Translation Lookaside Buffer Shutdown Scheme

1. Field of the Invention

The invention relates to translation lookaside buffers for a computer system using virtual addressing, and more particularly to means for preventing damage to the translation lookaside buffer which might occur when a virtual address is found in more than one TLB entry.

2. Description of Related Art

LSI CPU chips or chip sets which use virtual addressing schemes require a page table for conversion of virtual addresses (VA) generated by the CPU to real addresses (RA) (also called physical addresses (PA)) usable by external devices (such as main memory or peripherals). The page table may be located in main memory or in separate storage, and may be made accessible to the hardware, the operating system, or both. In order to speed up the address conversion process, CPUs frequently include a translation lookaside buffer (TLB), which is a small cache memory which stores the several most recently used virtual addresses and their corresponding real addresses.

A general description of cache memories may be found in Strecker, "Cache Memories for PDP-11 Family computers," in Bell, Computer Engineering (Digital Press), at 263-67. As can be seen, caches can be organized in several alternative ways. A direct mapped cache comprises a high speed data RAM and a parallel high speed tag RAM. The location address of each entry in the cache is the same as the low order portion of the main memory address to which the entry corresponds, the high order portion of the main memory address being stored in the tag RAM Thus, if main memory is thought of as 2.sup.m blocks of 2.sup.n words each, the i'th word in the cache data vector will be a copy of the i'th word of one of the 2.sup.m blocks in main memory. The identity of that is stored in the i'th location in the g vector. When the CPU requests data from memory, the low order portion of the address is supplied as an address to both the cache data and tag vectors. The tag for the selected cache entry is compared with the high order portion of the CPU's address and, if it matches, the data from the cache data vector is enabled onto the output bus. If the tag does not match the high order portion of the CPU's address, then the data is fetched from main memory. It is also placed in the cache for potential future use, overwriting the previous entry.

In the context of a TLB, the "main memory" being accessed is the page table; the "data" in the data vector is a real or physical address, and the "address" supplied by the CPU is a virtual address. Thus, for a direct mapped TLB, the low order portion of the virtual address. is supplied as an address to both the TLB data vector (also called the real address (RA) or physical address (PA) vector), and the TLB tag vector. The tag in the selected TLB entry is compared with the high order portion of the virtual address from the CPU, and if it matches, the physical address in the PA vector is enabled onto the output bus for further use within the computer. If it does not match, the physical address is obtained from the full page table.

Another cache organization usable in the TLB context is called "two way set associative." In this organization, a second pair of tag and data vectors (tag and PA vectors) are placed alongside the first pair and accessed in parallel therewith. Thus, when the CPU provides a virtual address, the corresponding physical address may be found in either or both of the pairs. The determination can be made serially by a single match comparator, by comparing the high order portion of the virtual address to each of the two tags in sequence; or it can be made in parallel by two match comparators, each of which compares the high order portion of the virtual address to one of the two tags. In either case, if one of the tags matches, the corresponding physical address is enabled onto the output bus for further use within the computer. If neither matches, then the physical address is fetched from the page table. If both match, which should not occur in the normal operation of the computer, then some means is used to select one or the other and/or an error condition is signaled. The concept of set associativity can be extended to cover any number of tag/data (tag/PA) pairs, a type of organization referred to generically as "n-way set associativity."

Yet another cache organization usable in the TLB context is called "fully associative." This type of organization employs a single tag/data (tag/PA) vector pair, but the location of the tag/data (tag/PA) information in the vectors no longer has any correspondence with its location in main memory (page table). Rather, the information may be found in any location in the vector pair. No portion of the address from the CPU is used as an address to the vector pair; instead, the entire address is compared to the tags in the vector. As with n-way set associative caches, the comparison may be performed serially or in parallel (or by some combination of those two methods). If a match is found with one tag, the corresponding information in the data (PA) vector is enabled onto the output bus for further use within the system. If no match is found, the data (PA) is obtained from main memory (or the full page table). If more than one tag matches, which, again, should not ordinarily occur, then some means is used to select the data (PA) corresponding to one of the matching tags and/or an error condition is signaled.

