DD290965A5 - PROCEDURE FOR MONITORING THE PROGRAM PROCEDURE IN COMPUTER ARCHITECTURES - Google Patents

Abstract

The invention relates to a method for monitoring the program sequence in computer architectures, in particular the orderly execution of subroutines * and is preferably used in microprocessor systems. It solves the problem to develop a method that allows the constant detection of errors in the execution of UP, which are based on the exchange of data between a processing unit and basement storage and / or lead to an extension of the program execution time. Prior to execution of a UP one of the maximum allowable processing time for the UP corresponding time constant is entered in a reserved time register and set a special computer status for time monitoring and the shifted by one clock signature of a used inverse switchable signature analyzer stored in the basement memory and at the same time to the signature after a first Imaging function shown. During the processing of the UP, the time register is set step by step against a limit value by means of specified processing time intervals, whereby an error handling is triggered when this limit value is reached. In addition, all data that is written in the cellar memory, at the same time after the first mapping function and all data that is read out of the cellar memory, simultaneously mapped to the signature after a second mapping function. After completion of the UP, the computer status for time monitoring is switched off, the signature is evaluated and, if a deviation from a set signature is detected, error handling is initiated. Finally, the signature initially stored in the cellar memory and shifted by one clock is read out of the cellar memory again. Microprocessor system; Processing unit; Stack; Subroutine; Opcode; Zeitueberwachung; Time constant; Time register; Signature analysis; Signature analyzer, inverse switchable}

Description

Field of application of the invention

The invention relates to a method for monitoring the program sequence in computer architectures, in particular the proper execution of subroutines, wherein error detection is initiated upon detection of a faulty program flow, and is preferably used in microprocessor systems.

Characteristic of the known state of the art

To increase the reliability of microprocessor systems, it is very important to diagnose errors quickly and safely.

It is generally known to use cyclically called / processed diagnostic programs. However, with this software solution, high-quality error detection is achieved only imperfectly and with considerable effort, so that it has become established to use additional hardware for this purpose (see Hedtke, R .: Microprocessor Systems - Reliability, Test Methods, Error Tolerance.) Berlin, Heidelberg, New York, Tokyo; Springer Verlag, 1984).

The well-known on-line method for detecting errors using additional hardware structures can be divided into three categories:

- Address check

- Time monitoring

- Monitoring the operation code.

The Address Validation method detects errors in microprocessor systems that may be accessing a non-existent one

or prohibited memory area, write accesses to read-only memory, unauthorized loosening of loops, and the like.

represent.

A method for monitoring program processing in microcomputers on the basis of address checking is described in DE-OS

2906117 disclosed.

Errors are detected that lead to the corruption of access addresses and / or erroneous jumps. By means of the address check only a limited number sn error possibilities can be recognized, the hardware cost

is relatively large.

In time monitoring, exceeding a processing time specified for a program part is considered an error

recognized. Procedures for time monitoring include i.a. in the DE-OS 2903638 and DD-WP 210775 set forth.

Hardware and software errors are detected in the monitored part of the program as additional loops or branches

appear that lead to a substantial time extension or to skip the end of the corresponding one

Program part lead. For error detection via the monitoring of the operation code several methods are known. In the simplest case, taking advantage of the fact that not all possibilities of the operation code meaningful Processor operations correspond to error handling upon the occurrence of such an inoperative opcode

triggered. Such a method is z. As described in DE-OS 2939194. In this case, the operation codes are compared with predefined setpoint values which are stored in a setpoint value memory.

