Nonvolatile memory ECC

For STM32H72x/3x/4x/5x lines, the nonvolatile memory word (smallest programmable amount of memory) is 256 bits, while on STM32H7Ax/Bx lines, STM32H5 series, STM32C5 series, and STM32U5 series, it is 128 bits. Table 5 Nonvolatile memory ECC coverage in STM32 devices shows the word size for STM32 devices with ECC in nonvolatile memory. This is also the portion of memory protected by the bits required to achieve error detection and correction on the nonvolatile memory word. Write access to any smaller unit of memory is only possible on read-modify-write basis, this action results in higher stress to the memory hardware. The STM32H5 series, STM32C5 series, STM32U5 series, and STM32H7Ax/Bx line also feature added robustness on the small 0.5-2 Kbyte OTP area, where every 16 bits are protected with 6 bits of ECC redundancy. There is no OTP memory area on STM32H72x/3x/4x/5x lines.

The ECC functionality is integrated into the nonvolatile memory controller and cannot be disabled. If the application is not designed to take advantage of the ECC, it can disable the associated interrupt and ignore the flag bits in the nonvolatile memory status registers.

The disadvantage of an integrated ECC solution is that programming single bits in the nonvolatile memory word is not possible without prior erase of this word. As programming without erase is sometimes used by implementations of EEPROM emulation or a monotonic counter, another algorithm must be selected for such applications on ECC enabled memories.

The flash memory controller of STM32H7 series implements also a hardware CRC integrity protection. The CRC is a complementary mechanism, not an ECC replacement. If the automated background CRC check is activated, the read access to the flash memory also implicitly checks the ECC in the whole range.

Cache is a memory that does not have its own address range. Its purpose is to reduce the latency of accessing the addressed memory by preserving a copy of frequently accessed contents (either code of data) or contents which are likely to be needed soon (current address+1 for example). Physically it is an SRAM with different addressing.

Only STM32H7 series have cache with ECC protection. By default, the Cortex®-M7 L1 cache is also protected by ECC by using the same SEC DED code. The word width is 256-bit as the entire line of cache is covered. The cache ECC protection can be disabled. To modify the state of the cache ECC, the code must first disable and flush the cache. Then the ECC settings can be modified and the cache re-enabled with new setting.

The ART accelerator cache that supports the Cortex®‑M4 core on dual-core STM32H7 series microcontrollers is not protected by ECC.

As there is no interrupt notification or interface to ECC detection results of the CPU cache, the only solution to detect the rare event of two-bit data cache ECC error is to monitor the IEBR and DEBR core registers. Refer to the document AN5342_General-information.html#id_9792__entry_wpb_xtz_gwb and the Arm® Cortex® technical documentation (TRM) for more details.

It is also necessary to flush or invalidate instruction cache after two-bit ECC error interrupt from instruction memory (by flash or SRAM). Otherwise, illegal opcode may remain in cache, leading to hard fault.

ECC testing does not verify that the STM32 MCU is functional. It is useful to test the application firmware reaction to ECC error occurrence, therefore there is a requirement to integrate ECC testing into different aspects of general software testing. The tests can include unitary tests of ECC subsystem functions, acceptance tests, or nonregression tests. The reaction to ECC detection or correction is important, for example, for certification on safety requirements compliance.

Testing the ECC in SRAM is relatively simple because reading uninitialized RAM on a cold boot is usually enough to trigger an ECC error and test the reaction. The effect is random, but it is easy to produce.

Sometimes, for example on the STM32H7 series, it is possible to disable the ECC, modify the memory contents, and then reenable the ECC, which becomes desynced with the data by this action. Subsequent read from that memory location encounters an ECC error.

Different methods can be used to test ECC, in addition to flash memory testing, as shown in Table 6 Methods for ECC testing in nonvolatile memory.