be checked during execution time (“online”) and at other times (“offline”).
[0016]
In order to generate the inspection data for each row, the data of the microprocessor system known per se must be transmitted via a data bus to a central processing unit (CPU). Thereby, the data bus is loaded. It is therefore advantageous to use a central processing unit with an integrated cache.
[0017]
Furthermore, it is particularly advantageous if an access unit for direct memory access is provided. This access unit further reduces the load on the data bus and the central processing unit. This access unit is in particular connected to a specific test data generator. However, in an embodiment with an access unit, it is also possible to use a central processing unit that does not have an integrated cache.
[0018]
The term “computer system” is understood to be an individual computer system or a computer system connected to each other, for example a microcontroller including additional memory and input / output functions in addition to a central processing unit (CPU). . This computer system can be formed as “single core (with one central processing unit)” or in particular “multi-core”. This multi-core computer system includes two or more central processing units.
[0019]
The term “program memory” is understood to be memory provided primarily for read access, in particular mask ROM, flash ROM, E2PROM or OTP-ROM.
[0020]
Advantageously, each physical block of program memory is assigned verification data (signature or CRC checksum). Block check data is calculated after compilation and written to memory along with the program file. When the memory is first written, the test data is generated by software, for example, according to the same method as the test data generator when reading the memory later.
[0021]
In another advantageous embodiment of the method, when reading a data word from the program memory at an initial point in time, memory errors are detected by generating line check data from this data word. This row inspection data is generated and stored especially during mass production of the memory, preferably during manufacture of the mask ROM. When reading, the actually detected row check data is compared with the row check data for this data word already stored at the previous time. In addition, the collected or stored column check data for the data word from the previous reading prior to the first time point is compared with the stored check data for the previously read block.
[0022]
In another advantageous embodiment of the method, the address data is additionally protected. This is particularly done by generating address check data for each column according to one of the above methods.
[0023]
In another advantageous embodiment, the test data is addressed corresponding to the additional data area of the data memory for the data to be protected and the physically separated first data memory. Stored in the program memory.
[0024]
In another advantageous method of the invention, the memory is checked by software inspection. This software check is especially started periodically. During software testing, the central processor preferably reads at least one memory block completely at maximum speed. Meanwhile, the test data generator monitors the data bus and collects all the data in the memory block supplied to the data bus. After reading the memory block, the calculated block check data is compared with the block data previously stored for this block. Thereby, the block check data information related to the data flow can be calculated without delay.
[0025]
In a preferred embodiment of the present invention, after detecting a data error, the information included in the inspection data is used to correct the data including the error.
[0026]
The program memory is preferably arranged “on-chip” on the multichip module or as a separate chip.
[0027]
The computer system according to the present invention is preferably an electronic control unit (ECU) which is assembled by being plugged into a part of an electronic vehicle control device, in particular a hydraulic brake control device (HCU) to form one block-like complex. Part of it. Accordingly, the present invention also relates to the use of the above-described computer system in an electronic control device for an automobile, particularly an electronic automobile brake system.
BEST MODE FOR CARRYING OUT THE INVENTION
[0028]
Other advantageous embodiments are evident from the dependent claims and the following description of the embodiments based on the figures.
[0029]
In FIG. 1, the central processing unit 1 includes an integrated cache 2. The central processing unit 1 is connected to the mask ROM 4 via the data bus 30. A data link 5 is guided from the data bus 30 to the access unit 6. A data link 7 is guided from the access unit 6 to the check computer 8. The check computer performs the check data calculation alone by generating a checksum. For this purpose, the check computer comprises a processing unit designed to process the appropriate logic elements or checksum methods. The access unit 6 is preferably a DMA (direct memory access) for accessing the memory independently without placing a load on the central processing unit. Data is transmitted to the check computer 8 via the data link 7. If an error is detected by the check computer 8, an error signal can be output from the line 9.
[0030]
The inspection data is stored in the program memory 4 together with the data. The program memory 4 can be understood as a table composed of an address column 13 and a data column 14. In this case, each address together with the data stored at this address forms a table row. The address column 13 is shown for illustration only and does not physically exist. The data memory 14 is divided into a data area 15 and a redundant data area 16. Data area 14 is further divided into blocks 12, which are typically about 10E2 to 10E5 words in size.
[0031]
In order to protect the stored data, the column inspection data 11 is stored in the redundant data area 16. This column inspection data is generated by a checksum method (for example, CRC method). If the Hamming distance method is used as the checksum method, individual errors and multiple errors can be detected and these errors can be corrected. This will improve the overall system usability.
[0032]
When test data is stored in the program memory itself (i.e. not a separate chip, chip area or core) according to an advantageous embodiment, the computer system according to the invention only requires a very small chip surface. In this case, it is appropriate to protect the address decoder with address check data. For this purpose, the sum of all program memory addresses of the block 12 is determined and stored in the test data area 10 before the first write operation of the memory.
[0033]
In FIG. 2, the data is examined row by row and column by column. First, every time a parity generator 100 reads and accesses the current data word on the data bus 30 to produce test data during program execution, a parity word or parity bit is calculated. At that time, the central processing unit 1 simultaneously designates an address to a necessary memory location in the data memory 20 and the parity memory 70 via the address bus 21. Parity data is preferably placed in a separate parity memory 70 and in another memory area 60. Thereafter, a parity word or parity bit is generated and compared with the parity data 130, 140 (FIG. 3) stored by the comparator 90. In the case of an error, the signal at the output unit 11 of the comparator 90 is output to an appropriate evaluation circuit.
[0034]
For the check for each column, the central processing unit 1 reads the data block 12 (FIG. 3) to be read. In this case, the read data is read into the signature check circuit 3 and ignored by the processing device 1. Circuit 3 calculates the CRC sum by itself from the supplied data flow. After reading the block, the calculated CRC sum is compared with the sum stored permanently for the block.
[0035]
FIG. 3 shows an example for dividing the program memory 150. The program memory is divided into individual blocks 12 each consisting of two data words 80 each having a width of 16 bits. Block inspection data 160 is assigned to each block 12. Further, in the other memory area 70, row check data 130 and 140 for each data word assigned to the memory address are provided. In doing so, exactly one parity bit is generated for each 16-bit word.
[Brief description of the drawings]
[0036]
FIG. 1 is a simplified schematic diagram of a computer system according to the present invention with an access unit for direct memory access.
FIG. 2 is a diagram showing another embodiment of a computer system according to the present invention having two test data generating devices.
FIG. 3 is a diagram schematically showing a data memory divided into a parity memory and a signature memory.