The memory required for this is considerable. It can only detect errors in the translation and / or Storage of the operation code arise. In the EP-Anm. 104635, a method is set out in which the opcode and the one triggered by the opcode Control signal sequence are equally checked. For this purpose, the operation code in a known manner to its admissibility

examined and additionally formed on the triggered by him control signal sequence a signature. This signature is compared with a second signature generated for the corresponding instruction in the test circuit; in case of a deviation becomes a

Error handling triggered. With this method, in addition to the method already set forth, monitoring for permissible operation codes Hardware error detected in the flow control of the microprocessor system. In another method of monitoring the opcode, the opcode sequence is identified by signature analysis

(See Sridhar, T., Thatte, S .: Concurrent Checking of Program Flow in VLSI Processors, Proc. 12th ITC, IEEE; 1982;

In this case, a signature is formed within branch-free program parts on the sequence of Operstionscodes and with

a previously calculated target signature compared.

In a detected deviation of the actual signature of this target signature is in a known manner an error treatment

triggered.

It will be found next to errors in the operation code and errors in the program flow. Modern programming techniques prefer a pronounced and strict modularity. One of the principles of rigorous modularity is that during the execution of subprograms, the return address

as well as other data of the calling program unit are not changed.

The for the continuation of the program execution when calling subroutines or program interruptions by Interrupts or traps necessary data are generally stored in microprocessor systems in cellars

cached. These cellars are usually reserved parts of the main memory with the organization last-infirst-out (UFO), in which data from special registers of the processing unit are stored.

The illustrated known solutions for error detection in program processing in microprocessor systems allow

it is not or only very imperfectly, errors in the execution of subprograms in the form of distortions of for the

Program continuation necessary data, as they arise in the transmission or caching in the basement storage

, the unacceptable change in the return address of the calling program, errors in the form of an unequal number of read and write operations to the cellar memories, further errors which may cause an extension of the

Program execution time of subroutines, as well as general violations of rules modular Recognize programming. Object of the invention

The aim of the invention is to increase the security of a proper flow of extensive programs in computer architectures, especially in the execution of subroutines, without much additional hardware.

Explanation of 'Is essence of invention

The invention has for its object to develop a method for monitoring the program flow in computer architectures, which allows the continuous detection of errors in the execution of subroutines, which are based on the data exchange between a processing unit and basement stores and / or cause an extension of the program execution time ,

To solve the problem, a method for monitoring the program flow in computer architectures, in particular

the proper execution of subroutines, in which the exchange of data between

Processing units and "last-in-first-ouf-organized basement storage is monitored based on the signature analysis. According to the invention, before executing a subroutine, a maximum allowable processing time for the Subroutine corresponding time constant entered in a reserved time register and a special computer status for Time monitoring set. Likewise, before execution of the subroutine, the state (X] = [A] © [S] of a

used inverse switchable signature analyzer with a system matrix [A], which carries the signature [S], before the

Execution of the monitored subroutine any value [SIx owns, stored in the basement memory and

simultaneously mapped to the signature [S] after a first mapping function.

If these operations are carried out correctly, the signature [S] changes from any state into a defined one Target signature [S] o over. During execution of the subroutine, the time register becomes incremental by fixed process time intervals

set against a limit.

If the program execution is error-free, the subprogram is executed before the expiration of the maximum allowable processing time, ie. H.

before reaching the mentioned limit, finished.

If the time register is set to or above the limit value, error handling is initiated. Furthermore, during the execution of the subroutine, all data (X) k, that is the continuation of the Program and the data to be stored during the execution of the subroutine, which are now available in

the basement memory are written, at the same time after the first mapping function on the signature [S] mapped.

The signature [S] thus progresses step by step to states [SJk, which are always a function of all since the subprogram was called in Cellar storage written data (XJk are. All data | X | k read out from the cellar memory will be sent after a second one Mapping function on the signature [S] shown. The signature [S] gradually changes to the states [S] k - 1. This process continues until all the data [X] k except the stored value [X] = [A] © [S] x are read out. If all operations are carried out incorrectly, the signature [S] again assumes the value of the target signature (S] o. After completion of the subroutine, the computer status for time monitoring is switched off. In the following, the signature (S) is evaluated, in the case of an existing deviation from the defined target signature [S] o

initiated an error handling.

