JP5699896B2 - Information processing apparatus and abnormality determination method - Google Patents

Description

  The present invention relates to an information processing apparatus having a plurality of cores, and relates to an information processing apparatus capable of monitoring core operations.

  In order to improve fuel efficiency, reduce driver's burden, and improve safety, vehicles are equipped with many electronic control devices that apply microcomputers. Since these controls are lost when a microcomputer breaks down, measures are taken to ensure the operation of the microcomputer by monitoring the operation state of the microcomputer.

  By the way, a multi-core type processor including a plurality of cores has been mounted on a microcomputer (hereinafter referred to as a multi-core microcomputer). As a technique for monitoring the operating state of each core in a multi-core microcomputer, a lockstep method is known in which one instruction is executed simultaneously by a plurality of cores and the execution results are compared in units of instructions. However, in the lockstep method, since a plurality of cores execute the same instruction, only one task is executed at the same time, resulting in a reduction in processing efficiency.

  Therefore, a technique is known in which the same task is executed on a plurality of cores in a single shot, and a comparison circuit detects the abnormality of the core by comparing the processing results (see, for example, Patent Document 1). In Patent Document 1, the same processing as a processor selected in a predetermined order among a plurality of normal task processing processors is sequentially selected in parallel with the same processor for parallel processing that is performed in parallel with the selected normal task processing processor. There is disclosed a multiprocessor device having comparison means for comparing the processing result of the processed normal task processor and the processing result of the parallel identical processing processor.

JP 2011-145900 A

  However, the core monitoring method disclosed in Patent Document 1 has a problem that a dedicated comparison means is required. This is because in order to compare the processing results of a plurality of cores, it is necessary to extract the processing results of each core to the outside of the core.

  If one of the multiple cores compares the processing result of the other core with the processing result of the own core, the comparison circuit becomes unnecessary, but the core that performs the comparison processing reads extra processing results such as reading the processing result of the other core. Processing is required. In this case, since the RAM area used by each core is different, there is a possibility that the processing results may not match even if the same processing should be performed using the same input data.

  An object of the present invention is to provide an information processing apparatus capable of monitoring operations of a plurality of CPUs without using a comparison circuit.

The present invention has a plurality of CPUs, storage means accessible by each CPU , and access control means for prohibiting the second CPU from writing data into the storage means , and each CPU has a common abnormality as means for each CPU to realize each by executing the detecting program, and a data writing means for writing the operation data to the first address of the storage means, the arithmetic data from the first address of said storage means a data reading means for reading a data calculating means for generating an operation result data performing an operation on said calculation data for data reading means has read, the data writing means writing the data read to the second address of said memory means and calculation result data unit read from the second address of said memory means, said data computation hand A state but which has a comparing means for comparing the generated operation result data, and the by the access control means the second CPU is prohibited to write to the storage means, the data writing of the first CPU The data reading means of the second CPU reads out the operation result data written by the means to the second address of the storage means, so that the comparing means of the second CPU is the data of the first CPU. The calculation result data by the data calculation means is compared with the calculation result data by the data calculation means of the second CPU .

  An information processing apparatus capable of monitoring the operations of a plurality of CPUs without using a comparison circuit can be provided.

It is an example of the figure explaining the general | schematic characteristic of a microcomputer. It is an example of the hardware block diagram of a microcomputer. It is an example of the figure explaining access control to RAM by MPU. It is a figure which shows an example of access permission information. It is an example of the figure which illustrates typically the order of the task which the core 1 and the core 2 perform. An example of the functional block diagram of the abnormality determination process (task B) which the core 1 or the core 2 performs is shown. It is a flowchart figure which shows an example of the procedure in which the cores 1 and 2 perform abnormality determination processing.

Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.
FIG. 1 is an example of a diagram illustrating schematic features of the microcomputer according to the present embodiment. The CPU core 1 and the CPU core 2 (hereinafter, the CPU core is simply referred to as a core) execute the abnormality determination process at different timings. This abnormality determination process is a task that is commonly executed by the cores 1 and 2.

