DD241802A1 - CIRCUIT ARRANGEMENT FOR MONITORING THE WORK OF A MICRO-COMPUTER - Google Patents

Abstract

The circuit arrangement for monitoring the operation of a microcomputer can be used in BMSR systems and prevents the occurrence of systematic and stochastic disturbances accidents or false readings by an error signal is output, an error handling program is initiated or a shutdown occurs. In the solution according to the invention, the addressed memory area is decoded by an address decoder and it is determined in an assignment circuit which operations are prohibited or meaningless in the respective memory area. A subsequent authorization circuit monitors the use of the information about the memory operation to be performed, compliance with the valid for addressed memory areas operation bans, z. Writing to ROM, reading RAM from RAM, or addressing physically non-existent memory. If a forbidden operation is to be carried out, error signaling takes place. Fig. 1

Description

For this 5 pages drawings

Field of application of the invention

The invention relates generally to devices and systems that are controlled by microcomputers or in which a microcomputer is integrated as a controlling body and in which by faulty circuits, made by the microcomputer and caused by errors in the program processing of the same, damage to the system or on the Device or connected equipment or devices may arise or pointless or incorrect information can be given to the operator.

Characteristic of the known technical solutions

For precise monitoring of the operation of a processor multicomputer systems are generally used. This means increased, for many applications unjustifiable hardware effort. Simpler monitoring arrangements provide for an interaction of software and additional hardware.

There is a difference between the occurrence of systematic disturbances (failure of a processor part) and stochastic disturbances (one-time error, eg of one bit).

From DE-OS 2946081 and DD-WP 210775 it is known that monitoring of the work of the processor by defined, provided in the program transmission of control pulses by the processor to a counting and monitoring circuit can take place, and a failure of the pulses causes the monitoring circuit To initiate measures for the synchronization of the program. According to DD-WP 210775 then takes place a response to a systematic disorder such that when such a disorder occurs, a continuous signal is emitted, which can be used to shut down the system. The implementation requires exact knowledge of the program cycle times, which causes restrictions in the programming, and requires relatively complex and even error sources performing counting and combination circuits. In DE-OS 29 39194 a monitoring possibility is described, in which a command decoder circuit detects and stores the respective current subprogram level. If the processor jumps due to a fault in a program section of another Üntergrgrammebene, so this is noticed at the end of the subroutine and the also elaborate monitoring circuit signals the error. In EP 0015445 a software solution for processor-controlled device systems is proposed which is based on the use of control and Prüfcodefplgen. For each control command sequence, a control sequence is generated and compared with a pattern. If the comparison is negative, this is a criterion that the instruction sequence was faulty. However, this method requires that the software processing be done substantially free of errors. .

The disadvantages of the above-mentioned methods are that they place special restrictive demands on the software or that expensive additional hardware is required, which itself can become the source of error.

Object of the invention

The object of the invention is to increase, with simple objective means, the safety of the operation of processor-controlled devices and systems and to reduce the possibility of dangerous switching operations and pointless or false displays.

Explanation of the essence of the invention

Based on the above object, the object is to propose a circuit arrangement for monitoring the work of microcomputers, which triggers an error signal when non-programmed commands that result from sudden stochastic or systematic errors occur. In the inventive solution of the object of the problem it is assumed that the addressable memory of a microcomputer is divided into individual areas, in which not all possible memory operations are equally allowed. Thus areas are conceivable in which write operations are forbidden, or areas in which command read operations are forbidden, or areas which generally can not be addressed (as an example: physically non-existent memory).

According to the invention, compliance with these prohibitions on operation in defined memory areas is monitored with a simple circuit, and if these prohibitions are violated, corrective measures are initiated. According to the characterizing parts of the invention claim and its sub-items, the circuit arrangement provides an address decoder which assigns the memory address lying on the address bus to a memory segment. It is impractical to decode the address completely. Decoding to segments of 1 kbyte is sufficient. A storage area allocation circuit determines, with the aid of the memory segment allocation information previously input thereto, to which storage area, characterized by one or more prohibited storage operations, the memory segment addressed by the applied address. A subsequent permission circuit monitors, using the information about the memory operation to be performed, compliance with the operation prohibitions valid for addressed memory segments and, if not complied with, outputs a signal at the output.

embodiments

The addressable memory of a microcomputer can be divided into five areas of different purpose:

B1 area in which the operating software is stored

B2 area for temporary storage or storage of variants _T

B3 area for storing constants

B4 area for special functions (image refresh memory, coupling segments in multi-computer systems and similar) B5-physically non-existent memory.

For each of these five areas, only special storage operations are allowed:

Write operations are prohibited in areas B1 and B3, commands may not be read from areas B 2 and B4, and area B5 may not be addressed.

A simplification of this division is possible, it is assumed that the memory areas B1 and B3 are usually realized by ROM and the areas B2 and B4 by RAM.

If an error occurs in the program execution due to a systematic or stochastic disturbance in such a way that the program and the instruction counter status no longer correspond to each other, then the program is interpreted differently. There is the possibility that one of the said Fehloperationen should be performed. The likelihood of this increases as the amount of physically realized memory decreases because of the likelihood of addressing non-existent memory, as well as the likelihood of performing forbidden operation of type "write in constant or program memory" or "read command from variable memory".