Finally, the value (X) is read out of the cellar storage, thus the initial level of the cellar storage is restored

reached.

In an embodiment of the invention, in particular to ensure the multivalent Nutzbai speed of Subroutines the time constant of a subroutine dimensioned so that the processing time internally '' if called Subprograms are not considered. Preferably, in an embodiment of the internal call of further subroutines, the current state of Sent time register of the calling subroutine in the basement storage. Now, in the called Subprogram The program sequence as monitored in the calling subroutine. With the return to the calling Subroutine, the value of the time register entered in the cellar memory before the subroutine call is read out and

the old state of the time register is set.

Conveniently, in a design variant, this is within the execution of a subroutine at Switching to a next cellar memory the signature analyzer state [X] = [A] © [S] is stored in the old cellar memory

and at the same time on the signature [S] after the first mapping function mapped.

If these operations were carried out without error, the signature [S] resumes the value of the target signature [S) o. Stack. After returning to the old cellar storage, the value [X] is read out of the cellar storage as well as after the

second mapping function to the signature (S) imaged, which returns to its original value before switching to another cellar memory.

The first mapping function is preferably with [S] k + 1 = [A] © [S] k © [X] k and the second mapping function with

[S] k - 1 = [A] exp - 1 © ([SJk © (X] k) (with k = number of since the last subroutine call or change of the

Basement store in the basement storage data). In a further embodiment of the invention is when calling subroutines without context between Program structure and program runtime the computer status for time monitoring switched off. Within the error handling is setting the target signature [S] o as well as defined program continuation conditions

advantageous.

Thus, after a detected error and error handling has not the execution of the entire program

be canceled.

The present invention provides a method for improved error detection in computer architectures. The techniques used ensure that errors in the execution of subprograms, which differs on the Map data exchange between the processing unit and basement stores, such. B. an unequal time of reading and Write operations to the cellar memories, the corruption of the data stored in the cellar memory, the

Inadmissible alteration of the return address of the calling program or a general violation of the rules of modular programming, taking into account one of the signature signature technique

Residual error probability can be detected with great certainty. In addition, all errors are detected, which are as Extension of the maximum processing time of the subroutine (s), such as. B. a crash of the program, Looping or skipping the return command, and can not be detected using the signature analysis. The necessary additional hardware expenditure for a realization of the method is small.

The invention will be explained in more detail below with reference to an embodiment.

The computer architecture to be monitored contains a processing folder and several cellar storages. The basement memories are configured as reserved areas of a main memory of computer architecture and UFO-organized (last-in-first-out). In the cellar memory data (X) k can be stored from special registers of the processing unit.

When subroutines are called, the return addresses and information required for program interruptions by interrupts or traps in order to continue program execution are buffered in the current cellar memory.

If data | X) k is written to a cellar memory, then it becomes a first mapping function at the same time

[S] k + 1 = [A] ® [S] k® [X] k IM

with [A] System matrix [S] Signature k Number of data stored since the last subroutine call or change of the cellar memory in the cellar memory

on the signature [S] of a working in normal operation inversely switchable,) signature analyzer. Data [X] k, which are again read from the cellar memory, nach.einer second mapping function

[S] k - 1 = [AIe] P - 1 ® ([SIkφ | X] k) / 2 /

mapped to the signature [S] of the inverse switched signature analyzer.

As an initial condition, the signature [S] has an arbitrary value [S] x.

Before the execution of a subroutine to be monitored in which there is a relationship between the program structure and the program runtime, a time constant which corresponds to the maximum permissible processing time for the subroutine is entered in a reserved time register. A special computer status for time monitoring is set.

Furthermore, before executing the subroutine to be monitored, the value (X) = [A] © [S] x is written to the cellar memory and simultaneously mapped to the signature [S] according to the mapping function / 1 / [S] from any state [S] x into the state [S] o = [0; 0; 0; ...; 0], the target signature.

