Non-Volatile Semiconductor Memory With SCRAM Hold Cycle Prior to SCRAM-to-E.sup.2 PROM Backup Transfer

The invention relates to non-volatile semiconductor memory systems including a volatile high speed SRAM (static random access memory), a non-volatile E.sup.2 PROM (electrically eraseable programmable read only memory) backup memory, and circuitry for transferring the contents of the SRAM to the E.sup.2 PROM in response to onset of a power interruption or failure.

In the past, core memory systems have been widely used where non-volatile RAMs were required, since the ferrite cores used therein are inherently non-volatile.

The technology for semiconductor memories has advanced rapidly, making semiconductor memories faster, more reliable, and less costly than core memories. However, in applications where non-volatile memory is required, the problems of volatility of available semiconductor RAM storage cells, the slow write speed and wear out factor of E.sup.2 PROM circuits that might otherwise be used as backup memories, the large amounts of power required to sustain data storage in available semiconductor RAMs and to effectuate transfer of data from such RAMs to E.sup.2 PROMs, and the difficulties of storing enough energy in a backup capacitor to effectuate RAM-to-E.sup.2 PROM downloading have combined to prevent semiconductor memories from being widely used where non-volatile memory performance is required.

U. S. Pat. No. 4,591,782 (Germer, issued May 27, 1986) describes a non-volatile memory incorporated into an electric meter in which volatile semiconductor memory is used in conjunction with a backup capacitor and control circuitry. The control circuitry senses the onset of a power failure. The backup capacitor supplies power to effectuate transfer of some of the data from the volatile semiconductor memory to a non-volatile E.sup.2 PROM backup memory. The Germer patent deals with the problem of "wear out" of the E.sup.2 PROMs by not: immediately transferring data from the non-volatile storage to the E.sup.2 PROMs and instead waiting a fixed amount of time until a preset counter "times out". The backup capacitor has sufficient energy storage to maintain power to critical circuits for a long enough period after power failure to permit transfer of the entire contents of the volatile RAM to the non-volatile E.sup.2 PROM. When a momentary power outage causes the voltage of an unregulated DC power supply to fall below a first threshold, a counter is started, but normal operation of the system continues. If the unregulated DC voltage does not rise above a second threshold that is slightly higher than the first threshold before the counter times out, a processor initiates transfer of data from the voltatile RAM to the non-volatile E.sup.2 PROM. If the regulated supply voltage falls below a third threshold at which the processor is no longer able to reliably maintain its operating conditions, a reset signal is produced to reset the processor. The third threshold is set low enough that all data is safely transferred from the volatile RAM to the non-volatile E.sup.2 PROM before the reset signal is generated.

There are several disadvantages of the Germer approach. The requirement of a backup timer and the circuitry using the three thresholds increases overall complexity and cost of the Germer system. The timeout period of the backup timer is constant, so if the current drawn by the E.sup.2 PROM and associated circuitry increases with age or if the storage capacity of the backup capacitors is degraded the timeout period of the timer may be inadequate and data may be lost. The constant duration timeout period does not permit maximum useage of the storage capacity of the backup capacitor, so unnecessary downloading and uploading may occur for short duration power losses even though the backup supply has the capacity to maintain integrity of data in the volatile RAM for the duration of the power loss.

There exist devices called NOVORAMs that combine the functions of an SRAM and an E.sup.2 PROM on a single silicon chip. Data from the SRAM portion may be stored in the non-volatile E.sup.2 PROM portion prior to power loss. However, if power is removed prior to completion of data transfer from the SRAM portion to the E.sup.2 PROM portion, the correctness of data in the E.sup.2 PROM is indeterminate.

It has been a common practice to encrypt data before storing it. Government approved encryption algorithms using a "key word" often are used. The encrypted data usually is stored in magnetic media. If there is a need to destroy the encrypted data, all of it must be erased from the magnetic media. In some cases, the amount of time required to erase the encrypted data from the magnetic media may be unacceptable.

There is an unmet need for a non-volatile memory system which includes a volatile semiconductor RAM and a non-volatile backup memory to which data in the RAM is downloaded during power interruptions and from which data is uploaded into the RAM after power interruptions, wherein the number of downloading operations is minimized in accordance with the duration of power interruption, condition of a backup power source, and current drain of the entire memory system.

Accordingly, it is an object of the invention to provide an economical non-volatile semiconductor memory system that provides substantially faster performance, utilizes substantially less power, and occupies substantially less space than the closest prior non-volatile core memory systems.

It is another object of the invention to provide reliable data retention in a high speed semiconductor random access read/write memory system in an environment in which intermittent short duration power failures are likely.

It is another object of the invention to provide minimum degradation of an E.sup.2 PROM backup memory for a high speed semiconductor SRAM.

It is another object of the invention to provide minimum duration of memory useage interruptions caused by short duration power interruptions, such as power interruptions caused by high electrical noise on an input power line.

It is another object of the invention to provide an E.sup.2 PROM based backup system for a volatile RAM wherein downloading operations are avoided unless a backup power source is unable to safely supply enough power to effectuate such downloading.

It is another object of the invention to provide a secure non-volatile memory system in which data stored in a non-volatile backup memory during a power interruption can be, in effect, very rapidly erased or made undecipherable.

Briefly described, and in accordance with one embodiment thereof, the invention provides a system that utilizes a volatile SRAM and a non-volatile backup store implemented by means of E.sup.2 PROMs in which data is transferred from the SRAMs to the E.sup.2 PROMs when the power is turned off or interrupted by using high voltage energy stored in a backup capacitor to provide operating power for at least a long enough period of time to effectuate reliable transfer of data from the SRAM to the E.sup.2 PROM. Any drop in input power below a first threshold causes operation of the SRAM to be halted as soon as the present cycle of operation is finished. An internal power supply voltage applied to the SRAMs is reduced to a minimal maintenance level (e.g., 2 volts), and power to certain other circuitry in the system is cut off. The energy stored in the backup capacitor is monitored, and at a time when just enough energy plus a safety factor remains to download all of the data from the SRAM to the E.sup.2 PROM, a controller effectuates downloading of all the data in the SRAM to the E.sup. 2 PROM backup memory. A unique row-column parity accumulation and check system "scrubs" errors from data read out of the E.sup.2 PROM during an upload of data from the E.sup.2 PROM to the SRAM.