The invention relates specifically to cache and TLB organizations in which a given address can be found in more than one location in the cache or TLB, and more specifically to those organizations in which the match comparison is performed, at least in part, in parallel. Systems using these organizations run the risk that more than one match-comparator operating in parallel will detect a match, and thereby enable more than one word of data((more than one physical address) onto the same output bus. If it happens that the different words of data (physical addresses) contain different information, excessive current flow could be created through the conflicting output transistors. This can cause, at best, loss of data, and at worst, physical damage to the chip.

One solution to this problem might be to add logic between the parallel match comparator outputs and the enable inputs to ensure that only one word of data (only one physical address) is ever enabled onto the output bus at one time. This additional layer of logic adds unwanted delay, especially if it operates by a ripple effect.

Another solution, disclosed in U.S. Pat. No. 4,473,878 to Zolnowsky, might be to prevent the storage of conflicting data initially. This solution does not reduce delay because it merely moves the comparison step to the data storage portion of the cycle. Additionally, it does not handle the situation existing on power-up, in which the data in any memory is random.

Another solution to this problem might be merely to have the software ensure that conflicting data is never stored in the cache or TLB. This is undesirable, however, because it requires every system programmer to be aware of the risk and expend effort and time avoiding it. There is also the possibility that the software will contain errors which have not been detected prior to execution. Moreover, the software cannot control the contents of the cache on power-up, in which the cache is typically filled with random data.

In U.S. Pat. No. 4,357,656 to Saltz, there is described a scheme for disabling part or all of a cache memory for the purpose of diagnostics on the cache. It comprises an ordinary direct mapped cache memory, with the addition of a cache control logic. Under microcode control, the cache control logic can be put into any of four modes: disable entire cache, disable none of the cache, disable top half, or disable bottom half. When diagnostics are to be performed, the cache control logic is first put into the appropriate mode. The cache control logic then compares each memory access address in conjunction with the mode stored therein, and forces, if appropriate, a "miss" condition regardless of the output of the match comparator.

It is therefore an object of this invention to provide a scheme for avoiding some or all of the above problems.

It is another object of the present invention to provide a scheme for preventing chip damage or data loss which may otherwise occur if a TLB has multiple identical entries stored therein.

It is another object of the present invention to increase the speed and density of caches or TLBs in which match comparisons take place in parallel.

It is another object of the present invention to propose a novel protection scheme for a fully associative TLB.

The above objects and others are accomplished according to the invention by detecting certain predefined conditions occurring in the normal operation of the system, and disabling the cache or TLB whenever such a condition is detected. That is, if one of the predefined conditions is detected, circuitry is activated which inhibits the cache or TLB from placing any data onto the output bus. Such inhibition need not take place immediately, but should take place soon enough that data loss and/or chip damage is prevented. Additionally, whereas no harm would occur if not more than one preselected entry is enabled onto the output bus despite the occurrence of the predetermined conditions, any benefit which might accrue from such a feature might not be sufficient to overcome the difficulties in taking advantage of that benefit.

For example, in the TLB context, protection circuitry may be incorporated which disables the TLB upon occurrence of either of the following two conditions: (1) the virtual address from the CPU is within a range that requires no page table lookup. That is, certain portions of main memory are predesignated as "unmapped" or "direct mapped" memory, meaning the virtual address is either always the same as the physical address, or always translatable into the physical address according to a relatively simple formula. If the virtual address from the CPU is within direct mapped memory, the TLB is disabled; (2) the current instruction is not a memory access instruction. The CPU may generate random addresses during execution of instructions which do not access memory, such as register to register instructions. The protection circuitry may disable the TLB when these instructions are being executed.

A shutdown scheme according to the invention may additionally include a failsafe mechanism to protect the chip in situations not covered by the predetermined conditions. In the TLB context, the failsafe mechanism may disable the TLB whenever more than about five tag comparators simultaneously indicate a match. Specific circuitry implementing this mechanism will be described in more detail below.

