Data processing system and method for protecting data in a data memory against an undetected change

Abstract

A method for protecting data in a data memory against an undetected change, wherein a functional variable x is encoded via a value, an input constant, an input signature and a timestamp D into a coded variable, where the functional variable is normalized relative to a base to form the integer value from the functional variable.

Description

BACKGROUND OF THE INVENTION

1. Field of the Invention

The invention relates to a data processing system and a method for protecting the data stored in a data memory against an undetected change.

2. Description of the Related Art

In safety-related applications, it is common practice to use variables in coded form so that they can be protected against errors and undetected modification. During an arithmetic coding process, a functional variable x is expanded by different check bits that enable specific errors that have occurred to be detected. An extended form of arithmetic coding is the ANBD encoding scheme. In ANBD encoding, an uncoded functional variable x is converted via an input constant A, a variable-specific input signature B_x and a timestamp D into a coded variable x_c.x_c=A*x+B_x+D  Eq. 1

The input constant A enables errors in the value range to be detected. The use of a variable-specific input signature B_x enables operand and operator errors to be detected. The use of a timestamp D enables an unperformed update of the variable to be detected.

In the application, the coded variable x_c is used throughout in this case, because a decoding of the variable into the uncoded form x would lead to the loss of the error information present in the coded variable x_c. In order to perform computational operations with a coded variable x_c, it is necessary to use coded operators that include not only the functional part x, but also the associated check bits in the operation.

EP 3 104 276 A1 describes a method that enables an AND-encoded variable x_c to be recoded into an A′NB′D′-encoded variable x_c′, i.e., the check bits A, B and D to be replaced by the check bits A′, B′ and D′, without at the same time decoding the coded variable in one of the intermediate steps.

A disadvantageous aspect of ANBD encoding is that realizing floating-point arithmetic in this encoding scheme is very complicated and time-consuming. Thus, in accordance with the present state of the art, floating-point numbers (also known, inter alia, as reals or floats) are not processed explicitly as a data type in purely software-based safety-related applications. In accordance with the present state of the art, a particular solution approach in integer arithmetic (also known, inter alia, as integers) must be found for each requirement. In safety-related applications, it should be noted in this regard that it is not the mean but the maximum error of a calculation that is relevant. For this reason, the property of floating-point arithmetic, i.e., a value is always calculated with maximum precision, is not relevant in safety-related applications, but leads in ANBD-encoded processing of the data type to a computing time that is orders of magnitude longer than the computing time elapsing in the case of uncoded processing. Using a fixed-point arithmetic is not an alternative, because it does not allow the desired precision, in particular for more complex processing operations.

SUMMARY OF THE INVENTION

It is therefore an object of the invention to provide a representation of the data that allows a comparable application flexibility to floating-point arithmetic but requires fewer computing steps.

This and other objects and advantages are achieved in accordance with the invention by a method for protecting data in a data memory against an undetected change. A modification of the data can therefore be detected via the method. In this case, a functional variable x is encoded via a value value_x, an input constant A, an input signature B_x and a timestamp D into a coded variable x_c in accordance with the following relationship:x_c:=value_x*A+B_x+D.  Eq. 2

The method is characterized in that the functional variable x is normalized relative to a base Base_x to form the integer value value_X from the functional variable x. In other words, a functional variable x is converted into an ANBD-encoded variable x_c, where the functional variable is normalized to a base Base_x. This means that the functional variable x is represented within the coded variable x_c as value_x, which is an integer multiple of the base Base_X. The base Base_X is therefore the unit in which the functional variable x is represented. Accordingly, a functional variable x present as a floating-point number is reproduced in the coded variable as a functional component via an integer value_x. The advantage resulting from this is that operations relating to the functional variable x may be performed in integer arithmetic. In this way, the maximum error in operations and the required computational overhead are reduced in comparison with floating-point arithmetic. At the same time, the flexibility is not limited with respect to the value range compared to the floating-point representation. The calculations are therefore performed with a higher degree of precision in the intermediate results and a subsequent rounding. As a result of the method, the duration of a coded processing operation is increased by a factor compared to uncoded processing. This factor lies significantly below the several orders of magnitude by which the duration increases when using coded floating-point numbers compared to uncoded processing.

In an embodiment of the method, the functional variable x is encoded during a compilation operation to yield the coded variable x_c. In other words, the functional variable x is encoded during the binary number generation, for example in the compiler, into the coded variable x_c. The encoding and in particular the normalization to a fixed base are therefore already performed at the time of the code generation. The advantage resulting from this is that the computing time can be reduced during the execution of the program because it is no longer necessary to establish a base during the runtime of a program.