More specifically, in the described embodiment of the invention, the backup capacitor voltage is charged up to and maintained at a selected level of approximately 100 volts while the external power supply is applied to the non-volatile memory system. Accessing of the SRAM by a host computer is halted while the backup capacitor is discharged to supply energy to maintain the reduced data maintenance voltage across the SRAM if the external supply voltage falls below the first threshold. Accessing of the SRAM by the host computer is resumed if the external power supply voltage rises above the first threshold before the backup capacitor voltage falls below a second threshold of approximately 85 volts. If the backup capacitor voltage falls below the second threshold, all of the data in the SRAM is downloaded to the E.sup.2 PROM while the backup capacitor is discharged to supply energy to maintain the internal power supply voltage at 5 volts during the entire downloading. The backup capacitor stores enough energy when the backup capacitor voltage is at 100 volts to both allow the halted condition to continue for at least one minute and also effectuate complete downloading of data from the SRAM to the E.sup.2 PROM. Power is removed from the E.sup.2 PROM during read or write memory accesses by the host computer and also when the 2 volt data maintenance voltage is being maintained on the SRAM. During downloading, row parity information and column parity information are accumulated and stored in the E.sup.2 PROM along with the data from the SRAM. The non-volatile memory system includes a plurality of integrated circuit SRAMs and a plurality of integrated circuit E.sup.2 PROMs, each of which is subdivided into a plurality of subsections. The downloading operation includes reading words in a first subsection of a first integrated circuit SRAM and transferring the read data into a corresponding subsection of a first integrated circuit E.sup.2 PROM, and also transferring the read data into corresponding words of a row parity accumulator and also into a column parity accumulator. The words in a first subsection of a second integrated circuit SRAM then are read and exclusively ORed with corresponding words of the row parity accumulator and the results replace corresponding words of the row parity accumulator. Each word of the first subsection also is exclusively ORed with the word in the column parity accumulator, and the result replaces the same prior word in the column parity accumulator. The contents of the row parity accumulator and the column parity accumulator then are transferred into a scratch pad section of the E.sup.2 PROM. The uploading operation includes reading the words in a first subsection of the first integrated circuit E.sup.2 PROM and transferring the read data into the first subsection of the SRAM, and also transferring the read data into corresponding words of the row parity accumulator and the column parity accumulator. The words in a first subsection of a second integrated circuit E.sup.2 PROM are read and exclusively ORed with the corresponding words of the row parity accumulator and the result replaces the same word of the row parity accumulator. The words in the first subsection of the second integrated circuit E.sup.2 PROM also are exclusively ORed with the contents of the column parity accumulator and the result replaces the contents of the column parity accumulator. The row parity data and the column parity data are compared with previously stored row parity data and column parity data written into the E.sup.2 PROM during a prior downloading operation. An error pattern is produced if a mismatch occurs, and data written into the SRAM is exclusively ORed with the error pattern to correct the data. The corrected data then is written into the SRAM.

FIG. 1 is a block diagram of the non-volatile semiconductor memory system of the present invention.

FIG. 2 is a schematic circuit diagram of the backup storage capacitor, voltage up converter, and voltage down converter circuitry which cooperate to effectuate transfer of data from the SRAM to the E.sup.2 PROM in the event of a power interruption of at least a minimum specified duration.

FIG. 3 is a detailed block diagram useful in describing the control logic of FIG. 1.

FIG. 3A is a detailed block diagram slowing an implementation of the ASIC (application specific integrated circuit) of FIG. 3.

FIG. 4 is a diagram useful in explaining the "bit per chip" row parity and column parity accumulation techniques of the present invention.

FIG. 5 is a timing diagram useful in describing the operation of the system of FIG. 1.

FIGS. 6A and 6B are logic diagrams useful in describing certain blocks in FIG. 3A.

Referring to FIG. 1, memory system 1 includes a volatile RAM (Random Access Memory) section 2, which in the presently preferred embodiment of the invention includes CMOS static RAM cells. The SRAM cells preferably operate reliably to retain data with power supply voltages as low as 2 volts, and operate at normal speeds with V.sub.DD, equal to +5 volts. SRAM 2 is organized as 256k (actually 262,144) words each including 16 data bits and 6 bits of Hamming code data.

SRAM 2 is accessed in response to control circuitry 22 and in conjunction with operation of error detection and correction circuitry 18. Control circuitry 22 generates addresses on bus 23 for accessing SRAM 2 and E.sup.2 PROM 8. Bus 23 also includes data conductors, a read conductor, and a write conductor. Bus 23 also includes 6 Hamming code conductors and 2 parity bit conductors. Control circuitry 22 is coupled by bus 25 to data input/output circuitry 26, which receives address and control signals on conductors 28. Eighteen Data In conductors 30A and eighteen Data Out conductors 30B are connected to input/output unit 26.

Power is supplied to SRAM 2 via a power bus from an energy storage circuit 6 which contains circuitry shown in FIG. 2 to supply a steady internal input power during normal operating conditions and backup power during short duration power interruptions. External power bus 10 supplies input power at, for example, +5 volts, to energy storage circuit 6.

Non-volatile memory system 1 also includes an E.sup.2 PROM 8. Bus 23 includes conductors coupled to error detection and correction circuitry 20 and control circuit 22. Error detection circuitry 18 includes standard Hamming code double bit detection, single bit correction circuitry to "scrub" errors from data read out of SRAM 2. Error detection and correction circuitry 20 includes row and column parity circuitry and correction circuitry which efficiently "scrubs" errors from data read out of E.sup.2 PROM 8.

The non-volatile memory system 1 of FIG. 1 normally operates as an SRAM when the main power on conductor 10 is present. If there is a power interruption or failure, non-volatile energy system 1 acts as a backup memory that contains all of the data in SRAM 2 immediately before the interruption of input power 10.

