DE102021108151A1 - SYSTEM WITH AN ISOLATED COMMUNICATION CHANNEL FOR EXECUTING A PROGRAM CODE - Google Patents

Abstract

Examples relate to a system (10) for executing program code. The proposed system (10) comprises at least a first processing unit (11), which is designed to run the software, and a second processing unit (12). Furthermore, a common communication channel (13) of the system (10) is provided, wherein in a first operating mode of the system (10) the first processing unit (11) and second processing unit (12) are connected to the common communication channel (13) and in a second Operating mode, the first processing unit (11) is separated from the common communication channel (13). An isolated communication channel (14) is designed for data exchange between the first processing unit (11) and the second processing unit (12). The system is designed to transmit the program code in the first operating mode via the common communication channel (13) to the first processing unit (11) and to execute the program code in the second operating mode on the first processing unit (11).

Description

technical field

Example embodiments relate to a system for executing program code. The proposed system includes a first processing unit that is designed to execute the program code, a second processing unit, and a common communication channel that connects the two processing units to other components of the system. Further aspects relate to a method for operating the proposed system.

background

Modern vehicles are increasingly connected to the internet, which can make them vulnerable to hacking. Usually, the Internet connection is equipped with a special electronic control unit (ECU), which then provides the connection to other control units in the car. With battery electric vehicles (BEV) there is another way to connect to the internet, namely via the electrical connection when the car is being recharged. The control device used for charging batteries is usually optimized for real-time control tasks and not for a secure connection to the internet. Thus, it can be a target of hacker attacks.

Microcontrollers that are optimized for strict real-time control tasks and operating systems (e.g. Autosar OS) are not necessarily also optimized for connecting to the internet and being constantly checked by attackers for software weaknesses. For example, these types of microcontrollers lack compute and memory resources for the operating system they are running on to implement advanced software attack mitigation options (e.g. ASLR or executable memory protection). Because these microcontrollers execute hard real-time code that requires a guaranteed execution time, implementing ways to prevent software attacks in non-real time is often not an option.

Typical modern microcontrollers have more than one processing unit (e.g. processing unit; e.g. CPU core and appropriate associated memory), all connected to one or more common system buses. The I/O units (input-output) of the microcontroller are also connected to this common system bus or communication channel. They allow the microcontroller's software to interact with external systems (e.g. internet connection; e.g. signal output to send signals to perform driving functions, e.g. accelerate the vehicle).

Microcontrollers and operating systems (e.g. Autosar OS) that are optimized for hard real-time control tasks are sometimes not optimized for connecting to the Internet and can therefore be affected by attempts to install malware.

summary

It is an object of the present disclosure to provide improved concepts for an architecture of microcontrollers and an operation of these, through which a threat from malware can be reduced.

This object is solved according to the subject matter of the independent patent claims. Further advantageous embodiments are described in the dependent patent claims, the following description and in connection with the figures.

Accordingly, a system for executing program code (e.g. software or executable file) is proposed. The system includes at least a first computing unit that is designed to run the software. The system also includes at least one second processing unit. A common communication channel of the system is provided (e.g. system BUS), with the first and second processor being connected to the common communication channel (e.g. directly; e.g. directly) in a first operating mode of the system, and with at least the first processor being connected in a second operating mode disconnected from the common communication channel. Due to the separation of the first processing unit, the second operating mode can be described, for example, as an isolation mode or isolated operating mode.

Provision is also made to provide an isolated communication channel, which is designed for data exchange between the first and second computing unit. The isolated communication channel can, for example, exclusively connect the first and second processing unit to one another and can be provided exclusively for data exchange between the first and second processing unit. In other words, it can be possible that no further processing unit can send or receive data via the isolated communication channel. Alternatively, the isolated communication channel can also be designed to connect more than two computing units (e.g. selected ones, e.g. three or four computing units, can be connected in this way units of the system communicate with each other). A fundamental idea of the isolated communication channel is that, in an isolated operating mode, a processing unit that is isolated from the common communication channel only has access to the isolated communication channel. For example, in the second operating mode, the first processing unit, which is separated from the common communication channel, can only communicate with the rest of the system via the isolated communication channel (and on the signal path via the second processing unit). For example, in an isolation mode, several or all processing units connected to the isolated communication channel can be separated from the common communication channel and thus communicate with one another via the isolated communication channel.

