ECC covers the whole word. Updating one byte requires the unchanged bytes to participate in a new codeword.
A byte write to the running SRAM therefore enters a small read-modify-write transaction. Normal access and scrub arbitration reserve that address until corrected old data has been merged, encoded, and written back, preventing a stale scrub result from overwriting a newer functional write.
Read and decode the old protected word.
Stop if it is uncorrectable; use corrected data if correctable.
Merge selected bytes using write strobes.
Encode and write the complete new protected word.
This read-modify-write sequence needs arbitration against normal reads/writes and must be atomic for the selected address.
Read the flow from the top: the address stays reserved from the first box to the last, so no other write or scrub can slip in between.
Merge into the corrected word, not the raw one. A correctable error in an untouched byte is repaired by the same write.
Stop on UE. Merging into data that cannot be trusted would store bad bits under a fresh, valid codeword.
Scrub takes the same lock, so its rewrite of a stale value can never overwrite a newer byte write.
A scrubber walks memory, reads each word, rewrites corrected words, and reports UEs. Scrubbing reduces the window for accumulating faults; it cannot guarantee repair before a second upset. Worst-case revisit time needs a guaranteed service budget, including arbitration, correction writes and sleep.
Worked bound: 1024 words, single port, one cycle read plus one cycle rewrite reserved for every word, and arbitration guaranteeing those two slots within each 16 active cycles. At 100 MHz a sweep takes at most 1024 x 16 = 16384 active cycles = 163.84 us. If cumulative clock-off time between visits is bounded by 1 ms, maximum revisit including repair is 1.16384 ms. Unbounded functional starvation or sleep removes the finite bound. A pipelined decoder must fit the reserved slots or increase the budget.
Worked model, assuming independent (Poisson) upsets: assume total upset rate lambda=1e-6 per word-second, no correlated multi-bit upsets, perfect single-bit repair and initialized words. Given a first upset, probability of another before the next repair is at most 1-exp(-lambdaT), approximately 1.164e-9 at that revisit bound. A conservative whole-array pair-rate bound is 1024lambda^2*T = 1.192e-12 per second (about 4.29e-9 per hour). Compare this conditional model to an explicitly allocated residual-risk budget, for example 1e-8 per hour; it is not a device reliability claim. Real signoff needs characterized rates, correlated faults, permanent defects, decoder faults and actual service/sleep bounds.
Scrubber concern | Design response |
|---|---|
Functional traffic | Low-priority arbitration with bounded starvation |
Power | Programmable rate and sleep awareness |
Reset/init | Do not scrub until contents and check bits are valid |
Permanent fault | Escalate repeated-address corrections to repair/retirement |
The stored ECC describes the old complete data word. After any data bit changes, the check bits must be regenerated for the merged full word.
The sweep bound (1024 words at 100 MHz and 16 active cycles per word: 163.84 us, or 1.16384 ms with 1 ms of clock-off time) and the Poisson pair-rate figures are worked arithmetic, not measured results and not a device reliability claim.