control logic, techniques, microprogram, output, decoder, self-checking, emitter follower, fault detection, microprocessor, IEEE TRANSACTIONS ON COMPUTERS, outputs, bit, processor design, University of Hawaii, William H. Sisson, electronic switching system, Eta Kappa Nu, electronic switching systems, parity generation, decoder outputs, parity bits, degree in electrical engineering, parity check, Naperville, University of Michigan, Oregon State University, central offices, multiple access, control units, central office, central control, centralized control, code, processor hardware, Mount Allison University, Control Theory Group, Nova Scotia Technical College, Bell Telephone Laboratories, Inc., power failures, integrated circuit chip, Phi Kappa Phi
ACTIONS ON COMPUTERS, VOL. C-22, NO. 3, MARCH 1973
Design of a Self-Checking Microprogram Control Robert W
. COOK, William H.
SISSON, THOMAS F. STOREY, AND WING N. TOY
Abstract-In designing a self-checking processor, it is essential to recognize the types of failures that are most probable. Matching the checking techniques with the type of faults that are expected to occur should yield the best result with the least amount of hardware. The microprogram control will consist of integrated circuits: large-scale integration (LSI) for the memory and small-scale integration (SSI) for the associated control logic. Because of the density of chips on a plug-in package and the physical proximity of the devices on an integrated circuit, multiple faults within a single circuit are highly probable. The types of faults within a circuit have been analyzed and found to be of the type which would tend to affect the bits in a unidirectional manner. Also the failed bits would probably be adjacent rather than randomly dispersed throughout-the microprogram store word. The checking technique implemented takes advantage of the error characteristics mentioned above. This led to the choice of using m-out-of-n codes for the control fields of the microprogram instruction words. This code permits the detection of all multiple unidirectional errors. However, for the address field, it is desirable to maintain the data in binary form. Consequently, a check code which is systematic is essential to give this flexibility. By recognizing that the multiple bit faults tend to affect adjacent bits, we can take advantage of this fact by interleaving the binary address field with the m-out-of-n codes in the microprogram store. Any multiple adjacent bit faults would then affect both the binary address field and the m-out-of-n code. Therefore, a single parity check bit is adequate to detect single bit faults in the binary field with multiple adjacent bit fault detected by the m-out-of-n check.
TELEPHONE TRUNKS TO OTHER
PER IPH ERAL SYSTEM
/0 CHANNELS l PROCESSOR
_________ TUNIT STORUNITE
| SSTTORC [email protected]
iTC g ~~STORE
j _,I I
_I CONTROL UNIT
Fig. 1. System block diagram.
Index Terms-Coding, control logic, fault detection
, logic design,
techniques within a processor, since it would add to the com-
plexity of the system without providing any appreciable in-
crease in reliability. The No. 1 ESS  used a Hamming code
in memQry to correct errors and the No. 101 ESS system 
ANEW STORED program-control processor is being developed for telephone central offices. In the older electromechanical offices, the control of the office was distributed in such a way that the failure of any single control unit resulted in degradation of service rather than complete failure. The advent of the electronic switching systems (ESS)  -[31 with a centralized control has required a high degree of attention to insuring the reliability of the control unit  . In order to meet the availability requirements of a telephone central office, a two-control unit standby redundant system has been used in all ESS systems. A system block diagram of an ESS system is shown in Fig. 1. The standby is used to continue service while a central control is being repaired. A single control unit would be unacceptable, even if it were self-correcting, since it would have to be periodically removed from service while it was being repaired. With two control units, there is no need to incorporate any self-correction
used a retry on memory operation, but both of these techniques were dropped on subsequent systems. Once an error is detected in the on-line central control, the standby is switched on-line. When the new on-line has spare time, it attempts to diagnose the fault in order to assist the maintenance personnel in repairing the defective central control. Errors must be detected as soon as possible in order to prevent any erroneous changes in the state of the central office. It is essential, therefore, that error detection be done continously. This function is much better suited to circuits than to programs since no real time is expended if it is performed by hardware concurrently with normal system operation. Also with integrated circuits, the cost of logic circuitry has been reduced drastically, making the hardware method of fault detection more attractive. The ability to apply efficient self-checking or self-detecting schemes seems to be a function of the regularity of the cir-
cuitry involved. The most irregular and hence the most
Manuscript received June 9, 1972; revised October 2, 1972. The authors are with Bell Telephone Laboratories, Inc., Naperville,
difficult area of the processor to make self-checking is the
control logic. This circuitry decodes the machine instruc-
ON COMPUTERS, MARCH 1973
microprogram structure. Next, the assumptions that have been made about the type of faults that are most probable will be discussed. Finally, several of the fault-detection techniques used to achieve self-checking in the control portion of the processor will be discussed.
