JP2668382B2 - Pseudo fault generation method for testing microprograms - Google Patents

Description

The present invention relates to the testing of microprograms, and in particular to
The present invention relates to generation of a pseudo fault for testing a fault handling function.

[Conventional technology]

To improve reliability, microprograms usually include a fault handling routine, which typically records the occurrence of a fault and takes actions that have not been performed correctly due to the fault. To retry.
In order to test whether the fault handling routine functions normally, it is necessary to generate a pseudo fault during the test.

The most rudimentary pseudo fault generation method is to manually fix the interface signal from the controlled hardware to the microprogram controller in a certain state. As a slightly advanced method, a circuit for artificially generating a signal indicating the occurrence of a failure is also provided. There is also known a method of rewriting an appropriate microinstruction in a microprogram under test into a microinstruction that creates an error state. Further, the pseudo-failure generating device described in Japanese Patent Application Laid-Open No. 62-17839 includes an address compare register in which the address of a micro-instruction in which a pseudo-failure should occur during execution is set, and a micro-instruction for generating an error state. When the address of the read microinstruction matches the address set in the address compare register, the microinstruction set in the proxy instruction register is executed instead of the read microinstruction. At the same time, the subsequent address match signal is suppressed, so that a pseudo failure occurs only once when the microinstruction at the desired address is executed.

[Problems to be solved by the invention]

According to the conventional pseudo-failure generating method or apparatus as described above, the pseudo-failure state is fixed, the pseudo-failure always occurs every time a specific microinstruction is executed, or the pseudo-failure is determined by the specific pseudo-instruction. Whether it occurs once and ends when the microinstruction is executed. That is, according to the related art, the timing (the position in the flow of processing by the microprogram) and the number of occurrences of the pseudo failure cannot be set freely. Therefore, for example, a pseudo fault occurs after a predetermined number of iterations of a predetermined routine, or
According to the prior art, complicated test conditions such as occurrence of a pseudo fault after a predetermined number of times of a predetermined routine and return to a normal state after a predetermined number of retries cannot be set. Then, unless the test under such conditions is performed, the test of the failure processing function cannot be said to be sufficient.

An object of the present invention is to make it possible to freely control the occurrence of a simulated fault in a test of a fault handling function of a microprogram with respect to the timing and the number of times, thereby enabling setting of such complicated test conditions as described above. Is to

[Means for solving the problem]

The present invention counts the number of times the microinstruction at the address specified as a waypoint is executed to control the position where the pseudo failure occurs in the processing flow, and after the number reaches the specified number, A pseudo failure occurs when the address of the microinstruction to be executed matches the address separately designated as the pseudo failure occurrence point.

Further, after the pseudo-failure is generated by the above-described method, the number of matches between the address of the microinstruction to be executed and the address specified as the pseudo-failure occurrence point is calculated, and the number is separately specified. After that number is reached,
Prevent the occurrence of pseudo failure.

[Operation] According to the first method, a pseudo fault occurs after a specified process is executed a predetermined number of times, and before that, a microinstruction of an address specified as a pseudo fault occurrence point is executed. However, no pseudo failure occurs.

Furthermore, according to the second method, after the designated process is executed a predetermined number of times, a pseudo fault occurs in a predetermined number of times of repeating the designated process, and then the normal state is restored.

〔Example〕

FIG. 1 shows a block diagram program by way of example of a microprogram controller for implementing the present invention. The microprogram execution unit 1 is a normal one, not shown for the sake of simplicity, but includes a control memory for holding a microprogram, an order control circuit for sequentially reading microinstructions from the control memory, It consists of a circuit which decodes each read microinstruction and generates a control signal, and a circuit related to them. However, the instruction execution address register (IEAR) 2 that holds the address of the microinstruction to be read is illustrated as if it were outside the microprogram execution unit 1 for convenience of explanation.

