DD290967A5 - CIRCUIT ARRANGEMENT FOR MONITORING THE PROCESSING OF SUB-PROGRAMS IN COMPUTER ARCHITECTURES - Google Patents

Abstract

The invention relates to a circuit arrangement for monitoring the execution of subroutines in computer architectures and is preferably used in microprocessor systems. It solves the problem to develop a circuit arrangement for monitoring the execution of subroutines that allows the detection of errors in the program flow, which are based on the data exchange between a processing unit and basement stores, with little additional Necessary effort in hardware structures. The computer architecture used contains at least one processing unit and one memory. Their components are connected via a bus system consisting of control, address and data bus. At an output of the circuit arrangement, a signal for initiating an error treatment is generated. According to the invention, the address and control buses are placed on respective inputs of a control decoder, the outputs of which are switched to mode control inputs of an inverse switchable and a signature & S! leading signature analyzer are placed. The data inputs of the signature analyzer are connected to the data bus. He is provided with i Ausgaengen, which shifted the clock shifted by a signature & A! & S! lead and put back on the data bus, as well as j outputs that the signature & S! lead and connected to the inputs of another decoder. The output of this decoder is connected to an input of a gate circuit, the output of which represents the signal leading to the initiation of an error treatment output of the circuit arrangement. Fig. 1 {computer architecture; Microprocessor system; Processing unit; Stack; Subroutine; Signature analyzer, inversely switchable; decoder; Error handling}

Description

For this 4 pages drawings

Field of application of the invention

The invention relates to a circuit arrangement for monitoring the execution of subroutines in computer architectures, wherein error detection is initiated upon detection of a faulty program flow, and is preferably used in microprocessor systems.

Characteristic of the known state of the art To increase the reliability of microprocessor systems, it is very important to quickly and accurately detect errors that occur

safe to diagnose.

It is generally known to use cyclically called / processed diagnostic programs. With this Software solution will be a high quality error detection, however, only very imperfect and with considerable Effort reached, so that has prevailed to use for additional hardware (see Hedtke, R .: Microprocessor systems reliability, test procedures, fault tolerance. Berlin, Heidelberg, New York, Tokyo; Springer Verlag; The known on-line solutions for the detection of errors by means of additional hardware structures can be divided into three Classify categories:

- Circuitry for address verification

- Circuitry for time monitoring

- Circuitry for monitoring the operation code.

Address checking circuitry enables errors in microprocessor systems to be identified as access

to a non-existent or forbidden memory area, write access to read-only memory, unauthorized

Leaving loops u. ä. represent. A circuit for monitoring the program execution in microcomputers on the basis of address checking is in the DE-OS 2906117 disclosed. Errors are detected that lead to the corruption of access addresses and / or erroneous jumps. By means of the address check, only a limited number of error possibilities can be detected, the hardware expenditure

is relatively large.

Circuit arrangements for time monitoring detect the exceeding of a predetermined for a program part Processing time as error. Such circuits are i.a. described in DE-OS 2903630 and DD-WP 210775. Hardware and software errors are detected, those in the monitored program part as additional loops or branches

appear that lead to a substantial time extension or to skip the end of the corresponding one

Program part lead. For error detection on the monitoring of the operation code several basic solutions are known. In the simplest case, taking advantage of the fact that not all possibilities of the operation code meaningful Processor operations correspond to error handling upon the occurrence of such an inoperative opcode

triggered. Such a circuit is z. B. set out in DE-OS 2939194. In this case, the operation codes are compared with predefined setpoint values which are stored in a setpoint value memory.

The memory required for this is considerable. It can only detect errors in the translation and / or Storage of the operation code arise. In the EP-Anm. 104635 describes a circuit in which the opcode and the one triggered by the opcode Control signal sequence are equally checked. For this purpose, the operation code in a known manner to its admissibility

In addition, the control signal sequence triggered by it is written to a signature analyzer and formed via a signature. This signature is generated with a second one generated for the corresponding instruction in the test circuit

Signature compared; if there is a deviation, an error signal is generated which triggers error handling. With this circuit, in addition to the circuit arrangement already described for monitoring on permissible Operation Codes Hardware errors detected in the microprocessor system flow. In another circuit for monitoring the operation code, the operation code sequence is determined by means of a Signature Analyzer (see Sridhar, T., Thatte, S .: Concurrent Checking of Program Flow in VLSI Processors, Proc.

12th ITC.IEEE; 1982; pp. 191-199).

