Program flow monitoring for deterministic firmware functions

An apparatus of a safety system, comprising:

• a memory circuit configured to store a series of executable instructions, wherein the series of executable instructions is grouped into code parts, and the code parts are individually assigned a code value that is derived independently of the code parts, wherein the series of executable instructions comprises a first code part to which is assigned a first code value and a second code part to which is assigned a second code value;
• a processor circuit configured to execute the series of executable instructions and to output the code value as the code parts are executed;
• a program flow monitoring (PFM) unit configured to
• receive the first code value from the processor circuit,
• generate a first PFMU value based on the first code value,
• receive the second code value subsequent to receiving the first code value, and
• generate an error-checking value based on the first PFMU value and the second code value;
• and
• a verification unit configured to compare the error-checking value to an expected return value to determine whether the series of executable instructions is executed properly, wherein the error-checking value matches the expected return value in response to the first code value and the second code value being input into the PFM unit in an expected sequence, wherein the second code value is selected such that the error-checking value matches the expected return value in response to the first code value and the second code value being input into the PFM unit in the expected sequence.

A method for monitoring a flow of a program, comprising:

• providing a first electrical signal to an electronic processor unit to trigger the electronic processor unit to execute a series of executable instructions, wherein the electronic processor unit is disposed on a first integrated chip and receives the first electrical signal from a controller that is disposed on a second integrated chip, wherein the series of executable instructions comprise a plurality of code parts that correspond to respective predefined code values, and the plurality of code parts is derived independently of the respective predefined code values, wherein the series of executable instructions comprises a first code part to which is assigned a first predefined code value and a second code part to which is assigned a second predefined code value;
• executing the series of executable instructions on the electronic processor unit, wherein executing the series of executable instructions comprises providing one or more electrical signals to a hardware monitoring unit based on the plurality of code parts such that the hardware monitoring unit performs a test on a monitored hardware device;
• inputting the first predefined code value associated with the first code part into a program flow monitoring (PFM) unit as the one or more electrical signals are provided to the hardware monitoring unit;
• subsequently inputting the second predefined code value associated with the second code part into the PFM unit as the one or more electrical signals are provided to the hardware monitoring unit;
• generating an error-checking value from the first predefined code value and the second predefined code value, wherein the error-checking value is generated by the PFM unit, and the error-checking value is based on an order in which the first predefined code value and the second predefined code value are input into the PFM unit;
• and
• comparing the error-checking value to an expected return value to determine whether the series of executable instructions executed properly, wherein the error-checking value matches the expected return value in response to the first predefined code value and the second predefined code value being input into the PFM unit in a predefined sequence, wherein the second predefined code value is selected such that the error-checking value matches the expected return value in response to the first predefined code value and the second predefined code value being input into the PFM unit in the predefined sequence.