JPS6027952A - Program address malfunction detection system - Google Patents

Abstract

PURPOSE:To monitor address malfunction and to attain a normal return by dividing a program into modules and providing a characteristic index and an index confirming instruction, storing the characteristic index by instruction execution, and detecting the instruction execution and comparing a generated index. CONSTITUTION:The program is executed successively, an index 1 is written in an index register 11 by the index write instruction of the 1st module, and an output significance signal 15 is sent to an incrementer 14 to add one to the contents of the index counter 12. As modules are executed successively, the register 11 and counter 12 are increased equally, one by one, and their contents are compared with each other by an index comparator 13, but they are equal in contents, so a dissidence signal 16 is not sent out. If a jump to a wrong module is caused owing to malfunction, the index is different, so the comparator 13 outputs the signal 16, allowing a CPU17 to perform error processing. An index counter initializing instruction is executed at a head part at the time of branching, returning, or repetition to write the value obtained by subtracting one from the index in the counter 12, and the index is increased by one in the ending, so the indexes become equal. When the signal 16 is received by the CPU17, the contents of the counter 12 are read out and a return to a normal loop is attained.

Description

DETAILED DESCRIPTION OF THE INVENTION [Technical field to which the invention pertains] The present invention relates to a program address malfunction detection method in an information processing device.

[Prior art]

In an information processing device that executes programs and controls peripheral devices, it is important to execute programs in a predetermined order. If a program address malfunction such as an unspecified jump or repetition occurs, the information processing device detects the malfunction and takes a corresponding action.

The conventional program address malfunction detection mechanism divides a program into modules of unit routines that can be divided, places a unique index at the entrance and exit of each module, and proceeds with processing while checking these two indexes. The purpose is to detect runaway behavior outside of that module.

FIG. 1 is a circuit diagram of an example of a conventional address malfunction detection circuit.

In FIG. 1, an index generator 1 outputs an index unique to the module being executed by a first index generation instruction to an index register 2, and the index register 2 temporarily holds this index. The index generator 1 outputs an index specific to the module being executed to the index comparator 3 in response to the second index generation command.

Index comparator 3 compares the index in index register 2 with index generator 1
The indices generated in are compared, and if the two are not equal, a mismatch signal 5 is output to the CPU 4.

As shown in FIG. 2, the program Kirinari is divided into modules of divisible unit routines, and each module has a first index generation circuit at the beginning of each module, and a second index generation instruction at the end. The first index generation command and the second index generation circuit in the same module cause the index generator 1 to output the same index.Now, when the first index generation command in the module is executed, , indicator generator 1 ore module M
, and stores it in index register 2.
holds. When the program continues along the predetermined route and the second index generation command is executed at the end of the module, the index generator 1 generates the second index, and the index comparator 3 reads this second index. and the first index held in the index register 2. As a result of the comparison, if the first index and the second index do not match, the index comparator 3 outputs a mismatch signal 5 to the CPU 4. Upon receiving the mismatch signal 5, the CPU 4 detects a malfunction in the program address and performs an error processing operation.

If the program is executed according to a predetermined route, the first index and the second index are unique to module M2 and are equal. However, if a malfunction occurs in the program address and the execution jumps to module M, as shown by the arrow, during the execution of module M, the second index generation instruction will be executed by the index generation instruction of module M3. be done. At this time, the index generator 1 is the module M
Since this second index and the first index unique to the module M held in the index register 2 have different values, the index comparator 3Fi generates a mismatch signal 5. Output 1 for CPU 4K, CPU
4 receives this and detects the operation of the program address.

However, the conventional detection schemes described above have several drawbacks.

Although it is advantageous that within the same program module its execution follows the specified route, it is impossible to detect whether the valley modules are executed according to the specified order. For example, just Executing one module by skipping all 5 modules ↓ An error like this: ``No, I don't run the same module over and over again. I can't detect it at all.

Second, since the partner generation instruction is easy to execute, the index generation i1j instruction can be executed even if the address malfunctions b1.
U6” ゛Rudder characteristics. Therefore, address malfunction &C
However, there is a high risk that the correct index will be written, and if this happens, malfunctions will not be detected. Unfortunately, there is little certainty in detecting an emergency situation such as an address malfunction.

Third, even if an address malfunction is detected, there is no way to confirm the module where the malfunction occurred, and it is impossible to return to the program module before the address malfunction and retry. It is.