If the input power 10 falls below specification limits (typically 10% below a nominal V.sub.DD voltage of 5 volts), the system 1 goes into a "hold mode", reducing the sustaining power to SRAM 2 to approximately 2 volts and cutting off power via conductors 14 to control circuitry 22, input/output circuitry 26, and error correction and detection circuitry 18 and 20. If the input power 10 does not then increase to a minimum specification level within a "hold" period which preferably is at least approximately one minute, control circuitry 22 (which along with SRAM 2 is being sustained by a backup capacitor in energy storage circuit 6) initiates downloading of data from SRAM 2 to E.sup.2 PROM 8 and applies the internal supply voltage to the components as needed to effectuate the downloading.

More specifically, downloading is initiated if the voltage stored on the backup capacitor falls below the predefined threshold, typically about 80% below the nominal backup energy level. In this event, the controller circuit 22 applies full power from the energy storage circuit 6 to all or nearly all of the circuitry in FIG. 1 to effectuate downloading of the entire contents of SRAM 2 into E.sup.2 PROM 8. Controller circuit 22 controls the sequence of all transfers of data between SRAM 2 and E.sup.2 PROM 8. Controller circuit 22 also controls all I/O functions and built-in self test and housekeeping functions.

The overall operation of non-volatile memory 1 can be more thoroughly understood by referring to the timing diagram of FIG. 5. In FIG. 5, numeral 32 designates an example of a waveform of the input voltage carried by conductor 10. Dotted line 33 represents a minimum input voltage threshold. Input power waveform 32 rises from an initial zero level up to a constant operating level, as indicated by numeral 32A. Data in E.sup.2 PROM 8 then is "uploaded" into SRAM 2 during the interval 38B in the "Data Location" graph in FIG. 5.

In the example of FIG. 5, the input voltage 10 then falls below the input voltage threshold at point 33A, as indicated by section 32B of waveform 32. After being below the input voltage threshold 33 for a short period of time, which should be at least about one minute, the input voltage rises as indicated by numeral 32D to level 32E, crossing the input voltage threshold at point 33B and remaining at +5 volts for an indefinite period of time. Then the input voltage falls below the input voltage threshold at point 33C and remains low for an indefinite time, as indicated by numeral 32F.

In accordance with the present invention, the duration of section 32C of input voltage waveform 32 is short enough that non-volatile memory system 1 goes into a "hold mode", which is a low power data maintenance mode, after finishing the present read or write cycle. However, the data of SRAM 2 is not downloaded to E.sup.2 PROM 8 unless the backup voltage waveform 35 falls below a "backup voltage threshold" designated by dotted line 36 for more than the minimum hold time.

The above mentioned backup voltage waveform 35 represents the voltage stored on backup capacitor 43 of FIG. 2 as a result of the input power interruptions shown in input voltage waveform 32. More specifically, input voltage waveform 32 causes backup voltage waveform 35 to rise as indicated by numeral 35A, crossing the backup voltage threshold 36 at point 36A and then leveling off as indicated by numeral 35B. The interruption of input power designated by section 32B of input voltage waveform 32 causes a very slow decay of backup voltage waveform 35 between points 35C and 35D. However, backup voltage waveform 35 does not fall below backup voltage threshold 36. When the input voltage waveform 32 then rises as indicated by numeral 32D, backup voltage waveform 35 rises from point 35D to its normal level 35E

However, when input voltage waveform 32 is later interrupted as indicated by numeral 32F, backup voltage waveform 35 slowly decays from point 35F to the backup voltage threshold 36, as indicated at point 35G. This initiates downloading of data from SRAM 2 to E.sup.2 PROM 8, resulting in the further decay of backup voltage 35 between points 35G and 35H.

Data Location graph 38 in FIG. 5 indicates the time intervals in which data is stored in the E.sup.2 PROM 8 and SRAM 2, uploaded from E.sup.2 PROM 8 to SRAM 2, and downloaded from to SRAM 2 to E.sup.2 PROM 8. When both input voltage waveform 32 and backup voltage waveform 35 are above their respective thresholds 33 and 36 during initial powering up of non-volatile memory 1, the read/write waveform 40 is at a low level. The powering up operation typically takes approximately 3 seconds. Interval 38B designates the time during which data is being uploaded from E.sup.2 PROM 8 to SRAM 2, and typically is approximately 250 milliseconds. Once the transfer is complete, then read/write waveform 40 undergoes transition 40A to level 40B. While read/write waveform 40 is at level 40B, a host computer 120 (FIG. 3) can perform ordinary read and write accesses to SRAM 2. Meanwhile, E.sup.2 PROM 8 and its associated row and column parity circuitry 20 are powered down by control unit 101 of FIG. 3A.

FIG. 2 shows energy storage circuitry 6, which includes a voltage up converter 42 that performs the function of boosting the external 5 volt power supply voltage on conductor 10 to charge up a l,000 to 5,000 microfarad backup capacitor 43 to approximately 100 volts to provide a backup voltage on backup capacitor terminal 65 to power the non-volatile memory system 1.

The 100 volts produced on conductor 65 by backup capacitor 43 when it is fully charged then is converted back down to the internal 5 volt supply voltage on conductor 91 whenever the external 5 volt level on conductor 10 is interrupted, by slowly discharging the energy stored in backup capacitor 43. Control circuit 101 (FIG. 3A) supplies separate control voltages to conductors 91A, 91B, and 91C to distribute the internal 5 volt supply voltage on conductor 91 to conductors 12, 14, and 16, respectively, by selectively turning on MOSFETs 97, 98, and 99. If MOSFET 97 is turned off, a three volt zener diode 92 maintains conductor 12 at 2 volts to provide standby power to SRAM 2. At this low voltage, all data is maintained in SRAM 2 in which the total current drawn by SRAM 2 is reduced to only about a miliampere.