Fig. 2. Processor block diagram. tions and provides the sequence of control signals to the data logic which is necessary to execute the instructions. This paper describes the techniques used to achieve a high degree of self-checking in the control logic of a new processor for telephone switching systems. The new processor, as shown in Fig. 2, may be divided into four major sections for the purpose of this paper, since different techniques for self-checking are used in each section. The major sections are the following. 1) Microprogram store and associated registers. 2) TO and FROM decoders, which are used to gate data to and from the single data bus and to drive the FUNCTION decoder. 3) data manipulation
logic that is duplicated and matched since Boolean functions which are not amenable to other checking schemes are included. 4) Register stack that contains the programmer accessible processor registers. These registers are bit sliced to prevent multiple bit faults and checked with parity bits. Only the first two sections are described in more detail, since the last two are not involved in the control portion of the processor. II. SELF-CHECKING DESIGN PHILOSOPHY The basic objective in designing self-checking circuits for a processor is to match the checking techniques with the type of faults that are expected to occur in the most efficient manner. If the classes of failures that are most likely to occur can be characterized in some way, then fault detection methods can be designed that will efficiently detect those classes of failures. The following section will discuss the major architectural features of the control logic of the new processor, i.e., its
A. Microprogram Control The major feature of the processor control logic is that it is microprogrammed. Microprogramming permits a more regular approach to the design of control logic and, therefore, self- checking techniques can be more readily applied  -. The conventional control logic for a processor is illustrated in Fig. 3. Other than the OPCODE register and COUNTER, there is very little regularity. Each operation code or instruction requires a series of gates that decodes the contents of the OPCODE register, COUNTER, and STATUS INDICATORS and provides, as a result, control signals to perform data manipulation, as well as updating the COUNTER and OPCODE register as necessary. The control circuitry shown in Fig. 3 is essentially a small wired logic computer capable of per- forming a fixed number of operations, one of which corresponds to each possible machine instruction which can be presented to it from the program store. A simple microprogrammed control is shown in Fig. 4. The wired logic of a conventional control section has been replaced by a small processor, appropriately called a microprocessor. The characteristics of the microprocessor that make it different from a main processor are the elementary nature of its operations and the speed of its memory and basic cycle time. There are many possible variations of microprocessor design, one of which is shown in Fig. 4. Each microprogram store word contains the address of the next instruction and a TO and FROM gating field which specifies the source and destination for a gating operation, or may specify some other type of operation. The microprogram store is addressed by the microprogram address register (MAR) which receives its contents either from the OPCODE of the main machine instruction to be executed (this forms the initial address of the microprogram sequence which performs the instruction) or from the last executed microprogram word. It should be noted that the microprocessor has very little irregular circuitry; most of the complicated logic is stored as microinstructions (a form of software called firmware) rather than individual gates. In other areas of the processor, special purpose hardware can also be reduced by performing its functions with a microprogram sequence, e.g., the interrupt control and initialization. The primary reliability feature of the microprogrammed structure is that it is regular and allows the use of self-checking coding techniques in the memory and registers. The TO and FROM field decoders are also checked by a coding technique as will be described later. In order to enhance the basic processor speed and flexibility, several features have been added to the basic microprocessor and these features are checked by a variety of techniques, ranging from coding to duplication. Some other reliability features of a microprogrammed structure include the minimization of clock signal distribution. Clock signal failures can be very difficult to diagnose because of the marginal conditions which result. In this micropro-
COOK et al.: SELF-CHECKING MICROPROGRAM CONTROL STATUS INDICATORS
32 BITS o -
I 32 BITS
OUTPUTS Fig. 5. 1024-bit emitter follower array masked encoded 512 words X 2 bits.