The isolated operating mode is therefore not specific to the entire system, for example, but to each processing unit that is connected to the isolated communication channel. This means, for example, both processing units (e.g. first and second processing unit or also several processing units connected via the isolated communication channel) could switch to the isolated operating mode if this makes sense or is desired - this means that these two (or more) processing units could communicate with each other, but not communicate with the rest of the system, since the connection of both (or more) computing units to the common communication channel is separated (e.g. this can be called third mode of operation).

The system is designed to transmit the program code (e.g. software, e.g. file to be executed; e.g. computer program or app) via the common communication channel to the first processing unit and to execute the program code in the second operating mode on the first processing unit. For example, in the first operating mode, the program code can be transmitted to the first processing unit on a direct transmission path from the common communication channel. Alternatively, the program code can also only be transmitted to the first processing unit in the second operating mode on an indirect transmission path via the common communication channel, the second processing unit and the isolated communication channel.

The provision of the first and second operating mode can have the advantage of being able to control whether or not the first processing unit has direct access to the common communication channel. For example, trustworthy program code can be executed in the first or second operating mode, since no damage to the system by the executed software is to be expected if it can directly access the common communication channel (e.g. central data transmission path of the system). On the other hand, unknown, potentially harmful program code (e.g. potential malware) can be executed in the second operating mode (e.g. isolation mode; e.g. security mode) in order to prevent the unknown software from having direct access to the common communication channel. On the other hand, the isolated communication channel can still be used to connect the first processing unit to the rest of the system, even in the second operating mode, so that e.g. the second processing unit also monitors data from the first processing unit to the rest of the system (e.g. I/O connections of the system). can be transferred. The monitoring of a transmission of control or result data of the program executed on the first processing unit (e.g. output data of the executed program code) with regard to potential negative effects on the system (e.g. malware) can be easier than the corresponding monitoring of the program code itself, which is on the first processing unit is executed.

According to one example, it is provided that the isolated communication channel comprises a memory unit shared by the first processing unit and by the second processing unit. For example, the first processing unit can write data to the shared memory, which can be read by the second processing unit and vice versa. The isolated communication channel could also be another, separate BUS system that does not have access to safety-critical functionality of the system (e.g. no access to the common communication channel). In this way it is possible to transmit data from the first processing unit to the second processing unit with little risk for the overall system. A decision can then be made at the second processing unit (e.g. using monitoring software) as to whether the data received from the first processing unit are uncritical or pose a risk and depending on the result the data can be forwarded to the common communication channel or blocked, for example.

According to one example, it is provided that the first and second arithmetic unit are formed within a common microcontroller. This can result in the advantage that individual arithmetic units of the microcontroller can be used for unknown program code and at the same time, with a low risk of potential malware on other arithmetic units of the same microcontroller, for example function-critical (eg safety-related) functions can be led. The proposed isolated communication channel can be used to connect safety-critical functions and unknown program code in a microcontroller with little risk and effort.

According to an alternative example, it is provided that the first arithmetic unit is formed in a first control unit and the second arithmetic unit is formed in a second control unit. In this way, different components can be combined to form a common system, with a low risk of malware for other components of the system being possible with relatively little effort (e.g. reduced monitoring effort).

According to one example, it is provided that the program code is a program code that is not certified by the system. For the effect on the overall system, it is not absolutely necessary for the program code that can be executed on the first computing unit to be checked, e.g. with regard to security-compliant execution or execution without malware (e.g. virus-free), since the rest of the system is also Running malware can remain unaffected (e.g. the data exchanged via the isolated communication channel can be monitored by relatively simple software in the second processing unit). In this case, it can be irrelevant what kind of program code is executed on the computing units. For example, program code or software for safety-critical applications can be certified.