Voltage up converter 42 includes a regulator circuit 46, which may be implemented by means of a Motorola "Universal Switching Regulator Subsystem", part number UA78S40. Oscillator 46 contains a comparator 48 and an oscillator 47. The output of oscillator 47 is connected to a pullup resistor and a coupling capacitor 51 and to the input of an amplifier. The amplifier includes NPN transistors 52, 55, and 57, diode 53, and resistors 54, 56, and 58. This amplifier provides a 6-to-1 duty cycle pulse signal to the base of NPN transistor 60, producing current to charge inductor 61. When the transistor 60 is turned off, a back emf is generated across inductor 61, forward biasing diode 62. This causes the current in inductor 61 to charge up capacitor 43. This operation continues with the same duty cycle until the voltage on conductor 65 reaches approximately 100 volts. The current flowing through inductor 61 also flows through a 0.1 ohm resistor 41A, the upper terminal of which is connected to +5 volt conductor 10. The other terminal of resistor 41A is connected to inductor 61 and a control input of oscillator 47. Resistor 41A prevents excessive current from flowing through inductor 61 and transistor 60. When the backup capacitor voltage 65 has been charged to approximately 100 volts, a voltage divider circuit including resistors 66 and 67 produces a voltage that exceeds a reference voltage V.sub.REF applied to the non-inverting input of comparator 48. This stops oscillator 47 until the voltage on conductor 68 falls below V.sub.REF, effectively stretching out the duty cycle of the charging of backup capacitor 43.

It should be noted that switch 49 initially is momentarily closed, charging conductor 91 to 5 volts, and thereby providing a 5 volt internal "jump start" supply voltage to all of the circuits in voltage down converter circuit 44. Voltage down converter circuit 44 includes an oscillator 71 that produces a square wave output that is amplified and shaped by an amplifier including transistors 72, 73, and 77. This amplifier also includes resistors 74 and 76 and capacitor 75, and produces a square wave current pulse through the primary winding of transformer 80. The secondary winding of transformer 80 is connected between the gate and source of a MOSFET 83. The source of MOSFET 83 is connected to the cathode of a diode 84, the anode of which is connected to ground. The secondary winding of transformer 80 produces a voltage pulse that turns MOSFET 83 on, causing current to flow from backup capacitor 43 through resistor 88, MOSFET 83, and inductor 69, charging up capacitor 89. When MOSFET 83 is turned off, a back emf across inductor 69 causes the induction current to continue flowing, forward biasing "catch" diode 84 and further charging up capacitor 89 and conductor 91.

When the voltage on conductor 91 reaches 5 volts, a resistive divider circuit including resistors 63 and 64 causes the voltage on the inverting input of comparator 70 to exceed a reference voltage V.sub.REF applied to the non-inverting terminal thereof, halting oscillator 71. Backup capacitor 43 thus is gradually discharged as needed to maintain 5 volts on internal 5 volt conductor 91.

Comparator 93 generates a "Input Power Okay" signal P.sub.INOK on conductor 94 by sensing the input supply voltage on conductor 10 by means of a resistive divider circuit that applies a voltage to the non-inverting input of comparator 93. When V.sub.DD is less then +4.5 volts, P.sub.INOK goes from a "1" to a "0", initiating the above described "hold mode".

When the backup voltage on conductor 65 is less than about 85% of its usual voltage of 100 volts, this causes a voltage divider to apply a voltage less than V.sub.REF to the non-inverting input of comparator 95, so that an "Energy Okay" signal E.sub.OK on conductor 96 goes from a "1" to a "0", initiating the downloading of data from SRAM 2 to E.sup.2 PROM 8.

FIG. 3 illustrates the organization of SRAM 2, E.sup.2 PROM 8, and ASIC (Application Specific Integrated Circuit) device 115 that includes control circuit 22, Hamming code error detection and correction circuitry 18, row and column parity error detection and correction circuitry 20, and part of input/output circuit 26. ASIC 115 can be an XC3090 programmable logic gate array manufactured by XILINK. It can be programmed to a wide variety of configurations to establish various input/output formats that might be desirable for input/output circuitry 26.

A 56 bit magnetic register 111 constitutes a "secure key" which is a completely eraseable 56 bit code that is read as a "seed" into an encryption/decryption circuit 112 (FIG. 3A) in ASIC 115 to automatically encrypt data being downloaded from SRAM 2 to E.sup.2 PROM 8 and automatically decrypt seed data when it is being uploaded from E.sup.2 PROM 8 to SRAM 2. The 56 bit magnetic register, which can be fabricated of ferrite memory cores, can be erased and reset to contain a different "security key" in such a manner that the original key cannot be recovered, at least not at the present state-of-the-art.

As those skilled in the art know, a fast, reliable erase of certain stored data may be required. It is known that E.sup.2 PROMs must be rewritten several times in order to reliably erase all evidence of the previously stored data. It is also known that E.sup.2 PROMs require very long write cycles.

Therefore, there is a need for a much faster, more reliable means of effectively erasing data stored in an E.sup.2 PROM. The above described system allows an "effective erasing" of the contents of the E.sup.2 PROM so that the previously stored data becomes undecipherable in an extremely fast manner by simply erasing the contents of the magnetic register 111, which can be accomplished in about 10 microseconds. It also is known that without a secure key, the encrypted data that might be otherwise recovered from E.sup.2 PROM 8 cannot, as a practical matter, be deciphered, and hence can be "declassified", whereas, certain data that might be stored in non-volatile memory system 1 might otherwise have to be treated as "classified" or secret.

As shown in FIG. 3, SRAM 2 includes sections 2A-1, 2A-2 . . . 2A-8, each of which is a 32,768 word (i.e., 32k) by 16 bit CMOS SRAM, such as an IDT71256L85LB, manufactured by Integrated Device Technology Corp., having its address inputs connected to address bus 28B. The data terminals of each of SRAMs 2A-1 . . . 2A-8 are connected to internal data bus 30A,B. A similar group of eight CMOS SRAMs 2B-1 . . . 2B-8 having address and data terminals connected to address bus 28B and the internal data bus 30A,B also is composed of identical 32k by 8 CMOS SRAMs; this group of SRAMs is used to store Hamming code data. Finally, SRAM 2 also includes an identical 32k word by 16 CMOS SRAM scratch pad memory 2C having its data terminals and address terminals connected to address bus 28B and the data bus 30A,B, respectively. The address terminals of the Hamming code data SRAMS 2B-1 . . . 2B-8 are connected by conductors 109A to ASIC 115.