The invention will be described with respect to specific embodiments thereof, and reference will be made to the drawings, in which:

FIG. 1 is a block diagram of a computer system;

FIG. 2 shows the virtual to physical page mapping for the computer of FIG. 1; and

FIG. 3 shows an address translation unit incorporating aspects of the present invention.

The present invention has been embodied in a system designed by the assignee of the present application, which system is described in the following articles: DeMoney, et. al., "Operating System Support on a RISC," Proceedings, 1986 COMPCON, IEEE, pp. 138-143; Moussouris, et. al., "A CMOS RISC Processor with Integrated System Functions," Proceedings, 1986 COMPCON, IEEE, pp. 126-131; Chow et al., "Engineering a RISC Compiler System," Proceedings, 1986 COMPCON, IEEE, pp. 132-137; Rowen, et. al., "RISC VLSI Design for System-Level Performance," VLSI Systems Design, Vol. 7, pp. 81-88 (1986). These articles are hereby incorporated herein by reference.

FIG. 1 shows an overall block diagram of the computer. It comprises an execution unit 10, which has a bidirectional interface to a data bus 12. The execution unit 10 also generates virtual addresses which it provides via a Virtual Address (VA) bus 14 to an Address Translation Unit 16. The Address Translation Unit 16 converts incoming virtual addresses to physical addresses and outputs them on a Physical Address bus 18 (PA). The Physical Address bus is connected to a CPU address bus 20, and also to a cache subsystem 22. The cache subsystem 22 includes a data cache and a separate instruction cache (not shown individually) for separately caching instruction and data streams. The cache subsystem 22 is also bidirectionally connected to the data bus 12. The CPU address bus 20 can provide addresses to a memory interface 24 and to a boot ROM 26. The boot ROM 26 can place data on the data bus 12. The memory interface 24 is further connected to a memory subsystem 28 which includes both main memory and private memory (not shown individually). Also connected to the data bus 12 and CPU address bus 20 may be coprocessors, input/output devices and other local peripherals. These are all shown in the diagram of FIG. 1 as 30. The computer also includes numerous control leads (not shown in FIG. 1).

Before describing the inventive portion of the embodiment in greater detail, it will be useful to describe the addressing scheme used. As shown in FIG. 2, the embodiment uses a 4 GByte virtual address space 40 which maps onto a 4 GByte physical address space 42. The virtual address space is divided into four segments. The user segment, denoted kuseg is a 2 GByte segment located from byte address 0 through 7FFF FFFF. Kuseg is TLB mapped into any portion of the physical address space and is cacheable at the option of software. Kseg0, a 512 MByte space used by the kernal, is located from address 8000 0000 through 9FFF FFFF. Kseg0 is cached and directly mapped onto addresses 0000 0000 through 3FFF FFFF of the physical address space. The only address translation which should take place on a memory reference to kseg0 is the forming of 0's in the high order three bits of the 32-bit address. Kseg1 is identical to kseg0, and mapped into the same physical address region as kseg0, except that it is uncached. Kseg1 is used for I/O registers and the boot ROM, for disk buffers, and for other code or data whose usage slows down caching. Kseg2 is a 1 GByte segment located at C000 0000 through FFFF FFFF, and is cacheable and TLB mapped onto any region of physical memory.

FIG. 3 shows address translation unit 16 in detail. It is divided into a fully associative 64-entry TLB 60 and a fully associative 2-entry micro-TLB (MTLB) 62. The MTLB 62 is used only for instruction fetches, whereas the TLB 60 is used both for data references and as a second level cache for the MTLB 62 on instruction fetches. Both the TLB 60 and the MTLB 62 are connected on their inputs to a 20-bit virtual page number (VPN) bus 64, which constitutes the high-order 20-bits of the VA bus 14 shown in FIG. 1.