In this case, a signature is formed within branch-free program parts on the sequence of opcodes and with

a previously calculated target signature compared.

In a detected deviation of the actual signature of this target signature is in a known manner an error treatment

triggered.

In addition to errors, the operation code also detects errors in the program flow. Modern programming techniques prefer a pronounced and strict modularity. One of the principles of rigorous modularity is that during the execution of subprograms, the return address

as well as other data of the calling program unit are not changed.

The for the continuation of the program execution when calling subroutines or program interruptions by Interrupts or traps necessary data have been stored in microprocessor systems generally in basement stores

cached. These basement memories are usually reserved parts of the main memory with the organization load-in-first-out (LIFO), in which data is stored from special registers of the processing unit.

The illustrated known solutions for error detection in program processing in microprocessor systems allow

it is not, falsifications of the data necessary for the continuation of the program, as in the transmission or

Caching may occur in the basement storage, the unacceptable change in the return address of the calling Program, errors in the form of an unequal number of read and write operations to the cellars and general To recognize violations of the rules of modular programming. There is no circuit arrangement for high-quality monitoring of the execution of subroutines

low additionally required hardware costs known.

Object of the invention

The aim of the invention is to increase the security of a proper flow of extensive programs in computer architectures, especially in the execution of subroutines, without much additional hardware.

Explanation of the essence of the invention The invention is based on the object, a circuit arrangement for monitoring the execution of Subroutines in computer architectures to develop, which are the constant detection of errors in the program flow, which

can be modeled on the data exchange between a processing unit and basement stores, with a small additional expenditure on hardware structures.

To solve the problem, a circuit arrangement for monitoring the execution of subroutines in Calculate. Architectures whose components are connected via a bus system of control, address and data bus and the

comprising at least one processing unit and a memory, provided with an output leading to an error-handling signal.

According to the address and the control bus are guided to associated inputs of a Steuerdekoders. The outputs of the Control decoders are placed on mode control inputs of an inverse switchable signature analyzer. This one leads Signature [S] and is provided in the further with several data inputs, which are connected to the data bus. He owns i Outputs containing the signature shifted by one cycle [A) 0 [S] (with [A] ... system matrix and [S] ... signature of the Signature analyzer), d. H. the subsequent state, lead and put back on the data bus, and j outputs that the Signature [S] and are connected to the associated inputs of a second decoder. This one decodes one

error-free program execution corresponding state of the signature analyzer. An output of the second decoder is connected to an input of a gate circuit whose output represents the output of the circuit leading to the error-handling signal.

In a preferred embodiment of the invention, the control decoder with an additional, a test signal leading output

provided, wplüh · - - "lit another input of the gate circuit is connected.

In a further embodiment variant of the invention, the output of the circuit arrangement is at an interrupt input

the processing unit laid.

The control decoder decodes computer operations into the modes / 1 / Write basement memory 121 Read basement memory

/ 3 / Output of the subsequent state [A] ® [S] of the signature analyzer to the data bus / 4 / Evaluation of the signature [S] of the signature analyzer

 In the four modes, the signature analyzer operates as follows

/ 1 / Normal mode: advance one bar 121 Inverse mode: switch back one bar

/ 3 / Release of the outputs for the subsequent status of the signature [A] © [S] / 4 / Saving the signature [S].

Prior to execution of a subroutine to be monitored, the signature analyzer is enabled by recognizing an agreed operation via the control decoder so that the subsequent state of the signature [A] © [S] passes from the i outputs to the data bus. This is either cached in the computer and transferred in the following operation cycle or immediately in the basement storage. At the same time, the subsequent state of the signature analyzer [A] © [S] is applied to the data inputs of the signature analyzer and is mapped to the signature [S]. If these operations are carried out correctly, the signature [S] changes to a defined target state.

All data, which are now written in the cellar memory, form analogously to the signature [S]. All data that is read out of the cellar memory again are displayed in inverse mode on the signature [S]. If all the stored data have been read from the cellar memory again and mapped to the inverse switched signature analyzer, then the signature [S] again has the desired state if the subprogram runs without error.

To evaluate the state of the signature analyzer, the test signal is generated in the control decoder, which test signal is transmitted to the gate circuit and releases it. A faulty state of the signature analyzer, d. H. a deviation of the signature [S] from the defined target state is detected by the second decoder and an error signal is formed. This passes through the enabled gate to the output of the circuit, is applied to an interrupt input of the processing unit and triggers a Fehlerbehandlung'aus.