Address buffer 26A buffers the 18 bit external address bus conductors 28A from the various internal address bus conductors 28B and 28C. Data buffers 26B and 26C buffer the 18 external Data In conductors 30A and the 18 external Data Out conductors 30B from the internal data bus conductors 30A,B.

E.sup.2 PROM 8 includes sections 8A-1 . . . 8A-8 organized identically (32k words by 16 bits) to data section 2A-1 . . . 2A-8 of SRAM 2. The address and data terminals of the E.sup.2 PROMs 8A-1 through 8A-8 are connected to the address bus conductors 28B and the data bus conductors 30A,B, respectively. E.sup.2 PROM 8 also includes an identical 32k word by 16 bit row parity memory 8B having its address and data conductors connected to address bus 28B and data bus 30A,B. Column parity and correction data and maintenance data section 8C of E.sup.2 PROM 8 also has its address and data terminals connected to address bus 28B and data bus 30A,B.

FIG. 3A shows a block diagram representing the functional blocks "programmed" into ASIC 115 in order to accomplish the control, Hamming code generation, row and column parity generation, and checking functions needed to implement the error detection and correction circuits 18 and 20 of FIG. 1.

Address decode circuit 100 receives as inputs 28C the three external higher order addresses A15, A16, and A17 of address bus 28B. Address decode circuit 100 also receives address inputs 107A (A15-A17) produced by address generation circuit 107 in response to either upload sequence circuit 106 or download sequence circuit 10B. Address decode circuit 100 generates nine SRAM chip select conductors 100A and ten E.sup.2 PROM chip select conductors 100B to effectuate the necessary chip select functions for downloading SRAM 2 into E.sup.2 PROM 8, uploading E.sup.2 PROM 8 into SRAM 2, and accessing of SRAM 2 by a host computer 120 via the input/output circuitry 26 of FIG. 1.

Control circuit 101 receives P.sub.INOK and E.sub.OK on conductors 94 and 96, upload control signals 106A from upload sequencing circuit 106, and download control signals 108A from download sequencing circuit 108. Download sequencer circuit 10B is an ordinary "state machine" circuit that receives control inputs 108A indicating that the input power has fallen below threshold 33 and that the backup capacitor voltage has fallen below threshold 36 (FIG. 5). By communicating back to control circuit 101 and address generator 107, data is transferred from the SRAM 2 to E.sup.2 PROM 8 at the same time that row/column parity data is accumulated. At the completion of a 64 word transfer, the row/column parity controller 105 transfers parity data into E.sup.2 PROM 8. This process is repeated 512 times, until all data has been transferred from the SRAM 2 to the E.sup.2 PROM 8. Control circuit 101 includes both a counter which counts 64 word blocks and the above-mentioned state machine.

Upload sequencer 106 triggers control circuit 101 to generate the necessary timing to generate the read and write signals required for the downloading operation.

Upload sequencer 106 is implemented similarly to download sequencer 108, to transfer data in opposite direction from the E.sup.2 PROM 8 to SRAM 2 wherein both input power and the backup voltage exceed their respective thresholds 33 and 36 (FIG. 5). At the completion of each 64 word block transfer, the generated row/column parities are compared to the stored parities for the determination of the failure locations so that uploaded data can be corrected.

Control circuit 101 receives data error information 102A from Data In parity check circuit 102, and also receives external read and external write signals and control signals on bus 101A. Control circuit 101 also receives control signals generated by host computer 120 on bus 101A. Control block 101 is configured to provide back plane timing signals and protocol and internal SRAM and E.sup.2 PROM timing. The timing element input is a delay line which is triggered by either an external cycle initiate trigger signal or an internal trigger stimulus. External trigger signals are the result of a request for read/write cycles from the host processor 120. Internal trigger signals result from internal requests for transfers, i.e., transferring data from SRAM 2 to E.sup.2 PROM 8 or vice versa. After an initial edge on the delay on a delay line following edges are produced by the conventional delay line circuitry at 25 nanosecond intervals, and suitable gain circuitry is provided to generate timing signals used to produce the sequence of handshaking required by the host computer 120, the setup timing, the hold times, and the access, read, and write timing signals required by SRAM 2 and E.sup.2 PROM 8 for an uploading or a downloading operation. Control circuit 101 also includes a mode sensing circuit which determines if a particular cycle is a read cycle or a write cycle. Once this information is latched, then the time sequence controlling data flow through the data input latch in block 102, the encryptor/decryptor circuit 112, the Hamming code generator 109, the Hamming comparator/corrector circuit 110, and the Data Out parity check circuit 104, and the column parity accumulator 103 can be processed. The control circuit 101 also provides feedback to the upload sequencer 106 and the download sequencer 108 allowing them to "bump" to the next address or sequence during the data transfers.

Column parity accumulator 103 performs exclusive OR functions necessary to accumulate column parity, as subsequently explained with reference to FIG. 4.

More specifically, column parity accumulator 103 includes a 16 bit exclusive OR register, each bit of which may have the configuration shown in FIG. 6A, where i represents a particular bit of the lower and upper data bytes on data bus 30A,B. For each bit, if a particular logic level already is stored in the D type latch, and if the next value of the same bit loaded into the register is of the opposite logic level, a mismatch will be produced, and a "1" will appear on the output terminal 102C-i.

Row/column parity accumulator control circuit 105 is used to control transfer of parity data from internal registers to scratch pad SRAM 2C, and then from scratch pad SRAM 2C into E.sup.2 PROM 8. During upload operations row/column parity accumulator control circuit 105 controls the comparison of generated parities to the previously stored parities and then helps effectuate correction of failed locations, as explained subsequently with reference to FIG. 4.

