Data correction for redundant data storage

Abstract

In one example, an apparatus includes a first memory device (702), a second memory device (704), and a third memory device (706), an error detection circuit (902), and an error correction circuit (904). The error detection circuit is configured to detect a mismatch among data stored at the first memory device, the second memory device, and the third memory device, and in response to detecting the mismatch, provide a correction signal (910) representing a majority state of the data. The error correction circuit is configured to write the majority state of the data into at least one of the first memory device, the second memory device, or the third memory device in response to the correction signal.

Description

Background Art

[0001] Electronic systems often include memory, such as random access memory (RAM) and sequential logic circuits, to store data to support various operations of the system. Electronic systems operating in high radiation environments, such as systems used in aviation and defense applications, can be prone to transient runaway events. In a transient runaway event, high-energy ionized particles (e.g., ions, electrons, and photons) can strike circuit components of the system and generate free charges through ionization. The free charges can cause state changes in circuit components such as memory. The free charges can corrupt data stored in the memory or cause the electronic system to write erroneous data into the memory. Both of these situations can introduce errors into the operation of the electronic system. Summary of the invention

[0002] An apparatus includes a first memory device, a second memory device, and a third memory device, an error detection circuit, and an error detection circuit. The first memory device has a first data input and a first data output. The second memory device has a second data input and a second data output. The third memory device has a third data input and a third data output. The error detection circuit has a first detection input, a second detection input, a third detection input, and a detection output. The first detection input is coupled to the first data output. The second detection input is coupled to the second data output. The third detection input is coupled to the third data output. The error detection circuit is configured to: detect a mismatch among data stored at the first memory device, the second memory device, and the third memory device; and in response to detecting the mismatch, provide a correction signal at the detection output, the correction signal representing a majority state of the data. The error correction circuit has a correction input, a first correction output, a second correction output, and a third correction output, wherein the correction input is coupled to the detection output, the first correction output is coupled to the first data input, the second correction output is coupled to the second data input, the third correction output is coupled to the third data input, and the error correction circuit is configured to write the majority state of the data to at least one of the first memory device, the second memory device, or the third memory device.

[0003] An apparatus includes a first memory device, a second memory device, and a third memory device, an instruction memory, and a processor. The first memory device is configured to store a first copy of first data. The second memory device is configured to store a second copy of the first data. The third memory device is configured to store a third copy of the first data. The instruction memory is configured to store an instruction set. The processor is configured to execute the instruction set to: detect a mismatch between the first copy, the second copy, and the third copy of the first data stored at the corresponding first memory device, the second memory device, and the third memory device; generate a correction signal representing an uncorrupted state of the first data; determine whether second data is received; in response to determining that the second data is received, store a copy of the second data at the first memory device, the second memory device, and the third memory device; and in response to determining that the second data is not received, provide a correction signal to at least one of the first memory device, the second memory device, or the third memory device to write the uncorrupted state of the first data to at least one of the first memory device, the second memory device, or the third memory device. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Figure 1 is a schematic diagram of an example system including a memory.

[0005] Figure 2 is a schematic diagram of another example system including a memory.

[0006] Figure 3 Show Figure 2 A graph of example operations of components of an example system.

[0007] Figure 4 is a schematic diagram of another example system including a memory.

[0008] Figure 5 and Figure 6 An example effect of a transient out-of-control event is shown.

[0009] Figure 7 A schematic diagram of an example redundant data storage system.

[0010] Fig. 8A and Figure 8B Shows multiple transient out-of-control events Figure 7 Instance impact of redundant data storage systems.

[0011] Fig. 9 FIG. 1 is a schematic diagram of another example redundant data storage system.

[0012] Fig.10 FIG. 1 is a schematic diagram of another example redundant data storage system.

[0013] Fig.11 for Fig. 9 and 10 A schematic diagram of internal components of an example of a redundant data storage system.

[0014] Fig.12 Show Fig. 9 and 10 A graph of an example operation of a redundant data storage system.

[0015] Fig.13 and 14 for Fig. 9 and 10 A schematic diagram of internal components of an example of a redundant data storage system.

[0016] Fig.15 is a schematic diagram of an example system including redundant data storage devices.

[0017] Fig.16 A flow chart illustrating a method of operating a redundant data storage system. DETAILED DESCRIPTION

[0018] Figure 1 1 is a schematic diagram of an example system 100 including a memory 102 and a circuit 104. The memory 102 may include memory devices such as static random access memory (SRAM), dynamic random access memory (DRAM), magnetoresistive RAM, and flash memory. The memory 102 may also include sequential logic devices such as latches (e.g., RS latches) and flip-flops.

[0019] Memory 102 may store various types of data to support the operation of circuit 104. For example, memory 102 may store operating state data 106. Operating state data 106 may represent the current operating state of circuit 104. Circuit 104 may read memory 102 to access the current state, and operate based on the current state. In response to the state machine transitioning to a new state, circuit 104 may also update operating state data 106 in memory 102 to reflect the new state. As another example, memory 102 may store configuration data 108. Configuration data 108 may include setting and / or programming information, such as the operating frequency of circuit 104, the power limit of circuit 104, and thresholds / conditions for different operating modes of circuit 104. Circuit 104 may read memory 102 to access configuration data 108, and operate based on the setting and / or programming information included in configuration data 108.

[0020] Figure 2 An example of system 100 is shown. Figure 2, system 100 may be a power converter system that transfers power from a power source 202 to a load 204. System 100 may include a control circuit 212, a high-side switch 214, and a low-side switch 216. High-side switch 214 may be coupled between power source 202 and a switching node 218, and low-side switch 216 may be coupled between switching node 218 and a ground terminal. Energy storage element 220 (e.g., an inductor) may be coupled between switching node 218 and load 204.

[0021] The power supply 202 can provide an input voltage V in The control circuit 212 may provide a high-side control signal 222 for enabling / disabling the high-side switch 214 and a low-side control signal 224 for enabling / disabling the low-side switch 216 to provide an output voltage V across the load 204. out By controlling the respective on-times of the high-side switch 214 and the low-side switch 216, the control circuit 212 can set the input voltage V in With output voltage V out The control circuit 212 may be based on the information from the processor 228 (in Figure 2 22 and the low-side control signal 224. For example, in response to the control signal 226 having an asserted state, the control circuit 122 may generate the low-side control signal 224 having an asserted state to enable the low-side switch 216 and generate the high-side control signal 222 having a de-asserted state to disable the high-side switch 214. And, in response to the control signal 226 having a de-asserted state, the control circuit 122 may generate the low-side control signal 224 having a de-asserted state to disable the low-side switch 216 and generate the high-side control signal 222 having an asserted state to enable the high-side switch 214.

[0022] In some examples, system 100 can be a step-down converter, where V in Higher than V out . V in Can be substantially higher than V out For example, V in can be about 100 volts (V), and V out The high-side control signal 222 may have a value between V in +V B and ground voltage (0V), and the low-side control signal 224 may have a voltage range between V DD The voltage range between 0V and ground voltage, where V DD Higher than V in The high-side switch 214 can be switched by placing V in +V BThe low-side switch 216 can be enabled by the high-side control signal 222 at V and disabled by the high-side control signal 222 at 0V. in The low side control signal 224 is enabled at 0V and can be disabled by the low side control signal 222 being at 0V.

[0023] The control circuit 212 may include a high-side driver circuit 230 for providing a high-side control signal 222, and a low-side driver circuit 232 for providing a low-side control signal 224. The high-side driver circuit 230 may have a positive power supply terminal 234 and a negative power supply terminal 235, and the low-side driver circuit may have a positive power supply terminal 236 and a negative power supply terminal 237. Current may flow from the positive power supply terminal 234 to supply power to the high-side driver circuit 230, and flow out from the negative power supply terminal 235. Also, current may flow from the positive power supply terminal 236 to supply power to the high-side driver circuit 232, and flow out from the negative power supply terminal 237.