According to one example, it is provided that the first processing unit is designed to always send an information signal to the second processing unit and/or to the common communication channel when there is a change from the second operating mode to the first operating mode. In this way, the rest of the system can be informed reliably when the isolation mode is exited and a potential threat to the entire system can ensue from unknown program code. The information signal (e.g. interrupt signal) can be triggered by hardware so that it is not possible for malware to suppress the information signal. For example, if the information signal is received unexpectedly, the system may switch to a restricted mode, e.g. security-related functions may be disabled so that unauthorized control of these security-related functions by malware may be prevented.

According to one example, it is provided that at least one further processing unit of the system is connected to the common communication channel, with the further processing unit being designed to carry out a safety-critical functionality of the system. When the system is used in a vehicle, one or more safety-critical functions can be, for example, an autonomous driving function, e.g. automatic acceleration or steering of the vehicle.

According to one example, it is provided that the system is designed to receive the program code from an Internet connection via the common communication channel. This refinement may make it possible for unknown code to be executed on the first processing unit (e.g. open source code) to be received. This can have the advantage of enabling a large variety of functions of the system and further developing the functionality of the system. Constant testing of new program codes with regard to the risk of a harmful influence on the system does not have to be carried out, since the isolated operation means that the execution of harmful software cannot have any direct harmful influence on the overall system, especially on safety-critical functions of the overall system.

According to one example, it is provided that the first arithmetic unit is designed to execute more complex software than the second arithmetic unit. For example, the first processing unit can have more processing power and/or more storage space than the second processing unit. It is thus possible to execute complex program codes on the first processing unit, with the second processing unit being able to run simpler program code which may be sufficient for checking possible damage caused by data transmitted by the first processing unit via the isolated communication channel. Alternatively, the computing units can have the same capacities.

One aspect of the present disclosure relates to a method for operating a system according to a system described above or below. The method comprises the steps: providing a program code to the first processing unit; disconnecting a direct connection between the first processing unit and the common communication channel to isolate the first processing unit from the common communication channel; and executing the software on the isolated first computing device. With the proposed method, the program code, e.g. unknown or non-certified program code, can be executed in an isolation mode, so that there is a potentially harmful impact on the rest of the system can be prevented. For example, data transmitted by the first processing unit operated in isolation can be checked by a monitoring program of the second processing unit before they are transmitted further via the common communication channel of the system.

According to one example, provision is made for the provision of the program code to include receiving the program code at the first processing unit via the common communication channel from an Internet connection, with the direct connection being disconnected after the program code has been provided. According to an alternative example, it is provided that the direct connection between the first processing unit and the common communication channel is separated before the program code is provided, the program code being provided via the common communication channel, the second processing unit and the isolated communication channel on the first processing unit. Depending on the design, it can thus be made possible to transfer the program code, e.g. faster or more simply, directly to the first processing unit, or also to transfer e.g. new program code to the isolated first processing unit in isolated operation.

For example, the system can be operated as follows: for example, the first processing unit is in the isolated operating mode and is sent an Internet file via the second processing unit and via the isolated communication channel. The second processing unit does not try, for example, to check, process or filter the Internet file itself, but only forwards this file to the first processing unit, since the Internet file could potentially contain malicious software that could be activated during processing. With the proposed method, on the other hand, malicious software could not cause any damage either, because it is first executed on the isolated first processing unit and data transmitted from the first processing unit can then be checked by the second processing unit.

According to one example, it is provided that data is received at the second processing unit from the first processing unit via the isolated communication channel, while the first processing unit is operated isolated from the common communication channel. As already mentioned, this data can then be checked by the second processing unit, for example whether it could potentially have a damaging effect on the system. If this is the case, the data will not be forwarded to the common communication channel. If the verification shows that the data is secure, it can be transmitted to the common communication channel so that the functionality of the program code that is executed on the first processing unit can be provided (e.g. by transmission of the data generated by the program code to an output of the system) .

