GB2332765A

GB2332765A - Identifying data storage locations which are likely to contain data of a particular type

Info

Publication number: GB2332765A
Application number: GB9906154A
Authority: GB
Inventors: Patrick Bossert
Original assignee: EMBEDDED SCIENCE Ltd
Current assignee: EMBEDDED SCIENCE Ltd
Priority date: 1998-03-18
Filing date: 1999-03-17
Publication date: 1999-06-30
Also published as: AU2944299A; GB2329267B; GB9805816D0; GB2329267A; GB9906154D0; WO1999048002A1

Abstract

A method of identifying storage locations in a data store of, for example, an embedded control system 10, which are likely to contain data of an identifiable data type, such as temporal data, length data, or currency data. Logic analyser 15 sequentially samples and stores memory accesses made by the embedded control system under test, for example over a period of five minutes. The storage locations containing data of the particular data type are determined by searching for patterns in clusters of consecutive addresses, in which the ratios of the data values (or of the rate of change of the data values) stored in the cluster have particular values: e.g. for time values, typical ratios are 10, 60, or 3600 (or 600:60:1). Alternatively, memory locations storing temporal data may be identified as those whose data values change on average every second or minute, etc. The identification of temporal data locations has particular applicability to testing the control system for Year 2000 compliance using the logic analyser 15, as is described in some detail.

Description

67921/001.604 2332765 TESTING OMPU-TER SYSTEMS The present invention

relates to the testing of computer systems, and in particular to a method and apparatus for interrogating computer systems, more particularly in order to establish the capability of computer system to continue to operate correctly after the year 2000.

It'is well known that many date-dependent computer hardware and software systems are expected to malfunction when the date changes from 31 December 1999 to 1 January 2000. The reason for the possible malfunction of date-dependent computer systems is that many such systems are programmed to store and process dates in a DD/MM/YY format which allows only two-digits to represent the year. Thus, for example, the stored date 01/01/00 could represent both 1 January 1900 and 1 January 2000. In the absence of additional data or revised programming instructions, the computer system has no way of resolving such an ambiguity. This problem is generally more prevalent in older systems which were designed before it was realised that such ambiguity would occur within the life time of the computer system.

In computer systems that store dates in DD/MM/YY format, calculations to determine the difference between two dates usually assume that the dates belong to the same century, so that year 00 precedes year 99. With such a two digit system, the calculation of, for example, the age of a person born in 1950, when performed in the year 2020, will give the result 20 50 = -30 years, rather than the correct result of 70 years. It will be appreciated that a nonsensical result of this type could cause a serious malfunction in a computer system that relies on the calculation of dates and periods of time.

A further problem which may occur at the millennium 2 - date change relates to the determination of leap years.

The existence of a leap year is calculated on the basis of one rule and two exceptions. If the year is divisible by 4 without remainder, the year is a leap year. However, as an exception to this rule, if the year is divisible by 100 without remainder then it is not a leap year. As an exception to the previous exception, if the year is divisible by 400 without remainder, the year is a leap year. The year 2000 will be a special year in that the 400-year rule is invoked.

If no leap year calculation other than the basic divide by 4 rule has been implemented in the computer system the result will be correct, although by accident rather than by foresight.

It will be apparent that any computer-based system which uses only two digits to store dates is likely to malfunction. It is therefore of vital importance that such systems are identified before the year 2000 so that suitable modifications can be made.

In order to establish the potential effect of the change from 31 December 1999 to 1 January 2000 on a particular computer system ("year 2000 compliance"), it is necessary to determine the manner in which dates are stored and processed in the system. The program code controlling most modern computer systems is, in general, vast and complex, which makes the task of identifying with total confidence all sections of the program code that deal with date operations and the effect of the millennium changeover on these code sections extremely time-consuming and expensive.

Analysis techniques and testing tools have been developed for general purpose computers such as IBM compatible "PC" computers. However, hitherto, the problem of interrogating embedded control systems for year 2000 compliance has not been addressed.

In general terms, embedded control systems are micro-controllers designed to run a very specific piece 3 is of code to control a machine of which they form part. Such systems are found, for example, in manufacturing and process control plant, communications hardware, banking and finance terminal hardware, medical equipment, transport management systems, building systems and domestic equipment. Embedded control systems often perform time-dependent process control tasks, which makes them particularly vulnerable to malfunction at the turn of the millennium.

The program code run by embedded control systems has often been heavily customised for a particular project or application by the end-user without detailed recordal of the changes made. Furthermore, different installations using the same make and model of equipment incorporating an embedded control system frequently operate with a mixture of different releases of embedded software. Thus, it can be extremely difficult, even for a manufacturer of an embedded control system, to establish the content of the program code running in an embedded control system with the degree of certainty required to determine beyond doubt the effect of the millennium date change on the system.

One possible way of determining the effect of the millennium date change on an embedded control system is simply to change the system date to a date later than 1 January 2000 and observe the result. However, this may have irreversible consequences on the control system or on the components controlled thereby and is thus undesirable. Alternatively, as mentioned above, it may be possible to decompile the program code running in the control system and examine it manually, or with the aid of a suitable automatic scanning system, in order to establish the way in which the code manipulates and stores date and thereby determine the effect of the millennium date change on the system. However, this is an extremely timeconsuming task in view of the potentially vast size of the program code and relies on the ability of a programmer to correctly identify the appropriate sections of code.