Data In parity check circuit 102 latches data from internal data bus 30A,B, performs a parity check on the 18 bits on data bus 30A,B, generates a data error signal on conductor 102A if an error is detected, and makes the latched data available to column parity accumulator 103 via conductors 102C or to encryptor/decryptor circuit 112 if it is presently enabled. If encryptor/decryptor circuit 112 is presently disabled, Data In parity check circuit 102 makes the latched data available to bus 112A, and hence to Hamming code generator 109 and Hamming comparator/corrector circuit 110. The parity check is a dual byte parity check which involves exclusive ORing of the first data byte D0, D1 . . . D7 with the first (lower byte) parity bit D8 and logically ORing that with the exclusive OR of the second byte of data D9, D10 . . . D16 and the second (upper byte) parity bit which is D17. This expression produces the data error signal on conductor 102, as indicated by the following equation:

Data Out parity generator 104 receives 16 bits of data via bus 103A from column parity accumulator 103 and generates the parity bits D8 and D17 for the lower and upper bytes of data, respectively. It receives corrected data from Hamming comparator/corrector 110 via bus 110C, and also performs the function of driving data bus 30A,B. The following equations show that lower parity bit D8 is the exclusive OR of the lower data bits D0, D1 . . . D7 on corrected data bus 110C, and upper parity bit D17 is the exclusive OR of bits D9 through D16 on corrected data bus 110C:

Encryptor/decryptor circuit 112 receives an enable/disable signal on conductor 101D from controller 101 to perform an encryption/decryption function during downloading and uploading. Encryptor/decryptor circuit 112 is bypassed during accessing of SRAM 2 by host computer 120. Encryptor/decryptor circuit 112 receives a 56 bit "security key" from fully eraseable 56 bit magnetic register 111 serially via conductor 111A. During upload or download operations the encrypted/decrypted output is supplied on bus 112A to Hamming code generator 109 and Hamming comparator/corrector 110. The encrypted data stored in E.sup.2 PROM 8 can be very quickly made un-decryptable, and hence "effectively erased", by merely erasing the security key word from magnetic register 111. Encryptor/decryptor circuit 112 could be implemented by using a Western Digital WD2001/WD2002 encryption/decryption devices which are designed to encrypt and decrypt 64-bit blocks of data using the algorithms specified in the Federal Information Processing Data Encryption Standard No. 46 using a 56 bit user-specified key to produce a 64-bit cipher text word. Alternately, the publicly known algorithm can be programmed into the ASIC 115, which is the applicant's preferred embodiment. The Western Digital Corporation June, 1984 Communication Products Handbook provides a detailed explanation and an application note.

Hamming code generator 109 receives the 16 bits of latched data present on bus 112A and generates 6 bits of Hamming data on bus 109A. This is an entirely standard function that can be readily implemented by those skilled in the art from any text on Hamming codes. The Hamming code equations are well known and can be implemented using commercially available circuits or by programming ASIC 115 to exclusive OR the latched and encrypted data bits on bus 112A.

Hamming comparator/corrector circuit 110 receives both the 16 bits of latched data on bus 112A and also receives the 6 bits of Hamming data supplied on bus 109A by Hamming code generator 109 or read out of Hamming data section 2B of SRAM 2. Hamming code generator 109 regenerates the Hamming codes. The Hamming data that is regenerated is compared to the Hamming data that was previously stored. Based on this comparison, a bit pattern is generated that can then be exclusively ORed with incorrect data to produce the corrected data on bus 110C. FIG. 6B indicates the implementation of Hamming comparator/corrector 110.

Maintenance control circuit 150 performs the function of error logging.

Data Out parity check circuit 104 produces two parity bits which are included with the two byte of corrected data to internal data bus 30A,B. The corrected data and its two parity bits can be read via buffer 26C by host computer 120. If the present data has in fact been corrected, it is also rewritten into SRAM 2 by applying a write command to SRAM 2 in order to write the corrected data into the present address (which still is available on address bus 28B).

A normal write operation by host computer 120 includes addressing SRAM 2 via address bus 28A to generate the chip addresses on internal address bus 28B and the necessary SRAM chip select signals on conductors 100A. The data to be written is applied to Data Input conductors 30A, including 16 bits of data and two parity bits. This data is latched into Data In parity check circuit 102 and stripped of the parity bits. The data is input via bus 112A to Hamming code generator 109 to produce the corresponding Hamming codes on Hamming bus 109A. Then the Hamming data on bus 109A is written into SRAM section 2B, and the data on data bus 30A,B is written in SRAM section 2A.

A normal read operation by bus host computer 12 includes addressing SRAM 2 via address bus 28A to generate the chip addresses on internal address bus 28B and the necessary SRAM chip select signals on conductors 100A. The data read from SRAM 2 is latched into Data In parity check circuit 102, bypasses the encryptor/decryptor 112, and is applied to Hamming code generator 109. The generated Hamming codes are compared to the previously stored Hamming codes in block 110, which detects data errors and supplies corrected data on bus 110C. Two parity bits are added to the corrected data by Data Out parity check circuit 104. The corrected data and the Hamming data on six bit Hamming data bus 109A then are simultaneously written into the presently addressed word of sections 2A and 2B, respectively, of SRAM 2 by means of a write command.

The addresses of any errors detected by Hamming comparator/correction circuit 110 are stored in the scratch pad section 2C of SRAM 2 along with a count of how many times an error has occurred at that address of SRAM 2 in response to maintenance control circuit 150.

A downloading operation occurs when both a P.sub.INK signal and an E.sub.OK is received by control circuit 101, indicating both loss of input voltage 10 below the input power threshold 33 and loss of the backup voltage 65 below energy threshold 36 (FIG. 5).

However, if only the P.sub.INOK signal has been received, control circuit 101 puts the non-volatile memory system 1 into the above-mentioned "hold mode" and turns off MOSFET 91A. (MOSFET 91C already will be off.) Then operating power will be absent from E.sup.PROM 8, and SRAM 2 will be powered by a 2 volt standby voltage produced on conductor 12 by 3 volt zener diode 92 in FIG. 2, maintaining all of the data in SRAM 2 with a very low current drain. If the input voltage on conductor 10 returns before the E.sub.OK signal is received, the P.sub.INOK signal disappears. SRAM 2 and all of control circuitry 22 are supplied by the normal 5 volt levels, and normal read and write operations by host computer 120 are continued.