The output of the TLB 60 is connected to a 20-bit TLBOUT bus 68, which is connected to a first input of a multiplexer (MUX) 70. The output of the MTLB 62 is connected to a second input of the MUX 70. A third input of the MUX 70 has its low order 17 bits connected to the low order 17 bits of VPN bus 64, and its high order three bits connected to ground. This third input is used for direct mapped addressing. The TLBOUT bus 68 is also connected to the MTLB 62 for refilling the MTLB 62 in the event of an MTLB miss condition. The TLB 60 is refilled on a TLB miss condition under software control from the VPN bus 64 via a path not shown. The output of the MUX 70 is connected to a 20-bit PAHIGH bus 72, which forms the high-order portion of physical address (PA) bus 18 shown also in FIG. 1. PALOW, the low 30 order portion of PA bus 18, is connected to the 12 low order bits of VA bus 14.

The TLB 60 comprises an array of 64 entries, each comprising an ENTRY-HI portion 80 and an ENTRY-LO portion 82. The ENTRY-HI portion 80.sub.i of any individual entry holds a virtual page number for matching with the virtual page number on VPN bus 64, and may further include a process ID (PID) for matching with the contents of a PID register (not shown) which may also be incorporated in the TLB 60. The inclusion of a PID register would permit the TLB 60 to hold address translation information for different processes even if more than one of such processes are continually addressing data in physical address regions which are mapped from the same virtual address region.

The ENTRY-LO portion 82.sub.i of each individual entry holds the physical page number corresponding to the virtual page number in the corresponding ENTRY-HI portion 80.sub.i, The ENTRY-LO portion 82.sub.i may also contain additional status bits, such as a valid bit, a global bit or other bits not important

to the invention. Each individual ENTRY-HI portion 80.sub.i is connected on its output to one input of a comparator 84.sub.i. There are 64 such comparators 84.sub.i, so match comparison is performed entirely in parallel. The second input of each of the comparators 84.sub.i is connected to the VPN bus 64. Each comparator 84.sub.i generates an output signal on a match line 89.sub.i which is either high if the information in ENTRY-HI portion 80.sub.i matches the information on VPN bus 64, or low if it does not. Each match line 89.sub.i is connected to one input of a corresponding AND gate 90 if the output of which (lead 91.sub.i) is connected to an output enable of the corresponding ENTRY-LO portion 82.sub.i. Thus, assuming the second input of AND gate 90.sub.i (the purpose of which will be described below) is high, then the physical page number in each individual ENTRY-LO portion 82.sub.i of TLB 60 will be enabled onto the TLBOUT bus 68 if the information in the corresponding ENTRY-HI portion 80.sub.i matches the information n VPN bus 64.

In addition to being connected to the output enable of an ENTRY-LO portion 82.sub.i, each lead 91.sub.i is also connected to the gate of a corresponding MOSFET 92.sub.i. The sources of all the MOSFETS 92.sub.i are connected to ground, and the drains are all connected to a common pull-down line 94. The pull-down line 94 is connected through a pull-up resistor 96 (which may comprise a MOSFET having its gate connected to its drain or to a reference voltage) to the supply voltage. The pull-down line 94 is also connected to the non-inverting input of an analog comparator 98, the inverting input of which is connected to a voltage reference V.sub.ref1. V.sub.ref1 is chosen such that the analog comparator 98 outputs a high level if none of the MOSFETs 92.sub.i are active, and a low level if at least one of the MOSFETs 92.sub.i are active. Assuming again that the second inputs of all the AND gates 90.sub.i are high, the output of analog comparator 98, called NOTLBMATCH, therefore is high when none

of the comparators 84.sub.i are indicating a match and low when at least one is indicating a match.

In accordance with the invention, the pull-down line 94 is connected further to the non-inverting input of a second analog comparator 100, the inverting input of which is connected to a second voltage reference V.sub.ref2 lower than V.sub.ref1. V.sub.ref2 is chosen such that the output of analog comparator 100 is low only when at least about five of the MOSFETs 92.sub.i are active at once. The output of analog comparator 100 is connected to the "set" input of a set/reset flip flop 102 which may be reset only on system power-up. Since the presence of at least about five simultaneous match indications represents a system failure, execution of the system should cease once flip flop 102 has been set. The state of flip flop is available to the software for that purpose. The Q output of flip flop 102 is also connected to one input of a 2-input AND gate 101, the output of which is connected to the second input of each of the AND gates 90.sub.i. The second input of AND gate 101 is connected to the output of a NAND gate 85. If flip-flop 102 ever becomes active, therefore, the AND gates 90.sub.i will all be gated off, thereby quickly inhibiting the output of any information from any ENTRY-LO portion 82.sub.i onto the TLBOUT bus 68. The inhibition does not prevent multiple physical addresses from ever being placed on the TLBOUT bus 68 simultaneously, but if that should occur, they will be removed from the bus quickly enough that no damage can occur.