The present invention seeks to provide a method of and an apparatus for interrogating a computer system, for example an embedded control system, which may be used, for example, to predict the effect of the millennium date change on the computer system.

According to a first aspect of the present invention there is provided a method of interrogating a computer system comprising:

continuously recording instructions processed by a microprocessor; and while recording, selecting some of the recorded instructions in response to an indication of the processing of temporal data by the microprocessor.

The term "temporal data" is used herein to refer to any data relating to dates and/or times, and/or the passage of time, particularly from a given reference point.

Thus, according to the invention an indication of the processing of temporal data by the microprocessor may be used to select from the recorded microprocessor instructions those that are likely to control the processing of temporal information. In other words, the instruction are effectived "filtered". Once these instructions have been identified they can be examined to establish how the microprocessor is instructed to manipulate and store temporal, in particular date, information. The effect of the date change at the turn of the millennium on the computer system may thus be determined, e.g. in a known manner by studying the selected instructions. However, it will be appreciated that, since the selected instructions will typically form only a very small portion of the vast number of instructions carried out by the microprocessor, this task is greatly simplified.

Furthermore, because the instructions that are recorded are the instructions that the microprocessor is actually processing, it is assured that the instructions obtained relate to the version of the program code that the microprocessor is actually running.

The indication of the processing of temporal data by the microprocessor used in the method may be any suitable, identifiable occurrence, signal, condition or the like in any appropriate part of the computer system, including the microprocessor itself. For example, the indication may be the occurrence of a predetermined instruction or a predetermined sequence of instructions. Such predetermined instructions may be known temporal data handling instructions used by the microprocessor, e.g. an instruction to obtain the current date from memory.

In a preferred arrangement, however, the indication is a signal associated with an exchange of temporal data between the microprocessor and a second component, for example a clock generator, such as a real- time clock.

The signal may be associated with the microprocessor receiving temporal data or the signal may be associated with the microprocessor sending temporal data, for example to a storage component of the computer system, or even both. In this way, a simple indication of temporal processing activity may be used to trigger the selection of instructions.

The second component may be external to the microprocessor or may be provided as an integral part of the microprocessor.

In certain embodiments of the invention there may be more than one second component. Indeed, this is preferred so that there is an increased probability of all relevant instructions being selected. Where a plurality of second components is used, a respective indication for each may be used.

The signal may result from the detection of data on a communication path between the microprocessor and the second component (s), which data need not be temporal data, but could be associated with preliminary communication before the transmission or receipt of temporal data, for example. Thus, the signal may be a write enable or a read enable signal sent by the microprocessor to the second component(s).

The second component may be a data store, for example a memory device or a non-volatile storage means. For example the data store may arranged to store time values, date values or other temporal data. The data store may be a non-volatile storage means arranged to store the current date. The signal may be associated with the reading of temporal data from the data store or the writing of temporal data to the data store. For example, the signal may be the change of state of the write enable or the read enable terminal of a randomaccess memory integrated circuit.

The data store may comprise a plurality of addressable storage locations, one or more of which may store temporal data. The signal may be associated with the addressing of one or more specific storage locations in the data store which store temporal data.

Such specific storage locations may be known from documentation relating to the computer system. Alternatively, the specific storage locations may be determined prior to carrying out the method of the invention.

one method of determining such specific storage locations takes advantage of it being common programming practice to store temporal data in different formats, for example a number of hours and a corresponding number of minutes, in adjacent or proximate storage locations. These locations may be found by sequentially calculating the ratio of the values stored in adjacent or proximate storage locations and comparing the calculated ratios to predetermined ratios associated with temporal data. For example, it is likely that a time value may be stored as - 7 number of seconds, a corresponding number of minutes, corresponding number of hours, days, months, years etc. in adjacent storage locations. By comparing the ratios of such storage locations with predetermined ratios equivalent to the number of seconds in a minute or the number of hours in a day etc., locations which are likely to contain temporal data may be identified.

Alternatively, the ratios of the rate of change over time of adjacent or proximate storage locations may be calculated and compared to ratios indicative of temporal data. For example, if a time is stored in the format of a number of minutes, seconds and tenths of seconds, with a respective storage location for each of the minute value, the seconds value and the tenths of seconds value, the ratio of the rate of change of the minutes value to the rate of change of the seconds value will be 1:60, which can be used to identify this time data.

This in itself is believed to be new and thus from a second aspect the invention provides a method of identifying storage locations in a data store which are likely to contain temporal data comprising sequentially calculating the ratio of a characteristic of the values stored in proximate storage locations and comparing the calculated ratios to predetermined ratios associated with temporal data.

This aspect of the invention may be applied to data types other than temporal data where there is an identifiable ratio associated with the data type. For example, length measurements may be stored in one storage location in a number of feet and in another storage location in a corresponding number of inches, or in one storage location in a number of kilometres and in another location in a corresponding number of miles. In each example, there is a fixed ratio (12 and 0.62, respectively) between the values of one storage location and the values of another storage location, which ratio - 8 is indicative of the data type.

other examples of suitable data type may be currencies. For example there would be an identifiable ratio between an amount stored in one storage locations in Euros and in another storage location in Deutschmarks or French francs.

As mentioned above, the characteristic may be the rate of change with respect to time of the value stored at the storage location or may be the value itself. The rate of change of the value may be determined by reference to the number of times data is written to the location over a given period of time.