In an embodiment, the value value_x is calculated in accordance with the following relationship:value_x:=(x/Base_x)mod(2)^Sizex.  Eq. 3

In other words, the functional variable x is divided by the base Base_x, where a remainder of the division is discarded. Size_x is the number of possible states or the available memory. This may be specified by the available number of bits n for storing a single value, that is to say, be equal, e.g., to a value 2ⁿ=2¹⁶ where n=16 bits. The advantage resulting from this is that the value value_x is present as an integer. It is therefore possible to convert a floating-point number into an integer.

In another embodiment of the invention, the value value_x is formed by subtracting a smallest attainable value min_x of the functional variable x, which smallest attainable value is predefined according to a control program, from the functional variable x before the smallest attainable value is divided by the base Base_x, the remainder being discarded, i.e.,value_x:=(x−min_x/Base_x)mod(2)^Sizex  Eq. 4

The value min_x may be determined in uncoded form in a test run of the control program.

This results in the advantage that the value range is limited to the predefined value range.

In another embodiment, the data is provided for a control program and the base Base_x is calculated to a value greater than or equal to the difference between a greatest attainable value max_x predefined in accordance with the control program for the value x and a smallest attainable value min_x of the value x, divided by the size of the available memory, i.e.,Base_x≥(max_x−min_x)/Size_x  Eq. 5

In other words, the base Base_x represents the smallest possible unit into which the attainable value range can be subdivided. Two advantages are produced as a result of this step: Because the base is determined relative to the entire attainable value range, an overflow of values is excluded. Put differently, a value is prevented from exceeding the maximum value and consequently being unable to be represented. Because the base assumes the smallest possible value, the greatest possible precision is provided. In other words, the computational inaccuracy due to an overly, roughly chosen base is minimized. Overall, this development leads to the base assuming the smallest possible value that is possible without the risk of an overflow. The precise value of the base Base_x may be specified according to this criterion.

In an embodiment of the method, a coded addition +_c of two coded variables x_1c and x_2c is performed in accordance with the following relationship:x_3c:=x_1c+_cx_2c, where:  Eq. 6value_x3:=(value_x1*k₁+value_x2*k₂+k₃)/Size_x3,where the following applies:max_x3=max_x1+max_x2 min_x3=min_x1+min_x2 Base_x1≥(max_x1−min_x1)/Size_x1 Base_x2(max_x2−min_x2)/Size_x2 Base_x3(max_x3−min_x3)/Size_x3 k₂/k₁Base_x1/Base_x2 k₁+Base_x1/2ⁿ≈Base_x3 k₂+Base_x2/2ⁿ≈Base_x3 and ≈ means that due to rounding errors and processor inaccuracy there is no requirement for any mathematical equality to be present, yet the specified calculation is to be implemented.

In other words, the coded operator +_c relating to the addition is defined via the above-cited relationship. Here, calculations in the compiled program are performed only with the values value_x1, value_x2 and value_x3. The constants k₁ and k₂ in this case describe the relations between the bases Base_x1, Base_x2 and Base_x3. The base Base_x1 is the base of the variable x₁, the base Base_x2 is the base of the variable x₂, and the base Base_x3 is the base of the result x₃. The greatest values max_x1 and max_x2 predefined in accordance with the control program, as well as the smallest values min_x1 and min_x2 predefined in accordance with the control program for the variables x₁ and x₂, are used to form the bases Base_x1 and Base_x2. The smallest and the greatest value for x₃ are formed by means of an addition of the greatest and smallest values, respectively, of the variables x₁ and x₂. The constant k₃ may be chosen so as to minimize rounding errors. The bases may be determined via a compiler. The advantage resulting from this is that no base needs to be determined during the runtime of the addition operation. Furthermore, only integers are used during the operation. Separate operations relating to the mantissa and the exponent, as is necessary in the addition of floating-point numbers, and the transformations and normalizations required for this, are therefore unnecessary.

In an embodiment, a coded multiplication *_c of two coded variables x_1c and x_2c is performed in accordance with the following relationship:x_3c:=x_1c*_cx_2c, where  Eq. 7value_x3:=(value_x1*value_x2+k)/Size_x3,where the following applies:Base_x1≥(max_x1−min_x1)/Size_x1 Base_x2≥(max_x2−min_x2)/Size_x2 Base_x3≥(max_x3−min_x3)/Size_x3 Base_x3≈(Base_x1*Base_x2)/Size_x3 max_x3=MAX(min_x1*min_x2,min_x1*max_x2,max_x1*min_x2,max_x1*max_x2)min_x3=MIN(min_x1*min_x2,min_x1*max_x2,max_x1*min_x2,max_x1*max_x2).