If the E.sub.OK signal is received while P.sub.INOK is present, control circuit 101 triggers download sequencer 108 via one of conductors 108A to download the data of SRAM 2 into E.sup.2 PROM 8. Download sequencer 108 triggers address generation circuit 107 by means of one of conductors 108B, causing address generation circuit 107 to generate addresses A15-A17 of SRAM 2, causing address decode circuit 100 to generate the corresponding chip select signals on ten conductors 100A to select one of the SRAM chips 2A-1, 2A-2, etc. at a time. Download sequencer 108 also causes address decode circuit 100 to generate chip select signals 100B to select corresponding E.sup.2 PROM chips 8A-1, 8A-2, etc. one at a time, and also causes data at each address to be read from SRAM 2, input to data in parity check circuit 102 and applied via 16 conductors 102C to column parity accumulator 103. Address generator 107 also generates addresses A0-A14 in response to download sequencer.

At the same time, the data on internal data bus 30A,B is written into the same location of E.sup.2 PROM 8 and also is written into the scratch pad section 2C of SRAM 2 to accumulate row parity data under the control of row/column parity control circuit 105, as subsequently described with reference to FIG. 4. The accumulated row parity and column parity then are written into corresponding locations of scratch pad memory 2C and row parity section 8B of E.sup.2 PROM 8 after scanning of a "row" is complete. At the end of the download cycle, all of the data and all of the associated row and column parity bits from SRAM 2 have been loaded into corresponding locations of E.sup.2 PROM 8.

An uploading operation is initiated when the P.sub.INOK and E.sub.OK signals disappear, indicating the return of input voltage on conductor 10 to a value above input voltage threshold 33 and indicating that backup voltage 65 has increased above threshold 36. When that happens, control circuit 101 generates a signal on one of conductors 106A causing upload sequencer 106 to produce signals on conductors 106B that trigger address generator 107. Address generator 107 produces addresses A15-A17 signals on conductors 107A which are decoded by address decode circuit 100 to generate SRAM chip select signals 100A and corresponding E.sup.2 PROM chip select signals 100B to access corresponding locations of E.sup.2 PROM 8 and SRAM 2 as necessary to upload data from E.sup.2 PROM 8 back to SRAM 2. Address generator circuit 107 also generates the addresses A0-A14 on conductors 28B in response to upload sequencer 106.

Data read from the accessed location of E.sub.2 PROM 8 appears on internal data bus 30A,B. The row parity and column parity are accumulated. The row and column parity are checked against the corresponding row and column parity for the previous downloading stored in E.sub.2 PROM section 8B. If a mismatch is found, an error exists in the data transferred to SRAM 2 at the mismatch address. An error pattern identifying the mismatch is exclusively ORed in column parity accumulator 103 with the erroneous data in the SRAM, and the corrected data is rewritten into SRAM 2. More specifically, the corrected data is uploaded into the present address of the selected one of SRAM sections 2A-1, 2A-2, . . . 2A-8 by applying a write command to it. The corrected data on data bus 30A,B also is used by Hamming generator 109 to generate correct Hamming codes which are stored at the same address of SRAM section 2B. The above process is repeated until all of the data in E.sub.2 PROM 8 has been read out, parity checked, corrected if necessary, corresponding Hamming codes have been generated, the corrected data has been stored in a corresponding one of SRAM sections 2A-1, 2A-2, . . . 2A-8, and the Hamming data has been stored in a corresponding section 2B of SRAM 2.

If a data error is detected by data in parity check circuit 102 at the present address, data in parity check circuit 102 produces a data error signal on conductor 102A. This data error signal may be read by host computer 120 to inform it that the present data contains an error.

Next, the row parity accumulation technique and column parity accumulation technique and corresponding error correction technique of the present invention will be described with reference to FIG. 4.

In FIG. 4, numerals 8A-1, 8A-2 . . . 8A-8 show three-dimensional representations of sections of E.sup.2 PROM 8 as described above. Each section such as 8A-1 is subdivided into 512 64 word by 16 bit subsections. For example, section 8A-1 includes 512 subsections such as subsection 129, which includes 64 words such as 125 and 128 each having 16 bits. Similarly, section 8A-2 of E.sup.2 PROM 8 includes 512 subsections 131 each having 64 16 bit words, such as word 130. Similarly, section 8A-8 includes 512 64 word subsections 136.

Although not shown in FIG. 4, sections 2A-1, 2A-2 . . . 2A-8 of SRAM 2 also each are similarly subdivided into 512 64 word by 16 bit subsections. Row parity accumulation and column parity accumulation are accomplished for SRAM 2 by scanning SRAM 2 in precisely the same fashion as for E.sup.2 PROM 8.

In FIG. 4 scratch pad RAM 2C includes a single 64 word by 16 bit "row parity accumulator" subsection 132, which includes 64 16 bit words such as 133, 134, etc. Individual corresponding bits of all of the above 64 word by 16 bit subsections of E.sup.2 PROM sections 8A-1 . . . 8A-8, SRAM subsections 2A-1 . . . 2A-8, and 64 word by 16 bit subsection 132 of scratch pad 2C of SRAM 2 are addressed by the same group of address conductors of address bus 28B.

"Column parity accumulator" register 103 of ASIC 115 of FIG. 3C is shown in FIG. 4 for convenience.

The group of 64 word by 16 bit subsections 129, 131 . . . 136 of E.sup.2 PROM 8 (or a similar row of subsections of SRAM 2) is referred to herein as a "row" for the purpose of describing scanning of E.sup.2 PROM 8 or SRAM 2 to accumulate row and column parities during an upload operation or a download operation of non-volatile memory system 1. In FIG. 4, exclusive OR gates 126, 127, and 137 are shown to assist in describing the functions of exclusive ORing corresponding bits on a "bit per chip" basis during "row" scanning to accumulate row and column parity, in accordance with the present invention.