Further in accordance with the invention, the inputs of NAND gate 85 are connected to the outputs of two additional NAND gates 86 and 87, respectively. NAND gate 86 has two inputs, which are connected respectively to a MAPPED signal generated by execution unit 1, for indicating that the memory access is to a mapped region of virtual memory; and to clock phase 1. NAND gate 87 has three inputs, connected respectively to a MEMACC signal generated by the execution unit 10, for indicating that the current instruction is a memory access instruction; to the MAPPED signal; and to clock phase 2. NAND gates 85, 86 and 87 are used to disable the TLB upon the occurrence of certain predefined system conditions.

The operation of the address translation unit 16 will now be described, noting first that the general architecture of the computer is such that instructions are fetched on every phase 1 of a two-phase clock, and memory data references are made on phase 2. On phase 1, the execution unit 10 provides the virtual address for an instruction fetch. The low order 12 bits of the virtual address directly constitute the low order portion of PA bus 18. The high order 20 bits of the virtual address are transmitted via VPN bus 64 to the MTLB 62 and to all 64 of the comparators 84.sub.i in TLB 60. The MTLB, the construction and operation of which is conventional, compares the information to the information already stored in its two virtual address registers. If a match is found, the corresponding physical page number is provided to the second input of MUX 70 and a selection signal, PAHIGHSEL, is generated which causes the MUX 70 to output such physical page number onto PA bus 18. If a match is not found, the execution unit 10 enters a stall state while the main TLB 60 attempts to translate the instruction virtual address on the following phase 1. Each of the comparators 84.sub.i will compare the virtual address to its corresponding ENTRY-HI portion 80.sub.i and output a high level on the corresponding match line 89.sub.i if equality is found. Assuming MEMACC and MAPPED are high, and assuming exactly one match has been found, the pull-down line 94 is pulled low by one of the MOSFETs 92.sub.i. The level of pull-down line 94 is low enough to turn off the NOTLBMATCH output of analog comparator 98, but not low enough to bring low the output of analog comparator 100. The second inputs of the AND gates 90.sub.i are therefore all high, permitting the output enables of ENTRY-LO portions 82.sub.i to be governed by the state of the match lines 89.sub.i. Exactly one of the ENTRY-LO portion 82.sub.i therefore places a physical page number on TLBOUT bus 68 and no conflict exists. This physical page number is transmitted to the first input of MUX 70 and the PAHIGHSEL signal is altered (by means not shown) to cause MUX 70 to transmit its first input to PAHIGH bus 72. The physical page number from TLBOUT bus 68 is also written into MTLB 62 at this time for potential future use.

On phase 2, the execution unit 10 provides the address translation unit 16 with virtual addressing information for a data reference. Since this information appears on phase 2, it is ignored by MTLB 62. Instead, only the TLB 60 attempts the translation as described above. Again assuming exactly one match is found, the translated physical page number will be placed on TLBOUT bus 68 and transmitted by the MUX 70 to the PA bus 18.