A waypoint address register (RPAR) 3 and a fault occurrence address register (EOAR) 4 are provided according to the present invention. The transit point address register 3 is for holding the address of a microinstruction to be passed a predetermined number of times before a pseudo fault occurs, and the fault address register 4 generates a pseudo fault at the time of execution. This is for holding the address of the microinstruction to be performed. The comparison circuit 5 compares the contents of the instruction execution address register 2 with the contents of the waypoint address register 3 and if they match,
The countdown circuit 7 is activated to decrement the content of the counter 8 by "1". The initial value of the counter 8 is set to the number of times (RPTCNT) the access point address must be accessed before the occurrence of the pseudo failure. When the count value of the counter 8 reaches "0", the first failure occurrence permission signal 14
Is generated and this signal 14 inhibits the countdown circuit 7 and energizes the first input of the AND circuit 9.

The comparison circuit 6 compares the contents of the instruction execution address register 2 with the contents of the failure occurrence address register 4, and if they match, a failure occurrence address match signal 16 is generated, and this signal 16 is the second signal of the AND circuit 9. Force the input of. First
When the failure occurrence address coincidence signal 16 is generated while the failure occurrence permission signal 14 is present, the output of the AND circuit 9 activates the countdown circuit 10 to reduce the content of the counter 11 by "1". As the initial value, the counter 11 is set to the number of times that the pseudo fault should occur successively (ERRCNT).
The counter 11 generates the second fault occurrence permission signal 15 unless the count value is "0". The count value of counter 11 is “0”
When, the generation of the second fault occurrence permission signal 15 is stopped, and at the same time, the countdown circuit 10 is suppressed.

The AND circuit 12 receives the first failure occurrence permission signal 14, the second failure occurrence signal 15, and the failure occurrence address match signal 16,
When all of them are present, a failure occurrence instruction signal 17 is generated, and the failure generation circuit 13 generates a pseudo failure signal 18 in response to the failure occurrence instruction signal 17. Pseudo fault signal 18
Is generated, for example, by setting the error indication latch. A set of respective address values to the waypoint address register 3 and the failure occurrence address register 4,
The setting of the respective initial values for the counters 8 and 11 may be performed manually or via a service processor.

FIG. 2 shows an outline of an example of the microprogram executed by the microprogram execution unit 1 shown in FIG. This microprogram 20 is an interrupt processing routine 21
And a microprogram under test 22, and the microprogram under test 22 includes a failure handling routine 23. However, the interrupt processing routine 21 does not participate in the operation of the embodiment shown in FIG.

FIG. 3 is a flow chart showing an outline of the microprogram 22 under test. This micro program is a process A
Is normally ended three times in succession, and if any of the processes A ends in error before that, the processing ends in error. In the figure, the processing A three times is shown separately, but in reality,
A single process A subroutine is repeated three times.

FIG. 4 is a flow chart showing the details of the process A in FIG. In the figure, RTYCNT represents the number of retries and CNT represents the number of iterations. Steps 40 and 4
In step 1, after RTYCNT and CNT are each reset to "0", the process B42 is performed. If the result of decision 43 is that no fault is detected, CNT must be incremented by "1" at step 44, RTYCNT must be reset to "0" at step 45, and then CNT must reach "5" at decision 46. If step 4
When 2 to 46 are repeated and CNT reaches “5”, the process ends normally. However, if a failure is detected as a result of judgment 43, a retry loop is entered, and after failure processing (reporting of failure occurrence, collection / recording of failure information, etc.) 47, RTYCNT is entered at step 48.
If RTYCNT does not reach "3" in decision 49 after "1" is added to, retry is repeated and RTYCNT becomes "3".
Is reached, an error ends. In short, process A is
This is a subroutine that repeats process B five times.
Up to consecutive retries are allowed.

It is assumed that it is desired to generate a pseudo fault three times consecutively during the execution of the second process A for the test of the microprogram described above. Under this test condition, error termination should occur in the second processing A. In order to realize this test condition, the address (RPTADR) of the microinstruction corresponding to step 40 in FIG. 4 is set in the waypoint address register 3 in FIG.
Is set, and numerical values "2" and "3" are set in the counters 8 and 11, respectively. In Figure 4, the symbols RPTADR and ERRADR with arrows pointing to each point in the process flow are
Each indicates the point where the transit point address (RPTADR) and the fault occurrence address (ERRADR) are accessed.