[Purpose of the invention]

SUMMARY OF THE INVENTION An object of the present invention is to provide a program address malfunction detection method that can eliminate the above-mentioned drawbacks, reliably monitor the entire program address for serial address malfunction, and restore the normal route when runaway is detected. It is in.

[Structure of the invention]

A first aspect of the present invention is to divide a program into divisible units of modules, provide each module with a unique index corresponding to the order of execution, and an index confirmation instruction having the unique index as index information, A first index storage means that stores the unique index as the index information in the index confirmation command as a first index upon execution of the index confirmation command; an index generation circuit that generates a second index, a second index storage means that holds the second index, and one index storage means that corresponds to the unique index of the actually executed module in the first index storage means. By comparing the first index of IJ and the second index corresponding to the unique index of the module to be executed due to the configuration of the program in the second index storage means, the program and index comparison means for detecting address malfunctions.

A second aspect of the present invention is to divide a program into divisible unit modules, and provide a unique index corresponding to the execution order for each module, and a first index confirmation instruction having the unique index as index information. A second index confirmation instruction is provided, and upon execution of the first index confirmation instruction, a first auxiliary register that holds index information in the first index confirmation instruction; a second auxiliary register that holds index information in the second index confirmation instruction upon execution; and a first determination signal that is determined depending on the contents of the first auxiliary register and the second auxiliary register. and a first condition determination circuit that outputs the index information in the first index confirmation command and the second index confirmation command upon receiving the first determination signal output from the first condition determination circuit. a first index storage means for storing a unique index of the module as a first index from index information in the module;
detecting that the first index is held in the index storage means and storing the second index.
an index generation circuit that generates an index of A write operation is performed by an index rewrite command. a fourth auxiliary register 7, a second condition determination circuit that outputs a second determination signal depending on the contents of the third auxiliary register and the fourth auxiliary register; means for changing the contents of the second index storage means according to the contents of the third auxiliary register and the fourth auxiliary register; Comparing the first index corresponding to the unique index of the module and the second index corresponding to the unique index of the module to be executed due to the configuration of the program in the second index storage means. and index comparison means for detecting address malfunctions in the program.

[Explanation of Examples]

First, the configuration of a program used in an embodiment of the present invention will be explained.

FIG. 3 is a 70-chart for explaining a first configuration example of a program used in the embodiment of the present invention.

Module M1 of a unit routine that can divide the program
~M, '~Mn, and 1. to the south between each module corresponding to the execution order. 2. 3. ..., i, ...
..., and use this as the index of that module. An index write command is placed at the end of each module as an index confirmation command.

The fourth diagram is a flowchart for explaining a second configuration example of a program used in the embodiment of the present invention.

This configuration example is an example where there is a repeat loop between program modules. In this case, the index counter initialization instruction (
(instruction to set the value of the index counter to i) is placed.

FIG. 5 is a 70-chart for explaining a third configuration example of a program used in the embodiment of the present invention.

This configuration example is an example where there is a conditional branch between program modules. In this case, for each execution route between each branch, for example, i, i+1, . j+
2.・・・−・・;j, j+1. j+2゜...
, -; to lc+1. k+2. Assign a number to the module, such as ...;, and use this as the index of that module. An index counter initialization instruction 22 is placed at the beginning of the first module of each branched route and at the beginning of the first module of the merged execution route.

Next, examples of the present invention will be described.

FIG. 6 is a block diagram of an embodiment of the present silk 1 invention.

This embodiment is divided into the program explained in FIGS.
When a program in which indexes m and g instructions are provided is executed, the index writing command 21 as an index confirmation command is executed, and the unique index as index information in the index writing command is held as the first index. An index register 11 as a first index storage means, an incrementer 14 as an index generation circuit that detects execution of an index write command and generates a second index, and a second index that holds the second index. An index counter 12 as a storage means and a first index corresponding to the unique index of the actually executed program module in the index register 11.

An index comparing device 13 serves as an index comparing means for detecting address malfunction sounds of the program by comparing a unique index of a module to be executed in the index counter 12 with a second index corresponding to the unique index of the module to be executed based on the configuration of the program. It consists of:

More specifically, the index register 11 is a register into which an index is written by an index write command. When the index is written to the index register 11, a write-in effect signal 15 is output to the incrementer 14. Index register 11 is a register that holds indices, and index counter 12 is a counter that counts the number of indices held in index register IIK, the contents of which cannot be read or changed by commands. The index comparator 13 compares the contents of the index register 11 and the index counter 12, and outputs a mismatch signal 16 to the CPU 7 if the values are different.