First, the row and column parity accumulation will be described for an uploading of data stored in E.sup.2 PROM 8 into SRAM 2. The first step in the scanning procedure is to sequentially read the contents of the first word 125 in subsection 129. That entire word 125 is stored in the first word 133 of SRAM scratch pad subsection 132. Word 125 also is written into column parity accumulator 103. Next, the second word 128 of subsection 129 is written into a second word 134 of scratch pad subsection 132, and is exclusively ORed with the contents of column parity accumulator 103 as indicated by Exclusive OR gate 137. The results replace the previous contents of column parity accumulator 103. The next step is to repeat the above process for the third 16 bit word and all subsequent 16 bit words of subsection 129. At this point, all of the data in subsection 129 has been transferred to scratch pad section 132, and the column parity for section 129 has been accumulated in column parity accumulator 103.

Then the above process is repeated for section 8A-2, except that each bit in each word of subsection 131 is exclusively ORed with the corresponding bit in scratch pad subsection 132 and the results are loaded into scratch pad subsection 132. The accumulated column parity then is written into the first word 142 of another 64 word by 16 bit subsection 141 of scratch pad RAM 2C. Meanwhile, column parity is accumulated for section 131 in column parity accumulator 103. Exclusive OR gate 126 illustrates the exclusive ORing of corresponding bits in first word 125 (after it is transferred to scratch pad subsection 132) with the corresponding bits in word 130 of subsection 131 and storing the results in word 133 of scratch pad subsection 132. Exclusive OR gate 127 represents the last such exclusive ORing in the first "row". When the entire "row" consisting of subsections 129, 131 . . . 136 has been scanned, the row parity for the entire "row" has been accumulated in scratch pad subsection 132, and the column parities for each of those subsections has been accumulated in the first eight words of scratch pad subsection 141.

Then the contents of subsection 132 of row parity accumulator subsection 132 and the contents of column parity accumulator subsection 141 are compared with corresponding row parity and column parity stored during the previous downloading operation into sections 8B and 8C, respectively, of E.sup.2 PROM 8. Simultaneously, all of the data being scanned and read out of E.sup.2 PROM 8 is being written into corresponding locations of SRAM 2. Whenever a mismatch is found between the present row and column parity and the row and column parity stored in sections 8B and 8C of E.sup.2 PROM 8 during the previous downloading operation, that row and column parity is exclusively ORed with the data just read out of the corresponding location of E.sup.2 PROM section 8A to correct the data. The result of that exclusive ORing represents a two-dimensional map of any erroneous bit positions. The third dimension information needed to locate the error precisely is derived from the exclusive ORing of the column parity information in subsection 141 with previously stored column parity information from the previous downloading operation. The result of that exclusive ORing represents the erroneous bit positions in the columns of the "row" 129, 131 . . . 136 being scanned. It is necessary to match bit positions in the "row error pattern" and "column error pattern" in order to properly locate the erroneous bit. This is performed by testing these row and column error patterns for each of the sections 8A-1, 8A-2 . . . until a match is found.

Once the location of the error is found so as to produce a row-column bit position match, that match is exclusively ORed with the data in the SRAM at the identified location to correct the erroneous data. The row-column bit match is obtained by logically ANDing the row error pattern and the column error pattern to produce the "correction data" which then is exclusively ORed with the erroneous data from the SRAM at the identified address.

The above "row" scanning procedure during uploading allows corrected data for an entire section such as 8A-1, 8A-2 etc. to be conveniently corrected if necessary and uploaded into SRAM 2, because all of the wrong row and column parity data corresponding to that chip can be stored in sections 8B and 8C and used to correct the erroneous bits. The above scanning procedure is particularly advantageous in view of the probable failure modes of SRAM chips, since if there is a failure in one bit of an SRAM chip, the probability of another failure in another bit of the same chip is high.

For downloading, the scanning procedure is identical except that in FIG. 4, E.sup.2 PROM sections 8A-1, 8A-2 . . . 8A-8 are replaced by SRAM sections 2A-1, 2A-2 . . . 2A-8. The same scratch pad subsections 132 and 141 and the same column parity accumulator 103 are used for both uploading and downloading. However, the accumulated row parity data in scratch pad subsection 132 and the accumulated column parity data accumulated in scratch pad section 141 are not used to locate and correct errors during downloading, but are simply stored in E.sup.2 PROM sections 8B and 8C at the end of scanning of each "row". The row and column parity data is then available for error correction during the next uploading operation, as described above.

Appendix 1 attached hereto shows how ASIC 115 can be programmed to produce the configuration of FIG. 3B.

The above-described non-volatile memory system provides a plug-in replacement for a core memory system providing the advantages of non-volatility, and is capable of providing substantially faster access times and cycle times than a comparable core memory. Reliability is greatly increased over that of a core memory system because of the use of integrated circuit components and attendant reduction in the number of solder connections. The amount of power dissipated is much less than that of a comparable core memory, resulting in much less generation of heat and thermal stressing of components and component connections. This contributes greatly to long term reliability. The described error detection and correction techniques further increase the reliability of the described memory system over a core memory system replaced thereby. Problems associated with the wear-out phenomena of with E.sup.2 PROMs are avoided. The hold mode duration is automatically "self-adjusting" to meet variations in energy stored in the backup capacitor and current drain by circuitry that discharges the backup capacitor during a power interruption due to aging, temperature changes, etc. The secure key using a ferrite core register as a completely erasable security key for encryption and decryption of data provides the advantage of a secure system which can allow confidential data to be more conveniently "declassified".

While the invention has been described with reference to a particular embodiment thereof, those skilled in the art will be able to make the various modifications to the described embodiment of the invention without departing from the true spirit and scope of the invention. For example, certain very high capacitance double layer low voltage capacitors could be used which are not charged to a boosted-up voltage. Alternatively, certain kinds of batteries might be used instead of a backup capacitor.