The present invention provides a circuit arrangement for improved error detection in computer architectures. The proposed solution ensures that errors in the execution of subroutines, which are based on the data exchange between the processing unit and basement stores, such. B. an unequal number of read and Schroiboperationen to the cellar memories, the distortion of the cached memory in the cell memory, the impermissible change in the return address of the calling program or a general violation of the rules of modular programming, taking into account one of the technique of signature analysis inherent residual error probability of

P, = 2 "'with r ... number of bit positions of the signature

be recognized with great certainty.

The necessary additional hardware effort for a technical realization of the circuit arrangement is low.

Additional memory requirements, for example for reference patterns of the target signatures, do not arise.

embodiment

The invention is explained below with reference to an embodiment and four drawings. Show

Fig. 1: a schematic diagram of the inventive circuit arrangement

Fig. 2: the configuration of a control decoder for a standard microprocessor

3a shows the configuration of an inversely switchable signature analyzer in normal operation

Fig. 3b: this is the truth table of a data transfer to the signature analyzer

Fig. 3c: the configuration of an inverse switchable signature analyzer in inverse operation

Fig. 3d: this is the truth table of a data transfer to the signature analyzer.

As shown in FIG. 1, the computer architecture to be monitored is configured from a processing unit CPU and a memory RAM. The components of the computer architecture are connected via a bus system consisting of control structures SB, address bus AB and data bus DB.

The computer architecture can - without affecting the solution according to the invention - other modules, eg. B. for input and output included.

Connected to the bus system is the monitoring circuit MON according to the invention, which is provided with an output AF which carries a signal F for initiating error handling and is connected to an interrupt input INT of the processing unit CPU.

The monitoring circuit MON is configured of a control decoder 1, an inverse switchable signature analyzer 2, a decoder 3 and a gate circuit 4.

The control decoder 1 is connected with its inputs to the control SB and address bus AB and decodes the computer operations in the modes

/ 1 / write cellar memory

121 Read the cellar storage

/ 3 / Output of the next state of the signature analyzer 2

[A] © [S] (with [A] ... system matrix [S] ... signature)

on the data bus DB / 4 / evaluation of the signature [S]

The realization of the decoding of the control and address signals for the said operations depends on the one used Processor and will be explained in more detail below with reference to FIG. 2. In the simplest case, the output of the state [A] © [S] is done by a read operation on eir.ir for the signature analyzer 2

reserved address and the evaluation of the signature [S] by a write operation on this address.

The control decoder 1 is further provided with a plurality of mode control outputs and an output leading a test signal TEST

Provided. The mode control outputs are related to the mode control inputs of the signature analyzer 2 assigned to them; the

Test signal TEST led to an input of the gate circuit 4. The signature analyzer 2 also has data inputs Xx and i high-impedance switchable data outputs ASx ', which the order

a clock shifted signature, d. H. the following state [A] [S] connected to the data bus DB, and j

Datenaüsgänge ASx, which carry the signature [S] and are placed on associated inputs of the decoder 3. The signature analyzer 2 operates in the four modes as follows: In normal mode: advance one bar

111 Inverse mode: switch back one bar

/ 3 / Release of the outputs ASx 'for the state of the signature [A] ® [S] / 4 / Saving the signature [S].

The decoder 3 decodes the state of the signature analyzer that corresponds to error-free program execution

[0; 0; 0; ...; 0). It has an output which is guided on a second input of the gate circuit 4.

The gate circuit 4 is in the event of an error, the error signal F to the output AF of the monitoring circuit MON, if by

the test signal TEST has been released.

Before execution of a subroutine to be monitored, reading is performed on one for the monitoring circuit MON reserved memory or ΙΟ address or a special control signal coding via the control decoder 1, the outputs ASx 'of the signature analyzer 2 is enabled, so that the subsequent state of the signature [A] ® [S] from the outputs ASx' on the Data bus DB arrives. This is either cached in the computer and in the following operation cycle or

Immediately transferred to the cellar storage. Simultaneously with the storage in the cellar memory is the successor state of the signature [A] ® [S] to the data inputs Xx of the signature analyzer 2 and is mapped in the normal mode to the signature [S]. Without error-free execution of these operations, the signature [S] goes into a defined nominal state [0; 0; 0; ...; 0] about.

All data, which are now written in the cellar memory, form analogously to the signature [S]. All data that is read out of the cellar memory, as well as via the data bus DB to the Data inputs Xx of the signature analyzer 2 and are mapped to the signature [S] in inverse mode. Were all stored data again read from the cellar memory and mapped to the signature analyzer 2, so

if the signature [S] is correct, the subroutine again has the setpoint state [0; 0; 0; ...; O].