Next, the operation of this embodiment will be explained.

First, we will explain the case of checking the execution route of a program that does not include conditional branches or repeat loops between program modules, as shown in Figure 3.1 Figure 7 shows the index register and the index register shown in Figure 6. Indices and counts stored in the indicator counter3. It is a figure explaining the storage state of.

In the initial state before program execution, the index register 11 and index counter 12 both contain 0. The index "'1" is written in the index register 11 by the index write command 4. At this time, the fC-* writing valid signal 15 output from the index register 11 is sent to the incrementer J4, and the incrementer 14 Add 1 to the contents of the index counter 12. This is equal to the same value as the index register IJ.Hereafter, as we execute the modules one after another, the contents of the index register 11 and the index counter 12 are equally incremented by 1. To go.

The contents of the index register 11 and the contents of the index counter 12 are compared by an index comparator 13 whenever rewriting is performed. If the program follows a predetermined route and each module is executed in order, the contents of the index register 11 that holds the number of the module that has finished execution, and the index counter that indicates the number of index write instructions of the module that has actually been executed. The contents of 12 are equal. Therefore, index comparator] 3 is a mismatch signal 1
6 is not output.

Due to the occurrence of program address malfunction, the module Mi
If execution jumps to module Mj from the middle of execution, an index write command is executed at the end of module Mj, and index "j" is stored in index register 11. On the other hand, since the number of index write instructions of the module executed up to this point is i, the index counter 1
The content of 2 is i''. Therefore, the index comparator 13 compares the two and outputs a mismatch signal 16 to the CPU 17, whereby the CPU 17 detects that a malfunction has occurred in the program address.

Based on the basic operation of address malfunction detection described above,
Next, a mechanism for checking the execution route in a program that branches midway as shown in FIG. 5 and a program having a repeat loop as shown in FIG. 4 will be described.

At the beginning of the first program module to be executed after branching or merging, the index counter initialization instruction 22 described above is executed, and the index counter 12 is filled with a value subtracted by 1 from the index of the branched program module. Write. The program is executed sequentially, and when the execution of this module is completed, the index value of this first module is written to the index register 11 by the index 1 insert instruction 21,
The value of the index counter 12 increases by one, so that it becomes equal to the value of the index. As a result, from υ onwards, the execution route is checked in the same way as the program address malfunction detection mechanism when there are no branches between program modules. As shown in FIG. 5, if the initial value of the index counter 12 is set differently by each index counter initialization instruction, a malfunction that branches from one route to another route in the middle of parallel execution routes will be detected. I can do that.

Next, as shown in FIG. 4, if there is a repeat loop, in order to re-execute the previously executed module, an index counter initialization instruction is executed when branching, and the index counter 12 is re-executed. Write the value minus 1 from the index value of the program module.

When the execution of the first re-executed program module is completed, the index value is written to the index register 11 in the same process as in the case of branching, and the index counter 12 has a value equal to the index value. This allows detection of program address malfunctions when module repeat loops are not included.
The execution route is checked in the same way as in structure A.

Next, the mechanism for returning to the normal route will be explained. Upon receiving the mismatch signal 15, the CPU 17 immediately proceeds to address malfunction processing. In this process, the CPU
7 reads out the contents of the index counter 12 through the data bus 18. This is the number of a module that would not normally have been executed if a program address malfunction had not occurred.

The module number is one-to-one with the module's start address.
Because of this correspondence relationship, the CPU 17 can read the start address of the module that should originally be executed and return to the normal execution route.

Next, the second investigation will be explained.

First, the structure of the program used in the embodiment of the invention of Honkinu 2 will be explained.

FIG. 8 is a diagram showing the configuration of an index write command of a program used in an embodiment of the invention of Honkinu 2, and FIG. 9 is a diagram showing the configuration of an index counter initialization instruction of a program used in an embodiment of the invention of Honkinu 2. FIG.

As shown in FIG. 3, the program is divided into modules of unit routines, and each module has a unique number 1. 2. 3. Attach ... and use it as an index. As shown in Figure 8, each module Δ
11 followed by the first index write command 41 at the end of Fi.
and the second index write command 42 are placed.

As shown in FIG. 5, when there is a conditional branch between program modules, each branched module Mi,
At the beginning of Mk and the beginning of the first module M/ of the merged execution route, as shown in
In FIG. 9, these modules are represented by module Mk), and the first index counter initialization instruction 43
and a second index counter initialization instruction 44.

Next, an embodiment of the second invention will be described.