When the first process A is started, the point RP in FIG.
In TADR, the comparison circuit 5 shown in FIG. 1 detects a match, and the count value of the counter 8 is counted down to "1". The first fault occurrence permission signal 14 has not yet been generated. After that, at the point ERRADR in FIG. 4, the comparison circuit 6 generates the fault occurrence address coincidence signal 16. However, since the first fault occurrence permission signal 14 has not been generated, the counter 11
Is kept at the initial value "3", the fault occurrence instruction signal 17 is not generated, and therefore, the pseudo fault signal 18 is not generated. As a result, the process of FIG. 4 proceeds through steps 44-46 and returns to process B. At this time, the comparison circuit 6 generates the failure occurrence address coincidence signal 16 again, but nothing happens because the first failure occurrence permission signal 14 does not exist.
Thus, after the fifth iteration of the process B, the first process A ends normally.

When the second process A is started, at the point RPTADR, the comparison circuit 5 generates a coincidence signal, whereby the count value of the counter 8 is counted down to "0", and is kept at that value thereafter. As a result, the first fault occurrence permission signal 14 is generated. Thereafter, at the point ERADR, the comparison circuit 6 generates the failure occurrence address coincidence signal 16. At this point, the count value of the counter 11 is the initial value “3”, and therefore, the second fault occurrence permission signal 15 has already been generated. As a result, the AND circuit 17 generates the fault occurrence instruction signal 17, and in response thereto, the pseudo fault signal 18 is generated. in the meantime,
In response to the output of the AND circuit 9, the count value of the counter 11 is counted down to "2". This time, judgment 43 in FIG.
A failure is detected in step S21, and as a result, a retry loop is executed which returns to the process B through steps 47 to 49.

During this first retry, at the point ERRADR, the comparison circuit 6 again detects a match, and outputs the failure address match signal.
Then, the pseudo failure signal 18 is generated again, and the count value of the counter 11 is counted down to "1". The occurrence of the second pseudo failure again causes a branch to a retry loop. During the second retry, the count value of the counter 11 has not reached "0" yet, so a pseudo fault is generated again, and a branch is made to the retry loop. However, the value of RTYCNT has already reached "3", which results in error termination. At the same time as the occurrence of the third pseudo failure, the counter 11
Has reached "0", whereby the subsequent countdown is blocked, the second fault occurrence permission signal 15 is terminated, and the generation of the pseudo fault is stopped.

As an example of other test conditions, set the initial value of counter 11 to "2"
If the other conditions are the same as in the above example, a pseudo failure occurs in the second process A and the retry is performed twice as in the above example. However, in this case, the second pseudo failure occurs during the first retry, and the count value of the counter 11 becomes “0” at the same time.
Therefore, the pseudo fault no longer occurs during the second retry and thereafter. As a result, the second retry succeeded, so the second processing A ended normally,
Eventually, the entire process of FIG. 3 should end normally.

FIG. 5 is a block diagram showing another example of the micro program controller for realizing the present invention. In this embodiment, a part of the functions realized by hardware in the embodiment shown in FIG. 1 is realized by a micro program. Instead of the waypoint address register 3 and the fault occurrence address register 4 in FIG. 1, a comparison address register (CPAR) 51 which alternately serves as these registers is provided. The comparison circuit 52 compares the content of the instruction execution address register (IEAR) 2 with the content of the comparison address register 51, and when a match is detected, generates an address match signal 55. When receiving the address match signal 55 while the microprogram execution unit 1 is generating the interrupt permission signal 56, the AND circuit 53 generates an interrupt generation signal 57,
An interrupt is issued to the microprogram execution unit 1. When a predetermined condition is satisfied, the microprogram execution unit 1
A failure permission signal 58 is generated. When the address match signal 55 is generated in this state, the AND circuit 54 generates the fault occurrence instruction signal 17 and causes the fault generation circuit 13 to generate the pseudo fault signal.
Generate 18.

The route point address (RPTADR) and the fault occurrence address (ERRADR) are stored in the control memory of the microprogram execution unit 1.
And areas 101, 102, 103, 104 for holding the number of times the waypoint address should be accessed before the pseudo fault occurs (RPTCNT) and the number of times the pseudo fault should occur consecutively (ERRCNT). You. Alternatively, each register may be provided. The set of values to these areas or registers is defined by register 3,
4 and the setting of the values to the counters 8 and 11 is carried out in advance.