Claims (17)

At least one central processing unit (1) and at least one data bus (30) connected to the central processing unit and storage elements (4, 20, 60, 70), the storage elements being at least one program A memory (15, 20) and one or more test data memories (16, 60, 70), the test data memory being part of the program memory (4, 20) (16, 60) and / or separately In order to evaluate and / or store data (80) supplied to the data bus in a computer system (50), in particular an electronic vehicle controller, which is part of a provided storage element (70) At least one inspection data generator (3, 6, 8, 90, 100) for generating data (130, 140, 160) is provided. Computer system characterized in that. Computer system according to claim 1, characterized in that the test data generator (3, 6, 8) collects data supplied to the data bus and this data is supplied directly to the data bus directly. The test data generator groups the data supplied to the data bus into blocks to produce column-by-column test data, the grouping in particular by applying a recursive method or storing data words followed by total information The computer system according to claim 1, wherein the calculation is performed by calculating The inspection data generator (6, 8) has an access unit (6) for directly accessing the memory via the data bus, and this access unit is connected to a check computer (8) for calculating the inspection data. The computer system according to claim 1, wherein the data processed by the check computer is readable and writable by the access unit. 5. At least one of claims 1 to 4, characterized in that a cache (2) is provided in order to reduce the burden on the data bus (30) and this cache is integrated in the central processing unit (1). The computer system described in 1. At least one inspection data comparison device (90) connected to the inspection data generation device (6, 8, 100) is provided, and the inspection data obtained by the inspection data generation device is stored in the inspection data comparison device. The computer system according to claim 1, wherein the computer system is compared with data. 7. Test data according to claim 1, characterized in that check data is generated by the check data generator (3) on a column-by-column basis and / or on a row-by-row basis by a parity generator (100). The computer system described in 1. Method for detecting an error while accessing a computer system (50) according to at least one of claims 1 to 7, in particular a program memory (4, 20) of an electronic vehicle control device, comprising: In another program memory module, in addition to the data to be protected (13, 14), additional inspection data is stored in the inspection data area (10, 11, 60), and this inspection data uses the data to be protected. The program memory is divided into data blocks or address blocks, and inspection data (160) is formed for each column for the data word (120) forming one data block, and in the inspection data area. In the stored method, the error detection device (3, 6, 8, 90, 100) reads or reads data. During the following, the data bus (30) and / or the address bus (21) is accessed independently for writing and / or the error detection device follows the bus traffic initiated by the central processing unit (1). A method characterized in that the data collected in the above is used for error detection. 9. The method according to claim 8, wherein address check data is formed for addressing a data memory area protected by the check data generated for each column. 10. Method according to claim 8 or 9, characterized in that for every individual data word (120), row inspection data (130, 140) are stored. When reading a data word from the program memory, a line check data is generated from this data word at the first time, and this line check data is compared with the line check data relating to this data word already stored at an earlier time; Grouping the test data in the columns relating to the data words collected and stored before the first time point into a block check data, grouping at the first time point, this block test data into the previously read block 11. A method according to at least one of claims 8 to 10, characterized in that a memory error is detected by comparing with stored block check data for. 12. Block check data is generated before almost completely writing to memory, in particular after compiling a program by generating a program file. the method of. A software inspection program is executed at a predetermined time and / or at regular intervals, and the software inspection program reads the data memory during which the inspection data is independent of the central processing unit by the error detection device (3). A method according to at least one of claims 8 to 12, characterized in that the creation is carried out in a particularly recursive manner and the obtained examination data is compared with the stored examination data. The method according to claim 13, characterized in that the reading of the data memory takes place at a maximum reading speed preset by the microprocessor system. 15. A method according to claim 13 or 14, characterized in that the contents of one block of the data memory are completely read out sequentially during program execution. When an error is detected by comparing the stored test data with the actually calculated test data, an error signal (9, 11) is output and / or the data value or address value containing the error is corrected. 16. Method according to at least one of claims 8 to 15, characterized in that the error is eliminated by substituting the value. Use of a computer system according to at least one of claims 1 to 7 in an automotive electronic control device, in particular an electronic automotive brake system.

Images