[0024] Furthermore, the system 100 may include a circuit for supplying V B The high-side driver circuit 230 includes a voltage source 238 for supplying a voltage, a capacitor 240 coupled between the positive power supply terminal 234 and the negative power supply terminal 235 of the high-side driver circuit 230, and a diode 242 coupled between the voltage source 238 and the positive power supply terminal 234. The voltage source 238, the capacitor 240, and the diode 242 can provide a bootstrap circuit. When the low-side switch 224 is enabled, the voltage of the switching node 218 (and the negative power supply terminal 235) can drop to ground (0V), and the voltage source 238 can charge the capacitor 240 via the diode 242 so that the voltage across the capacitor 240 becomes V B When the high-side switch 214 is enabled, the voltage of the switching node 218 (and the negative power supply terminal 235) may rise to V in , and the voltage at the positive power supply terminal 234 can become V in +V B , and diode 242 can disconnect positive power supply terminal 234 and capacitor 240 from voltage source 238. This allows high-side driver circuit 230 to provide a voltage with V in +V B The high-side control signal 222 of the voltage of the high-side switch 214 is fully enabled, while the voltage difference between the positive power supply terminal 234 and the negative power supply terminal 235 is maintained at V B To reduce the voltage stress on the transistor devices of the high-side driver circuit 230. The system 100 may also include a power supply, such as a positive power supply terminal 236 coupled to the low-side driver circuit 232 to provide V dd The negative power supply terminal 237 of the low-side driver circuit 232 may be coupled to ground.

[0025] The low-side driver circuit 232 may include a low-side driver 250 to receive the control signal 226 and generate a low-side control signal 224 based on the control signal 226. The low-side driver circuit 232 may also include a transmitter circuit 252 to transmit a signal 254 representing the control signal 226 to the high-side driver circuit 230. The high-side driver circuit 230 may include a high-side driver circuit 260 and a receiver circuit 262. The receiver circuit 262 may receive the signal 254 from the transmitter circuit 252. The high-side driver circuit 260 may generate the high-side control signal 222 based on the signal 254.

[0026] The high-side driver circuit 230 can be in +V B The low-side driver circuit 232 can operate in the high voltage domain of V DD In some examples, the high-side driver circuit 230 and the low-side driver circuit 232 may be in different chips within the integrated circuit package. In addition, since the high-side driver circuit 230 and the low-side driver circuit 232 operate in different power domains, they can be electrically isolated from each other to prevent the low-side driver circuit 232 from being exposed to high voltage stress. In some examples, the control circuit 212 may include a capacitor 264 coupled between the transmitter circuit 252 and the receiver circuit 262 to provide electrical isolation. The capacitor 264 may be configured as an alternating current (AC) capacitor that blocks the emission of the direct current (DC) component of the signal 254 and allows the emission of the transition edge of the signal 254. The receiver 262 may provide a transition indication signal 256 indicating that a transition edge has been detected.

[0027] The high-side driver circuit 230 may also include a high-side state machine 266 and a state storage device 268. The state storage device 268 may be Figure 1 The memory 102 may include a RAM or sequential logic circuit. The high-side state machine 266 may provide a state signal 274 to the high-side driver 260 to set the state of the high-side control signal 222. The high-side driver circuit 230 may also store the current state of the high-side control signal 222 in the state storage device 268, and in response to receiving the transition indication signal 256, provide the state signal 274 to toggle the state of the high-side control signal. The high-side driver circuit 230 may then toggle the storage state in the state storage device 268. The data stored in the state storage device 268 may be Figure 1 An example of operating status data 106 .

[0028] Figure 3Graphs showing example operations of the high-side driver circuit 230. Graph 302 shows an example change of the signal 254 over time, graph 304 shows an example change of the transition indication signal 256 over time, graph 306 shows an example change of the state data stored in the state storage device 268, and graph 308 shows an example change of the high-side control signal 222 over time. Referring to graphs 302 to 306, before time T0, the signal 254 (and the control signal 226) may be in a de-asserted state and have a voltage of V0, and the transition indication signal 256 may also be in an inactive state. In response to the transition indication signal 256 being in an inactive state, the high-side state machine 266 may maintain the current state stored in the state storage device 268. Before time T0, the state storage device 268 may store a first state (e.g., state 0). In response to the state storage device 268 storing the first state, the high-side driver circuit 230 may set the high-side control signal 222 to a de-asserted state (e.g., having a voltage of V out voltage) to disable the high-side switch 214.

[0029] At time T0, signal 254 (and control signal 226) transitions from the deasserted state to the asserted state and has a voltage of V1. Receiver 262 may detect the transition and generate a pulse for transition indication signal 256 at T0. In response to detecting the pulse (and transition indication signal 256 being valid), high-side state machine 266 may toggle the stored state in state storage device 268. For example, high-side state machine 266 may store a second state (e.g., state 1) in state storage device 268. In response to state storage device 268 storing the second state, high-side driver circuit 230 may set high-side control signal 222 to the asserted state (e.g., having a voltage of V1). in +V B The voltage of 250 is used to enable the high-side switch 214. Between T1 and T2, the signal 254 remains in the asserted state. The transition indication signal 256 may be in the inactive state, the state storage device 268 may continue to store the second state, and the high-side control signal 222 may remain in the asserted state.

[0030] At time T1, signal 254 (and control signal 226) transitions from the asserted state back to the deasserted state and has a voltage of V2. Receiver 262 may detect the transition and generate a pulse for transition indication signal 256 at T1. In response to detecting the pulse (and transition indication signal 256 being valid), high-side state machine 266 may toggle the storage state in state storage device 268 and store a first state (state 0) in state storage device 268. In response to state storage device 268 storing the first state, high-side driver circuit 230 may set high-side control signal 222 to the deasserted state (e.g., having a voltage of 0V) to disable high-side switch 214.

[0031] Figure 4 Another example of system 100 is shown. Figure 4 , the system 100 may include a set of fuse cells, such as fuse cells 402a, 402b, and 402n. Each fuse cell may be programmed to store data. For example, a blown fuse cell may store a logic zero, otherwise the fuse cell may store a logic one. The set of fuse cells may store static data, such as configuration data 108. For example, the set of fuse cells may store the frequency, target output voltage V out And the output voltage V out With input voltage V in Configuration data for the maximum ratio between .

[0032] The system 100 may also include power sources (e.g., voltage or current sources) 412a, 412b, and 412n and switches 422a, 422b, and 422n. Each switch may be coupled between a corresponding pair of power sources and a fuse unit to support a read operation of the fuse unit. For example, switch 422a is coupled between power source 412a and fuse unit 402a, switch 422b is coupled between power source 412b and fuse unit 402b, and switch 422c is coupled between power source 412c and fuse unit 402c. To perform a read operation, the switch may be enabled to connect between the pair of power sources and the fuse unit, and the fuse unit may output a signal (e.g., a voltage signal or a current signal) representing the stored data depending on the resistance of the fuse unit.

[0033] Figure 4 The system 100 may also include a fuse data storage device 430. The fuse data storage device 430 may be Figure 1 The memory 102 of the group of fuse cells 402 and may include RAM or sequential logic circuits. The system 100 may perform a read operation on each fuse cell to obtain a voltage / current signal representing the data stored in the fuse cell and write the data to the fuse data storage device 430. After the data is stored in the fuse data storage device 430, the system 100 may power off the group of fuse cells 402 by disabling the switch 422 and / or the power supply 412. Other circuits that use the data, such as the control circuit 212, may access the data from the fuse data storage device 430 instead of performing a read operation on the group of fuse cells 402. Such an arrangement may reduce the number and duration of read operations on the group of fuse cells 402, which may reduce the possibility of fuse regrowth due to an electric field applied across the fuse cell during a read operation of the fuse cell.

