Coding techniques for failure recovery in a distributive modular memory organization

Transcription

1 Coding techniques for failure recovery in a distributive modular memory organization by S. A. SZYGENDA Southern M ethodist University Dallas, Texas and M. J. FLYNN T<he Johns Hopkins University Baltimore, Maryland NTRODUCTON This paper considers various coding techniques which could be applied to a memory organization to achieve detection and correction of failures. n this discussion, we define a fault as a malfunction of a systems component and a failure as a manifestation of a fault. Notice that a single fault can result in multiple failures. Thus, techniques such as error-detecting and correction codes, when used alone, are. limited in that they operate on failures-not faults. Failure analysis of various memory organizations has been performed.! The material presented in this section of the.paper summarizes these results. The analysis demonstrated that a fault in the accessing units, the address decoders or in the drivers, can introduce multiple failures in the memory. To insure against these types of faults we must prevent, or detect and correct the following conditions: a. More than one of the decoder outputs becoming active during a memory instruction. b. Major fluctuations occurring in the amplitude of the current pulse provided for the selection of memory words. By digital simulation, it has been determined that, at most, two output leads from the memory drivers will be active at anyone time, under a single fault assumption. Hence, a device capable of summing the current supplied by the drive lines can be used. A simple parity check could perform this function; however, a better implementation would use a device capable of summing currents from a number of leads. Faults would be indicated by attainment of minimum or maximum threshold current values, i.e., this device would possess properties similar to that of a Zener diode. By measuring the current, checking for two types of faults can be accomplished, first, detection of fluctuations of the amplitude of the current pulse on the correct line and, second, detection of no-drive-line or two-drive-lines being activated. The current summing methods can detect the faults in the accessing units, but if processing is not halted while this check is made, data in the memory may be damaged. Since it is not desirable for processing time to be sacrificed for checking, except where absolutely necessary, it is assumed that data may have been erroneously changed in the memory due to checking being performed simultaneously with the memory operation. Since it is necessary to locate the faulty word, the procedure of summing the current pulses can be used for that purpose. Under fault conditions, it is known from the current summing check that half of the address (more precisely, which half), has been decoded properly. Therefore, the faulty word must be one which is selected by coincident current pulse with the correct drive line. Two questions remain to be answered: 1. How is the damaged memory word corrected? 2. How is the fault in the accessing hardware corrected? t will be shown that correction of memory data can be accomplished if it is known that there will only be 459

2 460 Spring Joint Computer Conference, 1971 Figure 1-Decoder and memory module organization one word damaged in a memory module. This correction will be accomplished by coding techniques to be discussed in the next section. Hence, the problem remaining is that of assuring that the type of faults being considered cannot affect more than one word in a memory module. This can be accomplished with the example organization shown in Figure 1. n general, the memory is divided into modules. For convenience, these modules may be logically divided into 2N groups of 2M words each. These groups will be referred to as the memory modules. The switching array is made up of elements which are switched by half select currents applied by the horizontal and vertical drivers. The memory word desired is then indicated by the switched element of the array. For the read operation, a linear select current is applied to the lead emanating from the selected element. The bit lines act as sensing lines to sense the bits of the accessed word. The word is regenerated by having the bit line inhibit positions requiring "0." The word line is then driven to the "" state. A major feature of this organization is the manner in which the switching array is implemented. This implementation must meet the requirement of storing words in such a manner that at most one complete word in each module can be affected by a fault. Figure 2 gives an example of this organization for a memory array of eight modules containing eight words each. As can be seen from the figure, lines R 1,, Rs thread eight elements in a diagonal manner. (The symbology used on the R lines is for plarification only and has not been used on the L lines. The lines are all identical accessing lines.) This organization provides the desired failure distribution for single faults that could occur in the memory accessing units. The question may arise as to the need for the current summing device if any single word in a memory module can be reconfigured. The reason for the summing is strictly for fault indication. That is, corrective action would not be taken unless a fault has been indicated. Another possible area of faults would be on the bit lines. A fault affecting a bit line can in turn affect a bit in every word of the memory. However, it would only affect a single bit per word, and this condition can be corrected by techniques to be considered. Faults in the accessing units can be eliminated by switching in a spare unit and then an indication of this condition will be given for replacement of the faulty unit. As yet, we have not mentioned the possibility of transient faults in this organization. To insure against needless replacement of modules, because of transient faults, a retry feature will be used. Mter a fault has been indicated and the memory words reconstructed, a retry order will be given. Under the retry condition, access to the switching array will be inhibited unless no fault is indicated. f a fault is again indicated, it will be assumed to be solid and the spare unit will be activated. Two way read technique An additional feature is to be provided for this memory organization. A two way read will be used on each memory module. That is, the capability will be provided to read an element in the same position of each word in a module. This feature provides the capability of reconstructing a damaged word of data in the memory. Figure 3 shows the basic organization with the two way read feature added. For reading, a linear select pulse will be provided on the bit line. This will switch all memory elements in the "" state to the "0" state. The changes will be sensed by the word lines and stored in the bit register. For rewriting, a half select pulse of opposite polarity WRNG TECHNQUE FOR TlE SW1l:H1NG ARRAY Figure 2-Wiring technique for the switching array