To evaluate the state of the signature analyzer 2 is now triggered by z. B. the decoding of the command sequence RETURN, arbitrary other commands or by reading on a reserved memory or ΙΟ address, in the control decoder 1

generates the test signal TEST to enable the gate 4.

A deviation of the signature [S] from the selected target state [0; 0; 0; ...; 0] is decoded by the decoder 3 and causes about

the enabled gate circuit 4, that at the output AF of the monitoring circuit MON a Fehlerigna F is active. The

Error signal F triggers an error handling via an interrupt input INT of the processing unit CPU. FIG. 2 shows the configuration of the control decoder 1 for the standard microprocessor U 8000. The U 8000 has special status outputs, with the help of which cellar memory, data and command accesses

and a multiplexed address and data bus ADB (see Brennenstuhl: Programming of the 16-bit microprocessor system U 8000). VEB Verlag Technik Berlin; 1987).

For the computer mode 131 , a write operation at the save address YY and for the mode / 4 / a Memory read operation on the adapters YY used. The control decoder 1 is on the input side with the lines of the control bus SB Address strobe / AS Data Strobe / DS Memory request / MREQ Read / write selection READ- / WRITE Status coding STO ... ST3 connected.

The control decoder 1 has three mode control outputs, which are used to control the signature analyzer 2 with the functions OE enable the outputs ASx 'of the signature analyzer. 2

/ NORMAL-INVERS Switching the signature analyzer 2 Normal mode / inverse mode

TS clock for switching the signature analyzer (with the low / high edge)

and an output leading to the test signal TEST.

The address and data bus ADB is connected to the inputs AO .. .A15 of a decoder 10 for decoding the address YY) whose output is connected to the data input of a D flip-flop 11.

The negated clock input of the D flip-flop 11 is located on the signal / AS. Its output is on each one input of AND gates 12; 13; 14 led.

The READ- / WRITE signal is applied directly to the output carrying the signal / NORMAL-INVERS as well as to another input of the AND-gate 12 as well as to a negated input of the AND-gate 14. The signals / DS; / MREQ; ST1 and ST2 are applied to the inputs of a NOR gate 15; the signal ST3 is fed to a negated input of the NOR gate 15. Desson output is connected to one input of the AND gate 12; 13; 14 connected. The signal STO is applied to one input of the AND gate 13 and one negated input of the AND gates 12 and 14, respectively. The output of the AND gate 12 carries the signal OE, the AND gate 13, the signal TS and the output of the AND gate 14, the test signal TEST.

In this case, the D flip-flop 11 is triggered by the signal / AS, so that the flip-flop the state "access to address YY" to

cached to the output of the address subsequent data transfer.

The logic gates 12; 13; 14; 15 realize a combinational network of the following function:

Calculator operation input signalsIN THE 111 IZI ΙΛΙ

ZugriffaufYY X X 1 1 READ / WRITE 0 1 0 1 / DS 0 0 0 0 / MREQ 0 0 0 0 ST3 1 1 1 1 ST 2 0 0 0 0 ST1 0 0 0 0 STO 0 0 1 1

output signals IN THE 111 / 3 / / 4 / otherwise OE 0 0 1 0 0 / NORMAL INVERS 0 1 X X X TS 0 0 1 1 1 TEST 0 0 0 1 0

withX ... any

FIGS. 3 a to 3 d illustrate the structure and mode of operation of an inversely switchable signature analyzer, using the example of FIG

four-digit parallel signature analyzer.

The signature analyzer consists of D flip-flops 20x (where x = 1 ... 4), EXOR gates 21x ({x = 1 ... 4), and an EX0R gate

21.0 configured feedback network.

In the normal mode shown in Fig.3a the inputs of the D flip-flops 20.x with the outputs of the EXOR gates 21.x and

the outputs of the D flip-flops 20.x {with χ = 1 ... 3) each having a first input of the EXOR gates 21 .x + 1 connected. The

EXOR gate 21.0 is connected to its inputs at the outputs of D flip-flops 20.1 and 20.4, its output is on

led the first input of the EXOR gate 21.1. The second inputs of the EXOR gates 21.x (mitx = 1 ... 4) set the

Data inputs Xx of the signature analyzer. The outputs of the D flip-flops 20.x sir. J leading to the signature ISI Outputs ASx (with χ = 1 ... 4) of the signature analyzer, the output of the EXOR gate 21.0 is connected to the output AS 1 'and the Outputs of the D flip-flops 20.x - 1 are connected to the outputs ASx '(with χ = 2 ... 4), which indicates the subsequent state of the signature [A] © [S]

lead, laid. The clock inputs of the D flip-flops 2O.i (with i = 1 ... 4) are at the clock signal TS.