Starting with the call of the subroutine, the time register is decremented stepwise by fixed process time intervals. The maximum permissible processing time of the subroutine ends before reaching the state [0] of the time register. In other words, if the program runs without errors, the subprogram is completed in advance. If the time register is decremented to [0], error handling is initiated within which defined program continuation conditions are set.

Furthermore, with the call of the subroutine, all the data [X) k with k = 1... I (such as, for example, continuation address of the calling program unit) required for the continuation of the program are entered into the cellar memory in one or more write operations and simultaneously after the Mapping function / 1 / shown on the signature [S]. Thus, the signature [S] is successively successively in response to the data stored in the cell memory [X] k from the state [S] o in the states [S] 1 ... [SJi on.

Within the subroutine, further data [X] k with k = ί + 1... + J are buffered in the cellar memory and at the same time mapped to the signature [S], which is transferred stepwise into the states [SJi + 1.. + j passes.

The signatui [S] is always a function of all data [X] 1 ... [X] i + j written into the cellar memory since the subprogram was called.

Before the internal call of a further subroutine, the current state of the time register of the calling subroutine is transferred to the cellar memory.

Thus, the processing times of internally called subroutines need not be taken into account in the time constant of the calling program unit.

If there is a relationship between the program structure and the runtime in the internally called subprogram, then the time constant of the subroutine to be called is written into the time register.

When calling subroutines in which this connection does not exist (eg dialog frame), the computer status for time monitoring is switched off and is only switched on again after these subroutines have been processed.

Furthermore, before changing to a new cellar memory, the value [X] '= (A) ® [SJi + j is written into the old cellar memory and simultaneously mapped to the signature [S] according to the mapping function / 1 /. S] again into the state [S) o = (0; 0; 0; ...; 0] via.

This means that with each change of the cellar memory the state [0; 0; 0; ...; 0]. A deviation from this state indicates an error in the program execution, to which an error handling is initiated, within which the signature [S] is set to the target signature [SIo.

Starting with the call of the new subprogram, the time register is decremented again in the manner described above and, upon reaching the register contents [0], responded with an error handling.

The writing of data in the new cellar storage now takes place in the manner already described.

The signature [S] is now a function of all data entered since the change of the cellar memory.

When reading out data [XIk from the new cellar memory, the last stored value (XJk is first read out and simultaneously mapped to the signature [S] of the inverse-operated signature analyzer according to the mapping function / 2 /.

The signature [S] resumes the state [SJk-1 before storing the value [XJk in the cellar memory and is only a function of the data stored in the cellar memory [X] 1 ... (X] k - 1.

In the following reading operation the value [XJk - 1 is read from the cellar memory, the signature [S] returns to the value (SJk - 2).

This process continues until all daies (XJk) written to the new cellar memory have been read out, and if all operations are performed correctly, the signature [S] returns to the state [S] o = [0; 0; 0; ...; If the data read out of the cellar memory [XIk does not agree with the written data [X] k in reverse order, ie during subroutine processing, data in the new cellar memory has changed or the number of read operations is different from the number of write operations, Thus, the signature (SJ when switching back to the old cellar memory from the state [SIo = [0; 0; O ;;;; 0]) differs with a residual error probability inherent in the signature analysis

P, = 2 "'with r ... number of bit positions of the signature.

The signature [S] is evaluated; in case of deviation from the error-free program execution decoding state [S] o = [0; 0; 0; ...; 0] an error handling is initiated. Within the error handling, the signature [S] is changed to the state [0; 0; 0; ...; 0] is set and defined program continuation conditions are set.

Thus, after detecting an error with the switch back to the old cellar memory a proper program continuation is possible.

With the return to the previous cellar memory, the value (X) '= [A] © [S] i + j last entered before the changeover switch to a new cellar memory is read out of the old cellar memory and used to recover the initial state of the signature analyzer to the signature [S The signature [S] resumes the value before switching to another cellar memory.

With the return to the calling subroutine, the value of the time register entered in the cellar memory before the subprogram call is read out and from this the old value of the time register is set again.