DECODED CONTROL LEADS TO EXECUTION LOIC Fig. 3. Conventional control logic. STATUS IDMATOtS DECODED CONTROL LEADS TO EXECUTION LOGIC Fig. 4. Microprogrammed control cessor, the gating control signals perforn the timing and it is not necessary to distribute the clock extensively throughout the processor. In general, the clock distribution is limited to the microprocessor itself where it can be easily checked. Another reliability feature of a microprocessor is the improved access to processor hardware for fault detection programs. The microprocessor has other advantages for system architecture, such as flexibility of the order structure and simplification of the logic involved that are beyond the scope of this paper.' B. Fault Assumptions The new processor is being constructed out of integrated circuits with each chip containing from four to eight Logic Gates
. Because of the physical proximity of the various 'IEEE Trans. Comput. (Special Issue
on Microprogramming), vol. C-20, pp. 727-830, July 1971.
circuits on an integrated circuit chip, multiple gate faults within a single chip are highly probable. As an example of the type of failures that can be expected in the microprocessor, let us consider a chip or integrated circuit from the microprogram memory as shown in Fig. 5. Each chip contains two bits of 512 words in an emitter follower array. Nine bits of address are supplied; five bits being decoded to;select I-out-of-32 word lines, and the other four bits being decoded to select the appropriate two bits out of the 32 bits previously selected. Now let us consider the most likely failures of such a chip. Since the decoding is from binary to l-active-out-of-32 possible outputs, we must only consider any output stuck-at-I or O or any input open on the decoding gates. Any of these failures, single or multiple, result in two basic types of failures, i.e., no access or multiple access of the memory words with the content of the accessed words oRed together. Similarly, the output decoding is binary to l-active-out-of-16 outputs, and the possible failures result in no access, multiple access, or single bit failures stuck-at-I or 0. Some typical data cell failures would be an open base which would cause all bits beyond the failure to be stuck-at-O, or two bases shorted together which would result in multiple access. An analysis of failures such as these results in two assumptions about fault classes. First, it is assumed that all errors in parallel bits are unidirectional, i.e., any number of bits may fail but they all fail in the same direction, either stuck-at-I or stuck-at-0. Both no access and multiple access of words from a memory cause unidirectional errors. Also, most failures on a chip that affect multiple bits on that chip, e.g., power failures, tend to affect all parallel bits in the same direction. The principal codes which have been used to detect multiple unidirectional errors are the m-out-of-n codes , . An m-out-of-n code is one in which all valid code words have exactly m bits equal to 1 out of the total of n bits. In some cases, it has not been desirable to use m-out-of-n codes because the valid code combinations are rather restrictive, e.g., an m-out-of-n coded field could not be used to hold an arbitrary binary constant for use in another mode of operation. However, they have been used extensively throughout the processor for data which is to be decoded and then used as control information.
IEEE TRANSACTIONS ON COMPUTERS, MARCH 1973
The second class of errors that has been identified is the adjacent errors. This assumption applies to circuits such as the microprogram store where bits in a word are physically adjacent. The assumption is that the bits which fail will be adjacent rather than randomly dispersed throughout the word. This assumption has allowed the use of a less powerful code by simply interleaving the various fields of a microprogram as will be described later. The errors discussed thus far have been assumed to be solid logical errors. The consideration of intermittent or nonlogical errors is difficult because of a lack of appropriate tools or any unifying characteristics. In the past, the assumption has been, and continues to be for this project, that they will be detected as soon as they cause a logical failure.