According to one example, it is provided that a system-specific program code that is executed on the second processing unit is less complex than the program code that is executed on the first processing unit. A simple code can suffice to check data generated by the program code with regard to possible damage. This means that the influence of malware can be prevented with little effort. Alternatively, however, the second processing unit could also be implemented as complex software. One recommendation would be that simple software (which communicates with the first processing unit) is run on the second processing unit (e.g. the second processing unit does not process the Internet file), but other implementations are also possible.

For example, it is provided that the second processing unit is used as a proxy in order to prevent unauthorized access to the common communication channel by the software running on the first processing unit. In isolation mode, the first processing unit has no access to the common communication channel. This means that the second processing unit does not have to prevent access, rather it offers access (as a proxy) to the common communication channel or accordingly prevents it if potentially harmful data is detected. It is also possible that the second processing unit fulfills a function as a firewall for the common communication channel.

According to an example it is provided that the received program code is an open source program code. It is irrelevant what kind of data is actually executed on the computing unit. However, there is the advantageous possibility of being able to run any program code with little risk (e.g. the received software does not have to be certified for safety-critical applications), because the provision of the isolated communication channel means that malicious software can have a direct influence on the rest of the system (which, for example, is not common communication channel is isolated) can be prevented.

character list

• 1 ein schematisches Beispiel eines Systems zum Ausführen eines Programmcodes;
• 2 ein Flussdiagramm eines Verfahrens zum Betreiben eines vorgeschlagenen Systems;
• 3 ein schematisches Beispiel eines Mikrocontrollers mit einer Recheneinheit und einem isolierten Kommunikationskanal; und
• 4 das Beispiel des Mikrocontrollers mit der Recheneinheit, die in einem Isolationsmodus betrieben wird.

Exemplary embodiments are explained in more detail below with reference to the enclosed figures. Show it:

• 1 a schematic example of a system for executing a program code;
• 2 a flowchart of a method for operating a proposed system;
• 3 a schematic example of a microcontroller with a computing unit and an isolated communication channel; and
• 4 the example of the microcontroller with the arithmetic unit operating in an isolation mode.

description

Various embodiments will now be described in more detail with reference to the accompanying drawings, in which some embodiments are illustrated. In the figures, the thickness dimensions of lines, layers, and/or regions may be exaggerated for clarity. In the following description of the accompanying figures, which only show a few exemplary embodiments, the same reference symbols can designate the same or comparable components.

An element that is referred to as being “connected” or “coupled” to another element, may be directly connected or coupled to the other element, or that there may be intervening elements. Unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meanings as those of ordinary skill in the art to which the exemplary embodiments pertain.

1 FIG. 1 shows a system 10 for executing program code (eg, software, an executable file, or the like). The system 10 includes a first processing unit 11, which is designed to run the software, and also at least one second processing unit 12. There may also be other processing units (see also 3 and 4 ).

The system 10 has a common communication channel 13, with the first and second processing unit 11, 12 being connected to the common communication channel 13 in a first operating mode of the system 10, and the first processing unit 11 being separated from the common communication channel 13 in a second operating mode. It is possible that the second processing unit 12 is also separated from the common communication channel 13 in the second operating mode. The common communication channel 13 can connect the first and second processor 11, 12 to other components, e.g. inputs and outputs of the system (e.g. for connection to a network or for an Internet connection) and other processors of the system 10.

The system 10 also has an isolated communication channel 14 which is designed for data exchange between the first and second processing units 11, 12. The system 10 is designed to transmit the program code, e.g. the software or file to be executed (e.g. in the first operating mode) via the common communication channel to the first processing unit and to execute the program code in the second operating mode on the first processing unit. The program code can be transmitted directly from the common communication channel 13 to the first processing unit 11 (e.g. in the first operating mode) or alternatively via an indirect transmission path via the second processing unit 12 and the isolated communication channel 14 to the first processing unit 11 (e.g. if this is second mode of operation is operated isolated from the common communication channel 13).