In the case of non-temporal data, an example where the ratio of the rates of change of values stored in two storage locations is indicative of the type of data stored therein is a recording of a distance travelled by a vehicle in miles and yards with the number of miles travelled being stored in one storage location and the additional number of yards travelled since the last whole mile being stored in another storage location. The ratio of the rates of change of these two values will always be in the ratio 1:1760, assuming a sufficiently long sampling period.

The proximate storage locations may be adjacent storage locations.

The rate of change of the data values in a plurality of storage locations may also be used directly as an indication of the storage of temporal data in those locations. Thus, from a third aspect the invention provides a method of identifying storage locations in a data store which are likely to contain temporal data comprising monitoring the respective rate of change with respect to time of the values stored in the storage locations and comparing the monitored rates of change to predetermined rates indicative of standard units of time.

The rate of change may be an average rate of change - 9 is and may be calculated by reference to the number of times data is stored in the storage location over a period of time. The standard units of time may be, for example, seconds, minutes, hours etc., or fractions of these units.

The addressing by the microprocessor of storage locations identified in accordance with this method may be used in accordance with the first aspect of the invention as an indication of the processing of temporal data by the microprocessor.

As discussed above, the indication used in the method may be a control signal of the computer system, for example a signal associated with communication between the microprocessor and the second component (s) In order to read this signal, an electrical connection may be made to the computer system.

The connection may be made in any suitable manner, for example to an interface of the computer system which may provide electrical connection to internal communication channels of the computer system, such as bus lines. Alternatively, the connection may be made directly to the communication channels.

The connection may be made to the microprocessor itself, for example to terminals on the microprocessor.

In a preferred embodiment, the connection is made to the second component(s) because such components vary in size and shape less than do microprocessors and so reliable connection is easier to provide for a wide range of computer systems.

Preferably, the connection is made in a noninvasive manner, for example by presenting a highimpedance load to the computer system such that substantially no current is drawn by the connection. In a preferred embodiment, the connection is made to the computer system by a connector which attaches mechanically to the microprocessor or the second component and makes electrical connection thereto. In - 10 the preferred embodiment the connector is in the form of a standard test clip.

The selecting of the recorded instructions may comprise inserting marking data into the recorded instructions. The marking data may identify one or more instructions which were recorded at the time of response to the indication, before or after the response to the indication. The marking data may define a sequence of instructions which were sampled in a window of time including the time of response to the indication or a window having a predetermined temporal relationship to the time of response to the indication.

However, in a preferred embodiment, the selected instructions are stored in a selected instruction store. The selected instruction store may accumulate instructions, or sequences of instructions, associated with the processing of temporal data.

The selected instruction store may be a local store, such as the memory or disc of a general purpose computer, or may be a remote store, such as a central ser-ver accessible via a modem. For example, the selected instructions may be communicated after selection directly to a remote stare via a suitable communications link.

The recorded instructions from which selection takes place may be recorded in any suitable manner, example in a buffer.

for The buffer may be arranged to buffer instructions sampled over a predetermined period of time. In this way, the instructions processed by the microprocessor before the occurrence of the indication may be recorded as well as those processed after the occurrence of the indication. The recorded instructions may be communicated to an instruction store in response to the indication. The instruction store and/or the buffer may be provided by a general purpose computer.

In order to record the instructions, a suitable connection may be made to the computer system from which the instructions processed by the microprocessor may be sampled. The connection may be made to the microprocessor itself, for example to terminals on the microprocessor, or may be made to communication lines within the computer system through which the microprocessor communicates, for example bus lines. In a preferred embodiment, the connection is made to an instruction store which communicates instructions to the microprocessor for processing. The instruction store may be in the form of a non- volatile storage device such as a read-only memory (ROM) device.

The connection may be made in any suitable manner, for example to an interface of the computer system which may provide electrical connection to the bus lines, for example.

Preferably the connection is made in a non-invasive manner, for example by presenting a high-impedance load to the computer system such that substantially no current is drawn by the connection. In a preferred embodiment, the connection is made to the computer system by a connector which attaches mechanically to a component of the computer system, for example an integrated circuit, such as the microprocessor, and makes electrical connection therewith. In the preferred embodiment the connector is in the form of a test clip.

The method may further comprise converting the selected instructions into a human-readable form for manual analysis. Additionally or alternatively, the method may comprise comparing the selected instructions to one or more predetermined sequences of instructions e.g. in the form of a library.

The predetermined sequences of instructions may be stored remotely, which has the advantage that the predetermined sequence(s) of instructions may be distributed to a plurality of locations at which computer systems are being interrogated, via suitable - 12 communication links. The predetermined sequence (s) of instructions may be identified as year 2000 compliant or non-year 2000 compliant so that a decision can be made by reference to the predetermined sequence (s) of instructions as to the year 2000 compliance of the computer system. In this way a decision can automatically be made as to the year 2000 compliance of many of the computer systems being interrogated, although it is appreciated that no library is exhaustive and so in some cases further analysis may be required before a decision as to compliance can be made.

It is, however, envisaged that the library may be expanded over time by the addition of data corresponding to code found to be year 2000 compliant by means of the invention.

The invention also extends to apparatus for carrying out the method of the invention. Thus from a further aspect the invention provides apparatus for interrogating a computer system comprising:

recording means for continuously recording instructions processed by a microprocessor; and selecting means for selecting some of the recorded instructions in response to an indication of the processing of temporal data by the microprocessor, while recording instructions.