First, the microprogram execution unit 1 sets the waypoint address (RPTADR) in the comparison address register 51,
Also, the interrupt permission signal 56 is turned on, and the fault occurrence permission signal
Turn OFF 58. Therefore, the instruction execution address is compared with the waypoint address, and if a match occurs, the AND circuit 5
3 generates an interrupt generation signal 57, and in response to this, an interrupt processing routine (FIG. 21, FIG. 21) is started.

The flow chart of the interrupt processing is shown in FIG. When the interrupt processing is started, first, the interrupt permission signal 56 and the fault occurrence permission signal 58 are turned off (steps 61 and 6).
2) Then, the value of RPTCNT is checked (Step 6)
3). If the value of RPTCNT is greater than "1", then "1" is subtracted (step 64) and the interrupt enable signal 56 is returned to the ON state (step 65). Thus, each time the instruction execution address and the waypoint address match, an interrupt occurs and RPTCNT is counted down.

If a similar interrupt occurs after RPTCNT reaches "1", the result of checking the value of RPTCNT is to branch to step 66 and check the value of ERRCNT. If this value is greater than "0", , Then after "1" is subtracted (step 67)
The failure occurrence address (ERRADR) is stored in the comparison address register 51.
Is set (step 68), and subsequently, the fault occurrence permission signal 58 is turned on (step 69). The interrupt permission signal 56 is maintained in the OFF state. However, if the value of ERRADR is "0", the processing of steps 67 to 69 is not performed,
The interrupt processing ends.

When the fault occurrence permission signal 58 is generated as described above, the instruction execution address matches the fault occurrence address (ERRADR) which is now the content of the comparison address register 51, and the address match signal 55 is generated. Then, the AND circuit 54 sends the failure occurrence instruction signal 17 to the failure occurrence circuit 13,
The pseudo failure signal 18 is generated. However, at this time, since the interrupt permission signal 56 is not in the ON state, the interrupt request signal 57 is not generated. When this pseudo-fault is detected (for example, at step 43 in FIG. 4), a fault handling routine (see FIG. 2).
3, FIG. 47) is activated.

FIG. 7 is a flow chart showing a fault handling routine for this embodiment. This routine performs the processing of steps 71 to 74 in order to control the circuit of FIG. 5 before the normal failure processing (recording of the occurrence of a failure) 75. First, the interrupt permission signal 56 and the failure permission signal 58 are turned off (steps 71 and 72), and then the value of ERRCNT is checked (step 73). And if it is greater than “0”,
The interrupt permission signal 56 is switched to the ON state (Step 7).
4) Then, when the instruction execution address and the fault occurrence address match next, a pseudo fault is generated by the interrupt processing of FIG. But if ERRCNT
Is "0", the specified number of pseudo-failures has already been generated, and the interrupt permission signal is not switched to the ON state, thereby terminating the generation of the pseudo-failure.

In the embodiment shown in FIG. 5 to FIG.
The same test conditions as in the embodiment shown in the figure, ie, "2" and "3" as the initial values of RPTCNT and ERRCNT, respectively.
And test the microprogram under test shown in FIGS. 3 and 4. In the initial state, the content of the comparison address register 51 is the waypoint address (RPTADR). In the first processing A, the first interrupt occurs at the point RPTADR (FIG. 4), and in step 63 of FIG.
The value of TCNT is “2”. Therefore, steps 64 to 65 are executed, the comparison address register 51 continues to hold the waypoint address (RPTADR), and as a result, the steps in FIG.
The loop of 42 to 46 is 5 without any interruption.
Is completed, and the first process A ends normally. However, the value of RPTCNT is counted down to "1" in step 64 of FIG.

In the second process A, a second interrupt occurs at the point RPTADR, and at this time, the value of RPTCNT is "1". Therefore, a branch is taken to step 66, at which time the initial value of ERRCNT is "3". Therefore, the value of ERRCNT is counted down to "2", a fault occurrence address (ERRADR) is set in the comparison address register 51, and a pseudo fault is generated. As a result, a retry is performed. A pseudo failure occurred during the second retry, so
The second process A ends with an error.