FIG. 1O is a block diagram of an embodiment of the present silk 2 invention.

This embodiment is divided into the programs explained in FIGS. 3, 5, 8, and 9, that is, modules, and includes a first index write command (first index confirmation command) and a second index write command. When executing a program that includes an instruction (second index confirmation instruction) and, if there is a conditional branch, first and second index counter initialization instructions, the first A first auxiliary register 60 for holding the index information in the first index write instruction 41 for execution of the index write instruction 41, and a first auxiliary register 60 for holding index information in the first index write instruction 41, and for execution of the second index write instruction 42 as a second index confirmation instruction. A second auxiliary register 61 that holds index information in the second index write instruction 42
a first ratio device 62 as a first condition determination circuit that outputs a first determination signal depending on the contents of the first auxiliary register 60 and the second auxiliary register 62; In response to the first judgment signal output from the weapon 62, the index information in the index write command 41 of ml and the second index write command 4
An index register 51 as a first index storage means that stores the unique index of the module as a first index from the index information in index information in the index register 51, and retains the index of Ml in the index register 51 upon receiving the first determination signal. An incrementer 54 as an index generation circuit that generates a second index based on the knowledge, and an index counter 52 as a second index storage means that holds the second index.
Then, a third subtraction operation is performed according to the first index counter initialization instruction 43 as a first index rewrite command.
The contents of the auxiliary register 64, the fourth auxiliary register 65 in which the convolution operation is performed by the second index counter initialization instruction 44 as the second index rewriting instruction, and the contents of the third auxiliary register 64. The contents of the fourth auxiliary register 65 include an 8142 comparator 66 as a second condition judgment circuit which outputs a second judgment signal, and a third auxiliary register which receives the second judgment signal outputted from the 8142 comparator 66. 64 contents and 4th
a second gate 67 as means for rewriting the contents of the index counter 52 according to the contents of the auxiliary register 65; and the first index corresponding to the fixed index of the actually executed program module in the index register 51. and a second index corresponding to the unique index of the module to be executed based on the configuration of the program in the index counter 52. An index ratio as an index comparison means for detecting address malfunction of the program. Softener 53.

To explain in more detail, the first auxiliary register 60 is written with the inverted logical value i of the index by the first index write command 41, and the auxiliary register 61 of 'ig2 is written by the second index write command 42. This is the register into which index i is written. The first ratio device 62 compares the contents of the first auxiliary register 6o and the second auxiliary register 61, and outputs a write valid signal 55 to the l-th gate 63 and the incrementer 54 when both are inverted values. do. The index register 51 is a register that holds indices, and the index counter 52 is a counter that counts the number of indices held in the index register 51, the contents of which can be read by a command.

The third auxiliary register 64 is written with the inverted value of the initial value of the index counter by the first index counter privatization instruction 43, and the fourth auxiliary register 65 is written by the second index counter initialization instruction 44. This is a register into which the initial value of the index counter is written. The second comparator 66 compares the contents of the third auxiliary register 64 and the fourth auxiliary register 65, and when the contents of the third auxiliary register 64 and the fourth auxiliary register 65 are inverted, the initialization valid signal 68 is set to the second value (67).
Output for. The index comparator 53 is the index register 51
The content of the index counter 52 is compared with the content of the index counter 52, and if the values are different, a mismatch signal 56 is outputted to the CPU 57.

Next, the operation of this embodiment will be explained.

First, writing to the index register 51 and index counter 52 as index storage means will be explained.

The content of the storage means of the index to check the program address is easily 41! If this is possible, there is a risk that the data in the index storage means will be rewritten when an address malfunction occurs, and if this happens, there is a risk that the address malfunction cannot be detected accurately.

Therefore, in the present invention, an error in changing index contents is prevented by providing a double write command.

In the case of a write operation to the index register, as shown in FIG. written to. Then the second
The write instruction 42 to the second auxiliary register 61 is executed, and the index i is written to the second auxiliary register 61. The first comparator 62 outputs the write enable signal 55 to the first gate 63 only if both values are convolved exactly in this order and are inverted values. When the first gate 63 receives this signal, it closes its gate and stores the index in the second auxiliary register 61 in the index register 51. The same applies to the convolution operation to the index counter 52.