The apparatus may be configured to carry out the method of the invention in accordance with the optional and preferred features described above.

The apparatus of the invention may be configured in software, in hardware or in a combination of both. The apparatus of the invention preferably comprises a general purpose computer arranged to receive signals from the computer system. The general purpose computer may comprise one or more of the recording means and the selecting means. The apparatus may be connected to the computer system in any suitable manner, preferably by means of one or more connections, more preferably one or - 13 is more connectors, as described above. The recording means may be in the form of a buffer or data store, for example in the memory or disk of a general purpose computer. The selecting means may be in the form of logic components, for example in the general purpose computer, provided with the indication in the form of electrical signals.

From a further aspect the invention provides apparatus for interrogating a computer system, the apparatus comprising a f irst connector, a second connector, a buffer electrically connected to the first connector and a data selector electrically connected to the second connector, wherein the f irst connector is configured for direct electrical connection to a component of a said computer system whereby to communicate to the buffer instructions processed by the microprocessor of the computer system, the buffer is arranged to record instructions received from the first connector, the second connector is configured for direct electrical connection to a component of said computer system whereby to communicate to the data selector a signal indicative of the processing of temporal data by the microprocessor of the computer system, and the data selector is arranged to select at least some of the instructions recorded in the buffer in response to the signal communicated by the second connector.

The invention further extends to the apparatus described above in combination with a computer system. Preferably the computer system is an embedded control system.

Some embodiments of the invention will now be described, by way of example only and with reference to the accompanying drawings, in which:

Figure 1 shows a schematic view of a typical embedded control system with which the invention may be used; Figure 2 shows a schematic view of an embodiment of 14 the invention connected to the embedded control system of Figure 1; and Figure 3 shows a view of the components of a test system according to an embodiment of the invention.

In order to understand the operation of the method and apparatus according to the invention, a typical embedded control system with which the invention may be used will firstly be described, with reference to Figure 1.

The exemplary embedded control system shown in Figure 1 comprises a microprocessor 1, random access memory (RAM) 2, read-only memory (ROM) 3 which stores the instructions ("program code") for operating the microprocessor 1, a real time clock (RTC) 4 and input/output and communications circuitry S. The input/output and communications circuitry 5 does not have an effect on the way in which the embedded control system manipulates date information, and will therefore not be described in further detail herein. However, the skilled person will be familiar with such circuitry.

Each of the components of the embedded control system, i.e. the microprocessor 1, the RAM 2, the ROM 3 and the RTC 4, will generally be in the form of discrete integrated circuits (ICs) surface-mounted to the printed circuit board (PCB) of the embedded control system and communicating with each other via an address bus 6, a control bus 7 and a data bus 8. The buses 6-8 are generally in the form of conductive tracks provided on a surface of the PCB. The ICs 1-4 are connected to the buses 6-8 by electrical terminals, or pins, which project from the edges of the ICs and are soldered to the conductive tracks of the PCB.

In some embedded control systems the RTC is not connected to the data bus and address bus, but is connected to a peripheral input/output bus. Indeed, some embedded control systems generate temporal data without using an RTC, as such.

is The microprocessor 1 executes instructions stored as firmware in the ROM 3 to monitor inputs, implement process algorithms, and control outputs based on the results of the algorithms. There are about 35 main types of microprocessor widely used in embedded control systems, for example: the AMD 2111; Dallas 80C320; Intel 8085, 8086/8088, 8031/8051, BX51GB, 80186/88/XL, 80386/EX; Motorola 6800/6802, 6809, 68000/08/10/20/30, 78302/332/339; NEC V25; Rockwell 6502, 6511; Siemens 80C165/166/167, 80C515/517/537; Texas Instruments TMS320C31; Zilog Z80, Z180.

Such microprocessors understand variants of 10 programming instruction sets, often referred to as 11opcodes" or "machine code instructions".

The microprocessor 1 retrieves instructions for execution from the ROM 3. Read-only memory is non-volatile, so that its contents are not lost when the power supply to the embedded control system is interrupted or switched off. The program code stored in the ROM 3 may be set when the ROM 3 is manufactured and may be unchangeable subsequently. Alternatively, the ROM 3 may be in the form of an erasable programmable ROM (EPROM), or an electrically erasable programmable ROM (EEPROM).

A few modern microprocessors support a small on-board ROM capability, in which case the ROM 3 may be formed integrally with the microprocessor 1, but in the majority of embedded control systems the instructions are held externally to the microprocessor 1 in a discrete ROM 3.

Seven different basic ROM types are widely used by embedded control systems, regardless of their microprocessor types. These are:

Amtel, Hitachi, Microchip, Mitsubishi 27xxx series EPROMs (used in the majority of embedded control systems); NEC 27xxx series EPROMs; AMD, Excel, Intel, XICOR 28xxx series EEPROMs; AMD, Amtel, Fujitsu, Hitachi 29xxx series Flash PROMs; Philips 82xxx series PROMs; Texas Instruments 38xxx series PROMs; Cypress 7xxx PROMs.

A typical ROM 3 stores program instructions in 8-bit binary form. Many newer 16-bit microprocessors use two banks of 8-bit ROMs to hold the instructions. one bank, usually labelled with LSB (least significant bits), holds the lower 8 bits of each instruction, and the other bank, usually labelled with MSB (most significant bits), holds the upper 8 bits of each instruction. The banks operate in parallel. In order for the microprocessor 1 to retrieve a new instruction from the

ROM 3, it provides a set of control signals on the address bus 6 and the control bus 7. In response, the ROM 3 provides the instruction on the data bus 8.

