Revision(s) Affected:

AWR2544

Description:

In the uncommon occurrences of single bit upset events on below tabulated memory ranges in the SoC, under a specific memory access sequence combination, the single bit error correction mechanism can cause an incorrect memory update.

The RAM memories on AWR294x are ECC protected with a Single bit Error Correction, Double bit Error Detection (SECDED) mechanism. On the occurrence of a specific sequence of events, the single bit error correction mechanism can cause an incorrect memory update.

For the issue to cause an impact to the application, all the below conditions must satisfy

• Random hardware faults, due to environmental conditions or other factors, leading to a single bit upset events occur, AND
• The Single bit upset event affects the impacted memory ranges, AND
• A read or partial-write access to the memory location with single bit error occurs (leading to the single bit error correction mechanism kicking in), AND
• A specific memory access sequence combination occurs after the single bit error correction happens, AND
• The incorrect memory update by the error correction mechanism is critical enough to impact the application program flow and is undetected by other safety mechanisms.

The following access combination (Conditions 3 and 4 above) to the impacted memory range after the single bit error correction happens can cause the issue.

• Read / Partial write access (from/to the location A with SEC) → (Followed by) Full write (to one or more memory locations in the same memory range) → (Followed by) Partial write (to any other location in the same memory range) : leads to incorrect update to last full-write location.
• Partial write access (to the location A with SEC) → (Followed by) Partial write (to any other location in the same memory range) : leads to incorrect update to location A.

Workaround(s):

The single bit upset events are uncommon with lower probability of occurrence.

• The scenario must lead to single bit errors alone. Double bit errors are only detected and on double bit errors, depending on the criticality, the device is taken to safe state.

Partial write memory accesses (needed to cause the issue) are limited as

• Cached memory ranges do not lead to partial write accesses as cache lines writes are always full writes.
  • Ex., MSS L2 memories
• Code sections are read only (hence the entire code section accesses do not satisfy the conditions to cause the issue).
  • Ex., MSS L2 memories
• Impacted memories with partial write accesses can have other safety mechanisms that can detect or avoid such random errors.
  • Higher level processing algorithms of Radar data cube have built in outlier rejection capabilities due to tracking functions (temporal and logical monitoring).
    • Ex., DSS L3
  • Information redundancy techniques may be used on impact memories like Mailbox to detect errors.
    • Ex., Mailbox memories

In the impacted memory ranges, identify if there are possibilities of partial memory write accesses. Decide on the criticality for the need to take cation on such identified memory ranges with partial writes. Following are the possible courses of actions:

• If single bit upset events are unlikely in the operating environment.
• If there are other safety mechanisms that can detect or avoid such spurious random errors.

• Action: One or more of the following options can be considered
  • Avoid the partial write access pattern to those memory ranges.
  • Re-initialise the impacted memory bank on single bit memory correction event.
  • Treat the single bit memory correction event as an un-correctable error and enter safe state.
    • This does not impact the Functional safety detectability claims and may impact the availability in the event of such single bit upset occurrence.

Refer below table for memory range and its corresponding ESM line & ECC aggregator bit if action (2-b-ii) needs to be taken.

This table includes only impacted memory list and corresponding details regarding

Other memories that are not utilized by the application but used by the BSS, such as BSS_Mailbox and BSS_Static_RAM, are also affected by this errata

• The BSS mailbox is primarily used for communication between the BSS and MSS/DSS using mmWaveLink, following a message protocol that incorporates CRC for data integrity. Using CRC during message exchanges over the BSS mailbox reduces the risk associated with this memory.
• When a fault occurs (in this case, an ECC SEC), BSS sends an ESM Fault Asynchronous event message to the MSS/DSS as a notification. The application must read the b20:ECC_AGG_SEC_ERROR from AWR_AE_RF_ADV_ESMFAULT_STATUS_SB async-event from the BSS. Treat this single-bit memory correction event as an uncorrectable error and enter to a safe state.
  • This workaround is only valid if the application uses BSS Patch from DFP version 2.4.14 or earlier