FIG. 3 b illustrates the function of the signature analyzer according to FIG. 3 a using an example. The signature analyzer has a random initial state [S] x. In the first measure he is stimulated with the value [X] o = [A] © [S]

and goes to the state [S] ο = [0; 0; 0; ...; 0] about. In the following measures, the input vectors (X] 1 ... [X] 4 are given over the

Inputs X1 ... X4 entered into the signature analyzer, the signature analyzer in succession in the states

4übeigeht [S] 1 ... (S].

In inverse mode, shown in Fig. 3c, the outputs of the D flip-flops 20.x are connected to the first inputs of the EXOR gates 21.x.

(with χ = 1 ... 4) and the inputs of the D-flip-flops 20.x (with χ = 1 ... 3) connected to the outputs of the EXOR-gates 21.x + 1 EXOR-gate 21.0 is with its inputs connected to the outputs of EXOR gates 21.1 and 21.2

Output is applied to the input of the D flip-flop 20.4. The second inputs of the EXOR gates 21.χ provide the data inputs Xx dos signature analyzer. The outputs of the D flip-flops 20.x are on the outputs ASx (with X = 1 ... 4) of the Signature analyzer led. The switching of the signature analyzer in the inverse operation is expediently via multiplexer (not shown). Fig. 3d illustrates the switching back of the signature analyzer associated with the laying out of data from the cellar memory. The signature analyzer switched to the inverse mode is started with the initial value [S] 4 and successively with the Input vectors [X] 4; [X] 3; [X] 2; [X] 1 and [X] ο are stimulated. He goes one after the other into the states [S) 3; [S] 2; [S] 1; [S] o

and [S] x over.

List of used reference signs for patent application "Circuit arrangement for monitoring the processing

subprograms in computer architectures *

CPU processing unit RAM MON monitoring circuit AB address bus ADB address and data bus (multiplex) DB data bus SB tax bus A ^r output of the circuit, the error signal F leading ASx outputs of the signature analyzer leading the signature ISI ASx 'outputs of the signature analyzer, leading the signature state of the signature [A] © [S] Xx data inputs of the signature analyzer

[A] IS] IX) [A] © I?] System matrix of the signature analyzer Signature of the signature analyzer Data transmitted to a cellar memory the signature shifted by one measure (Fo 1 2 3 4 Control decoder Signature analyzer decoder gate circuit 10 11 12; 13; 14 15 Decoder D flip-flop AND gate NOR gate 20.x 21.0; 21.x D flip flops EXOR gate / AS / DS / MREQ READ / WRITE STO ... ST3 Control signals from the control bus SB (operating state display of the standard miki / NORMAL INV. OE TS TEST Mode control signals for signature analyzer Test signal for the monitoring circuit F error signal YY memory address

Claims (3)

1. Circuit arrangement for monitoring the execution of subroutines in computer architectures, whose components are connected via a bus system of control, address and data bus and which contain at least one processing unit and a memory, wherein at an output of the circuit generates a signal to initiate an error handling is characterized in that the address (AB) and control bus (SB) are connected to associated inputs of the Steuerdekcders (1), whose outputs are connected to mode control inputs of a inverse switchable and a signature [S] leading signature analyzer (2) Data inputs (Xx) of the signature analyzer (2) are connected to the data bus (DB) and i outputs (ASx ') of the signature analyzer (2) which carry the shifted by one clock signature [A] (*) [S] back to the Data bus (DB) and j outputs (ASx) of the signature analyzer (2) that lead to the signature [S], inputs assigned to them decoder (3), and that an output of the decoder (3) is connected to an input of a gate circuit (4) whose output represents the output (AF) of the circuit leading to the error-handling initiation signal (F). 2. A circuit arrangement according to claim 1, characterized in that the control decoder (1) is provided with an additional, a test signal (TEST) leading output, which is connected to a further input of the gate circuit (4). 3. Circuit arrangement according to one of the preceding claims, characterized in that the output (AF) of the circuit arrangement with an interrupt input (INT) of the processing unit (CPU) is connected.