[0034] Electronic systems operating in high radiation environments, such as those used in aerospace and defense applications, can be susceptible to transient runaway events. High energy ionizing particles (e.g., ions, electrons, and photons) can strike circuit components of the system and generate free charges through ionization. Figure 5 and Figure 6 Schematic diagram showing an example transient out-of-control event. Figure 5 , transistor 500 may include current terminals 502 and 504 (e.g., drain and source terminals), a gate terminal 508, and an insulating layer 510 (e.g., an oxide layer) in a substrate 506. Transistor 500 may also include a depletion region 512 at a pn junction between current terminal 502 and substrate 506, and a depletion region 514 at a pn junction between current terminal 504 and substrate 506.

[0035] In a transient runaway event, high energy ionized particles 520 may strike depletion regions 512 and / or 514 of transistor 500 and generate free charges 522 at the depletion regions. A transient runaway event may cause a state change in a circuit, such as memory 102, that includes transistor 500. Figure 6 An example state change caused by free charge is shown. Figure 6 , the memory 102 may include a device coupled to supply V dd A pair of cross-coupled inverters 602 and 604 are provided between a power supply voltage and ground. Inverter 602 may include an N-type field effect transistor (NFET) 602a and a P-type field effect transistor 602b. Inverter 604 may include an NFET 604a and a PFET 604b. Initially, memory 102 may store a logic one, so that node A has V dd Voltage and Node 602a has a ground voltage (e.g., 0 volts). If particle 520 strikes the depletion region at drain terminal 610 of NFET 604a and generates new charge 522, the new charge may flow to gate terminal 612 of NFET 602a and gate terminal 614 of PFET 602b and increase their voltages. The increased gate terminal voltage may disable PFET 602b and enable NFET 602a, which brings the voltage of node A to ground and increases node A to ground. The voltage brought to V dd Therefore, the transient runaway event changes the data stored in the memory 102 from a logic one to a logic zero, thereby causing data corruption at the memory 102 .

[0036] Damage to the memory 102 may result in failure of the electronic system. Figure 2 and 3 , if stored in Figure 2If the state data in the state storage device 268 becomes corrupted, the state storage device 268 may store state 1 instead of state 0 when the low-side driver 250 enables the low-side switch 216. Therefore, the high-side driver 260 and the low-side driver 250 may simultaneously enable the corresponding high-side switch 214 and the low-side switch 216, which may create a direct electrical path between the power supply 202 and the ground. A large current may flow through the high-side switch 214 and the low-side switch 216 and damage the switches. In addition, the voltage of the switching node 218 may reach V in , which may generate high voltage stress and damage the load 204. Figure 4 In the case where the fuse data storage device 430 provides configuration data, damage to the fuse data storage device 430 may cause failure of circuit components that operate based on the configuration data. For example, if the configuration data defines Figure 2 The target V of the power conversion system out , data corruption may cause the power conversion system to provide an incorrect V across the load 204 out .

[0037] In order to mitigate the impact of memory data corruption, the electronic system may include a redundant data storage system to store multiple copies of the same data. If one copy of the data is damaged, the redundant data storage system can provide another undamaged copy of the data for access. Figure 7 An example of a redundant data storage system 700 is shown. Figure 7 , the redundant data storage system 700 may include an odd number of memory devices, including memory devices 702, 704, and 706. Each memory device may have a memory data input and a memory data output. The memory device may receive an input data signal at the memory data input, and in response to the input data signal, store data represented by the input data signal. The memory device may also provide an output data signal representing the data at the memory data output. For example, the memory device 702 includes a memory data input 702a for receiving an input data signal 722 and a memory data output 702b for providing a candidate output data signal 724. Also, the memory device 704 includes a memory data input 704a for receiving an input data signal 732 and a memory data output 704b for providing a candidate output data signal 734. In addition, the memory device 706 includes a memory data input 706a for receiving an input data signal 742 and a memory data output 706b for providing a candidate output data signal 744.

[0038] Memory devices 702, 704, and 706 may receive respective input data signals 722, 732, and 742 representing the same data from redundant data generation circuit 750. In some examples, redundant data generation circuit 750 may have first and second data inputs 752a, 752b, and redundant data outputs 754a, 754b, and 754c. First data input 752a may receive a relatively valid data signal 756 (e.g., Figure 2 The redundant data generation circuit 750 may include a filter circuit 760 to filter the data signal 758. The filtering may remove transient signals (e.g., caused by high energy ionized particles) from the data signal 758. Also, the redundant data generation circuit 750 may include data generation circuits 762a, 762b, and 762c with corresponding redundant data outputs 754a, 754b, and 754c. In some examples, the data generation circuits 762a, 762b, and 762c may each include a comparator to generate corresponding input data signals 722, 732, and 742 by comparing between the data signal 756 and the filtered data signal 758.

[0039] Furthermore, the redundant data storage system 700 may include a majority state determination circuit 770. The majority state determination circuit 770 has an input 770a coupled to the memory data output 702a, an input 770b coupled to the memory data output 702b, an input 770c coupled to the memory data output 702c, and an output 770d. The majority state determination circuit 770 may include logic circuitry to receive the candidate output data signals 724, 734, and 744 and determine the majority state of the data (majority data) stored in the memory devices 702 to 706 based on the candidate output data signals 724, 734, and 734 thereof, and provide a data signal 772 representing the majority state at an output 750d. In the case where the redundant data storage system 700 has N number of memory devices or otherwise stores N copies of data, where N is an odd number, the majority state determination circuit 770 may store at least N copies of data in the memory devices. Common data in a number of memory devices is identified as a majority state. Figure 7In the example of FIG. 7 , if the data of at least two of the three memory devices 702, 704, and 706 are logic one, the majority state determination circuit 770 may determine that the majority data is logic one and provide a final output data signal 780 representing logic one. Also, if the data of at least two of the three memory devices 702, 704, and 706 are logic zero, the majority state determination circuit 770 may determine that the majority data is logic zero and provide a final output data signal 780 representing logic zero.

[0040] By such an arrangement, even if a high-energy ionized particle strikes one of the memory devices 702, 704, or 706 and damages the data stored at the affected memory device, or a high-energy ionized particle strikes one of the data generating circuits 762a, 762b, and 762c and damages one of the input data signals 722, 732, and 742, and the data stored in one of the memory devices 702, 704, or 706 becomes damaged, the damaged data is a minority, and the undamaged data is a majority. The redundant data storage system 700 can still provide the undamaged data as the majority data for access, which can mitigate the impact of data damage in a transient out-of-control event.

[0041] Although redundant data storage system 700 can mitigate the effects of data corruption caused by a single hit of a high-energy ionized particle, if there are multiple hits of a high-energy ionized particle at different memory devices at different times, redundant data storage system 700 may still provide corrupted data. Due to the multiple hits, the majority of memory devices may store corrupted data, and the corrupted data becomes the majority.

[0042] Fig. 8A and Figure 8B 7 shows an example of the impact of multiple transient out-of-control events on the redundant data storage system 700. Fig. 8A and Figure 8B In the example of , redundant data storage system 700 stores a logical one in each of memory devices 702, 704, and 706 prior to a transient outage event. Fig. 8A At time T0, the memory device 702 (or the data generation circuit 762a) is hit by the high-energy ionized particles 520 in the first transient runaway event, which damages the data stored at the memory device 702 and the data becomes logic zero. However, because the majority of memory devices still store undamaged data (logic one), the majority state determination circuit 770 can select the undamaged data as the majority data and output logic one.