The program code stored on the ROM 3, which is executed by the microprocessor 1, is generally made up of the operating system, also known as the basic input system (BIOS) or "firmware kernel" and the applications code.

The operating system is program code responsible for initialising and interfacing with the peripheral devices to the processor. Such devices include keypad or input/output devices, communications devices e.g. universal asynchronous receiver transmitters (UARTS), display devices, memory management devices, data storage devices, and the RTC 4. The operating system abstracts the applications running on the embedded control system from dealing with the complexities of the hardware devices. It usually provides a set of "programmer friendly" interfaces for interfacing with the peripheral devices, including functions for getting and setting the time and date. A well-written operating system will compensate, as far as possible, for a two-digit year date, and provide a full date and time to any calling application.

The applications code implements the specific function the embedded control system is intended to perform. The applications code often relies on userconfigured data, which may be stored in the RAM 2, the ROM 3 or an additional volatile or non-volatile memory device, to tailor its operation. For example, the userconfigured data may define the types of sensors attached to the inputs of the embedded control system, and high or low limits for a value relating to a particular process task. The applications code depends upon being supplied with the correct time and date to function properly. The applications code is likely to perform some time and date comparison calculations, which, as described above, may lead to a malfunction of the embedded control system post-1999, if the date supplied by the operating system is not based on a four-digit year.

The microprocessor 1 stores data in the RAM 2 for later manipulation. The RAM 2 is volatile and its contents are lost when the power supply to the embedded control system is interrupted or switched off. The RAM 2 is of a similar format to the ROM 3, but has a read/write control line so that the microprocessor can instruct the RAM 2 to store data in an address in the RAM provided on the address bus 6 or to retrieve data from that address. When the microprocessor 1 stores a data value to the RAM 2, it provides a set of control signals on the address bus 6 and the control bus 7, and 18 is the data value on the data bus B. In the case of a 16-bit microprocessor, the RAM 2 may be arranged in the form of two parallel banks of 8bit RAM in a corresponding manner to that described above in relation to the ROM 3.

Many of the operations implemented by the microprocessor 1 in accordance with the instructions (firmware) stored on the ROM 3 are time-dependent, and require temporal data, such as the current time and date, in order to calculate whether an operation should be performed. Thus, the embedded control system has a real-time clock (RTC) 4, which maintains the data corresponding to the current time and date even if the power supply to the embedded control system is interrupted or switched off. There are about ten types of RTC IC which are widely used in embedded control systems. These include the Dallas Semiconductor 16xx and 17xxx ranges and the Motorola 146818.

The RTC 4 operates in a similar manner to the RAM 2, but differs in that the contents of the RTC memory locations are updated automatically by the RTC circuitry as time passes. Of course, the RTC 4 is also a nonvolatile storage device. The microprocessor 1 retrieves temporal data from the RTC 4 by providing appropriate signals on the address bus 6 and the control bus 7. The temporal data will be returned to the microprocessor 1 on the data bus 8 by the RTC 4.

The RTC 4 is often a relatively slow device in comparison to the speed of the microprocessor 1. It is therefore not always efficient for the operating system retrieve temporal data from the RTC 4 at every request by the applications code, which could be hundreds of times per second. Thus, it is more efficient for the operating system regularly to retrieve the temporal data f rom. the RTC 4 and store it, f or example in the RAM 2, so that the data can be retrieved quickly when required by the applications code.

19 - Some RTCs provide their data as a serial data stream, and others generate a processor interrupt request (IRQ), whenever the time changes Other RTCs must be polled for changes on a regular basis by the operating system. The operating system will generally retrieve the time and date from the RTC 4 by one of these methods and then store it in memory. Whenever the applications code requests the time and date in a specific format, the operating system will read the current stored values from memory, and return them to the calling application. The applications code may require the time and date from the operating system in a number of different formats depending upon the application requirement. If the date is to be shown in a display, the application code may ask for it in 01 January 2000 format. If it is for tagging of other stored data, for example a history log, the application code may require the temporal data in DD:MM:YYYY format. If the temporal data is to be used for comparison in determining a time interval the application code may request the data in a format of absolute seconds since 1 January 1970, or some other baseline data. In general, the operating system will carry out the necessary processing to provide the different formats.

Most RTCs manufactured to date store and supply the year as a two-digit code, e.g. 98, which may lead to malfunctions in the embedded control system, as described in detail above. Some RTCs provide a leap year indication, which, as described above, may not be correctly calculated, and may also lead to malfunctions in the year 2000.

If an embedded control system contains an RTC 4 that provides a fourdigit year then, in general, little further testing is required to determine the effect of the millennium date change on the embedded control system, as an unambiguous date will be supplied to the microprocessor 1, for use by the operating system. Of - 20 course, it is possible that the operating system may convert the four- digit year to a two-digit year during manipulation of date data, in which case malfunctions could still occur post-1999.

is If the RTC 4 provides a two-digit year then it does not necessarily mean that the embedded control system will malfunction after 1999, as the operating system may correctly compensate for the lack of information as to the century. In these circumstances, the embedded control system can be interrogated in accordance with the invention to establish how the operating system and the applications code manipulates date data, in order to determine whether the embedded control system will malfunction after 1999.