Thus, there is the possibility to signal such an irregular state of the processor by a monitoring circuit, which appropriately associates the address signals with the control signals for memory request, command and memory write, and thus trigger operations that the processor into an error handling program or into a defined initial state. An indication of the fault can be effected or the device or system can be switched off.

A corresponding monitoring circuit for the five memory areas B1 to B5 and the control signals "Read Command" - M1, "Memory Operation" - MREQ and "Write Memory" -WR must send out a signal E (Error) if Equation (I) - is satisfied ,

E = M1 (b2 + b4) + MREQ- WR (b1 + b3) + MREQ- b5 (I)

E = K + L + M (II)

The term K generates an error signal E when the processor executes an instruction read operation in the variable memory, the term L provides an error signal E when a write operation is in program or constant memory, and term M asserts an error signal E when a memory that is physically non-existent is addressed ,

The operation of the corresponding circuit arrangement will be explained with reference to FIGS. 1 and 2.

The address decoder 1 determines from the applied address Am ... to the addressed memory segment S1 .. .SK and forwards these signals to the assignment circuit 2. Based on the memory segment assignment, represented by switches in the exemplary embodiment, the affiliation of the addressed by the address Speichersegementes to one of the areas B1 to B 5 is fixed. Finally, the permission circuit 3 supplies the terms K by combining the memory area signals b1 to b5 with the signals "memory operation" MREQ, "memory write" WR and "read command M1"; L; M of equation (II). Over a

OR connection finally takes place the formation of the error signal E at the output 4. The entire circuit arrangement requires for their realization in the simplest form only combinatorial elements. The memory segment assignment 2 is statically appropriate to relieve. The address decoder 1 can be adapted by increasing or disarming the existing addressing space and according to the desired smallest segmentation, the number of address line to be evaluated is to be selected.

Another embodiment according to FIG. 3 makes use of the simplification that program and constant memory have been realized as ROM and variable and special function memory as RAM. Using the configuration of a widely used microcomputer, contiguous RAM and ROM areas can be located in the address space. With a 1 kbyte segmentation and an address of 16 bits, the address decoder uses 5 address bits A10 to A15. The Speicherbereic hszuordnun g takes place (in the address decoder 5) by winding bridges. Signals are available for the memory areas ROM, RAM and ROM · RAM. The permission circuit 6, which corresponds to that of Fig. 2, generates a non-markable interrupt signal NMI and is the

Equation (III)

NM = RAM · M1 + ROM · MREQ · WR + ROM RAM · MREQ (III)

adequately .; the NMI signal initiates the transition to an error handling routine.

In the exemplary embodiment according to FIG. 4, the address decoder and memory segment allocator 7 is a programmable read-only memory (PROM) which contains the assignment address-memory segment-memory area in the form of a table.

Due to the segment size, the number of address bits to be evaluated is fixed. The signals for the areas B1 to B 5 are included uncoded in the stored table. The permission circuit 8 corresponds to that of FIG. 2.

In the embodiment of FIG. 5, the output of the permission circuit 9 corresponding to the permission circuit of FIG. 2 is connected to a presettable counter 10. After a predetermined number of error signals, the counter device triggers a shutdown of the system.

In the embodiment of FIG. 6, the permission circuit 11 has two outputs 12,13, which emit a signal depending on the addressed memory areas. Depending on the error that has occurred, this can trigger a RESET or NMI signal. The assignment of the memory areas to the outputs can be selected.

Claims (5)

Invention claim: 1. Circuitry for monitoring the work of a microcomputer and for triggering an error signal when non-programmed commands occur due to sudden stochastic or systematic errors' and thereby cause in the periphery malfunction, characterized in that an address decoder (1) with its inputs to the address bus is connected, which assigns the applied address to a memory segment of fixed size and outputs on each, the memory segment associated output a logic level, which switched to a memory segment allocation circuit (2) and with previously entered information for the assignment of the segments to defined memory areas (B 1 ... B5), wherein the memory area signals (b1 ... b5) obtained in a permission circuit (3) are preferably linked to the signals M 1, WR, MREQ or their negations in such a way that at the output of the permission circuit ( 3) an F error signal (E) is removable if the processor addresses physically non-existent memory, executes write operations in the program or constant memory, or reads commands from the variable or special purpose memory. 2. Circuit arrangement according to item 1, characterized in that the address decoder (5) with the Memory segment allocation circuit (2) is combined and has three outputs signaling the addressing of ROM, RAM and physically unoccupied memory and their permission circuit (6) has an output at which in the prohibited memory operations "Write in ROM", "read command in RAM "," addressing physically non-existent memory "a non-maskable interrupt signal (NMI) or whose negation is removable. 3. Circuit arrangement according to item 1 and 2, characterized in that the address decoder combined with the memory segment allocation circuit and as PROM, EPROM or EEPROM, which contains the memory segment allocation as a table, is realized. 4. Circuit arrangement according to item 1,2 and 3, characterized in that the output of the permission circuit (9) is connected to the input of a counting circuit (10). 5. Circuit arrangement according to items 1, 2 and 3, characterized in that the permission circuit (11) has two outputs (12) and (13) whose assignment for addressing the memory areas B1 to B5 can be selected.