III. DETECTION TECHNIQUES The microprogram store contains basically two types of data: control and address information. The control fields are immediately decoded and checked to provide control signals, hence, a more efficient nonsystematic code, such as the m-out-of-n code, would give the maxum detectability at the least possible cost in hardware. However, for the address field, it is desirable to maintain the data in binary form not only for addressing, but also to provi4e binary data to several sources. Consequently, the choice of a systematic code for the address field is essential to give this flexibility. By recognizing that multiple bit faults would tend to affect adjacent bits rather than be randomly dispersed throughout the word, we can take advantage of this fact by interleaving the binary field with the m-out-of-n code as shown in Fig. 6. Any multiple adjacent bit fault would then affect both the binary field and the m-out-of-n code. Consequently, a single parity check bit is adequate to detect single bit faults in the binary field , [111 and multiple adjacent bit faults would be detected by the m-out-of-n check. A. Control Field Checks The TO and FROM control fields are each eight bits wide and are encoded as a 4-out-of-8 code. Fig. 7 shows the func- tional diagram of the control field decoding and check circuitry. There are 70 valid combinations in an 8-bit field which have four l's and four O's. The control fields must be decoded to l-out-of-70 in order to drive the control points of the machine. The decoded leads are reencoded to the bit-by-bit comple- ment of the original 4-out-of-8 field, and then checked by a selt-checking 4-out-of-8 checker designed by Anderson and Metze [161. This check will detect any multiple unidirectional errors which occur anywhere from the Aicroprogram address register (MAR) to the decoded control leads. This is a very powerful check since it checks many parts of the microprocessor, including microprogram store address decoding, microprogram store, its output circuitry, microinstruction register (MIR), and 4-out-of-8 control decoders. A number of microoperations consists of setting or clearing individual flip-flops or enabling dedicated paths in which the Use of a single TO or FROM field crosspoint would be in-effuient. Thus, a combination of these two fields is used to
Fig. 6. Microprogram store coding techniques.
IPI_ NA _| TO
FROM TPI MIR
4/8 TO 1/70 DECODER
TO 1/70 DECODER TI 1 I T
CHECKER I' ERROR ENCODER
4 8 CHECKE ERROR ENCODER CONTROL
11 FUNlCTION DECODER
CONTROL Fig. 7. Control field decoding and check circuitry. form a FUNCTION decoder whose inputs require the simultaneous operation of a TO and a FROM field crosspoint. In this way, a 10 X 10 matrix or 100 crosspoints can be generated by assigning only 10 crosspoints from each of the TO and FROM fields. These control signals are checked in several ways. Some are checked functionally during the execution of instructions. Some feed duplicated circuitry, e.g., the data manipulation logic; consequently, the decoder gates are also duplicated so that any fault will be caught by a mismatch in the duplicated circuits. Finally, some miscellaneous control signals are only used for maintenance-type functions and, therefore, do not need to be immediately checked by hardware but can be periodically checked by software.
COOK et al.: SELF-CHECKING MICROPROGRAM CONTROL
In the design of normal binary decoders, it is necessary to clock or strobe the decoder outputs to eliminate spurious noise spikes during the changing of the information at the input to the decoders. Because of the nature of the m-out-of-n code, it is necessary to first clear the buffer register (MIR) which serves as an input to the decoders before gating in a new m-out-of-n code. In this way, one can guarantee that no noise spikes occur on the output of the decoders. If one has to strobe the decoders themselves and the strobe signal fails, a marginal type of failure occurs which is extremely hard to diagnose. By removing the strobe at the decoder and clearing first and then gating into the MIR the problem is eliminated. That is, if the clear signal fails, a new m-out-of-n code is gated in on top of the last one or, if the gating signal fails, all zeros result. Both of these faults result in immediate m-out-of-n decoder errors which are caught. The use of microprogram control in conjunction with the m-out-of-n control fields significantly reduces the complexity and use of a clock or timing source which is needed in a conventional machine to eliminate race condition. B. Microinstruction Sequencing Checks The