3 Coding Techniques 461 will be provided by the bit line and the word lines which sensed the original change. By repeating the procedure of sequentially stepping through all the bit lines, we can read the contents of the memory module as rows of bits. This procedure will be essential to the discussion in the succeeding sections. CODNG SCHEME Since all the memory modules are identical, we will restrict our attention to a typical module. The major techniques to be used are: 1. Virtual embedding of the address of the data word into the word itself (Figure 4). 2. Use of an iterated code for reconstruction of a memory word, or of a string of bits. The scheme employed here uses virtual embedding of the address of the data word into the word itself, for the purposes of failure detection and correction. The embedding is virtual because the address of the data is never stored with the data. Rather, since its true value is presumably known during the storage phase, the coding f-or detection and correction treats its argument as the concatenation of the address and the data word itself.2 n conjunction with the vitrual embedding technique, an iterated code is used. A linear code is applied over the rows and over the columns of a memory module to produce the iterated code. The use of these techniques will be demonstrated for the implementations adopted in this study. Double error detection and single error correction n this case, a Hamming minimum distance four code (applied over the address and data jointly) is sufficient to obtain double error detection and single error correction. With this system, the following can be accomplished. Assume an address has been moved to the address register (A.R.). The address is then decoded and a location is accessed. From the configuration of a typical system (Figure 5), we can determine whether the location accessed is the location that was specified. When a word is moved to the A.R., the code bits are checked to determine if a fault exists in the A.R. or in the transfer. f a single failure has occurred, it will be detected and corrected by the code. Therefore, the validity of the contents of the A.R. can be assessed. When a word is accessed, a code will be generated jointly on the data portion of that word and on the address in the A.R. This code should match identically the code contained in the accessed location. f a match does not occur, there exists an error in the address, the data, or the match circuit. By decoding the accessed word, it can be determined if the error is in the data. f so, it can simply be corrected by the check circuitry. f the error is not indicated in the data, it is concluded that the fault is in the accessing circuitry. Correction of this fault would be by use of the spare accessing circuitry. Accessing of the word is then tried again. f, again, an error indication is given (not in the data), it is concluded that the fault is not in the address decoder but actually in the code matching circuit. The preceding discussion is formalized in Algorithm 1. ALGOUTD 1: HfX)llY ACCESS WTH DOUBLE ElUlOll DETECTON Al) SGLE ElUlOll CORllECTON 1 1 :L - 1. Baa. fault been :Lnd:Lcated by the current sng circuit? '7 2!love addre.., covered by code, to address register r: 3 Yal:Ldity of content of address regiater 18 checked by use of code bits.! 4 il' Ho.., 6 s Oe code to single error, or indicate double error. 1 r 1 6 Decode addre.s and access designated word. 7 Generate code bits on the concatenation of the data and address. 8 Figure 3-Memory organization with two way read

4 462 Spring Joint Computer Conference, Check the code on the data alone. 10 e an error indicated in the data? l '8 11 A8s that the fault 18 in the word accessing circuits. 12, ADDRESSES OF MEMORY WORDS COVERED BY CODES. BUT NOT PHYSCALLY CONTANED.. MEMORY MEMORY L l,.--code CHECK an COVERNG EACH WORD AND TS ADDRESS...& Switch to spare units. 13 s i - 2? yes Figure 4-Virtual coding technique these codes will permit the complete reconstruction of a memory word. 14 i t6 15 Conclude that fault is in the match circuit mplies that a valid access has been made to the correct location of uncorrupted data. 17 ALGORTHM Use code to mask failure in data. terated codes An iterated, or product, code can be envisioned as one applied over the rows and columns of a binary array (Figure 6). The minimum weight of such a code is the product of the minimum weights of the individual codes. A proof of this theorem is given by Peterson. 3 Two different product codes will be considered: 1. Minimum weight 2 code on columns and rows. 2. Minimum weight 4 code on columns and rows. The minimum weight of the first product code would be 4. This code would be capable of double error detection and single error correction. These codes will serve a double purpose in the memory organization proposed. They permit the reading of a memory word covered by a code or the reading of a string of bits covered by the code. Furthermore, Reconstruction of a data word The particular memory organization chosen in this study attempts to decrease the probability of multiple random type failures and increase the probability that multiple failures will be restricted to a single word in the memory module. Under this condition, it is desirable to reconfigure a given word in a module. However, before failures can be corrected, they must be isolated. The detection is provided by two methods. First, there is the Hamming code to detect failures. However, multiple failures are not always detectable by a double error detection code. Therefore, some alternate method of detection must be provided. Since detection by the coding techniques would be the fastest, this will be attempted first. f no failures are indicated by the code, and a fault exists (knowledge of this fault would be provided by the current summing circuit), the bit read would be performed for the module, and the code which had been previously generated on the hits would be checked. f a failure exists in a word, it will be detected by this method. At L..L"T""-:OO-E J}U CODE BTS OVER DATA AND ADDRESS r--, DUPUCATE A.R. L'-r L i ouplcate' OUPLCATEleJ SWTCHNG ARRAY LDECODER '..J L -- r OOPCATE'" J DECODER L..J Figure 5-Memory configuration with virtual coding features