Many microcomputers have a circuit called MPU (Memory Protection Unit). The MPU controls access to the RAMs of the cores 1 and 2. Here, the MPU performs access control as follows.
The core 1 is allowed to write / read to the RAM address A and address B.
The core 2 is permitted to read from the address A and address B of the RAM, but is prohibited from writing.
A. The core 1 that has started the abnormality determination process operates as follows.
(1) Write operation data to address A.
(2) Read operation data from address A.
(3) Perform calculation using the calculation data to generate comparison data. The core 1 holds the comparison data.
(4) Write the comparison data to address B.
(5) Read the comparison data from address B.
(6) The comparison data read from address B is compared with the held comparison data to determine whether or not they match.

In the abnormality determination process executed by the core 1, since the comparison data of (3) and (5) are originally the same, the two comparison data match unless a write error or the like occurs.
B. The core 2 that has started the abnormality determination process operates as follows.
(1) Write operation data to address A. However, the core 2 cannot write operation data to the address A.
(2) Read operation data from address A.
(3) Perform calculation using the calculation data to generate comparison data. The core 2 holds the comparison data.
(4) Write the comparison data to address B. However, the core 2 cannot write the comparison data at the address B.
(5) Read the comparison data from address B.
(6) The comparison data read from address B is compared with the held comparison data to determine whether or not they match.

  That is, since the core 2 cannot write the calculation data in (1), the core 2 executes the calculation using the same calculation data as the core 1 in (3). In (4), the core 2 cannot write comparison data. In (6), the core 2 generates the comparison data executed by the core 1 and written to the address B, and the core 2 executes the calculation. Compare the comparison data.

  Therefore, the core 2 can generate comparison data using the calculation data used by the core 1 to calculate the comparison data, and can compare the comparison data with the comparison data generated by the core 1. Since the identity of the calculation data is guaranteed, the abnormality of the core 1 or the core 2 can be detected with high accuracy from the mismatch of the comparison data.

  Further, since the abnormality determination processing is exactly the same processing, it is sufficient to store one abnormality determination processing program in the ROM. Furthermore, since the above-described process of abnormality determination processing can be included in a control program, the abnormality determination processing can be performed only by adding some processing to the control program.

[Configuration example]
FIG. 2 is an example of a hardware configuration diagram of a microcomputer mounted on the vehicle. The microcomputer 100 is assumed to be mounted on an ECU (Electronic Control Unit), but its application is not limited to a vehicle. There are various types of ECUs mounted on the vehicle, such as an engine ECU, a brake ECU, a body ECU, a navigation ECU (AV / information processing ECU), and a gateway ECU, depending on main functions. The microcomputer 100 of the present embodiment can be mounted without being affected by the difference in ECU functions. Further, the microcomputer 100 may be mounted on an ECU in which a plurality of functions are integrated into one.

  The microcomputer 100 includes a processor 11, a ROM 12, an INTC 13, a RAM 14, a DMAC 15, and an I / O bridge 16 connected to the main bus 21, and an ADC (Analog to Analog) is connected to the I / O bridge 16 via a peripheral bus 22. Digital Converter) 17 and CAN controller 18 are connected.

  The processor 11 has at least two or more cores 1 to n. Each of the cores 1 to n has a general arithmetic function (for example, an arithmetic device such as an ALU, an instruction buffer, an instruction decoder, a register set, etc.). Instead of a processor having a plurality of cores 1 to n on one chip, a CPU may be connected to the main bus 21 independently.

  The MPU 20 is disposed in the processor, but may be mounted alone. The MPU 20 is often implemented as an MMU (Memory Management Unit). The MMU has an address conversion function, a memory protection function, a cache management function, a bus arbitration function, and the like, and this memory protection function corresponds to the function of the MPU 20.

  The ROM 12 is a nonvolatile memory such as a flash memory, and stores a program 30 executed by the processor 11, initial values, parameters, and the like.