An advantage of the system 10 can be that the program code can be executed on the first processing unit 11 isolated from the common communication channel 13 and thus isolated from the rest of the system 10 . As a result, for example, a possible influence of potential malicious programs that may be contained in the program code on the system 10 can be reduced. Nevertheless, an exchange can take place between the first processing unit 11 and the rest of the system 10 via the isolated communication channel 14 and the second processing unit 12 . Thus, for example, files created by the program code (e.g. results of the executed program code) can be made available to the remaining part of the system (e.g. an output port of the system), but only when software on the second processing unit 12 checks these files and it is ensured that they do not contain any malicious programs or functions. In other words, a secure exchange of data (e.g. of queries to the program code to be executed and/or results of the executed program code) can be made possible, with the execution itself being able to take place in an isolated environment and thus potential risks from the program code being able to be reduced.

One possible method of operating the system 10 is also in connection with the following 2 described in more detail.

• - Bereitstellen 21 eines Programmcodes an der ersten Recheneinheit;
• - Trennen 22 einer direkten Verbindung zwischen erster Recheneinheit und dem gemeinsamen Kommunikationskanal, um die erste Recheneinheit vom gemeinsamen Kommunikationskanal zu isolieren; und
• - Ausführen 23 des Programmcodes auf der isolierten ersten Recheneinheit.

2 shows a flow chart of a method 20 for operating the system 10 as, for example, in FIG 1 is revealed. The method 20 includes the steps:

• - Providing 21 a program code at the first processing unit;
• - Separating 22 a direct connection between the first processing unit and the common communication channel in order to isolate the first processing unit from the common communication channel; and
• - Execution 23 of the program code on the isolated first processing unit.

Depending on the implementation of the method 20, the step of providing 21 can take place before or after the disconnection 22 of the direct connection between the first processing unit and the common communication channel. This can take place depending on whether the program code is to be transmitted directly to the first processing unit via the common communication channel or whether an indirect transmission path is to take place via the common communication channel, the second processing unit and the isolated communication channel.

Further details and aspects are mentioned in connection with the embodiments described above or below. This in 2 The embodiment shown may have one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or with one or more above (e.g 1 ) or below (e.g 3-4 ) described embodiments are mentioned.

3 shows a schematic example of a microcontroller 30 with a first and second processing unit 31, 32, which are connected to a common communication channel 33. Additional processing units 35 , 36 are connected to the common communication channel 33 . Critical or safety-related functions, for example, can be executed on the further processing unit 35, 36 (for example autonomous driving functions). In addition to the connection via the common communication channel 33, the first and second processing units 31, 32 are also connected to one another by means of an isolated communication channel 34, for example a shared memory unit 34. The isolated communication channel 34 enables data to be exchanged between the second processing unit 32 and the first processing unit 31 even when the first processing unit is operated in an isolated mode (see also the following 4 ).

Further details and aspects are mentioned in connection with the embodiments described above or below. This in 3 The embodiment shown may have one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or with one or more above (e.g 1-2 ) or below (e.g 4 ) described embodiments are mentioned.

4 12 shows the example of the microcontroller 30. FIG 3 , operating in an isolation mode. For this purpose, a direct connection between the first processing unit 31 and the common communication channel 33 is disconnected, e.g. a connection 37 is disconnected accordingly (e.g. a switch 37 is open; e.g. a transistor 37 is not conductive, so that no data is transmitted directly from the first processing unit 31 to the common communication channel 33 can become). The connection 37 can be separated physically in order to make isolation of the first processing unit 31 from the common communication channel 33 more secure.

Furthermore, information signals 38 are shown schematically, which can be transmitted from the first processing unit 31 to the second processing unit 32 and/or to the common communication channel 33 . The information signals 38 are sent whenever the link 37 is changed from a disconnected state (isolation mode) to a connected state. In this way, the other components of the system 10 (e.g. further processing units 35, 36) can be informed when there is a change from a (secure) isolation mode to a general mode in which data from the first processing unit 31 is sent directly to the common communication channel 33 can be transferred.

The proposed disclosure introduces a new architectural element (e.g. isolated communication channel) in microcontrollers and a new way of working for processing units.