5 Coding Techniques 463 r ADDRESS OF ROWS L r ADORESS OF COLUMNS MEMORY LNEAR COOE BTS... V-... """- LNEAR COOE BTS ai Si Pi Pil Figure 6-1 terated coding technique this point, the failure is located in a given module of memory. Location of the failures to a particular word in that module is accomplished with the assistance of the summing circuit. Since a fault would have been indicated by this circuit, it is known that a failure for a given module will be at the intersection of the drivers specified. This will locate the word containing failures. Figure 7 illustrates a possible memory configuration utilizing these techniques. For an example of this technique, consider (Figure 2) that drivers Ri and R j are active and a fault is indicated by the checker. Also, qriver Lk is active. The specified word of the module would be indicated by Lk and the modules being affected would be indicated by LkRi or LkR j This discussion has covered the types of solid faults detectable by the codes or the current summing check. For a read only memory the use of a minimum weight four code may be acceptable. However, in a read write memory, where data is constantly being changed, it would not be practical to generate this type of code for the entire module each time a memory word is changed. Although the use of a weight four code is impractical, virtual parity codes can be used efficiently. The encoding of a parity bit on a word of data is well known and will not be discussed here. However, it would be a costly procedure to recompute the parity on the bit strings by generating the parity after each access to the memory. Fortunately, the new parity on the bit string can be simply computed. Consider a word (a, a2,..., an) being entered into storage, and the storage word (S, S2,..., SN) which is to be replaced, also, the parity word (P, P2,..., PN) for the module. The values of the parity word are assumed to be that of the memory module containing the storage word to be replaced. The following truth table provides the specification for the new values of the parity word as a function of the possible input combinations. Pil is the new required value of Pi. Hence, changes need only take place where there is a change between Pi and p i l in the truth table. The required function can be performed utilizing two exclusive-or operations. Verification of this statement can be shown by the following truth table. ai Si aiebsi Pi Pi! = (aiebsi) EBpi Therefore, an exclusive-or can be performed between the new word being placed in memory and the word whose place is being taken. This would be followed by an exclusive-or with the parity word. The result would MEMORY MODULE CHECK ON CHECK BTS Figure 7-Memory configuration with iterated code CHECK ON ROWS

6 464 Spring Joint Computer Conference, 1971 be the new parity word. This procedure would take place only on a WRTE operation. The complete method for reconstruction of a data word is formalized in Algorithm 2. Next, we will consider fults in the checkers. Checking the checkers The question arises as to whether or not a malfunction can occur in the check circuitry, such that it could mask or introduce a fault into the data. The checking circuits of interest are the current summing circuits and the linear code decoders. Faults occurring in the summing circuit could be of the type that a fault is indicated, but none actually exists. This case would be detected by the code circuit. f the summing circuit indicates a fault, the code circuit would attempt to locate the failures and correct them. f the fault was in the summing circuit, the code circuit would not be able to locate the failure. Hence, a fault indication is provided for the summing unit, and the faulty unit would be removed from the configuration. Whether or not a fault is in the code circuitry will be determined by a procedure described later. Another possibility is that a fault exists in a checker, such that it continually provides a fault free indication. One way to insure against this type of failure is to use a microprogrammed diagnostic sequence, containing failures to be detected by the checker, which will be executed periodically to verify the integrity of the checkers. Another alternative for this condition is to duplicate the check circuitry. Duplication is acceptable since this circuit is quite inexpensive. f a fault is indicated by either unit, the code check will determine if the fault is in the summing circuit. The precise unit can be deduced from the outcome of the code check. A procedure will now be given to provide fault detection for the parity or Hamming decoding unit. For these units, duplication will again be employed. The inputs to the decoders will be identical. Assume that an output of 0 is the no fault indication and a 1 will be the fault indication. The possible outputs for decoders A and B would then be: A B 0 0 No Fault 0 1 Decoder Fault 1 0 Decoder Fault 1 1 Fault, Not in the Decoder f both units indicate a failure, it will be masked and processing will continue. f only one of the units indicate a failure, an attempt will be made at masking the supposed failure. After masking the data, it will again be processed through the decoders. The following tree diagrams show, for both units, the possible output states that could be observed upon reprocessing f\ Consider the outputs originally being 01. After masking and reprocessing, it could not again assume the 01 state due to the single fault assumption. f the outputs assumed the 00 state, the fault would be isolated to the A unit. The 10 state and the 11 state would indicate the B units. f the original outputs were 10, the possible outputs could be: 00 indicating a fault in unit B, 01 indicating a fault in A, or 11 indicating a fault in A. These conditions are summarized below: ALGORTHM 2: RECONSTRUCTON OF A DATA WORD ALGORTHM 1 1 Has a fault been indicated by the current su.ming circuit? 2 k - 1 yes L.. _ Access row k of bits and check code for modules accessed by the word decoders. 4 Does the bit access current summing circuit indicate a fault? S Switch to spare bit accessing circuit. 6 Does a failure exist in th data accessed? 7 Failure 1.& now isolated to a givn module. 8 Use Summing circuit to determine whicnword in the faulty module has been accessed. 9 nvert faulty bit. 10 Have all rows been read? 1 no 1 no no k-k+1-11 mplies data is valid. Continue processing.