In other words, a multiplication of the coded variables x_1c and x_2c is performed via the values value_x1 and value_x2. The greatest and smallest product yielded in each case in a multiplication of the greatest possible values max_x1, max_x2 and the smallest possible values min_x1, min_x2 of x₁ and x₂, respectively, are used as the greatest possible value max_x3 and as the smallest possible value min_x3, respectively, of the variable x₃.

In a further embodiment, a value value_x1 having a base Base_x1 is recoded to a value value′_x1 having a base Base′_x1 in accordance with the following relationship:value′_x1=(((value_x1+k₁)/2ⁿ)*k₂+k₃)/2ⁿ′,  Eq. 8wherek₂/(2ⁿ+n′)≈Base_x/Base′_x and n′ is the bit count of the recoded representation.

In this case, the constants k₁, k₂ and k₃ are chosen so as to minimize the rounding error as a function of k₂.

It is also an object of the invention to provide a data processing system that is configured to perform one of the above-cited methods. In this context, the system may be a microcontroller or a microprocessor, for example.

Other objects and features of the present invention will become apparent from the following detailed description considered in conjunction with the accompanying drawings. It is to be understood, however, that the drawings are designed solely for purposes of illustration and not as a definition of the limits of the invention, for which reference should be made to the appended claims. It should be further understood that the drawings are not necessarily drawn to scale and that, unless otherwise indicated, they are merely intended to conceptually illustrate the structures and procedures described herein.

BRIEF DESCRIPTION OF THE DRAWINGS

An exemplary embodiment of the invention is described below, in which:

FIG. 1 illustrates the execution flow of a coded calculation of a sine value using the described method; and

FIG. 2 is a schematic block diagram of a data processing system in accordance with the invention.

DETAILED DESCRIPTION OF THE EXEMPLARY EMBODIMENTS

The sine value of a functional variable x in degrees may be calculated numerically in a range of 0° inclusive up to and including 45° by means of the following function:

static float sin7pi4(float x){
float a = 9.99999989793669848536e−1;
float b = −1.66666423796176028737e−1;
float c = 8.33179571459221545387e−3;
float d = −1.94842039748219288187e−4;
float square = x*x;
float tmp1 = square*d;
float tmp2 = c + tmp1;
float tmp3 = square*tmp2;
float tmp4 = (b + tmp3);
float tmp5 = square*tmp4;
float tmp6 = (a + tmp5);
float tmp7 = tmp6*x;
return tmp7;
}

The function concerns a power series using the constants a, b, c and d. Intermediate steps may be combined here under tmp1-tmp7. The power series may be concluded with tmp7, which can be output at the end of a program (return tmp7). The value square may be the square of the functional variable x. All of the values may be a floating-point number (float).

The above-cited function may be performed in coded form via the method in accordance with the invention. Here, a bit count n of e.g. 49 bits may be made available. The precision of the input may be specified to a thousandth, for example.

With reference to FIG. 1, in a first step P1, the size Size_x is calculated. According to the limits of the control program, which may range from 0° inclusive up to and including 45°, a smallest possible value min_x=0 and a greatest possible value max_x=45000 may be specified in the case of a precision fixed at 1/1000°. The input value is therefore present as an integer. According to the above definitions, this yields:

Size_x:=2⁴⁹

min_x:=0

max_x:=45000

In a second step P2, the square of x is calculated, where a bit count of n=49 bits can be available. The base for calculating a square of x given a bit count of n=49, Base_x2,n=49, can be calculated from the smallest possible value min_x2,n=49 and the greatest possible value max_x2,n=49 of the square.max_x2,n=49:=max_x*max_x min_x2,n=49:=min_x*min_x Base_x2,n=49:=(max_x2−min_x2)/Size_x2,n=49 value_x2,n=49:=value_x*value_x/Base_x2,n=49 =value_x*value_x*277999.

In a third step P3, the value value_x2,n=49 is recoded from the base Base_x2,n=49 to a base Base_x2,n=24, which can have a bit count of 24 bits:value_x2,n=24=(value_x2,n=49+2²⁴)/2²⁵.

In a fourth step P4, the temporary value value_tmp1 is calculated:value_tmp1:=(value_x2,n=49*value_d,n=49+k)/2²⁴

In a fifth step P5, the temporary value value_tmp2 is calculated:value_tmp2:=(value_c,n=49*k₁+value_tmp1,n=49*k₂+k)/2²⁴

In a sixth step P6, the temporary value value_tmp3 is calculated:value_tmp3:=(value_x2,n=24*value_tmp2,n=24+k)/2²⁴

In a seventh step P7, the temporary value value_tmp4 is calculated:value_tmp4:=(value_b,n=24*k₁+value_tmp3,n=24*k₂+k)/2²⁴

In an eighth step P8, the temporary value value_tmp5 is calculated:value_tmp5:=(value_x2,n=24*value_tmp4,n=24+k)/2²⁴