  The INTC 13 arbitrates based on the priority of the peripheral device and notifies the processor 11 of the interrupt request input from the peripheral device via the IRQ or other interrupt terminal. As a result, the processor 11 reads an instruction at an address determined according to the interrupted peripheral device from the ROM 12 and executes the process.

  The RAM 14 is a work area for the processor 11 to execute the program 30. The processor 11 reads the program 30 from the ROM 12, and reads the data from the RAM 14 via the data bus if necessary and executes the program 30. The DMAC 15 transmits data from the RAM 14 to the peripheral device via the I / O bridge 16 according to an instruction from the processor 11. In response to an instruction from the processor 11 interrupted by the peripheral device, data is received from the peripheral device via the I / O bridge 16 and written to the RAM 14.

  The I / O bridge 16 absorbs the difference in frequency between the main bus 21 and the peripheral bus 22 and transfers data between the main bus circuit and the peripheral bus circuit to each other. The I / O bridge 16 is a multiplexer, a bridge circuit, or the like, and is connected to the ADC 17 and the CAN controller 18 for each channel, and transmits / receives data to / from these peripheral devices.

  The ADC 17 converts analog signals detected by various sensors into digital signals. The ADC 17 notifies the end of conversion to the processor 11 via the INTC 13. The CAN controller 18 is a communication device for communicating with other ECUs connected via an in-vehicle network. When receiving a communication data transmission request from the processor 11, the CAN controller 18 stores the CAN ID and data in each field of the frame and outputs them to the CAN bus. Further, when the CAN controller 18 detects the communication data of the CAN ID to be received, the CAN controller 18 captures the data and interrupts it to the processor 11 via the INTC 13 to notify it.

  FIG. 3 is an example of a diagram illustrating access control to the RAM 14 by the MPU 20. The cores 1 and 2 are connected to the MPU 20 via an address line 41, an R / W selection signal line 42, a chip identification signal line 43, and the like. The MPU 20 is connected to the RAM 14 via an address line 41, an R / W selection signal line 42, an R / W permission / rejection signal line 44, and the like. The RAM 14 is connected to the core 1 and the core 2 via the data line 45.

  When the core 1 or the core 2 requests access to the RAM 14, for example, an arbiter (not shown) gives an access right to the core 1 or the core 2 based on a round robin method, a fixed priority method, a weighted round robin method, or the like.

  The core 1 or core 2 that has acquired the access right asserts the chip identification signal line and connects to the MPU 20. Then, the MPU 20 is notified of the read request or the write request via the R / W selection signal line, and the address is notified via the address line. When the MPU 20 is mounted as a function of the MMU, the MMU converts a virtual address into a physical address, but in the present embodiment, whether or not the address is converted does not matter.

  The MPU 20 passes through the address line and R / W selection signal line of the core 1 or core 2 connected by the chip identification signal line to the RAM 14 side, and outputs an address and a read request / write request to the RAM 14. Whether or not reading of data from the RAM 14 or writing to the RAM 14 is permitted is controlled by an R / W permission / rejection signal line.

  The MPU 20 has access permission / denial information 23. The access permission / denial information 23 is stored in the register of the MPU 20 when the OS or program starts up the microcomputer. In the access permission / denial information 23, whether or not each core can be read or written is set for each area of the RAM 14.

  The MPU 20 refers to the access permission / denial information 23 to determine whether or not the core that has requested access can read or write to the area indicated by the address. When the core 1 or the core 2 requests a read and the read is prohibited, the MPU 20 outputs a read prohibition to the RAM 14 through the R / W permission / rejection signal line. In this case, the core 1 or the core 2 cannot read data from the RAM 14. When the core 1 or the core 2 requests a write and the write is prohibited, the MPU 20 outputs a write prohibition to the RAM 14 through the R / W permission / rejection signal line. In this case, the core 1 or the core 2 cannot write data to the RAM 14.