basic check on microinstruction sequencing is single-bit parity that is carried on all microprogram store addresses. Because this may be insufficient to detect all multiple errors, additional checks are added to augment the single-bit parity technique. Normally, a parity generation circuit or parity tree is required to check parity; however, in this case a bit in each microprogram memory word has been used to replace it. As shown in Fig. 8, two parity bits are stored in every microprogram memory word PF which is the parity of the address stored in the word and is gated to the MAR with it, and PN which is the parity of the address of the microprogram memory word itself. The MAR parity is simply matched with PN of the word accessed from microprogram memory to check parity. Although the address bits are shown contiguous in the MIR in Fig. 8, they are interleaved with the other bits in microprogram store as shown in Fig. 6 in order to enhance the the fault detection probability. In general, the many sources which feed the MAR also contain parity which is gated to the MAR and then checked. The branch logic, which consists of five status bits and the logic necessary to select one and gate it to bit 0 of the MAR, is duplicated in order to detect faults. A branch occurs when bit 0 of the MAR is set to 1 (by convention, bit 0 of the next address on a conditional branch is always initially 0) and, in this case, the parity bit in the MAR must also be complemented. In order to save a match circuit, one output from the duplicated branch logic feeds bit 0 of the MAR while the other feeds the parity bit. In this way, any fault in the branch logic is detected by the parity check circuit. In order to provide a more complete check of the sequencing from one microinstruction to the next, the return address register (RAR) is used as a duplicate MAR whenever it is not busy holding a return address for microsubroutines. The RAR receives its input directly from the microprogram store output,
MI A R --4
DE DC i
IA TPF TO I FROM IP MIR
I 8 BITS _ 12
z MATCH I
ERROR Fig. 8. Sequencing checks. and so it can be used to check for faults in the MIR address portion, the gating path from the MIR to the MAR, and the MAR itself. Any multiple errors in either the RAR or the MIR/MAR circuitry will be detected by this scheme when it is active. When this check is not active, the parity check will detect the majority of failures. IV. DESIGN OF m-OUT-OF-n DECODING AND CHECK CIRCUITRY In any binary to 1-out-of-n decoding, one and only one output will be active for a given binary code. There are various arrangements in designing decoders. One typical configuration is to fully decode n binary combinations with n gates. Altematively, the decoding may be divided into two or more groups with each combination represented by two or more outputs, one from each group . The choice of design depends on many factors, e.g., fan-out, speed, packaging, and maintenance considerations. Similarly, the basic scheme of checking the decoding circuitry is to encode the outputs into a two or more bit binary number  -. Similar choices exist for the design of m-out-of-n decoders. In fact these decoders are somewhat simpler since spurious outputs do not occur if the inputs are first cleared. A partially decoded scheme of m-out-of-n decoding was selected for the same reason that partially decoded binary decoders are often built, that is to minimize the number of signal leads in the decoder circuits. In checking the m-out-of-n decoding circuitry, the Anderson and Metze scheme of totally selfchecking k-out-of-2k checkers were used in the implementation . However, much work had been done earlier by Carter and associates on checking of m-out-of-n codes - . Fig. 9 shows the general block diagram of the 4-out-of-8 decoder and check circuitry. The two 4-bit groups are individually decoded into 16 outputs. Two methods of decoding are presented in Fig. 10. The first. one is the normal 4-bit binary to l-out-of-16 decoding. This method requires both uncomplemented and complemented inputs, with the second derived by means of inverters. The outputs are sorted into five subgroups with the binary inputs having four l's, three l's, two 1's, one 1 and no 1's. The number of gates belonging to
IEEE TRANSACTIONS ON COMPUTERS, MARCH 1973
i4(I I0() 3(I) 2(I) 1(1)
I0 (1)I 2() 3() 4() DECODER
Ixl 4x4 6x6 4x4 Ixi I + 16+ 36+ 16+ 1 .70
Fig. 11. Decoder output grouping.
ERROR Fig. 9. General block diagram of partially decoded 4-out-of-8 decoder and check circuitry. 4 BIT
I T _ i -T -le., ,
1(I) O(I) REDUNDANT (NOT NEEDED) I
Fig. 10. A 4-bit decoding logic.