As also in the 3 and 4 shown, a typical modern microcontroller has more than one processing unit (e.g. the microcontroller 30 has the first and at least second arithmetic unit 31, 32), all of which are connected to one or more common system buses (e.g. common communication channel 33).

In 3 a proposed concept is presented. Here two (or more) Verar Processing units 31, 32 communicate over an isolated communication channel 34 (e.g. separate shared memory). The purpose of this channel is to allow communication between processing units (e.g., computational units) that do not require access to a common system bus (e.g., common communications channel 33). When this isolation channel is available, the one or more processing units/processing units can switch to isolation mode, as in 4 is shown. When isolated mode is activated, the processing units no longer have access to the common system bus (e.g. the first processing unit 31 can no longer directly access the common communication channel 33) and can only communicate with the rest of the system via the isolated communication channel 34. If, for technical reasons, complete separation from the common system bus is not possible, it is possible that only clearly defined, restricted access is permitted (e.g. no access by the isolated computing unit to I/O units, but restricted access to a common used part of memory).

For (full) system bus access, another processing unit (e.g. second processing unit 32) can grant proxy access to the processing units running in isolation mode. This setup has the advantage, for example, that potentially untrustworthy code can then be executed on the core (e.g. computing core, e.g. CPU) of the respective processing unit or computing unit that is running in isolation mode. Even if this executing code or program code were compromised, the isolated processing units do not have access to the common system bus, so potential damage to the rest of the system can be minimized or prevented altogether.

If compromised software succeeds in switching the first processing unit 31 from isolation mode back to normal working mode, by hardware design any switch from isolation mode (or any access to the system bus in isolation mode) to another working mode will generate an interrupt signal or information signal 38 trigger (see signal 38 in 4 ). In this way, it can be made known to the rest of the system when the isolated processing unit (eg first computing unit 31) has switched modes, so that appropriate action can be taken if necessary.

Even in isolation mode, there may be the possibility that if the isolated processing unit is endangered, the processing unit(s) connected to the isolated communication channel 34 (e.g. the second processing unit 32) may also be endangered. In order to minimize this risk, it is intended that the software interacting with an isolated communication channel running on a proxy processing unit be implemented as simply as possible and with as few lines of code as possible. Due to the simple design of this software, it may be possible to test this software (which runs, for example, on the second processing unit 32) better, more easily or more cost-effectively using various methods (e.g. formal verification methods, peer reviews, static code analysis, component tests...). This may be possible because all the more complicated (e.g. untrusted) code can be executed on a processing unit operating in isolation mode (e.g. the first processing unit 31 with disconnected connection 37).

Further details and aspects are mentioned in connection with the embodiments described above or below. This in 4 The embodiment shown may have one or more optional additional features corresponding to one or more aspects mentioned in connection with the proposed concept or with one or more above (e.g 1-3 ) or in the exemplary embodiments described below.

The present disclosure relates to a system with a plurality of processing units, of which at least one, in particular several, can each be separated from a common communication channel in order to reduce a direct influence of program code executed on the respective processing unit. The introduction of an isolated communication channel from the computing unit that can be isolated in each case is proposed as a possibility of still being able to enable data exchange. By implementing the isolation channel between processing units in the microcontroller, the following advantages can be achieved, for example: - Untrusted software (e.g. TCP/IP stack, TLS software libraries, software loaded from an Internet source via an Internet connection) can be isolated from the rest of the system by running on the processing unit in isolation mode; - if the untrustworthy software is compromised, the impact on the rest of the system can be reduced, since the software has e.g. no access to I/O (in/out) units of the microcontroller (e.g. an impact of the compromised software on functions of an autonomously driving vehicle can be reduced or avoided) and thus does not interfere with the operation of a software or program that runs on other processing units (e.g. the further computing units 35, 36) that require access I/O units. It can also go through the signaling of the mode change (e.g. outputting an information signal when changing from isolated mode to connected mode) informing the processing unit (e.g. first computing unit 11) the rest of the system that the program code is no longer being executed in isolation. As a result, other functions can be switched to a security mode, for example, or security-critical functions can be deactivated until it is clear whether the program code is harmful or not. - Due to the possibility of accessing the rest of the system from the processing unit in isolation mode only via a proxy processing unit (e.g. second processing unit 12), the software on the proxy processing can be kept simple, since it only transfers the data between the system bus of a isolated processing unit. - With such rather simple pass-through software, for example, it may be easier to check for errors than more complex (eg untrustworthy) code or program code. Such simple pass-through software, for example, is more difficult to exploit or corrupt. - in this way it may be possible that no complex software has to be checked and still get a software certification for real-time systems (e.g. ASIL D, SIL 4), which can result in a large cost reduction.