Figure 2 shows a schematic view of an embodiment of the invention connected to the embedded control system of Figure 1. In this embodiment three test clips 12 14 are connected respectively to the RAM 2, ROM 3 and RTC 4 of the embedded control system. The test clips 12-14 are connected to a logic analyser 15, via an interface 16. This embodiment is also shown in a physical representation in Figure 3.

In the case of a 16-bit microprocessor 1 and parallel banks of ROM 3 and RAM 2, a test clip will be required for each bank of RAM or ROM.

As shown in Figure 2, the test clips 12-14 connect respectively to the integrated circuits forming the RAM 2, ROM 3, and RTC 4 of the embedded control system. The integrated circuits forming the RAM 2, ROM 3, and RTC 4 in known embedded control systems usually exhibit less variety in terms of IC package type, shape and device permutation when compared to the larger variety of microprocessor packages that are used in embedded control systems. For this reason it is preferred for 3S the test clips 12-14 to connect to the RAM 2, ROM 3, and RTC 4, rather than the microprocessor 1 of the embedded control system 10, so that a more limited range of test 21 is clips is required to enable the test clips 12-14 to be connected to any desired embedded control system.

Test clips are commercially available for many IC packages, for example from Emulation Technologies UK Ltd, Bedford, U.K.

The test clips 12-14 connect mechanically to the iC packages of the RAM 2, ROM 3, and RTC 4 and electrical connection is made via terminals of the test clip 12-14 on to the pins of the IC package 2-4. Each test clip has a built-in LED (light emitting diode) indicator which draws only a few milliamps from the power supply pin (Vc c) and the earth (ground) pin of the IC package to which the clip is attached. The LED is illuminated when the test clip 12-14 has been correctly applied to the appropriate IC package 2-4 in the correct orientation.

The terminals of the test clips present a very high impedance load (>1 Mega Ohm) to the pins of the IC package to which they are mounted. Thus the mounting of the test clips to the IC packages does not interfere with the operation of the embedded control system in any way, and the test clips 12-14 allow the logic analyser access to the signals on the address bus 6, control bus 7 and data bus 8 of the embedded control system, in particular the signals received and sent by the RAM 2, ROM 3, and RTC 4.

As shown in Figures 2 and 3, the test clips 12-14 are connected via a hardware interface 16 to the logic analyser 15. The interface 16 has a single cable connection to the logic analyser 15 and sockets for cables to the test clips 12-14. The interface allows the number of test clips to be connected to the embedded control system 10 to be varied without having to provide a plurality of cable connections on the logic analyser 15, which may become cumbersome when the logic analyser 15 is in the form of a standard PC card. The interface 16 may also be arranged to verify that the test clips 12-14 are correctly connected to the ICs of the embedded control system 10, for example by providing LEDs on the interface 16 rather than on the test clips 12-14 themselves as described above. The interface 16 provides the logic analyser 15 with an electrical connection to each of the test clips 1214 via a single cable connection between the logic analyser 15 and the interface 16.

The logic analyser 15 is a 48-channel logic analyser which in this embodiment is in the form of a commercially available PC-card, such as a PA600 Logic Analyser Card manufactured by NCI, USA. The logic analyser may also be in the form of a dedicated hardware, or a peripheral device connected to a general purpose computer.

As shown in Figure 3, the logic analyser 15 in this embodiment is installed in a commercially available "lunch boxlltype portable PC unit 17 equipped with the usual peripherals such as a built-in keyboard 18, touch-pad 19, modem 20 and display 21. The PC 17 may be powered by a battery supply or by a mains power supply 22. A suitable lunch box PC is the PC-III-1)810 made by Wescom Corp., Miami, USA.

In order to set up the test system according to the invention as shown in Figures 2 and 3, the user must identify the RAM 2, ROM 3, and RTC 4 of the embedded control system 10, so that the test clips 12-14 can be correctly connected. In a preferred system, a custom software application is provided on the PC 17 to guide users of the test system to the required components of the particular embedded control system 10. The software application also stores connection data which the logic analyser 15 can access to identify which test clips 12 14 are connected to which components 2-4. The software application stores a database of embedded control systems from which it can provide information to a user as to the location and identifying features of the components to which the test clips 12-14 should be 23 - connected. The components may be identified by shape, size, location on the PCB of the embedded control system 10, or product number.

When applying the test clips 12-14 caution must be taken to apply the clips without forcing or jarring any of the circuitry of the embedded control system 10.

In some modern embedded control system, with very compact enclosures, it may not be possible to enter the enclosure without disrupting the operation of the system or it may not be possible to position the test clips 1214 an the integrated circuits within the confines of the enclosure. Nevertheless, the test system of the invention can still be used by providing a separate, parallel, version of the embedded control system which can be run in a partly disassembled state such that the test clips can be attached. However, most older embedded control systems have plenty of space for test clip access.

In some very compact embedded control systems the operating system is stored in a ROM which forms part of the microprocessor, together with a small amount of on-board RAM. In such cases, a test clip may be provided which attaches directly the microprocessor and monitors the internal address and data lines of the microprocessor. Such microprocessors are generally provided, for programming during manufacturing assembly, with pins on the IC package from which the program code being processed can be sampled as well as the address and data line signals.

Thus, it will be seen that the connections made by the test clips 12-14 are not limited to the RAM 2, ROM 3, and RTC 4, but could include alternatively or additionally connections to the microprocessor or the address, data and control buses. It is only necessary that the signals required by the logic analyser 15 for the processing operations described hereinafter can be provided from the embedded control system while it is 24 operating.