7 Coding Techniques No action to be taken 00,, Fault in A Disconnect A and continue processing 01 Correct failure and process through decoders Correct failures and continue processing Fault in B 11 Disconnect B, return data to original state and continue processing 10 Correct failures and process through decoders , Fault in B Disconnect B and continue Fault in A 1 Disconnect A, return data to original state and continue processing These techniques provide the capability of fault detecti<;m and isolation for the checking circuits. M errwry configuration A major objective of this study is to reduce, as much as possible, the amount of redundant hardware used in the system. The configurations shown in Figures 5 and 7 have utilized duplication of the accessing units, resulting in an undesirable level of redundancy. Since the proposed memory would be modular or expandable in nature, a configuration was adopted which decreases the total amount of redundant hardware. This configuration includes one or more read-only memory (R.O.M.) units, one or more read-write memory (R.W.M.) units, and one spare address register.ue1ilelllclrrw.t L f r ,...-, r..l-, A.D." SA LT..J L"T-' r-td' L_r':'.1 L. r yo ADDREU latr Figure 8-Memory configuration with redundant accessing (A.R.), address decoder (A.D.) and switching array (S.A.), as shown in Figure 8. This approach eliminates the need for duplication of the accessing units for each R.O.M. or R.W.M. module. Whenever a fault is indicated in any A.R., A.D. or S.A., the spare system is switched into use, the appropriate address is decoded and accessing of the word is accomplished by switching to the correct unit. To insure that the spare units are functioning, they are not left idle under fault free conditions. A counter is provided so that every nth access to a memory unit will be processed by the designated unit, as well as the spare. The spare contains the same checking features as the other units. Hence, corresponding faults will be indicated in a similar manner. To insure the functioning of the switches, the outputs of the spare and the designated units are compared. This process would be performed sequentially through each of the memory units, to check the functioning of the interconnections between any unit and the spare. CONCLUSON The techniques proposed in this paper provide the capability of failure recovery in the memory organiztion described. All failures resulting from single solid faults can be detected and corrected. n addition, fault detection in the accessing circuitry and the checkers is considered. A primary objective of this study has been to demonstrate that multiple failures could be corrected before they cause malfunctions, without resorting to duplication or triplication of hardware. A total memory system has been configured using the techniques described in this paper. This configuration uses less than 25 percent redundant hardware and no diagnostic software. The system is presently undergoing fault analysis by the use of digital simulation. 4 While the codes considered have fulfilled the specified objective, it may be possible to use other codes resulting in a more efficient implementation. Two possibilities

8 466 Spring Joint Computer Conference, 1971 are presently being considered, the first is coding techniques utilizing more efficient decoding procedures or less redundant hardware. Second, the possibility of utilizing residue codes, such that common decoders could be utilized for codes applied to data undergoing arithmetic operations, as well as memory data, is being considered. REFERENCES 1 S A SZYGENDA M J FLYNN Failure analysis of memory organizations for utilization in a self repair memory system EEE Transactions on Reliability Feb R W DOWNNG J S NOWAK L S THOMENOKSA No 1 EBB maintenance plan The Bell System Technical Journal Vol 43 Sept 1964 Part 1 of 2 pp W W PETERSON Error correcting codes MT Press 1961 pp S A SZYGENDA D ROUSE E THOMPSON A model and implementation of a universal time delay simulator for large digital nets AFPS Proceedings of the SJCC May 1970