[0043] See also Figure 8B, at time T1, the memory device 706 (or the data generation circuit 762c) is hit by the high energy ionized particle 520 again in the second transient runaway event, which damages the data stored at the memory device 706 and the data becomes logic zero. Because the memory device 702 still stores the damaged data (logic zero), the majority memory devices (two of the three) now store the damaged data. Therefore, the majority state determination circuit 770 may select the damaged data as the majority data and output logic zero, and the redundant data storage system 700 fails to mitigate the impact of data damage caused by multiple hits of high energy ionized particles.

[0044] Fig. 9 An example of a redundant data storage system 900 is shown that can address at least some of the above-mentioned issues. Fig. 9 , the redundant data storage system 900 may include components of the redundant data storage system 700, such as the memory devices 702, 704, and 706 forming a forward data path and the majority state determination circuit 770. The redundant data storage system 900 may also include an error detection circuit 902 and an error correction circuit 904 forming a feedback data path. The error detection circuit 902 may detect data errors (or corrupted data) among the copies of data stored in the memory devices 702, 704, and 706, and provide a correction signal 910 representing the majority data (representing the stored data in an uncorrupted / original state) to the error correction circuit 904. In response to the correction signal 910, the error correction circuit 904 may write the majority data back to the corrupted memory device to correct the data error and restore the stored data back to an uncorrupted / original state as part of the feedback data path operation. With such an arrangement, the error detection circuit 902 and the error correction circuit 904 can replace the damaged data with the undamaged data in the damaged memory device before the next transient out-of-control event, so that the undamaged data can remain the majority after the next transient out-of-control event, and the redundant data storage system 700 can still provide a final output data signal 780 representing the undamaged data.

[0045] The error detection circuit 902 has inputs 912a, 912b, and 912c coupled to respective memory data outputs 702a, 702b, and 702c, and a detection output 914. The error detection circuit 902 may receive the candidate output data signals 724, 734, and 744 at respective inputs 912a, 912b, and 912c, and detect data errors among the memory devices 702, 704, and 706. The error detection circuit 902 may detect data errors by detecting mismatches in data stored in the memory devices 702, 704, and 706 based on the candidate output data signals 724, 734, and 744. The error detection circuit 902 may also determine majority data stored in the memory devices from the candidate output data signals 724, 734, and 744. In response to detecting a data error, the error detection circuit 902 may generate a correction signal 910 representing the majority data, and provide the correction signal 910 at the detection output 914.

[0046] Furthermore, the error correction circuit 904 has a correction input 924, external data inputs 926a, 926b, and 926c, and correction outputs 928a, 928b, and 928c. The detection output 914 of the error detection circuit 902 is coupled to the correction input of the error correction circuit 904. Furthermore, the correction outputs 928a, 928b, and 928c of the error correction circuit 904 are coupled to the corresponding memory data inputs 702a, 704a, and 704b. In response to the correction signal 910 at the correction input 924, the error correction circuit 904 may provide an input data signal representing majority data to the damaged memory device to overwrite the damaged data with the majority data at the damaged memory device. In some examples, the error correction circuit 904 may only provide the input data signal to the damaged memory device in response to the correction signal 910. For example, if the memory device 702 is damaged, the error correction circuit 904 may only provide the input data signal 934 to the memory device 702. Also, if memory device 704 is damaged, error correction circuit 904 may only provide input data signal 944 to memory device 704. Furthermore, if memory device 706 is damaged, error correction circuit 904 may only provide input data signal 954 to memory device 702. In some examples, in response to correction signal 910, error correction circuit 904 may also provide input data signals 934, 944, and 954 representing the same majority data to overwrite data stored in respective memory devices 702, 704, and 706, and may overwrite both damaged data and undamaged data.

[0047] In addition, the error correction circuit 904 may receive external input data signals 962, 972, and 982 at respective external data inputs 926a, 926b, and 926c. The external input data signals 962, 972, and 982 may represent external data to be stored at the memory devices 702, 704, and 706. In some examples, the error correction circuit 904 may receive the input data signals 722, 732, and 742 from the redundant data generation circuit 750 as respective external input data signals 962, 972, and 982. In response to receiving the external input data signals 962, 972, and 982 representing the external data, the error correction circuit 904 may ignore the correction signal 910 and provide the input data signals 934, 944, and 954 representing the external data to the respective memory devices 702, 704, and 706. The external data may then be provided via the majority state determination circuit 770 as part of the forward data path operation.

[0048] The detection of data mismatch by the error detection circuit 902, the generation of the correction signal 910 by the error correction circuit 904, and the correction of the damaged data in the memory devices based on the correction signal 910 may each be an asynchronous operation or a synchronous operation. For example, the error detection circuit 902 may asynchronously detect the data mismatch and generate the correction signal 910 when one of the memory devices stores damaged data, and asynchronously overwrite the damaged data in the memory device upon receiving the correction signal 910. The asynchronous error correction operation does not require a clock signal for synchronization, which may reduce power consumption and allow the redundant data storage system 900 to be implemented without the need for additional clock generation and buffer circuitry.

[0049] Also, in synchronous operation, the error detection circuit 902 may periodically sample the data stored in the memory device according to a clock signal, and the detection of data mismatch and the generation of the correction signal 910 may be synchronized with the clock signal. Also, in some examples where the memory device is a synchronous memory device (e.g., a flip-flop, synchronous DRAM, and synchronous burst SRAM), both the detection of data mismatch (involving read access to the memory device) and the overwriting of damaged data (involving write access to the memory device) may be synchronized with a signal (e.g., a clock signal or a control signal sequence).

[0050] Also, in some examples, the error detection circuit 902 and the error correction circuit 904 may be part of an application specific integrated circuit (ASIC) or may be implemented on a programmable logic device such as a field effect programmable logic array (FPGA), both of which may interface with or include the redundant data storage system 700. In some examples, a processor such as a controller or a central processing unit (CPU) may execute instructions from a memory to perform the operations of the error detection circuit 902 and the error correction circuit 904.

[0051] Fig.10 Another example of a redundant data storage system 900 is shown. Fig.10 In an example of , the redundant data storage system 900 may include a filter 1002 coupled between a detection output 914 of the error detection circuit 902 and a correction input 924 of the error correction circuit 904. The filter 1002 may be a low pass filter to remove transient components of the correction signal 910 that are not contributed by data mismatches among the memory devices 702, 704, and 706. One example source of the transient components is a timing mismatch among the candidate output data signals 724, 734, and 744 from the respective memory devices 702, 704, and 706. Due to the timing mismatch, the candidate output data signals 724, 734, and 744 representing the same data may arrive at the error detection circuit 902 at different times, which causes the error detection circuit 902 to erroneously detect the data mismatch. Another example source is a high frequency signal source (e.g., a high frequency clock), and the high frequency signal may be coupled into the electrical connection carrying the correction signal 910 as a high frequency noise signal. In some examples, the filter 1002 may include an analog RC filter with an RC time constant that exceeds the timing mismatch but is less than the average duration between transient out-of-control events (e.g., the average duration between two impacts of the ionized particles 520). In some examples, the filter 1002 may also include a digital filter. The digital filter may include a sample and hold circuit to sample the correction signal 910, and a computation circuit (e.g., a digital signal processor) to calculate an average from a number of samples and provide the average as a filtered signal. The number of samples may span a duration that exceeds the timing mismatch but is less than the average duration between transient out-of-control events. The digital filter may be implemented as an ASIC, an FPGA, or software instructions executable by a processor.