With some embedded control systems, connections may be provided at an interface of the system which enable all of the information required by the logic analyser 15 to be obtained without the use of test clips.

Referring again to Figure 2, the test clip 12 provides the logic analyser 15 with the control signals provided by the microprocessor 1 and supporting logic devices on the address bus 6, the control bus 7 and the data bus 8 which control the reading and writing of data to the RAM 2. These control signals are sampled and stored by the logic analyser 15, so that the logic analyser 15 has access to the addresses in the RAM 2 to which the microprocessor 1 has written a data value or from which the microprocessor 1 has read a data value, over a period of time, together with the data value written or read.

The test clip 14 provides the logic analyser 15 with the control signals provided by the microprocessor 1 on the address bus 6, the control bus 7 and the data bus 8 which control the reading and writing of data to the RTC 4. The logic analyser 15 can determine from these control signals when temporal data from the RTC 4 is being accessed, and more particularly when the year register of the RTC 4 is being read.

In the case of an embedded control system in which the RTC is connected to peripheral input/output bus, control signals from this bus may be provided to the logic analyser 15, rather than from the data and address buses. However, the control signals from the control bus 7, may suffice for the purposes of the invention.

The test clip 13 provides the logic analyser 15 with the control signals on the address bus 6, the control bus 7 and the data bus 8 which control communication between the ROM 3 and the microprocessor 1. Thus from these signals the software instructions (program code) stored in the ROM 3 and communicated to the microprocessor 1 for execution can be derived. These instructions are continuously sampled and stored by the logic analyser 15, in a buffer of the instructions that the microprocessor 1 has recently processed.

Once the test clips 12-14 have been connected to the embedded control system 10, the memory locations in the RAM 2 in which it is likely that temporal data is stored are located. This process is carried out by hardware, such as the logic analyser 15, provided in the PC 17 which sequentially samples and stores memory accesses made by the embedded control system under test, for example over a period of five minutes. The sampled information is transferred to the PC's memory and analysed by a software application which identifies the range of memory locations in the RAM 2 at which temporal data, such as the time and date, is stored, in particular the address location of the year-date register. The software application constructs a statistical analysis of the total numbers of write operations directed to each memory location in the RAM 2. The storage locations for the time and date in the RAM 2 are determined by searching for patterns in clusters of consecutive addresses, in which the ratios of the data values stored in the memory locations in the cluster have particular values. The ratios searched are typically 10, 60 or 3600, which correspond to a sequence of memory locations storing the same time value respectively in tenths of seconds, seconds and minutes.

Alternatively, the rate of change over time of the data values stored in the memory locations may be analysed and ratios of the rate of change between adjacent memory locations calculated. Thus a time stored in minutes, seconds and tenths of seconds in three respective memory locations will be immediately identifiable by the relative rate of change of the memory locations having the ratios 600:60:1. The rate - 26 of change can be observed for each memory location by reference to the number of write operations made to that location over a period of time, assuming that a write operation is only made when the data value changes. Alternatively the stored data value itself may be monitored.

Both the technique of comparing data values and the technique of comparing rates of change of data values may be used together, to ensure that all temporal data storing locations are identified.

A further method of identifying memory locations storing temporal data is to identify, by a statistical analysis, those memory locations which change at a rate, or average rate, indicative of temporal data. For is example, locations which have a value which changes every second or every minute are likely to store temporal data. The rate of change can be determined by counting the number of write operations made to each memory location of a period of time and then calculating an average of write operations per unit time. Typically sets of adjacent locations the value of which change at rates indicative of temporal data will be chose as most likely to contain temporal data rather than individual locations which may happen to change at the appropriate rate.

The data stored at the memory locations thus identified can be viewed by the operator of the test system to visually verify that the memory locations store time and date information. This sampling method significantly reduces the amount of time that would be required to manually examine the content of each memory location to identify temporal data.

The addresses of the memory locations in the RAM 2 in which time and date information is stored are retained by the logic analyser 15.

Following the preliminary steps described above, the interrogation process according to an embodiment of - 27 the invention is carried out. As described above, the software instructions processed by the microprocessor 1 are sampled by the logic analyser 15 via the test clip 13 and stored in a buffer of recently executed instructions. The logic analyser 15 is configured to download the contents of the buffer to the memory of the PC 17 in response to one or more triggers determined by the control signals received from the test clips 12-14. In this way, the PC's memory stores a sequence of software instructions ("a snapshot") starting from before the activation of the trigger and continuing until shortly after activation of the trigger. The triggers reflect a state of the embedded control system 10 in which the microprocessor 1 is operating under instructions for the processing of time and/or date information. Thus, when the contents of the buffer are downloaded to the PC's memory, the downloaded instructions will relate to the way in which the embedded control system 10 is programmed to manipulate and store time and date information. An examination of the downloaded instructions will allow a determination of the effect of the change of date from 1999 to 2000 on the operation of the embedded control system 10. However, other parts of the program code running in the embedded control system which do not relate to the processing of temporal data are not downloaded to the PC's memory, as none of the triggers will be activated. Thus, the sampled instructions are filtered automatically according to the invention so that only those instructions, or sequences of instructions, relevant to year 2000 compliance are presented for further examination.