If only the initial value of ERRCNT is changed to “2” without changing other conditions, in the second processing A, when an interrupt occurs at the point ERRADR during the first retry, the interrupt processing in FIG. In step 67, the value of ERRCNT is counted down to "0". Therefore, in step 73 (FIG. 7) in the failure processing 47 performed at the beginning of the second retry, ERRCNT = 0 is detected, and as a result, the interrupt permission signal is output.
Opportunity to switch 56 to ON state is lost. Then 2
Even if the address match signal 55 is generated at the point ERRADR during the retry for the second time, the interrupt generation signal 57 is not generated, so that the interrupt processing routine of FIG. During the subsequent repetition of the process B (loop of steps 42 to 46), the interrupt permission signal 56 is kept in the OFF state, so that the interrupt process (FIG. 6) is started,
As a result, the occurrence of a pseudo failure is prevented. Therefore, the second process A ends normally, and the third process A ends normally.

There are many possible variations of both of the above embodiments, within the knowledge of one of ordinary skill in the art. For example, in FIG.
A single comparison circuit is provided in place of the two comparison circuits 5 and 6, and respective switching circuits for switching the input source and output destination are added. These switching circuits are controlled by the count value of the counter 8. Then, the single comparison circuit is connected as the comparison circuit 5 until the count value of the counter 8 reaches "0", and after the count value reaches "0", it is connected to the comparison circuit 6.
The connection may be configured as follows. In addition, a single countdown circuit may be provided instead of the two countdown circuits, and a switching circuit for selectively connecting the single countdown circuit to the counter 8 or the counter 11 may be added.

Further, the embodiment shown in FIGS. 5 to 7 may be provided with a counter which counts down in response to a coincidence signal from the comparison circuit 52. In this variation, the microprogram first sets RPTCNT in this counter, and when notified by an interrupt that the count value has reached “0”, sets the ERRCNT in this counter, and A fault occurrence permission signal is generated, and when the count value reaches "0" again by an interrupt notification, the fault occurrence permission signal is reset.

〔The invention's effect〕

According to the present invention, even when repetition of a routine is included, a pseudo failure can be generated at an arbitrarily designated point in the flow of processing by a microprogram,
In addition, it is also possible to generate a pseudo fault only a specified number of times. Thus, more diverse and complex test conditions can be set for the fault handling function, which in turn leads to a further improvement of the reliability of the microprogram controlled device.

[Brief description of the drawings]

FIG. 1 is a block diagram of an embodiment of the present invention, FIG. 2 is a block diagram schematically showing an example of a microprogram including a microprogram to be tested, and FIG. 3 is an example of a microprogram to be tested in FIG. FIG. 4 is a flowchart showing details of one of the processes in FIG. 3, FIG. 5 is a block diagram of a second embodiment of the present invention, and FIG. 6 is a diagram shown in FIG. FIG. 7 is a flowchart of an interruption processing routine for the embodiment, and FIG. 7 is a flowchart of a failure processing routine for the embodiment shown in FIG. 1, a microprogram execution unit; 2, a register for receiving the address of a microinstruction to be executed; 3, a register for holding a via point address; 4, a register for holding a pseudo failure point address; ...... Comparison circuit, 7,8
... Counters for detecting that the via point address has been passed a predetermined number of times, 10, 11... Counters for detecting that the pseudo fault occurrence point address has been reached a predetermined number of times, 13. .., A register used for holding the transit point address and the pseudo failure point address 52, a comparison circuit 56, an interrupt enable signal 57, an interrupt generation signal 58,
.., A process for checking the number of times of passing through points, 65, 66... A process for checking the number of times a pseudo fault has occurred, and 69.

Claims (2)

(57) [Claims] An address of a microinstruction to be executed to generate a pseudo fault for testing a microprogram comprising a plurality of microinstructions held in respective memory locations identified by respective addresses. A step of counting the number of matches of the first specified address; a step of detecting that the number of matches has reached the first specified number; and a second specified address after the detection. And a step of generating a pseudo fault when a match occurs between addresses of microinstructions to be executed. 2. The method according to claim 1, further comprising the step of counting the number of matches between the second specified address and the address of the microinstruction to be executed, and wherein the number of matches is equal to the second number.
And a step of preventing the occurrence of the pseudo fault after the specified number of times is reached.