[0052] exist Fig.10In the example of , filter 1002 is provided along the feedback data path to filter correction signal 910, rather than being provided along the forward data path to filter input data signals (e.g., input data signals 724-744 and 934-954) and output data signals (e.g., output data signal 780). Such an arrangement can avoid filter 1002 introducing delay and limiting the bandwidth of the forward data path, which in turn can improve the overall performance of the system operating on data stored in redundant data storage system 900. For example, again referring to Figure 2 In the power converter system 100 of FIG. 1 , the time delay of the high-side driver circuit 230 when enabling / disabling the high-side switch 214 can be on the order of a few nanoseconds, which allows the power converter system 100 to operate at a high frequency (e.g., in the megahertz range) to reduce energy leakage from the energy storage element 220. In the case where the state storage device 268 includes the redundant data storage system 900, improving the bandwidth of the forward data path of the redundant data storage system 900 (e.g., by not having a filter 1002 for filtering the input and output data signals) can reduce the overall time delay of the high-side driver circuit 230. Also, since transient out-of-control events occur at a much lower frequency than the input / output data signals, the filter 1002 can have a much lower bandwidth than the input / output data signals to remove high-bandwidth interference to the correction signal 910.

[0053] Fig.11 FIG. 9 is a schematic diagram of an example of internal components of a redundant data storage system 900. Fig.11 In the example of , the detection of data mismatch by the error detection circuit 902, the generation of the correction signal 910 by the error correction circuit 904, and the correction of the damaged data in the memory device based on the correction signal 910 can each be asynchronous operations. Fig.11 Each of the memory devices 702, 704, and 706 may include a sequential logic circuit, such as an RS latch. Each RS latch has a set input (labeled S) and a reset input (labeled R) as memory data inputs. Each RS latch also has a non-inverting output (labeled Q) and an inverting output (labeled ) as the memory data output. When the set input is in the asserted state (having a logic one) and the reset input is in the de-asserted state (having a logic zero), the RS latch can latch / store a logic one and provide a logic one at the non-inverting output and a logic zero at the inverting output. When the reset input is in the asserted state and the set input is in the de-asserted state, the RS latch can latch / store a logic zero and provide a logic zero at the non-inverting output and a logic one at the non-inverting output. When both the set input and the reset input are in the de-asserted state, the RS latch can retain the stored data. The memory data element / RS latch 702 can provide a candidate output data signal 724a (also labeled m0) at the non-inverting output and a candidate output data signal 724b (also labeled m0) at the inverting output. ). The memory data element / RS latch 704 may provide a candidate output data signal 726a (also labeled m0) at a non-inverting output and a candidate output data signal 726b (also labeled m0) at an inverting output. ). Also, the memory data element / RS latch 706 may provide a candidate output data signal 728a (also labeled m2) at a non-inverting output and a candidate output data signal 728b (also labeled m2) at an inverting output. The non-inverting outputs of RS latches 702 , 704 , and 706 are coupled to corresponding inputs 770 a , 770 b , and 770 c of majority state determination circuit 770 .

[0054] Furthermore, the error detection circuit 902 may include error detection subcircuits 902a, 902b, 902c, 902d, 902e, and 902f. Each error detection subcircuit may include an AND logic gate configured to generate a correction signal for a set input and a correction signal for a reset input in response to the candidate output data signal. The error detection subcircuit may generate an asserted correction signal for the set input of a particular RS latch if the RS latch stores a logic zero and the other two RS latches (majority) store a logic one. Furthermore, the error detection subcircuit may generate an asserted correction signal for the reset input of a particular RS latch if the RS latch stores a logic one and the other two RS latches (majority) store a logic zero.

[0055] Thus, error detection subcircuit 902a may receive candidate output data signals 724b, 726a, and 728a and provide correction signal 910a for the set input of RS latch 702. Error detection subcircuit 902b may receive candidate output data signals 724a, 726b, and 728b and provide correction signal 910b for the reset input of RS latch 702. And, error detection subcircuit 902c may receive candidate output data signals 724a, 726b, and 728a and provide correction signal 910c for the set input of RS latch 704. Error detection subcircuit 902d may receive candidate output data signals 724b, 726b, and 728b and provide correction signal 910d for the reset input of RS latch 704. Additionally, error detection subcircuit 902e may receive candidate output data signals 724a, 726a, and 728b and provide correction signal 910e for the set input of RS latch 706. Error detection subcircuit 902f may receive input data signals 724b, 726b, and 728a and provide correction signal 910f for the reset input of RS latch 706.

[0056] Furthermore, the error correction circuit 904 may include error correction subcircuits 904a, 904b, 904c, 904d, 904e, and 904f. Each error correction subcircuit may include an OR logic gate having a first input coupled to the output of the error detection subcircuit and a second input coupled to the external data input. The OR logic gate may provide an asserted signal output if at least one of the output of the error detection subcircuit or the external data input has an asserted state.

[0057] Specifically, the error correction subcircuit 904a may provide a set signal to the RS latch 702, and has an input coupled to the output of the error detection circuit 902a to receive the correction signal 910a, and an external set input (labeled as S0) to receive the external input data signal 962a. If at least one of the correction signal 910a or the external input data signal 962a has an asserted state, the error correction subcircuit 904a may write a logic one into the RS latch 702. The error correction subcircuit 904b may provide a reset signal to the RS latch 702, and has an input coupled to the output of the error detection circuit 902b to receive the correction signal 910b, and an external set input (labeled as R0) to receive the external input data signal 962b. If at least one of the correction signal 910b or the external input data signal 962b has an asserted state, the error correction subcircuit 904b may write a logic zero into the RS latch 702.

[0058] Also, the error correction subcircuit 904c may provide a set signal to the RS latch 704, and has an input coupled to the output of the error detection circuit 902c to receive the correction signal 910c, and an external set input (labeled as S1) to receive the external input data signal 972a. If at least one of the correction signal 910c or the external input data signal 972a has an asserted state, the error correction subcircuit 904c may write a logic one into the RS latch 704. The error correction subcircuit 904d may provide a reset signal to the RS latch 702, and has an input coupled to the output of the error detection circuit 902d to receive the correction signal 910d, and an external set input (labeled as R1) to receive the external input data signal 972b. If at least one of the correction signal 910d or the external input data signal 972b has an asserted state, the error correction subcircuit 904d may write a logic zero into the RS latch 704.

[0059] In addition, the error correction subcircuit 904e may provide a set signal to the RS latch 706 and has an input coupled to the output of the error detection circuit 902e to receive the correction signal 910e, and an external set input (labeled S2) to receive the external input data signal 982a. If at least one of the correction signal 910e or the external input data signal 982a has an asserted state, the error correction subcircuit 904e may write a logic one into the RS latch 706. The error correction subcircuit 904f may provide a reset signal to the RS latch 706 and has an input coupled to the output of the error detection circuit 902f to receive the correction signal 910d, and an external set input (labeled R2) to receive the external input data signal 982b. If at least one of the correction signal 910f or the external input data signal 982b has an asserted state, the error correction subcircuit 904f may write a logic zero into the RS latch 706.

[0060] And, in Fig.11In the example of , filter 1002 may include filter subcircuits 1002a, 1002b, 1002c, 1002d, 1002e, and 1002f. Filter subcircuit 1002a may be coupled between error detection circuit 902a and error correction circuit 904a. Filter subcircuit 1002b may be coupled between error detection circuit 902b and error correction circuit 904b. Filter subcircuit 1002c may be coupled between error detection circuit 902c and error correction circuit 904c. Filter subcircuit 1002d may be coupled between error detection circuit 902d and error correction circuit 904d. Filter subcircuit 1002e may be coupled between error detection circuit 902e and error correction circuit 904e. Filter subcircuit 1002f may be coupled between error detection circuit 902f and error correction circuit 904f. Each filter subcircuit may include an RC filter. In some examples, each filter sub-circuit may also include a buffer, such as a Schmitt trigger, to improve the edge rate and voltage swing of the corresponding filtered correction signal.

