Event ID 12 Microsoft-Windows-HAL

  • Article

Applies to

Windows Server 2008 R2, Windows 7  

Details

Product

Windows Operating System

ID

12

Source

Microsoft-Windows-HAL

Version

6.1

Message

The platform firmware has corrupted memory across the previous system power transition. Please check for updated firmware for your system

Cause

This event is reported after detection of memory corruption by firmware after a power transition or sleep event.

Windows 7 and Windows Server 2008 R2 automatically checksum the contents of the lowest 1 MB of physical memory before and after a sleep transition. This checksum process enables Windows to detect memory corruption and report any corruption as an error in the system event log.

If memory corruption occurs in the lowest 1 MB of physical memory during a sleep transition, the hardware application layer (HAL) logs event ID 12 in the Event Viewer.

The HAL logs the event after each sleep transition in which it detects memory corruption. The event data includes the number of physical memory pages corrupted, the first physical page of corrupted memory, and the last physical page of corrupted memory.

User Action

  • Contact your hardware vendor to obtain the updated firmware and BIOS to address the issue.
  • System manufacturers should cycle all new Windows-based platforms through sleep transitions and check for the HAL event. If the HAL detects and logs the event, engage the firmware developer to resolve the issue.
  • Firmware developers can use the event details, including the number of corrupted pages and the first corrupted page, to determine the exact code defect that caused the memory corruption.

Firmware Corruption of Memory During Sleep Transitions

http://download.microsoft.com/download/7/E/7/7E7662CF-CBEA-470B-A97E-CE7CE0D98DC2/mem-corrupt.docx

How to troubleshoot Event ID 12 with source Microsoft-Windows-HAL

http://support.microsoft.com/kb/2028443