  FIG. 4 is a diagram illustrating an example of the access permission information 23. Access permission / denial information 23 is provided for each core. It can also be defined for each core and for each task. The access permission / denial information 23 includes items of “area number”, “address”, “size”, “read”, “write”, and “mode”. Actually, such a label is not assigned to the MPU 20, but information stored by the register number of the MPU 20 and the bit position in the register is determined in advance.

  The “area number” is identification information for identifying an area when a part or the whole of the RAM 14 is divided into several areas. “Address” indicates the address where the area starts, and “Size” indicates the capacity of the area. “Read” indicates whether or not reading of the area is permitted, and “Write” indicates whether or not writing to the area is permitted. The “mode” is an operation mode of the cores 1 and 2. In the present embodiment, each core has two operation modes of a privilege mode and a user mode. Briefly, the privileged mode is an operation mode in which the core executes an OS, and the user mode is an operation mode in which the core executes an application. Generally, only the OS can access the system area of the OS. In FIG. 4, since the area 1 is the system area, the area 1 is allowed to be read and written only in the privileged mode.

  Comparing the access permission information 23 of the core 1 and the access permission information 23 of the core 2, the core 2 is prohibited from writing in the user mode in the area 2. That is, the core 2 cannot write data in the area 2 in the user mode. Therefore, the access permission information 23 enables access control such that the core 1 is permitted to read and write to the area 2 and the core 2 is permitted only to read from the area 2.

For example, an instruction for the core 1 and the core 2 to write data to the RAM 14 is as follows.
ST Gr0, @ Gr1
This instruction is to write the data of the register Gr0 to the address of the RAM 14 stored in the register Gr1 (corresponding to the address A and the address B in FIG. 1) (“@” means a pointer). . The developer or the like grasps the address of the RAM 14 stored in the register Gr1, and describes the access permission information 23 of the area including this address as shown in the area 2 in FIG. As a result, an area in which the core 1 can be read / written but the core 2 can only be read can be secured as an area of the RAM 14 used in the abnormality determination process.

  When the MPU 20 denies access to the core (whether read or write) by the access permission / denial information 23, an exception generally occurs. That is, the MPU 20 interrupts the core that refuses access to notify the occurrence of an exception. The core executes a predetermined exception handler or exception processing routine for this interrupt. In this embodiment, this exception is an assumed exception, so the exception handler immediately returns to the original abnormality determination process. do it. In addition, an interrupt caused by this exception may be masked. Further, when the MPU 20 is connected to the core 2, the occurrence of an exception may not be notified to the core 2. For example, when a switch is arranged on an exception interrupt line connecting the MPU 20 and the core, and the core 2 or MPU 20 is connected to the core 2, the core 2 or the MPU 20 turns off the switch.

[Task Schedule]
FIG. 5A is an example of a diagram schematically illustrating the order of tasks executed by the core 1 and the core 2. A task is a process in which processing included in one program starting from the Main function is divided into functional units, and corresponds to, for example, a function or a subroutine called from the Main function. A program executed by an external interrupt is also a task.

  In the present embodiment, description will be made assuming that, for example, task B in the figure is a task for abnormality determination processing. Although both the core 1 and the core 2 execute the task B, they cannot be executed at the same timing. This is because the core 2 uses the processing result of the task B of the core 1. For this reason, the core 2 needs to execute the task B at least slightly after the core 1 starts executing the task B. Such task scheduling is performed by a scheduler provided by the OS.

  FIG. 5B is an example of a diagram for explaining task scheduling. In general, a task goes through a dormant state, an executable state, an executing state, and a waiting state. The dormant state is the state of a task that has just been created or has completed execution. The execution state refers to the state of the task currently being executed by the core. There are less than the number of cores in the running state. The executable state refers to a task state in which input / output of peripheral devices is completed and ready for execution. A task in an executable state is assigned (dispatched) to a core if the core terminates the task in the execution state (if the core is free). The wait state is a state of a task that is waiting until a necessary condition for execution is satisfied, such as a peripheral device completing input / output.