[0061] Fig.12 Contains shown Fig.11 Graph of an example operation of a redundant data storage system 900. Fig.12 Contains graphs 1202, 1204, 1206, 1208, 1210, 1212, 1214, 1216, 1218, and 1220. Graph 1202 illustrates an example time change of the state of the set input of RS latch 702. Graph 1204 illustrates an example time change of the state of the reset input of RS latch 702. Graph 1206 illustrates an example time change of the state of the set input of RS latch 704. Graph 1208 illustrates an example time change of the state of the reset input of RS latch 704. Graph 1210 illustrates an example time change of the state of the set input of RS latch 706. Graph 1212 illustrates an example time change of the state of the reset input of RS latch 706. And, graph 1214 illustrates an example time change of the state of the non-inverting output (Q) of RS latch 702. Graph 1216 shows example time variations of the state of the non-inverting output (Q) of RS latch 704. Graph 1218 shows example time variations of the state of the non-inverting output (Q) of RS latch 706. Graph 1220 shows example time variations of the output data signal 780 from majority state determination circuit 770.

[0062] Referring to graphs 1202 to 1220, between T0 and T1, the set inputs of RS latches 704, 706, and 708 may be in an asserted state. Therefore, each of RS latches 704, 706, and 708 may store a logic one, and the majority state determination circuit 770 may output a logic one starting from T0. After T1, the set inputs of RS latches 704, 706, and 708 may be in a deasserted state, and each of RS latches 704, 706, and 708 may retain the stored logic one data.

[0063] Referring to graph 1204, at T2, a first transient out-of-control event may occur at the reset input of RS latch 702, which causes the reset input to be briefly asserted. Referring to graph 1214, the assertion of the reset input causes RS latch 702 to write a logic zero at T2, which damages the data stored at RS latch 702. In the case where RS latch 702 stores a logic zero, candidate output data signal 724b transitions to an asserted state, and candidate output data signals 726a and 728a are also in an asserted state. Therefore, error detection circuit 902a may provide an asserted correction signal 910a, and the set input of RS latch 702 may transition to an asserted state at T3. A logic one may be written into RS latch 702, and the output of majority state determination circuit 770 remains a logic one. In response to RS latch 702 storing a logic one and storing the same data as RS latches 704 and 706, error detection circuit 902a may de-assert correction signal 910a and the set input of RS latch 702 may transition back to a de-asserted state at T4.

[0064] Referring to graph 1212, at T5, a second transient out-of-control event may occur at the reset input of RS latch 706, which causes the reset input to be asserted briefly. The assertion of the reset input causes RS latch 706 to write a logic zero at T5, which damages the data stored at RS latch 706. In the case where RS latch 706 stores a logic zero, candidate output data signal 728b is transformed into an asserted state. Candidate output data signal 726a is also in an asserted state. And, due to the previous data correction operation for RS latch 702 at T4, candidate output data signal 724a is also in an asserted state. Therefore, error detection circuit 902e can provide an asserted correction signal 910e, and assert the set input of RS latch 706 at T6. Logic one can be written into RS latch 706, and the output of most state determination circuit 770 remains logic one. In response to RS latch 706 storing logic one and storing the same data as RS latches 702 and 704, error detection circuit 902e may de-assert correction signal 910e and the set input of RS latch 706 may transition back to the de-asserted state at T7.

[0065] Fig.13 Show Fig.11 The additional instances of the internal components of the redundant data storage system 900. Fig.13 In an example of , redundant data storage system 900 may include a logic gate 1302 having an input coupled to the outputs of error detection circuits 902a and 902b, a logic gate 1304 having an input coupled to the outputs of error detection circuits 902c and 902d, and a logic gate 1306 having an input coupled to the outputs of error detection circuits 902e and 902f. Each of logic gates 1302, 1304, and 1306 may receive a correction signal for a set input and a correction signal for a reset input, and may provide a de-asserted correction signal for the set input if the correction signal for the reset input is in an asserted state. Such an arrangement may prevent both the set input and the reset input of the RS latch from being asserted simultaneously, which may cause the RS latch to enter an undefined state.

[0066] Fig.14 Additional examples of internal components of redundant data storage system 900 are shown. Fig.14 In an example of , each of the memory devices 702, 704, and 706 may include a flip-flop, such as a D flip-flop. The data input (D) of each flip-flop may be coupled to a voltage source that provides a voltage representing a logic one. Also, the clock input of each flip-flop may be coupled to the output of the corresponding error correction circuit 904a, 904c, and 904e. Also, the flip-flops of the memory devices may each asynchronously store a logic one in response to the output of the corresponding error correction circuit 904a / 904c / 904e transitioning from a deasserted state to an asserted state. In addition, the reset input of each flip-flop may be active low. The flip-flops may be coupled to the outputs of respective error correction circuits 904b, 904d, and 904f, each of which may include a NOR gate. The flip-flops may each be asynchronously reset and store a logic zero in response to the output of the respective error correction circuits 904b / 904d / 904f having a deasserted state. The non-inverting output (Q) and the inverting output (Q) of each flip-flop can be coupled to the majority state determination circuit 770 and the error detection circuits 902a-902f, similar to Fig.11 and Fig.13 The RS latches in the , and error detection circuits 904a-904f can asynchronously detect data mismatches and generate corresponding correction signals 910a-910f.

[0067] Fig.15An example system 1500 including redundant data storage devices is shown. System 1500 may include a processor 1502, an instruction memory 1504, a memory controller 1506, and a set of memory devices, including memory devices 1508a-1508n, each of which may store a redundant copy of a piece of data. The memory devices may be part of a random access memory (RAM) array, such as a DRAM array, an SRAM array, or an MRAM array. Processor 1502 may include a controller or a central processing unit (CPU).

[0068] The memory controller 1506 may provide an interface between the processor 1502 and the memory devices 1508a-1508n. For example, the memory controller 1506 may include a read circuit 1512 and a write circuit 1514. The read circuit 1512 may receive a read request including a read memory address from the processor 1502. In response to the read request, the read circuit 1516 may perform a read operation to read data at the read memory address of the memory devices 1508a-1508n and provide the data to the processor 1502. Also, the write circuit 1518 may receive a write request including a write memory address and data to be written from the processor 1502. In response to the write request, the write circuit 1514 may perform a write operation to write data at the write memory address of the memory devices 1508a-1508n.

[0069] The processor 1502 may fetch software instructions from the instruction memory 1504 and execute the instructions. The instructions may include an error detection module 1522 to detect data mismatches among the memory devices 1508a-1508n. The processor 1502 may also execute software instructions of an error correction module 1524 to correct corrupted data in one or more of the memory devices 1508a-1508n. The processor 1502 may synchronize the error detection and correction operations to a clock signal. For example, the error detection module 1522 may periodically transmit a read request to the read circuit 1512 to read the data stored in the memory devices 1508a-1508n. The duration between each read operation of the stored data may be shorter than the average duration between transient runaway events (e.g., the average duration between two impacts of the ionized particles 520). The error detection module 1522 may detect a mismatch among the data extracted from the read operation and identify the corrupted memory address (and memory device) where the mismatch occurred. The error detection module 1522 may determine an uncorrupted state of the redundant data based on identifying the majority data. The error correction module 1524 may then transmit a write request targeting the corrupted memory address (or the memory addresses of all memory devices 1508a-1508n) and including uncorrupted data to the write circuit 1514, which may restore the corrupted data at the corrupted memory address back to an uncorrupted state in response to the write request. The processor 1502 (when executing the error correction module 1524 or other software instructions) may also transmit other write requests to the write circuit 1514 to store a copy of the new data at the memory devices 1508a-1508n.