According to the invention, as previously described, there is no logic in the TLB 60 for ensuring that a match occurring with two or more ENTRY-HI portions 80.sub.i will not cause more than one of the ENTRY-LO portions 82.sub.i to drive the TLBOUT bus 68 simultaneously. Thus, the TLB 60 includes circuitry to temporarily or permanently "shut itself down" upon the occurrence of certain predefined system conditions. These conditions are selected to generally include the situations most likely to result in multiple matches, such as the initial boot routine activated upon power-up. Multiple matches are a stronger possibility here because the contents of ENTRY-HI portion 80 are random on power-up, not set under any software control. One way to implement this aspect of the invention would be to place the boot ROM in an unmapped region of virtual memory so as to avoid any necessity to use the TLB during boot. The execution unit 10 would generate a "booting" signal upon power-up, which it would clear only upon completion of the boot routine. The "booting" signal would be used to shut down the TLB, preventing any possible enabling of multiple physical page numbers onto the TLBOUT bus 68, and the boot routine itself would include code to write non-identical entries into the ENTRY-HI portion 80 of the TLB 60. Thus, by the time booting is complete, and the booting signal is cleared, there would no longer be a possibility of multiply enabling physical page numbers onto the TLBOUT bus 68, due to random power-up data in the ENTRY-HI portion 80.

The preferred embodiment, however, protects against this source of identical data in a different manner, which also permits greater flexibility in software coding. In the preferred embodiment the boot ROM is located in a direct mapped segment of virtual memory as in the above described embodiment, but the TLB 60 is shut down whenever a memory reference is made to any direct mapped page. This is permissible because the TLB 60 is not needed during such memory references, and it is desirable because it provides an otherwise unavailable method for the software to erase entries from the TLB 60 when necessary. Without this feature, the software would have to select a dummy virtual address or process ID for writing into that entry, taking time to ensure that the dummy virtual address and process ID is not identical to any other virtual address and process ID already stored in the TLB 60 instead, in the preferred embodiment, the software need only write a fixed virtual address into the desired TLB entry, which virtual address was preselected by the programmer to be in direct mapped memory space. Thus, under the preferred embodiment, the software may erase an entry (or even several entries) in the TLB simply by writing a fixed value into those entries. It does not matter that these entries will then contain identical information because they were preselected to be in a direct mapped portion of memory. Because of the way the preferred embodiment protects against the placing of multiple physical addresses onto the TLBOUT bus 68, no match signal based on these entries will ever =presented to the output enable of any ENTRY-LO portion 82.sub.i.

A second source of multiple identical entries in the ENTRY-HI portion 80 of the TLB 60 is the software. Typically this would occur only if the software contains errors or bugs. However, bug-free software cannot be presumed; the hardware should protect itself in case bugs exist. Obviously the TLB protection scheme cannot take the same broad-brush approach to deal with this source of multiple identical entries that the preferred embodiment takes with respect to random entries on power-up: this would require shutting down whenever any access is made to memory. Instead the preferred embodiment reduces the risk of multiple matches somewhat by shutting down the TLB whenever it is not needed. This occurs when the address being referenced is in a direct mapped region of memory, or when the instruction being executed is not a memory reference instruction at all. The former condition is the same as that sensed to handle the first described source of multiple identical entries, and no additional circuitry is needed to prevent multiple physical page numbers from being placed on the TLBOUT bus 68 during the presence of such condition. The latter condition arises because unless somehow prevented, the TLB 60 attempts a translation of whatever information is on VPN bus 64 at the beginning of each clock phase. Many instructions are not memory access instructions, and the information present on such buses during phase 2 is either random or intended for an entirely different purpose. This information is just as likely as any other to constitute a virtual address which happens to match multiple TLB entries placed there by erroneous software. On the theory that any reduction in the number of TLB address translations is an improvement as long as other parts of the system do not suffer, the preferred embodiment shuts down the TLB on phase 2 whenever the instruction being executed is not a memory access instruction.

A system according to the invention may also include a failsafe portion in the TLB protection circuitry which shuts down the TLB if, despite all other portions of the protection circuitry, more than one match line 88.sub.i becomes active. This circuitry does not depend on any system condition; rather, it operates by directly sensing the occurrence of multiple matches. Since the failsafe portion is activated only on some unknown and unanticipated event, any TLB shutdown based thereon may be made permanent until the next power-up reset in order to avoid chip damage. In the preferred embodiment, the presence of about five simultaneous matches will activate the failsafe portion, and the shutdown is permanent. The choice of the number 5 represents a tradeoff between the desirability of detecting as few as possible matches greater than one, and the need to avoid noisy regions of operation.