the respective subgroups are 1, 4, 6, 4, and 1 as shown in Fig. 10. Similarly, the second four bits in the 4-out-of-8 code are decoded and divided into the same subgrouping. Now the subgroups are paired to obtain the 70 possible 4-out-of-8 code combinations. The 4(1) group pairs with 0(1) group to give one combination; the 3(1) with 1(1) to give 16 combinations, and so on as shown in Fig. 11. A control function is then represented by two outputs, one from each group. An alternative decoding arrangement is shown in Fig. 10(b)
whereby only the uncomplemented inputs are used for decod- ing. The fan-in decreases with the number of 1's in the sub- group resulting in a less complicated wiring pattern. More important, the additional stage of logic in generating the complemented inputs is eliminated, and this, of course, has direct influence- on establishing the microcycle interval. Con- sequently, the second arrangement is chosen over the first because of its simplicity and speed. However, with the exception of the 0(1) group, more than one output will be active from the decoder gates. For example, the 1111 input code would cause all gates to be active. This is entirely satisfactory since only the gate in the corresponding subgroup of the second decoder (in this case, the 0(1) subgroup) would be active with none in the other subgroups. Hence, one and only one pair of decoder outputs is in the active state. This uniquely defines one out of the possible 70 in the 4-out-of-8 codes. As indicated in Fig. 9, the 32-decoder outputs are used as control signals. They are paired according to the arrangement shown in Fig. 11 to give 70 combinations at the control points. The reduction of decoder leads allows a greater pacKing Den
sity of integrated circuits, not only in the decoder boards, but also in other circuit boards. For example, in the bit-slice circuit board where one bit from each of the 16 general registers is partitioned onto one circuit board, the control of data transfer via the common data bus requires a total of 32 controls. As shown in Fig. 11, the 32 controls can be realized by taking 3(1) - 1(1) and 1(1) - 3(1) pairs to give two 4-by4 or 16 controls. A 2-to-I saving in terminals is achieved with this arrangement. Similarly, the number of replicated gates required for additional fan-out capability is also reduced. The decoder outputs are reencoded into their code comple- ments and are then checked with a totally self-checking 4-out-of-8 checker. Before reencoding, certain decoder outputs must be inhibited or masked in order to obtain the correct code complement. The scheme for enabling or transmitting the exact two outputs corresponding to the 4-out-of-8 code is shown in Fig. 12. A 1111 decoder output is used to enable the transmission of the 0000 output. Similarly, a 0000 output performs the same function for the 1111 output. Since
COOK et al.: SELF-CHECKING MICROPROGRAM CONTROL
DECODER OUTPUTS TO CODER Fig. 12. Group pair select. both the 1111 and the 0000 outputs are active, they are passed through to the coder circuit. This is represented by the enable lead connected between the 4(1) and the 0(1) subgroups as shown in Fig. 12. Although every decoder output on the left is active, only the 111 1 output is transmitted through by the enable signal from the 0000 decoder output. This output enabling is done on all group pairs. The net result is that the ambiguity of multiple decoder outputs within one decoder is removed and only one output from each decoder is passed through to the coder identifying uniquely the 4-bit binary input. This simplifies the coder by reducing the fan-in from 36 to 8. V. SUMMARY AND CONCLUSIONS Microprogramming permits the normally complex and irregular structure of the control section of a conventional machine to be designed in an organized and simplified manner. As a result, it is possible to identify and enumerate clearly the possible failure modes of the microprogram control logic. Having defmed the various possible failures, one can design the circuitry required to detect them. In order for the microprogram control to function properly, it is necessary that: 1) the microprogram word read out from the microprogram store or READ-ONLY memory contains no errors; 2) the microinstruction is decoded properly; and 3) the next microprogram store word is accessed correctly so that a string of microinstructions is executed in the proper order. Any malfunctions of the store access circuitry, the store data, the gating paths, the buffers, or the microinstruction decoder will cause improper operation of the controls in the system. The use of m-out-of-n codes and the associated check
