Field of the Invention

The present invention relates to memory systems and in particular to memory systems intended for data critical applications, that is applications in which a corruption of the data during storage and subsequent retrieval can have a potentially catastrophic effect on the overall system, a control system, for example, of which the memory system forms a part.

Background Art

There are many examples of data critical applications in the automotive area, for example the storage of control parameters by the control system of an anti-lock braking system, or engine parameter storage (e.g. diagnostic parameters) by an ignition control system, all of which systems may be realised by a microcomputer controller comprising a microprocessor and associated memory. Factors which can cause a corruption of stored data include subjecting the semi-conductor devices of the system to extreme temperatures and electrical noise causing erratic or unpredictable behaviour.

Data storage in control systems may be permanent ROM (control programs, for example), temporary RAM (e.g. intermediate process parameters), or long-term EEPROM (parameters to be carried forward to be retrieved at a later date, such as for example engine diagnostic parameters and performance parameters). A memory cell of an EEPROM (Electrically Erasable/Programmable Read Only Memory) typically comprises a field effect memory transistor having a floating gate, which is selectively charged to change the logical state of the transistor.

EEPROM is commonly integrated with a microprocessor to form a single device, but the amount of the EEPROM storage is severely limited to 2-4 kbits.

Corruption of long-term data stored in EEPROM can be particularly problematic since, it is unlikely to lead to a manifest failure of the system as a whole. For example, suppose a diagnostic

variable stored in EEPROM by the processor at the instant of an engine malfunction to be indicative of the failure becomes corrupted, then when the false information is subsequently read, much expenditure could be wasted in trying to solve a non-existent problem, whilst the real failure goes untreated. Equally, if an engine running parameter, such as one used to make small variations in ignition timing to preserve performance as engine wear is encountered, is corrupted then not only will the engine run inefficiently, but the performance may actually be degraded. In this sense, such applications are data-critical. In an extreme case, engine damage could be caused if a stored control parameter were corrupted to a value that produced a severe ignition timing error. Firing with the inlet value open could give combustion right through the manifold to the carburetter. When an EEPROM is reprogrammed, say one byte at a time, firstly all the cells of the byte are erased and secondly the "new" cells are programmed with desired data. An erased EEPROM cell (conventionally designated as a logical "1 ") is programmed (logical "0") by storing a small amount of energy on the floating gate of the cell transistor; however the programming action requires a relatively large expenditure of energy. Whilst data can be corrupted in various ways, it cannot normally be corrupted by energising an erased cell ("1 ") to "0", because the energy required would not be available save in a catastrophic situation. The usual problems of data corruption are that not enough energy is loaded into the cell to program to "0", or that the energy stored in a "0" programmed cell is lost, whereby the cell reverts or remains in a "1" condition.

Loss of energy stored in a programmed cell may occur through leakage at a very high temperature. However, the most common form of data corruption is that not enough energy is loaded into the cell during programming the cell to "0". In view of the finite time interval for reprogramming the cell, if there is a power supply voltage spike or power down during a program or erase operation, then the state of the cell after the operation will be indeterminate with consequent corruption of the data stored. For example it is common practice to hold the processor in a reset mode during power down so that potentially damaging spurious outputs cannot be

generated by the power supply. A reset which occurs before all memory cells have been erased or after memory cells have been erased but before the required cells have been programmed will cause data corruption. The problem of data corruption is well known in memory systems in general, and many types of algorithms and codes have been devised to detect corruption, e.g. checksum algorithms, hamming codes, CRC checks. The problem with all such methods is that they require significant memory overhead, and in Automotive applications, memory space is strictly limited.

One system which has previously been proposed in automotive applications is the triple redundancy check in which data is written in three separate locations so that if one data set is corrupted then other two sets, which will be identical, will provide data verification. However such a system is wasteful of memory.

Summary of the Invention

It is an object of the invention to provide a memory system for automotive applications wherein data corruption may easily be detected and which is economic of memory space.

The present invention provides in one aspect a memory system comprising a suction of electronically erasable programmable read only memory (EEPROM) , means for programming the EEPROM including means for transforming input data into specific codes of a code set, each code of the set having the same number of data bits and the same predetermined number of data bits of one logical state, means for writing the codes representing the input data into the EEPROM, and means for reading the codes stored in EEPROM including means for checking said codes for data corruption by determining whether said codes contain said predetermined number.

In a further aspect the invention provides a method of writing data into a memory system comprising a section of electronically erasable programmable read only memory (EEPROM), the method comprising: transforming input data to be recorded into specific codes of a code set, each code of the set having the same number of data bits

and the same predetermined number of data bits of one logical state; writing said specific codes into the EEPROM section, and verifying the write operation by reading the codes written into the EEPROM section, and determining in each read code whether the number of data bits of said one logical state is the same as said predetermined number.