The following triggers may be used: The reading of temporal data from the RTC 4 by the microprocessor 1; The writing of temporal data to the RAM 2 by the microprocessor 1; and The reading of temporal data from the RAM 2 by the microprocessor 1.

All three triggers may be used together to test a particular embedded control system 10, so that a snapshot of code is produced in response to each trigger. However, not all of the triggers need be used for a particular embedded control system, depending on the configuration of the embedded control system. A single snapshot may be produced in response to each trigger, or successive snapshots may be produced at each occurrence of each trigger. Preferably, three code snapshots are produced, one in response to the occurrence of each trigger.

The first trigger is activated when the microprocessor 1 reads time and date data from the RTC 4. The logic analyser 15 identifies this trigger, via the test clip 14, as a combination of the setting of the output enable (/OE) and chip select (/CE) pins of the RTC 4 and the address lines of the RTC 4 carrying an address representing the year register in the RTC chip. The address of the year register is known from the type of RTC chip in the embedded control system 10.

When the time and date is read from the RTC it is formatted by the operating system for storage in the RAM 2, or for further manipulation by the applications code. A snapshot at this stage shows how the operating system takes the date information from the RTC 4 and formats it. If a two-digit year is supplied by the RTC 4 it is usually at this stage that compensation is applied by the operating system, and a four-digit date stored. If this is not the case, then the applications code must perform the compensation, which is less likely.

The second trigger is activated when the microprocessor 1 writes temporal data to the RAM 2. As described above, the logic analyser 15 has already retained the addresses of the memory locations in the RAM 2 that store temporal data. The logic analyser 15 identifies this trigger, via the test clip 12, as a combination of the setting of the write enable (/W) and chip select (/CE) pins of the RAM 2 and the address lines of the RAM 2 carrying an address representing the location of the year register in the RAM 2.

In many cases, the snapshot in response to the second trigger produces a very similar sample of code as that in response to the first trigger, as the temporal data is read from the RTC 4 (first trigger), formatted, and stored in the RAM 2 (second trigger). This sample is particularly useful, however, in cases where the RTC 4 is not accessible, its type is unknown, or the RTC produces data in a serial data format. For year 2000 compliance, the sample should indicate that the date is is being stored with a four-digit year.

The third trigger is very similar to the second trigger, with the difference that the logic analyser 15 recognises the trigger by a read enable of the RAM 2 rather than a write enable. The same addresses of the memory locations that store temporal data in the RAM 2, located by the method described above are used.

The code sample produced in response to the third trigger shows the program code responsible for reading the time and date from its storage location in the RAM 2, the formatting of the retrieved temporal data, the supply of the formatted data to the part of the applications code requesting it, and the manipulation of the temporal data by the applications code. If this code sample does not exhibit the use of four-digit year dates, or implement a compensation method to provide information as to the century, the embedded control system under test can be concluded to be non-year 2000 compliant.

This third trigger provides a neardefinitive criterion for year 2000 compliance, and can be used as the basis for a high-certainty conclusion in the absence of positive indications from the other two triggers.

is In the case of embedded control systems which do not have an RTC 4 or the RTC 4 of which is inaccessible to the system of the invention, the second and third triggers may be used without the first trigger.

Once the sampled "snapshots" of program code have been downloaded to the PC 17, they can be converted from the raw binary data to a numeric form and then into disassembled "human readable" code, by a commercially available code disassembler, such as one manufactured by NCI, USA. In this format, a trained software engineer is capable of examining the program code and determining whether it is year 2000 compliant.

However, if desired, the code sample in numeric form may be automatically compared to previouslyexamined code samples which are stored in a database of classified compliant and non-compliant code samples. Thus, if a match is found, a decision as to compliance or non-compliance can be made automatically. If no match to a previous sample can be made, the three new code samples may be communicated, for example by electronic mail message, together with details of the embedded control system and location, to a central resource capable of providing further expertise, which resource returns a decision as to compliance. Once a decision as to compliance or non-compliance has been made, the sampled code segments are added to the database for use in relation to further embedded control systems.

31 -

Claims

Claims is 1. A method of identifying storage locations in a data store

which are likely to contain temporal data comprising calculating the ratio of a characteristic of the values stored in proximate storage locations and comparing the calculated ratio to a predetermined ratio associated with temporal data.
2. A method of identifying storage locations in a data store which are likely to contain data of an identifiable data type other than temporal data comprising calculating the ratio of a characteristic of the values stored in proximate storage locations and comparing the calculated ratio to a predetermined ratio associated with said data type.
3. A method as claimed in claim 1 or 2, wherein the characteristic is the value stored in a storage location.
4. A method as claimed in claim 1 or 2, wherein the characteristic is the rate of change with respect to time of the value stored in a storage location.
5. A method as claimed in any of claims 1 to 4, wherein the proximate storage locations are adjacent storage locations.
6. A method of identifying storage locations in a data store which are likely to contain temporal data comprising monitoring the respective rate of change with respect to time of the values stored in the storage locations and comparing the monitored rates of change to predetermined rates indicative of standard units of time.

32
7. A method as claimed in claim 6, wherein the rate of change with respect to time is an average rate of change.
8. A method as claimed in claim 6 or 7, wherein the time rate of change is calculated by reference to the number of times data is stored in a storage location over a period of time.
9. A method of testing a computer system substantially as hereinbefore described with reference to the drawings.
10. Apparatus for testing a computer system substantially as hereinbefore described with reference to the drawings.

is