The proposed concept introduces a new architectural element in microcontrollers and a new way of working for processing units that, for example, allows the microcontroller to be securely connected to the internet while still being able to perform safety-critical real-time control tasks. Aspects concern the introduction of an isolation mode for microcontrollers with real-time software.

Claims (15)

System (10) for executing a program code, the system (10) comprising: a first arithmetic unit (11) which is designed to execute the program code; a second computing unit (12); a common communication channel (13) of the system (10), wherein in a first operating mode of the system (10) the first processing unit (11) and second processing unit (12) are connected to the common communication channel (13), wherein in a second operating mode the first processing unit (11) is separated from the common communication channel (13); and an isolated communication channel (14) which is designed for data exchange between the first processing unit (11) and the second processing unit (12), wherein the system (10) is designed to transmit the program code via the common communication channel (13) to the first processing unit (11) and, to execute the program code in the second operating mode on the first processing unit (11). System (10) according to claim 1 , wherein the isolated communication channel (13) comprises a memory unit shared by the first computing unit (11) and by the second computing unit (12). System (10) according to claim 1 or 2 , wherein the first and second computing unit (11, 12) are formed within a common microcontroller (15). System (10) according to claim 1 or 2 , wherein the first arithmetic unit (11) is formed in a first control unit and the second arithmetic unit (12) is formed in a second control unit. System (10) according to one of the preceding claims, wherein the program code is a non-system (10) certified program code. System (10) according to one of the preceding claims, wherein the first processing unit (11) is designed to always send an information signal to the second processing unit (12) and/or to the common communication channel (13) when there is a change from the second operating mode to the first operating mode. System (10) according to one of the preceding claims, wherein at least one further processing unit (35, 36) of the system (10) is connected to the common communication channel (13, 33), the further processing unit (35, 36) being designed to perform safety-critical functionality of the system (10). System (10) according to one of the preceding claims, wherein the system (10) is adapted to receive the program code from an Internet connection via the common communication channel (13). System (10) according to one of the preceding claims, wherein the first processing unit (11) is designed to execute more complex software than the second processing unit (12). Method (20) for operating a system (10) according to one of the preceding claims, the method (20) comprising: providing (21) a program code at the first computing unit (11); Separating (22) a direct connection between the first computing unit (11) and the common communication channel (13) to the first computing isolating the unit (11) from the common communication channel (13); and executing (23) the program code on the isolated first computing unit (11). Method (20) according to claim 10 , wherein the provision (21) of the program code comprises receiving the program code at the first processing unit (11) via the common communication channel (13) from an Internet connection in the first operating mode, the disconnection (22) of the direct connection taking place after the program code provided (21). Method (20) according to claim 10 , wherein the separation (22) of the direct connection between the first processing unit (11) and the common communication channel (13) takes place before the provision (21) of the program code, the program code being transmitted via the common communication channel (13), the second processing unit (12) and the isolated communication channel (14) is provided (21) at the first computing unit (11) in the second operating mode. Method (20) according to any one of claim 10 until 12 , Data being received at the second processing unit (12) from the first processing unit (11) via the isolated communication channel (14), while the first processing unit (11) is operated in isolation from the common communication channel (13). Method (20) according to any one of claim 10 until 13 , wherein a system-specific program code that is executed on the second processing unit (12) is less complex than the program code that is running on the first processing unit (11). Method (20) according to any one of claim 10 until 14 , wherein the received program code is an open source program code.

Images