Thus in accordance with the invention the coded data written or programmed in the cells of the EEPROM may easily be checked for data corruption by assessing the number of bits having said one logical state. Since the number of cells programmed by the code to a "0" condition is known, then a test which counts the programmed cells of a data byte of the EEPROM and compares the result with this known number, is a 100% effective failure detecting test. This test or check will usually occur immediately after writing, in accordance with usual write check methods, and at any time that data is to be read from the EEPROM. Thus the danger of wrongly programmed cells through power down during a write operation or other abnormal conditions can easily be detected. The present invention is particularly adapted for automotive applications since normally there is only a limited number of data values that need to be stored, e.g. data values related to diagnostic routines.

It is also possible when reading data for the read codes to undergo a further transformation into a further code set which may be for example a code set designated by a particular automobile manufacturer.

It will be understood that the EEPROM may be provided with a separate means for assessing whether the individual memory cells are functioning correctly.

Advantageously the code set, termed in general a "n out of m" code, will be a so-called "4 out of 8" code wherein the predetermined number of data bits is half the byte size. It is possible that in certain situations an additional code set may be provided with longer codes, e.g. 2 bytes long, and with a different predetermined number, e.g. 8.

Brief Description of the Drawings

A preferred embodiment of the invention will now be described with reference to the accompanying drawings in which:- Figure 1 represents a microcomputer system including a memory system in accordance with the present invention.

Fig 2 represents a flow chart of a write cycle incorporating the present invention, and

Fig 3 represents a flow chart of a read cycle incorporating the present invention.

Description of the Preferred Embodiment

Referring now to Fig. 1, a schematic block diagram is shown of the Motorola MC68HC05B6 microcomputer. Among features worthy of mention is a central processing unit 2, an input port 4 which accepts 8 analog inputs on lines PD0-7, and 8 bit A/D converter 6, a static ram 8 of 176 bytes, an EPPROM 10 of 256 bytes, and a user ROM 12 of 6kbytes. The user ROM 12 contains EPPROM read/write algorithms in a memory space 14 and a code conversion look up table in memory space 16. An address/data bus 18 and a further code lookup table 19 are provided.

The codes of the code set in table 16 are chosen as "n out of m" codes so that they all contain the same number of 1 logical states. Thus for a code which is 1 byte long, ie. 8 bits long, a code is chosen so that in each code of the code set a certain number of the bits are 1 and the rest are 0. The largest number of allowable byte values occur when the number of Is is half the number of the available bits. Thus for a byte of 8 bits long the number of allowable combinations in the situation where 4 of the bits are logical 1, is 70.

Such a code is known as "4 out of 8" code. Although the number of allowable byte values has been restricted compared with the 256 possible values this is not a limitation for example in automotive diagnostics, where perhaps considerably less than 70 different codes are used.

It will be understood that when use in an automotive system, the analog inputs of PDO-7 to port 4 will be coupled to appropriate sensors. A typical problem for which the present invention is

particularly applicable is for detecting whether a sensor is inoperative. For example the A/D converter 6 has a range of from 0 to 255 and a temperature sensor coupled to an input line may provide typically when it is operating correctly values of between 30 and 200. If the temperature sensor readings fall between 0 and 30 and 200 and 255, this indicates the possibility of an open circuit or a short circuit in the temperature sensor. If an outer limits reading occurs say 20 or 30 times within a pre-determined time span then this indicates that the temperature sensor has in fact failed and CPU 2 will generate an appropriate interrupt to ensure that the failure of the temperature sensor is registered. In accordance with the invention, a failure code is pre-allocated to this condition and is written into EPPROM 10.

It will be understood the microcomputer contains monitoring and maintenance algorithms to ensure that its component parts are working correctly, and in particular that EPPROM 10 is working correctly. Typically this is done before data is written into EPPROM 10 by checking that its output is FF (hexadecimal code) , and at other times by checking the output "number" remains the same. It will be understood the processing of writing data to EPPROM

10 occupies several clock cycles since first it is necessary to erase data contained in the selected memory cells and then new data has to be programmed into those cells. During this relatively lengthy write operation the data to be stored is open to corruption, by failure to program a "0" state into an erased "1 " state cell, if for example a power down re-set occurs within the system, which is a common occurrence in automotive applications. Solutions such as battery back-up are not practicable for reasons of costs in automotive applications. In accordance with the invention when CPU 2 determines from the various analog inputs that are being monitored that long term data is to be stored in EPPROM 10 for example to describe the failure of a sensor, the write operation shown in Fig. 2 takes places. Firstly a write request interrupt 21 is generated. Data generated by CPU 2 to denote failure for example from a temperature sensor is output on address/data bus 18 (22) and the address created by CPU 2 is employed to access look up table 16 to access a code of a code set which has been pre-selected for temperature sensor failure (23).

This code is then output on address data bus 18 and is written into EPPROM 10 (24). To check the writing operation, the code is immediately read (25) from EEPROM and the code is validated by counting the number of l's present and comparing the total with the predetermined number. If equal to the predetermined number of 4 no action is necessary (27); otherwise, the write operation is repeated.

The counting and comparison actions may be implemented in software routines in the CPU; alternatively, a special purpose hardware "discriminator" may be provided.