The invention as used in the preferred embodiment therefore has three aspects: (1) temporary shutdown of the TLB on unmapped address references; (2) temporary shutdown of the TLB on phase 2 only, if the current instruction is not a memory access instruction; and (3) permanent shutdown of the TLB if at least about five matches are detected at the same time. These three aspects of the TLB shutdown scheme are implemented in the preferred embodiment as follows. First, when the execution unit 10 generates a virtual address, combinational circuitry (not shown) generates an accompanying MAPPED signal for indicating whether the virtual address is in a mapped or unmapped (direct mapped) region of memory. This signal is generated on both clock phases, since both instructions and data may appear in mapped or unmapped regions of memory. Both clock phases are gated by the MAPPED signal (phase I by NAND gate 86 and phase 2 by NAND gate 87) and the results are NANDed (by NAND gate 85) together. The resulting signal is used to gate (AND gates 90.sub.i) the match lines 89.sub.i before they reach the output enables of ENTRY-LO portions 82.sub.i. Therefore, none of the output enables will ever be activated due to a memory reference to an unmapped region of memory. Also, if MAPPED is inactive, PAHIGHSEL is altered such that MUX 70 selects the direct mapped address for presentation to PA bus 18.

The second aspect of the shutdown scheme is implemented similarly to the first. Combinational logic in the execution unit 10 decodes the opcode of the current instruction and generates a MEMACC signal which indicates whether the instruction is a memory access instruction. The MEMACC signal gates only clock phase 2 (via NAND gate 87), because instruction fetches, which are the only pertinent events occurring on clock phase 1, always require a memory access. Phase 2 is therefore gated by both MAPPED and MEMACC, and both must be active for any of the leads 91.sub.i to be activated on phase 2. Analog comparator 100, flip flop 102, MOSFETs 92.sub.i, AND gates 90.sub.i and AND gate 101 implement the third, failsafe, aspect of the shutdown scheme. If, at any time or for any reason, a lead 91.sub.i is active, the corresponding MOSFET 92.sub.i will also be turned on. The dimensions of all the MOSFETs 92.sub.i are similar, and are chosen such that their "on" resistances are on the order of the resistance of the pull-up component 96. The "on" MOSFETs 92.sub.i therefore act as a resistor divider network in combination with the pull-up component 96. Thus, the voltage of the pull-down line 94 at any time is determined by the number of MOSFETs 92.sub.i which are in their "on" state. For example, assuming each MOSFET 92 has an "on" resistance R, as does pull-up component 96, the voltage of the pull-down line 94 will be at some value V.sub.0 if none of the MOSFETs 92.sub.i are on. If one is on, the voltage of the pull-down line 94 will be V.sub.1 =V.sub.0 /2. If n are on, the voltage will be V.sub.n =V.sub.0 /(n+1). The analog comparator 98 distinguishes easily between the voltages present when none or one of the MOSFETs 92.sub.i are on, since it need only distinguish between V.sub.0 and V.sub.0 /2, respectively. It is more difficult to sense two active MOSFETs 92.sub.i and distinguish it from only one active MOSFET 92.sub.i, because a smaller voltage difference (V.sub.0 /2-V.sub.0 /3) is involved. This voltage difference is small enough to risk activation of the failsafe circuitry by noise. Therefore, analog comparator 100 is made only to distinguish one active MOSFET 92.sub.i from about five. The voltage difference (V.sub.0 /2-V.sub.0 /3) is larger and easier to detect without incurring problems with noise.

If analog comparator 100 does detect the appointed number of MOSFETs active, indicating that more than one match has been detected despite other aspects of the protection scheme, the comparator 100 outputs a low level which sets the flip flop 102. The output of flip flop 102 also gates all the match lines 89.sub.i (via AND gate 101 and AND gates 90.sub.i) and inhibits any of them from enabling any information onto the TLBOUT bus 68. The presence of multiple matches is thereby prevented from causing any physical damage to the chip.

The invention has been described with respect to specific embodiments thereof, and it will be understood that numerous variations may be made within the scope of the invention.