[0070] Fig.16 A flow chart of a method 1600 of operating a redundant data storage system, such as redundant data storage system 900 or system 1500, is shown. Method 1600 may be performed by an error detection and correction system, such as error detection circuit 902 and error correction circuit 904. Method 1600 may also be performed by a processor (e.g., processor 1502) that executes an instruction set to implement an error detection and correction system. A redundant data storage system may include a set of memory devices configured to store copies of the same data. The set of memory devices may include sequential logic circuits (e.g., RS latches and flip-flops) and RAM (e.g., SRAM, DRAM, and MRAM).

[0071] In step 1602, an error detection and correction system (e.g., error detection circuit 902, error detection module 1522) may detect a data mismatch among copies of the first data stored in the set of memory devices that, if not damaged, would output the same first data. In some examples, the error detection and correction system (e.g., error detection circuit 902, error detection module 1522) may detect a data mismatch among copies of the first data stored in the set of memory devices that, if not damaged, would output the same first data. Fig.11 , 13The detection of data mismatch may be performed asynchronously by logic circuits such as logic AND gates of 14. In some examples, the detection of data mismatch may be performed asynchronously by, for example, Fig.15 The processor 1502 of the processor 1503 may synchronously perform the detection of data mismatch. The processor may implement an error detection module to periodically read the first data stored in the group of memory devices in response to a clock signal. The duration between each read operation of the stored data may be shorter than the average duration between transient out-of-control events (e.g., the average duration between two impacts of the ionized particles 520). After reading the first data from the group of memory devices, the error detection module may process the data to detect a data mismatch among the first data extracted from the group of memory devices, and identify the address of the memory device storing the damaged data.

[0072] In step 1604, the error detection and correction system (e.g., error detection circuit 902, error detection module 1522) may generate a correction signal (e.g., correction signal 910) representing an uncorrupted state of the first data. The system may set the state of the correction signal based on the majority state of the copies of the first data. For example, for an RS latch, if the majority state of the copies of the first data is a logic one, the system may provide the asserted correction signal as a set signal to the RS latch. And, if the majority state of the copies of the first data is a logic zero, the system may provide the asserted correction signal as a reset signal to the RS latch. And, for a RAM, the correction signal may be in the form of a write request including an address and majority data.

[0073] In step 1606, the error detection and correction system (eg, error correction circuit 904, error correction module 1524) may determine whether second data is received. The second data may be received from, for example, redundant data generation circuit 750 or processor 1502.

[0074] If the second data is received (in step 1606), the error detection and correction system may proceed to step 1608 and store a copy of the second data (e.g., a logic one, a logic zero, or a set of logic ones and zeros) at the second memory device. For example, the error correction circuit 904 may provide a set signal or a reset signal to store the second data at the RS latch or flip-flop. The error correction module 1524 may also provide a write request including the address of each memory device and the second data to the memory controller 1506, which may store a copy of the second data at the set of memory devices.

[0075] And, if the second data is not received, the error detection and correction system may proceed to step 1610 and provide a correction signal to at least one memory device in the group of memory devices to store the first data in an uncorrupted state. For example, the error correction circuit 904 may provide the correction signal as a set signal or a reset signal to restore the data stored at the RS latch or flip-flop back to an uncorrupted state. The error correction module 1524 may also provide a write request including the majority data and the address of the corrupted memory device (or the addresses of all memory devices) to the memory controller 1506, which may write the uncorrupted data back to the memory device or all memory devices.

[0076] Any method described herein can be performed in whole or in part using a computing system comprising one or more processors that can be configured to perform the steps. Therefore, an embodiment may be related to a computing system configured to perform the steps of any method described herein, which may have different components that perform corresponding steps or corresponding step groups. Although presented in numbered steps, the steps of the method herein can be performed at the same time or in different orders. In addition, the parts of these steps can be used together with the parts of other steps of other methods. Moreover, all or part of the steps can be optional. In addition, any step of any method can be performed with a module, a unit, a circuit or other devices for performing these steps.

[0077] In this description, the term "coupled" may encompass connections, communications, or signal paths that enable a functional relationship consistent with this description. For example, if device A provides a signal to control device B to perform an action, then: (a) in a first instance, device A is directly coupled to device B; or (b) in a second instance, if the intermediate component C does not substantially change the functional relationship between device A and device B, device A is indirectly coupled to device B through intermediate component C, so that device B is controlled by device A via the control signal provided by device A.

[0078] A device "configured to" perform a task or function may be configured (e.g., programmed and / or hardwired) when manufactured by a manufacturer to perform the function, and / or may be configurable (or reconfigurable) by a user after manufacture to perform the function and / or other additional or alternative functions. Configuration may be by firmware and / or software programming of the device, by the construction and / or layout of the device's hardware components and interconnections, or a combination thereof.

[0079] A circuit or device described herein as including certain components may actually be adapted to be coupled to those components to form the described circuit system or device. For example, a structure described herein as including one or more semiconductor elements (e.g., transistors), one or more passive elements (e.g., resistors, capacitors, and / or inductors), and / or one or more sources (e.g., voltage and / or current sources) may actually include only semiconductor elements within a single physical device (e.g., a semiconductor die and / or an integrated circuit (IC) package), and may be adapted to be coupled to at least some of the passive elements and / or sources to form the described structure, either at the time of manufacture or after manufacture, such as by an end user and / or a third party.

[0080] Certain components may be described herein as belonging to a particular process technology, but these components may be exchanged with components of other process technologies. The circuits described herein may be reconfigured to include replaced components to provide functionality at least partially similar to the functionality available before the component replacement. Unless otherwise stated, components shown as resistors generally represent any one or more elements coupled in series and / or in parallel to provide the impedance amount represented by the displayed resistor. For example, a resistor or capacitor shown and described herein as a single component may actually be a plurality of resistors or capacitors coupled in series or in parallel between the same two nodes as a single resistor or capacitor, respectively.

[0081] The use of the phrase "ground voltage potential" in this specification includes chassis ground, ground wire ground, floating ground, virtual ground, digital ground, common ground, and / or any other form of ground connection that is applicable or suitable for the teachings of this specification. In this specification, unless otherwise specified, "about", "substantially" or "substantially" before a parameter means within + / -10% of the parameter.

[0082] Modifications are possible in the described examples, and other examples are possible within the scope of the claims.

Claims

1. A device comprising: a first memory device having a first data input and a first data output; a second memory device having a second data input and a second data output; a third memory device having a third data input and a third data output; an error detection circuit having a first detection input, a second detection input, a third detection input, and a detection output, the first detection input being coupled to the first data output, the second detection input being coupled to the second data output, and the third detection input being coupled to the third data output, the error detection circuit being configured to: detecting a mismatch among data stored at the first memory device, the second memory device, and the third memory device; as well as responsive to detecting the mismatch, providing a correction signal at the detection output, the correction signal representing a majority state of the data; and an error correction circuit having a correction input, a first correction output, a second correction output, and a third correction output, wherein the correction input is coupled to the detection output, the first correction output is coupled to the first data input, the second correction output is coupled to the second data input, the third correction output is coupled to the third data input, and the error correction circuit is configured to write the majority state of the data to at least one of the first memory device, the second memory device, or the third memory device.