As the program progresses, the time register is again decremented as already performed.

The reading out of data from the old cellar memory now takes place in the manner already described until all the data [X] k written into the subroutine and when the subroutine is called up in the cellar memory are read out.

If all operations are executed incorrectly, * I again set the state [S] o = [0; 0; 0; ...; 0) a.

After completion of the subroutine, the computer status for time monitoring is switched off.

Furthermore, the signature [S] is evaluated and in case of deviation from the state [S] o = [0; 0; 0; ...; 0] initiated an error handling, within which the state [S] o = [0; 0; 0; ...; 0] and defined program continuation conditions are set.

Finally, to recover the initial level of the cellar memory, the value [X] = [A] © [SIx is read from the memory of the motor vehicle and mapped to the signature [S] to recover the initial state of the signature analyzer. Thus, the signature [S] resumes the output value.

Listing of the symbols used for the patent application "Method for monitoring the program flow in computer architectures"

[A] System matrix of the signature analyzer

[S] Signature of the signature analyzer

[X] data

(Index) k Number of since the last subprogram call or change of the cellar memory

stored in the basement storage data

(Index) i Number of stored data required to continue the program

(Index) j Number of data stored within the execution of the subroutine

0 modulo-2 multiplication

© Modulo-2 addition

Claims (8)

1. A method for monitoring the program flow in computer architectures, in particular the proper execution of subroutines, on the monitoring of the data exchange between processing unit and "last-in-first-ouf'-organized cellar memories based on the signature analysis, characterized in that prior to execution of a subroutine a time constant corresponding to a maximum permissible processing time for the subroutine is entered in a reserved time register and a special computer status for time monitoring is set, that before execution of the subroutine the state [X] = [A] © [S] of an inserted inverse switchable signature analyzer with a System matrix [A], which leads to a signature [S], stored in the cellar memory and simultaneously mapped to the signature [S] after a first mapping function, that during the execution of the subroutine, the time register by fixed Prozeßzeiti ntervalle is incrementally set against a limit value, whereby, when this limit value is reached, error handling is triggered so that, during the execution of the subroutine, all data [X] k written to the cellar memory is sent simultaneously to the first mapping function and all data [X] k, which are again read out of the cellar memory, are simultaneously mapped onto the signature [S] after a second mapping function, that after completion of the subprogram the computer status for time monitoring is switched off, the signature [S] is evaluated and if a deviation from a target signature [S] is detected. o an error treatment is initiated and that finally the value [X] is read from the cellar memory. 2. Verfahrer, according to claim 1, characterized in that the processing time internally called subroutines is not taken into account in the time constant. 3. The method according to claim 2, characterized in that when internal call other subroutines, the state of the time register is outsourced to the basement memory, that in the new subroutine monitoring of the program sequence as in the calling subroutine is performed and that with the return to the calling program unit of the old State of the time register is set again. 4. The method according to claim 3, characterized in that when switching to a new cellar memory of the signature analyzer state [X] = [A] © [S] stored in the old cellar memory and is simultaneously mapped to the signature [S] after the first mapping function and that after returning to the old cellar memory, the value [X] is read out of the cellar memory and simultaneously mapped to the signature [S] after the second mapping function. 5. The method according to any one of the preceding claims, characterized in that the first mapping function with [S] k + 1 = [A] © [S] k © [X] k and the second mapping function with [S] k - 1 = [ A] exp - 1 © ([S] k © [X] k) (mitk = number of data stored since the last subroutine call or change of the cellar memory in the cellar memory). 6. The method according to any one of the preceding claims, characterized in that is switched off when calling subroutines without a link between the program structure and program runtime, the computer status for time monitoring. 7. The method according to any one of the preceding claims, characterized in that within the error treatment, the target signature [S] o is set. 8. The method according to any one of the preceding claims, characterized in that within the error treatment defined program continuation conditions are set.