4.6.2.1 SRAM Error Correction Code (ECC)

The LAN8650/1 contains an internal 8 kB SRAM that is used for the internal buffering of transmit/receive Ethernet frames as well as buffer queue management structures. The corruption of a single SRAM bit can result in a corrupt Ethernet packet or undefined behavior when the corrupted bit occurs in a buffer queue manager memory. Safety critical applications cannot tolerate any memory corruption.

The SRAM controller implements a Single Error Correction, Double Error Detection (SECDED) error correction and detection circuit. The 8 kB memory is implemented as a 2 k word x 39 bit SRAM. Each word of the SRAM consists of 32 bits of data plus 7 bits of parity. Six of these bits are used as Single Error Correction parity bits, or SEC parity. These 6 parity bits allow for the detection of bit errors in the 32-bit data word. If only a single bit is corrupted, the syndrome calculated from the SEC parity indicates which bit of the 32-bit word was corrupted. The SRAM controller will then flip the corrupted bit, providing the correct data value onto the bus. The seventh parity bit is a Double Error Detection parity bit, or DED parity. When the SEC parity indicates a corrupted data word, the DED parity indicates if only a single bit of the data word was corrupted, and therefore correctable, or if more than 2 bits were corrupted. The corruption of two or more bits can only be detected; they cannot be corrected.

Note: If the data word is likely to have more than two bits corrupted, false negatives may occur.

The SRAM ECC is enabled by default. To disable the SRAM ECC, the parity encoder and decoder must be disabled. This is accomplished by setting the ECC Encoder Disable (ENCDIS) and ECC Decoder Disable (DECDIS) bits to a ‘1’ in the Error Correction Code Control (ECCCTL) register. When disabled, no memory corruption will be detected or corrected.

Note: Both the ECC Encoder and Decoder Disable bits (ENCDIS, DECDIS) must be written to the same value.

When a single bit error is detected in the data word, the SRAM controller calculates the syndrome and automatically corrects the corrupted bit. The LAN8650/1 continues to operate normally and the Single Bit Error Count (SBERCNT) field is incremented in the Error Correction Code Status (ECCSTS) register if the Bit Error Count Enable (BERCNTEN) bit is set. As single bit errors are detected and corrected, the SBERCNT field will increment up to the limit set by the Single Bit Error Limit (SBERLMT) field in the ECCCTL register. Once the SBERCNT reaches the limit, the ECC Error (ECC) and Internal Bus Error (BUSER) status bits will be set in the OPEN Alliance Status 1 (OA_STATUS1) register. If enabled, the setting of these bits will also assert the an interrupt to the host alerting it to the excessive number of single-bit errors encountered.

Note: When the Single Bit Error Count (SBETCNT) field increments to and reaches the Single Bit Error Limit (SBERLMT), an additional single bit error will cause the SBERCNT to roll over to zero. As single bit errors accumulate, the SBERCNT will continue incrementing again up to the limit.

The detection of double bit errors will immediately set the ECC Error (ECC) status bits will be set in the OA_STATUS1 register. The transfer of the corrupted SRAM data word on the internal bus will be prevented avoiding any harmful effects and the Internal Bus Error (BUSER) status bit in the OA_STATUS1 register will also be set. Additionally, if the BERCNTEN bit is set the Double Bit Error Count (DBERCNT) field of the ECCSTS register will be incremented.

Note: When the Double Bit Error Count (DBERCNT) increments to 255, an additional double bit error will cause the DBERCNT to roll over to zero.

The type of fault for the last detected SRAM error is available by reading the Error Status (ERRSTS) field of the ECCSTS register. This field will indicate if the fault was due to a single data bit error, a single parity bit error, or a uncorrectable double bit error. Additionally, when single bit errors are corrected, the computed Error Syndrome (ERRSYN) field indicates on which SRAM bit the failure was detected. The address in which the fault was detected is not available. The Error One Shot (ERONESHT) bit determines if the ERRSTS and ERRSYN fields are updated each time an error is detected (ERONESHT=’0’) or only on the first error detected (ERONESHT=’1’). The ECC Error Status fields may be cleared to their default value at any time by writing a ‘1’ to the Error Clear (ERCLR) bit.

Fault Simulation

The SRAM controller can be forced to inject single and double bit errors to simulate memory corruption. This feature may be useful for the testing of firmware safety mechanisms.

To simulate single bit errors, configure both the FLTINJBIT1 and FLYINJBIT2 fields identically to flip the same SRAM bit. Double bit errors are simulated by setting the FLTINJBIT1 and FLYINJBIT2 fields to flip different bits.