In a ninth step P9, the temporary value value_tmp6 is calculated:value_tmp6:=(value_a,n=24*k₁+value_tmp5,n=24*k₂+k)/2²⁴

In a tenth step P10, the temporary value value_tmp7 is calculated:value_tmp7:=(value_x,n=24*value_tmp6,n=24+k)/2²⁴

In an eleventh step P11, the value z is calculated from the temporary value value_tmp7 and its base Base_tmp7:z:=sin(x):=value_tmp7,n=24*Base_tmp7

In a twelfth step P12, the value value_z having a base 2⁻⁴⁹ specified for a return value is calculated from the temporary value value_tmp7 and its base Base_tmp7:value_z:=Base_tmp7*Base_tmp7/2⁻⁴⁹

In a thirteenth step P13, the value value_z is converted into a floating-point number Float_z. This is advantageous owing to the fact that the base of the value value_z is a 2nd power.

A program code could be written in the following manner, for example:

Size:=2⁴⁹

Minimum:=0

Maximum:=45000square_val49:=277999*X_val*X_val square_val24:=(square_val49+2²⁴)/2²⁵ tmp2_val:=18172496+(−1378477226−squareval49)/2³¹ tmp4_val:=(square_val24*tmp2_val+111040616)/2−18415894tmp6_val:=(square_va124*tmp4_val−197673)/2¹⁸+11464190094tmp7_val:=(tmp6_val*x_val+2²²)/2²³ tmp7_bas:=1.277097000028899636e−8z:=SIN(x):=tmp7_val*1.277097000028899636e−8Desired base for z: 2⁻⁴⁹ Z_val:=tmp7_bas*7189417

Overall, the example demonstrates how, via the invention, a representation of data is provided that allows a flexible and efficient processing of ANBD-encoded data.

FIG. 2 is schematic block diagram of a data processing system 200 in accordance with the invention. Here, the system may comprise memory 210 and a processor 220, such as a microcontroller or a microprocessor, which is configured to implement the method in accordance with the invention.

Claims

1. A method for protecting data in a data memory against an undetected change, comprising: encoding a functional variable x via a value valuex, an input constant A, an input signature Bx and a timestamp D into a coded variable xc in accordance with the relationship: xc:=valuex*A+Bx+D; andnormalizing the functional variable x relative to a base Basex to form the integer value valuex from said functional variable x to protect the data in the data memory against the undetected change;wherein the value valuex is calculated in accordance with the following relationship: valuex:=(x/Basex)mod 2Sizex,where Sizex is a size of an available memory.

2. The method as claimed in claim 1, wherein the functional variable x is encoded during a compilation operation to yield the coded variable xc.

3. The method as claimed in claim 1, wherein the data is provided for a control program and the base Basex is set to a value greater than or equal to a difference between a greatest attainable value maxx predefined according to the control program for the value x and a smallest attainable value minx predefined according to the control program, divided by the size of the available memory Sizex, such that Basex≥(maxx−minx)/Sizex.

4. The method as claimed in claim 1, wherein a coded addition +c of two coded variables x1c and x2c is performed in accordance with the relationship: valuex3:=(valuex1*k1+valuex2*k2+k3)/Sizex3,

5. The method as claimed in claim 1, wherein a coded multiplication *c of two coded variables x1c and x2c is performed in accordance with the relationship: valuex3:=(valuex1*valuex2+k)/2n,

6. The method as claimed in claim 1, wherein a recoding from a Basex to a base Base′x is performed in accordance with the following relationship: value′x1=(((valuex1+k1)/2n)*k2+k3)/2n′,

7. A data processing system comprising: a processor; anddata memory:wherein the processor is configured to: encode a functional variable x via a value valuex, an input constant A, an input signature Bx and a timestamp D into a coded variable xc in accordance with the relationship: xc:=valuex*A+Bx+D; andnormalize the functional variable x relative to a base Basex to form the integer value valuex from said functional variable x to protect the data in the data memory against the undetected change;wherein the value valuex is calculated in accordance with the following relationship: valuex:=(x/Basex)mod 2Sizex,where Sizex is a size of an available memory.

8. A method for protecting data in a data memory against an undetected change, comprising: encoding a functional variable x via a value valuex, an input constant A, an input signature Bx and a timestamp D into a coded variable xc in accordance with the relationship: xc:=valuex*A+Bx+D; andnormalizing the functional variable x relative to a base Basex to form the integer value valuex from said functional variable x to protect the data in the data memory against the undetected change;wherein the value valuex is calculated in accordance with the following relationship: valuex:=(x−minx/Basex)mod 2Sizex,where minx is a predefined minimum value of x.