As shown in Figure 5, at the beginning of the program module at the branch point or confluence of the program,
As shown in the figure, first, the first index counter initialization instruction 4
3, storage into the third auxiliary register 64 is executed, and the inverted value of the initial value of the index counter is written into the third auxiliary register 64. Subsequently, writing to the fourth auxiliary register 65 is executed by the second index counter initialization instruction material, and the initial value of the index counter is written to the fourth auxiliary register 65 -! ! 't'Lru. If both values are written in exactly this order and they are inverted values, then the second ratio collector 66 transfers the initialization valid information 68 to the second value.
Output to gate 67. The second gate 67 is this (
Upon receiving number g, the gate will be opened and the fourth auxiliary register 6 will be opened.
The initial value of the index counter in 5 is stored in the index counter 52.

Next, see FIG. 7 for a mechanism for checking the execution route of a program that does not include conditional branches or repeat loops between program modules as shown in FIG. 3, using the index held in the index register 51. I will explain while doing so.

In another initial state when the program is executed, the index register 5
1. The contents of both the index counters 52 and 52 are '0'. When the program is executed sequentially and a successful module is completed, the index '1' is written to the index register 51 by the above-mentioned index write command. .

At this time, the write valid signal 55 output from the first comparator 62 is also sent to the incrementer 54, and the incrementer 54 adds 1 to the contents of the index counter 52. This is equivalent to the contents of index register 51. Thereafter, by successively executing the module, the contents of the index register 51 and the index counter 52 are equally incremented by one.

The contents of the index register 51 and the contents of the index counter 52 are compared at index comparison 'a53 every time there is rewriting. If the program executes each module in sequence according to a predetermined route, the contents of the index register 51 that stores the number of the module that has finished execution, and the index counter that indicates the number of index instructions of the module that has actually been executed. The contents of 52 are the same.

Therefore, the index comparator 53 does not output the mismatch signal 56.

To prevent program address malfunction, module M
If the execution jumps from the middle of execution of module Mj to the execution of module Mj, the first . The second index write commands 41 and 42 are executed, and the index IT+ is stored in the index register 51. On the other hand, the first module of the module executed up to this point. Since the number of second index confirmation commands is i, the content of the index counter is "lit".

Therefore, the index ratio softener 53 compares the two, and detects the discrepancy information 5.
6 is output to the CPU 57, and the CPU detects that there is a malfunction in the program address.

Based on the basic operation of address malfunction detection described above,
Next, a mechanism for checking the execution route in a program that branches midway as shown in FIG. 5 and in a program having a repeating loop as shown in FIG. 4 will be explained.

The index counter initialization instruction 4 mentioned above is executed at the beginning of the module that is branched, merged, and executed first.
3 and the second index counter initialization instruction 44 are executed, and a value obtained by subtracting 1 from the index of the branched program module is stored in the index counter 52. When the program is executed J times and the execution of this module is completed, the index value of this first module is written to the index register 51 by the index write instruction described above, and the value of the index counter 52 is increased by one. equal to the value of the index.

Accordingly, the execution route is checked in the same manner as the program address malfunction check in the case where there are no branches between program modules. As shown in FIG. 5, if the initial values of the index counters 52 are set differently by each index counter initialization command, a malfunction will occur that will cause branching from one route to another route in the middle of parallel execution routes. can be detected. If you have a repeating loop.

When branching to re-execute a previously executed module, an index counter initialization instruction is executed, and the index counter 52 is
Index of program modules to be re-executed from 1 to 1
Subtract the value by 1. When the execution of the first re-executed program module is completed, the index value is stored in the index register 51 in the same process as in the case of the minute limit, and the index counter 52 has a value equal to the index value. As a result, the execution route is checked in the same manner as the program address malfunction detection mechanism when the module does not include a repeating loop. 7 Next, we will explain the mechanism that prevents you from returning to the regular route. Upon receiving the mismatch signal 56, the CPU 57 immediately proceeds to address malfunction processing. In this process, the CPU
57 outputs the contents of index counter 52 through data bus 58 . This is the number of the module that would normally have been executed if no program address malfunction had occurred. The module number is the start address of the module and 1
Since there is a one-to-one correspondence relationship, the CPU 57 can read the start address of the module to be executed and return to the normal execution route.

〔Effect of the invention〕

As explained above, the present invention has the advantage of being able to monitor the execution of a program in accordance with a predetermined sequence throughout the entire program. It is possible to detect and restore to the normal route.For this reason, it is useful as a method for detecting program address malfunctions in information processing equipment, and is especially useful in environments where the usage environment is severe, such as in process control, etc. It has practical effects in applications in fields where the processing order is strictly defined.

