High reliability processor system

• US 8,615,684 B2
• Filed: 04/18/2011
• Issued: 12/24/2013
• Est. Priority Date: 04/18/2011
• Status: Active Grant

• Current Assignee: Astronautics Corporation of America
• Original Assignee: Astronautics Corporation of America
• Inventors: Hering, Jeffrey
• Primary Examiner(s): Maskulinski, Michael
• Assistant Examiner(s): MILES, NEIL D
• Application Number:
  US13/088,597
• Publication Number:
  US 20120265973A1
• Time in Patent Office: 981 Days
• Field of Search: 714/10, 714/38.1
• US Class Current: 714/38.12
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 9/226 Microinstruction function, e.g. input/output microinstruction; diagnostic microinstruction; microinstruction format

Abstract

A method of testing the integrity of microprogramming within a computer processor employs a test calculation designed to exercise instructions and to reveal errors in those instructions. The problem of testing instructions using the very instructions which may possibly be corrupt is addressed by developing a signature passed from instruction to instruction providing a low likelihood of a false positive outcome. A time-out system is used in the evaluation of the test calculation to capture a wide variety of other pathological operating conditions.

Claims

1. A computer system comprising:

a processor executing a stored program, the processor providing for an execution of instructions on the processor, the stored program executing on the processor to;

(a) perform functions of a first application program employing at least a subset of the instructions;

(b) perform a calculation employing the subset of the instructions, the calculation provoking an error state of the processor when any of the subset of the instructions is not operating correctly, the calculation further entering a predetermined delay loop when the results of a given instruction in the calculation are incorrect;

wherein the processor includes a timer triggering an error state at a conclusion of a predetermined time and wherein the calculation is performed repeatedly at a period less than the predetermined time and wherein the processor resets the timer using at least one instruction in the subset of instructions only when the result of the calculation matches a correct output value and wherein the correct output value provides an address of a memory mapped reset of the timer used by the processor to reset the timer.

2. The computer system of claim 1 wherein the subset of the instructions accept data operands and flag operands and produce data results and flag results and wherein the calculation is provided with given data operands and flag operands and provokes the error state when the instructions do not produce correct data results or correct flag results.

3. The computer system of claim 2 wherein the instructions include at least both addition and subtraction and wherein the flag operand and flag result are selected from the group consisting of:

carry, sign and overflow flags.

4. The computer system of claim 2 wherein the calculation employs each instruction at least twice with different data operands.

5. The computer system of claim 2 wherein the different operands produce different flag results for a given flag type.

6. The computer system of claim 2 wherein the calculation employs each instruction at least twice with different flag operands for a given flag type.

7. The computer system of claim 1 wherein the calculation tests first results of each instruction to provoke an error state in the processor when any of the first results of any given instruction are not correct and wherein the calculation tests at least one second result depending on a cumulative execution of the given instructions and provokes an error state in the processor when the second results are not correct.

8. The computer system of claim 1 wherein the calculation writes a value to an address equal to the output of the calculation depending on a cumulative execution of the instructions and wherein when the subset of instructions executes correctly the output of the calculation matches an address for a reset input to the timer.

11. The computer system of claim 1 wherein a plurality of operands for a plurality of given instruction are pseudorandomly related.

12. The computer system of claim 1 wherein the first application program interacts with avionics equipment during aircraft flight.

9. A computer system comprising:

a processor executing a stored program, the processor providing for an execution of instructions on the processor, the stored program executing on the processor to;

(a) perform functions of a first application program employing at least a subset of the instructions;

(b) perform a calculation employing the subset of the instructions to calculate a value, the calculation provoking an error state of the processor when any of the subset of the instructions is not operating correctly;

wherein the calculation enters a predetermined delay loop when data results of a given instruction or flag results of a given instruction in the calculation are incorrect;

wherein a correct value of the calculation provides an address of a memory mapped reset of a timer used by the processor to reset a timer, the timer triggering an error state at a conclusion of a predetermined time; and

wherein the processor resets the timer using at least one instruction in the subset of instructions.

10. The computer system of claim 9 wherein the delay loop is an infinite loop.

13. A method of testing a processor of a type providing for the execution of instructions on the processor, the method comprising the steps of:

(a) performing the functions of a first application program employing at least a subset of the instructions;

(b) performing a calculation employing the subset of the instructions, the calculation providing a predetermined value when the subset of instructions is properly operating;

(c) provoking an error state of the processor when the calculation provides a value different from the predetermined value and by entering a predetermined delay loop when data results of a given instruction or flag results of a given instruction in the calculation are incorrect;

(d) wherein the processor includes a timer triggering an error state at a conclusion of a predetermined time and wherein the calculation is performed repeatedly at a period less than the predetermined time and wherein the processor resets the timer using at least one instruction in the subset of instructions, wherein the predetermined value provides an address of a memory mapped reset of the timer used by the processor to reset the timer; and

wherein the processor resets the timer using at least one instruction in the subset of instructions.