logic fulfill the requirement of a complete check of the microprogram store readout and the decoding of the control fields to generate the control signals. The decoder outputs fan out to various functional units for controlling logical operations or data transfers within the processor. Those that go to the data transfer logic control the gating of information from one register to another via the data bus. The circuitry of the data transfer logic is partitioned on a bit slice with all the logic gates associated with one bit contained on a single circuit board. Since the decoder outputs fan out to each bit, any malfunctions of the transfer logic within a circuit board would affect only one bit of data. When the word is used at a later time, the error will be detected by the parity check on the data bus. Consequently, it is sufficient to check the control signals prior to entering the data transfer block. This is also true for the data manipulation block because the circuitry is duplicated. The sequencing of the microinstruction is checked to determine that each microinstruction is accessed properly. The basic check is provided by two parity check bits; one directly associated with the binary address, and the second with the word addressed in memory. As shown in Fig. 8, they are compared to determine whether the right memory word has been accessed. In addition, the address bits of the NA field are interleaved with the m-out-of-n TO and FROM control bits to enhance fault detection capability. If any multiple adjacent errors do occur in a microprogram memory word which are not detected by parity checks, they will be caught by the m-out-of-n decoder check logic. The sequencing from one microinstruction to the next is further checked by using the RAR as a duplicate of MAR whenever it is not busy holding a return address. The contents of RAR are compared with the contents of MAR to provide detection of multiple errors in addressing the microprogram store. The number of gates required in the microprogram control exclusive of the store resulted in 62 percent used for actual processing operations and 38 percent for maintenance. Of the 32 bits in each word of microprogram store, 6 or 19 percent were used for detection. The maintenance hardware is made up of at least two classes, that necessary for access to the system for fault diagnosis and that required to make the processor self-checking. In conclusion, checking techniques, such as m-out-of-n codes, interleaved parity and, in some cases, duplicating and matching, are used to detect the possible failures that may occur in the microprogram control. These checks are required to permit detection of multiple unidirectional types of faults possible with integrated circuit technology. A microprogram control lends itself to analysis of these multiple bit errors, hence, the ability to detect them. REFERENCES  J. A. Harr, F. F. Taylor, and W. Ulrich, "Organization of the No. 1 ESS central processor," Bell Syst. Tech. J., Sept. 1964. [21 T. E. Browne, T. M. Quinn, W. N. Toy, and J. E. Yates, "No. 2 ESS control unit system," Bell Syst. Tech. J., Oct. 1969.  E. L. Seley and F. S. Vigliante, 'Common control for electronic private branch exchange," IEEE Trans. Commun. Electron., vol. 83, pp. 321-329, July 1964.
IEEE TRANSACTIONS ON COMPUTERS, MARCH 1973
 R. W. Downing, J. S. Nowak, and L. S. Tuomenoksa, "No. 1
ESS maintenance plan," Bell Syst. Tech. J., Sept. 1964.
 M. V. Wilkes and J. B. Stringer, "Microprogramming and the
design of the control circuits in an electronic digital computer,"
in Proc. Cambridge Philosophical Soc., Apr. 1953.
 S. S. Husson,MicroprogrammingPrinciples and Practices. Engle-
wood Cliffs, N.J.: Prentice-Hall.
M. J. Flynn duction and
and R. F. Rosin, "Microprogramming: An a viewpoint," IEEE Trans. Comput., vol.
pp. 727-731, July 1971.
[81 H. J. Beuscher, W. H. Sisson, and W. N. Toy, "A self-checking
microprogram control," in 3rd Annu. Workshop on Micropro-
gramming, Preprints, Oct. 1970.
 D. A. Anderson
, "Design of self-checking digital networks using
coding techniques." Ph.D. Dissertation
, Univ. Illinois, Urbana,
CSL Rep. R527, Oct. 1971.
[101 H. L. Garner, "Generalized parity checking," IRE Trans. Elec-
tron. Comput., vol. EC-7, pp. 207-213, Sept. 1958.
 R. W. Hamming, "Error detecting and error correcting codes,"
Bell. Syst. Tech. J., Apr. 1950.
[121 H. J. Beuscher and W. N. Toy, "Check schemes for integrated
microprogrammed control and data transfer circuitry," IEEE
Trans. Comput.,vol. C-19, pp. 1153-1159, Dec. 1970.
 W. N. Toy, "Error detection circuits," U. S. Patent 3 428 945,
 F. F. Sellers, M. Y. Hsiao, and L. W. Bearnson, Error Detecting
Logic for Digital Computers. New York: McGraw-Hill, 1968.