  For example, each task is generated by a system call of a program and enters a dormant state. The system call is changed from the dormant state to an executable state. When a task is generated, the scheduler (or OS) registers the task status and the like in a TCB (Task Control Block), and thereafter manages the task based on the TCB.

  In the TCB, a task identification number, task priority, task current state, task start address, stack area address, and the like are registered. The task priority is described in advance in the program. The OS registers the task identification number, the current state of the task, the task start address, and the stack area address.

  Here, it is known that the program execution mode of the multi-core processor 11 is classified according to the OS and task execution mode of each core. This program execution mode includes AMP (Asymmetric Multiprocessing) in which a specific OS and task are assigned to the core, and SMP (Symmetric Multi-processing) in which each core executes a common OS and the relationship between the core and the task can dynamically change. processing) ”, there is BMP (Bound Multiprocessing) having both AMP and SMP properties.

  Similar to a single core in AMP, a scheduler is prepared for each core, and in SMP, one scheduler is prepared for a plurality of cores. In AMP, a unique task operates in each core, so the scheduler need only schedule one core. In SMP, the tasks executed by the core are not fixed and can be switched dynamically. Therefore, the scheduler assigns tasks in an executable state to the cores 1 and 2. In the present embodiment, since the cores 1 and 2 execute the task B with the execution timing shifted, scheduling is easier with SMP or BMP. However, even when the processor 11 operates by AMP, the scheduler of the core 2 may monitor the execution timing of the task B by the core 1, and the core 1 and the core 2 may execute the task B at appropriate timing, respectively. Is possible.

  The scheduler determines a task to be assigned to the core 1 or the core 2 from the tasks in the executable state according to a predetermined rule. For example, when assigning in order of high priority, the scheduler assigns the task with the highest priority to the core 1 or the core 2 from the tasks in the executable state. When there are a plurality of tasks with the highest priority, priority is given to a task that has become ready for execution earlier.

  The task B is generated or generated and started periodically by a timer interrupt, for example. In addition, two tasks B are started at certain time intervals so that the core 1 and the core 2 can be executed. Or, when the core 1 is executing the task B or when the execution is completed, the task B for the core 2 to execute may be generated and activated.

  Then, the scheduler alternately assigns task B in the order of core 1 and core 2. Thereby, after the core 1 executes the task B, the core 2 can execute the task B. The certain time interval is a time required for the core 1 to write at least calculation data to the RAM 14 or a time required to write calculation data and comparison data to the RAM 14. Therefore, if this time interval is sufficient, the core 1 and the core 2 can execute the task B in parallel.

  If the abnormality determination process is periodically executed, the core 2 is determined to be abnormal after the core 1 without strictly controlling the timing at which the scheduler assigns the abnormality determination process to the cores 1 and 2. A situation for executing the processing is obtained. However, there is a possibility that another task of the core 1 rewrites the operation data and comparison data in the RAM 14 after the core 1 executes the abnormality determination process and before the core 2 executes the abnormality determination process. For this reason, preferably, after the core 1 executes the abnormality determination process, the abnormality determination process is assigned to the core 2 before another task is executed.

  Note that when the core 1 and the core 2 finish the execution of the task B, the task B enters a dormant state or disappears, and is generated or generated / activated at the next processing timing.

  FIG. 6 shows an example of a functional block diagram of the abnormality determination process (task B) executed by the core 1 or the core 2. The functional blocks of core 1 and core 2 are the same. The abnormality determination process includes a data calculation unit 31, a data comparison unit 36, an abnormality processing unit 33, a data writing unit 34, a data reading unit 35, and a data holding unit 32.

The data writing unit 34 writes the calculation data and the comparison data in the RAM 14 using the instruction as described above.
ST Gr0, @ Gr1
When the calculation data is written, the calculation data described in the abnormality determination processing program is stored in Gr0, and Gr1 corresponds to the address of the RAM 14 in the area 2 described above (corresponding to address A in FIG. 1). , Hereinafter referred to as “calculation data storage address”).