[Brief explanation of drawings]

FIG. 1 is a circuit diagram of an example of a conventional address malfunction detection circuit, FIG. 2 is a flowchart of an example of a program configured to perform conventional address malfunction detection, and FIGS. 3 to 5 are embodiments of the present invention. 6th flowchart for explaining the first to third configuration examples of the program used for
The figure is a block diagram of one embodiment of the invention of this publication, FIG. 7 is a diagram explaining the storage state of the index and count value stored in the index register and index counter shown in FIG. 6, and FIG.
FIG. 9 is a diagram showing the configuration of the index counter initialization instruction used in the embodiment of the invention of this Eki 2, and FIG. 1 is a block diagram of an embodiment of the invention; FIG. 1... Index generator, 2... Index register, 3... Index comparator, 11... Index register, 12... Index Counter, 13...
...Indicator comparator, 14...Incrementer,
15...Write valid signal, 16...Disagreement signal, 17...CPU, 18...
Data bus, 19...Address bus, 21...
... Index write command, 22 ... Index counter initialization command, 41 ... First index write command, 42 ... Second index write command, 43 ...
...First index counter initialization instruction, 44...
- Second index counter initialization instruction, 51... Index register, 52... Index counter, 53...
...Indicator comparator, 54...Incrementer 155...Write valid signal, 56...
Mismatch signal, 57... CPU, 58... data bus, 59... address bus, 60...
・First auxiliary register, 61... Second auxiliary register, 62... First comparator, 63...
- 1st gate, 64... River - 3rd auxiliary register, 65
...Fourth auxiliary register, 66... Second comparator, 67... Second gate, 68...
...Initialization valid signal 13 Figure 萬 4 Figure line 5 Figure line 6 Tuko, grab 'Jiki, [Roa ■) Ding 7 Ding 1 Prayer purple sister [] 7 Ding Σ mouth low n) i, 'i , 力'+ :, ri↓ 箭l7joules　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　
] Finger P! b Jistaro ■ Non-sweat Roa ■ Ball ■ Mouth Nokabuton・
↓ Money ζZ Shiney Kenmura Saimu [Σ0006)l) 10 1
Shinshi Sista [Feather] 7 [Chobe Feather] 70 King Σ1 ``=1 Shi Luck ``A I Ding Shirutoushida! [■7T7 [Loa] 7T stone [l
8 mung sword → Nanda body 7 shi] 〃 口↓ Inscription q Diagram

Claims (1)

[Claims] 1. Divide the program into divisible units of modules, and provide a unique index corresponding to the execution order for each module;
An index confirmation command including the unique index as index information is provided, and upon execution of the index confirmation command, a first index that holds the unique index as the index information in the index confirmation command as a first index is provided. an index storage means, an index generation circuit that detects execution of the index confirmation command and generates a second index, a second index storage means that holds the second index, and the first index storage means. the first index corresponding to the specific index of the actual-executed module within; and the second index.
index comparison means for detecting an address malfunction of the program by comparing the index with the second index corresponding to the unique index of the module to be executed based on the configuration of the program in the index storage means of the program; A program address malfunction detection method characterized by comprising: 2. Divide the program into divisible unit modules,
A unique index corresponding to the execution order for each module, and a first index confirmation command and a second index confirmation command each having the unique index as index information are provided, and the execution of the first index confirmation command A first auxiliary register that holds index information in the first index check instruction; and a second auxiliary register that holds index information in the second index check instruction upon execution of the second index check instruction. an auxiliary register; a first condition determination circuit that outputs a first determination signal depending on the contents of the first auxiliary register and the second auxiliary register; and an output from the first condition determination circuit. a first determination signal that receives the first determination signal and holds the unique index of the module as a first index from the index information in the first index confirmation command and the index information in the second index confirmation command; an index storage means, an index generation circuit that receives the first determination signal, detects retention of the first index in the first index storage means, and generates a second index; a second index storage means for holding an index; a third auxiliary register in which a write operation is performed in response to a first index rewrite instruction; and a fourth auxiliary register in which a write operation is performed in response to a second index rewrite instruction; a second condition determining circuit that outputs a second determination signal based on the contents of the third auxiliary register and the fourth auxiliary register;
means for rewriting the contents of the second index storage means according to the contents of the auxiliary register and the contents of the fourth auxiliary register; the first index corresponding to the index; and the second index corresponding to the unique index of the module to be executed due to the configuration of the program in the second index storage means.
and index comparison means for detecting address malfunctions in the program by comparing indices of the program address malfunctions.