 W. C. Carter, K. A. Duke, and D. C. Jessep, "A simple self-testing decoder checking circuits," IEEE Trans. Comput. (Corresp.),
vol. C-20, pp. 1413-1414, Nov. 1971.
 D. A. Anderson and G. Metze, "Design of totally self-checking
check circuits for m-out-of-n codes," IEEE Trans. Comput., this
issue, pp. 263-269.
 W. G. Bouricius, W. C. Carter, K. A. Duke, J. P. Roth, and
P. R. Schneider, "interactive design
of self-testing circuitry,"
in Proc. Purdue Centennial Year Symp. Inform. Processing,
 W. C. Carter and P. R. Schneider, "Design of dynamically
checked computers," in Proc. 1968 IFIP Conf., vol. 2, Aug. 1968.
 W. C. Carter, K. A. Duke, and P. R. Schneider, "Self-checking
error checker for k-out-of-n coded data," U. S. Patent 3 559
168, Jan. 1971.
Robert W. Cook (S'67-M'70) was born in Providence, R.I., on December 1, 1943. He received the B.E.E. degree from Rensselaer Polytechnic Institute, Troy, N.Y., in 1966, and the M.S. and Ph.D degrees from Northwestern University
, Evanston, Ill., in 1968 and 1970, respectively. Since 1966 he has been a member of the technical staff of Bell Telephone Laboratories, Inc., Naperville, Ill., where he has worked in both the Service Program Group and the Control Complex Group of the Suburban Switching Systems Laboratory. He has recently been engaged in the design and verification of a self-checking processor. Dr. Cook is a member of Eta Kappa Nu, Tau Beta Pi, and the Association for Computing Machinery.
William H. Sisson (S'61-M'66) was born in Leb- anon, Oreg., on September 21, 1942. He re- ceived the B.S. degree from Oregon State University
, Corvallis, in 1965 and the M.S. degree from the University of Michigan
, Ann Arbor, in 1966. Since 1965 he has worked for Bell Telephone Laboratories, Inc., Naperville, lll., where he was in a memory design group. He is now working in a processor design group. Mr. Sisson is a member of Tau Beta Pi, Eta Kappa Nu, and Phi Kappa Phi. A X Thomas F. Storey (M'71) was born in Halifax, IfhNova Scotia
, on March 1, 1942. He received the Engineering Certificate from Mount Allison University, Sackville, N.B., in 1964, the B.S. degree in Electrical Engineer
ing from Nova Scotia Technical College
, Halifax, in 1966, and the M.S. degree in electrical engineering
from the University of Hawaii, Honolulu, in 1967. While at the University of Hawaii he had a teaching assistants
hip in the control theory
Group. For the past five years he has been with Bell Telephone Laboratories, Inc., Naperville, Ill. He has worked on a number of electronic switching systems and is presently active in the design and development of a small self-checking processor. 'a, Wing N. Toy (A'52-M'57) was born in China on February 3, 1926. He received the B.S.E.E. and M.S.E.E. degrees from the University of Illinois
, Urbana, in 1950 and 1952, respectively, and the Ph.D. degree in electrical engineering from the University of Pennsylvania
, Philadel- pha,i 169. He joined the Bell Telephone Laboratories, Inc., Naperville, Ill., in 1952. His earlier work was concerned with carrier terminals and Feedback amplifier
design, and he later worked on a secure voice communications
system for the military. He was next involved with the design of the first terminal for high-speed data transmission
over telephone circuits. In 1956 and the following years, his effort was directed in the exploratory work of a time-division electronic switching system which led to the development of the No. 101 ESS, an electronic private branch exchange. In this project, he worked on many assignments, including circuit, store, and logic design of the central processor. Since 1962 he has been involved with the development of the No. 2 ESS, a medium-size electronic switching system. It included the control unit design and the responsibility of planning and writing test programs for factory checkout of the system. Recently, he has been engaged in logic partitioning, fault detection, and LSI design of central processors. At present, he is the Supervisor of the Control Complex Group and has the responsibility of designing a self-checking processor for telephone switching applications. He has received 16 U.S. patents from his technical work.
RW Cook, WH Sisson, TF Storey