2. The apparatus of claim 1 , wherein the data is first data, the error correction circuit has an external data input, and the error detection circuit is configured to provide a first data signal at the first correction output, the second correction output, and the third correction output to write second data to each of the first memory device, the second memory device, and the third memory device in response to a second data signal at the external data input.

3. The apparatus of claim 1, further comprising a filter having a filter input and a filter output, the filter input coupled to the detection output and the filter output coupled to the correction input.

4. The apparatus of claim 3, wherein the filter comprises a resistor coupled between the filter input and the filter output and a capacitor coupled to the filter output.

5. The apparatus of claim 4, wherein the filter comprises a buffer circuit coupled between the resistor and the filter output.

6. The apparatus of claim 5, wherein the buffer circuit comprises a Schmitt trigger circuit.

7. The apparatus of claim 3, wherein the filter comprises: a sampling circuit having a sampling input coupled to the filter input and a sampling output, the sampling input being configured to provide a sample of the state of the filter input at the sampling output; and A digital signal processor has a processing input coupled to the sampled output and a processing output coupled to the filter output, the digital processing circuit being configured to generate the correction signal at the processing output based on averaging the samples.

8. The apparatus of claim 1 , further comprising a majority state determination circuit having a first candidate input, a second candidate input, and a third candidate input and a majority output, wherein the first candidate input is coupled to the first data output, the second candidate input is coupled to the second data output, and the third candidate input is coupled to the third data output, the majority state determination circuit being configured to set a state of the majority output in response to a majority state of the first candidate input, the second candidate input, and the third candidate input.

9. The apparatus of claim 1, wherein: the first memory device comprising a first sequential logic circuit having a first set input, a first reset input, a first non-inverting output, and a first inverting output, the first set input and the first reset input being coupled to the first data input, and the first non-inverting output and the first inverting output being coupled to the first data output; the second memory device includes a second sequential logic circuit having a second set input, a second reset input, a second non-inverting output, and a second inverting output, the second set input and the second reset input being coupled to the second data input, and the second non-inverting output and the second inverting output being coupled to the second data output; and The third memory device includes a third sequential logic circuit having a third set input, a third reset input, a third non-inverting output, and a third inverting output, the third set input and the third reset input being coupled to the third data input, and the third non-inverting output and the third inverting output being coupled to the third data output.

10. The apparatus of claim 9, wherein each of the first sequential logic circuit, the second sequential logic circuit, and the third sequential logic circuit comprises an RS latch.

11. The apparatus of claim 9, wherein: The first sequential logic circuit includes a first flip-flop having a first clock terminal and a first reset terminal, the first clock terminal coupled to the first set input, and the first reset terminal coupled to the first reset input; the second sequential logic circuit comprises a second flip-flop having a second clock terminal and a second reset terminal, the second clock terminal being coupled to the second set input and the second reset terminal being coupled to the second reset input; and The third sequential logic circuit includes a third flip-flop having a third clock terminal and a third reset terminal, the third clock terminal coupled to the third set input, and the third reset terminal coupled to the third reset input.

12. The apparatus of claim 9, wherein the error detection circuit comprises: a first error detection subcircuit having a first detection subinput and a first detection suboutput, the first detection subinput being coupled to the first inverting output, the second non-inverting output and the third non-inverting output via the first detection input, and the first detection suboutput being coupled to the detection output; a second error detection subcircuit having a second detection subinput and a second detection suboutput, the second detection subinput being coupled to the first non-inverting output, the second inverting output and the third inverting output via the first detection input, and the second detection suboutput being coupled to the detection output; a third error detection subcircuit having a third detection sub-input and a third detection sub-output, the third detection sub-input being coupled to the first non-inverting output, the second inverting output and the third inverting output via the second detection input, and the third detection sub-output being coupled to the detection output; a fourth error detection subcircuit having a fourth detection sub-input and a fourth detection sub-output, the fourth detection sub-input being coupled to the first inverting output, the second non-inverting output and the third inverting output via the second detection input, and the fourth detection sub-output being coupled to the detection output; a fifth error detection subcircuit having a fifth detection subinput and a fifth detection suboutput, the fifth detection subinput being coupled to the first non-inverting output, the second non-inverting output and the third inverting output via the third detection input, and the fifth detection suboutput being coupled to the detection output; as well as A sixth error detection sub-circuit has a sixth detection sub-input and a sixth detection sub-output, wherein the sixth detection sub-input is coupled to the first inverting output, the second inverting output and the third non-inverting output via the third detection input, and the sixth detection sub-output is coupled to the detection output.

13. The apparatus of claim 12, wherein each of the first to sixth error detection subcircuits comprises an AND gate.

14. The apparatus of claim 12, wherein the error correction circuit comprises: a first syndrome circuit having a first external data input, a first syndrome input and a first syndrome output, wherein the first syndrome input is coupled to the first detector output via the correction input, and the first syndrome output is coupled to the first setting input via the first correction output; a second syndrome circuit having a second external data input, a second syndrome input, and a second syndrome output, wherein the second syndrome input is coupled to the second detector output via the correction input, and the second syndrome output is coupled to the first reset input via the first correction output; a third syndrome circuit having a third external data input, a third syndrome input and a third syndrome output, wherein the third syndrome input is coupled to the third detector output via the correction input, and the third syndrome output is coupled to the second setting input via the second correction output; a fourth syndrome circuit having a fourth external data input, a fourth syndrome input and a fourth syndrome output, the fourth syndrome input being coupled to the fourth detector output via the correction input, and the fourth syndrome output being coupled to the second reset input via the second correction output; a fifth syndrome circuit having a fifth external data input, a fifth syndrome input and a fifth syndrome output, the fifth syndrome input being coupled to the fifth detection suboutput via the correction input, and the fifth syndrome output being coupled to the third setting input via the third correction output; and The sixth syndrome circuit has a sixth external data input, a sixth syndrome input and a sixth syndrome output, wherein the sixth syndrome input is coupled to the sixth detection output via the correction input, and the sixth syndrome output is coupled to the third reset input via the third correction output.

15. The apparatus of claim 14, wherein each of the first to sixth syndrome subcircuits comprises an OR gate or a NOR gate.

16. The apparatus of claim 1, wherein each of the first memory device, the second memory device, and the third memory device comprises a random access memory (RAM) device.

17. The apparatus of claim 1, wherein the error detection circuit is configured to detect the mismatch in response to a change in state of at least one of a first detection input, a second detection input, or a third detection input.

18. The apparatus of claim 1, wherein the error detection circuit is configured to: determining a respective state of each of the first detection input, the second detection input, and the third detection input; and The mismatch is detected from the corresponding states.

19. An apparatus comprising: a first memory device configured to store a first copy of the first data; a second memory device configured to store a second copy of the first data; a third memory device configured to store a third copy of the first data; an instruction memory configured to store an instruction set; as well as A processor configured to execute the set of instructions to: detecting a mismatch between the first copy, the second copy, and the third copy of the first data stored at respective first, second, and third memory devices; generating a correction signal representing an uncorrupted state of the first data; determining whether second data is received; In response to determining that the second data is received, storing copies of the second data at the first memory device, the second memory device, and the third memory device; as well as In response to determining that the second data was not received, providing the correction signal to at least one of the first memory device, the second memory device, or the third memory device to write the uncorrupted state of the first data to at least one of the first memory device, the second memory device, or the third memory device.

20. A method comprising: detecting a mismatch among copies of first data stored in a set of memory devices; generating a correction signal representing an uncorrupted state of the first data; determining whether second data is received; In response to determining that the second data is received, writing a copy of the second data to the set of memory devices; as well as In response to determining that the second data was not received, the correction signal is provided to at least one memory device in the set of memory devices to write the uncorrupted state of the first data into the at least one memory device.

Images