  Further, when writing the comparison data into the RAM 14, Gr0 stores comparison data generated by the data calculation unit 31 using the calculation data. Gr1 stores the address of the RAM 14 in the area 2 described above (corresponding to the address B in FIG. 1 and hereinafter referred to as “comparison data storage address”).

The data reading unit 35 reads calculation data and comparison data from the RAM 14.
LD @ Gr1, Gr0
This instruction stores data read from the address of the RAM 14 stored in the register Gr1 in the register Gr0. When the calculation data is read, the calculation data storage address used in the ST instruction is stored in Gr1. Therefore, calculation data is stored in Gr0. When reading the comparison data, Gr1 stores the comparison data storage address used in the ST instruction. Therefore, comparison data is stored in Gr0.

  The data calculation unit 31 performs a predetermined calculation F (x) on the calculation data. The contents of the operation F (x) are determined so that arithmetic shifts, logical shifts, adders, multipliers, dividers, and the like, which are implemented by the core 1 and core 2 ALUs, operate. This makes it easier to detect any abnormality in the ALU.

The calculation result performed by the data calculation unit 31 is written as comparison data into the RAM 14 by the data writing unit 34 and held by the data holding unit 32. The data is held for comparison with the comparison data read from the RAM 14 by the data reading unit 35. Therefore, the retention may not be destroyed by reading by the data reading unit 35 or other processing (not shown). In the description of a program in a high-level language such as C language, the operation result is stored in a variable called a return value, so no special description for holding is required. If expressed in mnemonics, the result of the operation can be expressed by a description saved in a general-purpose register such as Gr2 or a description stored in the stack area.
MOV Gr0, Gr2
PUSH Gr0
The data comparison unit 36 compares the comparison data held by the data holding unit 32 with the comparison data read from the RAM 14 by the data reading unit 35. In the description of a program in a high-level language, instructions for comparing two variables are prepared as appropriate. When the comparison data held by the data holding unit 32 is stored in Gr2 and the data reading unit 35 stores the comparison data read from the RAM 14 in Gr0, the mnemonic can be expressed as follows.
CMP Gr0, Gr2
The comparison result is reflected in the status flag.

  The abnormality processing unit 33 performs abnormality processing when the comparison data held by the data holding unit 32 and the comparison data read from the RAM 14 by the data reading unit 35 do not match. When the MPU 20 applies the access permission information 23 described above, the data comparison unit 36 of the core 1 may not detect a mismatch when the core 1 executes the abnormality determination process (task B).

On the other hand, the data comparison unit 36 of the core 2 may detect a mismatch, but there are two cases where the mismatch occurs when the core 1 has an abnormality and the core 2 has an abnormality. For this reason, in the case of mismatch, it is effective for the data comparison unit 36 to further compare the expected value data previously held as a constant with the comparison data held by the data holding unit 32. Expected value data is data obtained by a normal core performing calculation F (x) on calculation data.
When the expected value data matches the comparison data held by the data holding unit 32, it is determined that the core 1 has an abnormality.
If the expected value data and the comparison data held in the data holding unit 32 do not match, at least the core 2 has an abnormality, but there is a possibility that both the core 1 and the core 2 have an abnormality.

  Therefore, the expected value data is compared with the comparison data (calculation result of the core 1) read by the data reading unit 35.

  -If the comparison result matches, it can be determined that the core 2 is abnormal.

-If the comparison results do not match, it can be determined that both the core 1 and the core 2 are abnormal.
(i) When it is determined that there is an abnormality in the core 1, since the monitoring core (core 2) monitors the monitored core (core 1), the abnormality processing is easy. For example, the abnormality processing unit 33 of the core 2 performs the following fail-safe processing.

  (a) Core 1 is reset. If the same abnormality is detected even after returning, the power supply to the core 1 is cut off and the standby core n is activated, and the task of the core 1 is assigned to the core n. If there is no such core n, the task of core 1 is assigned to core 2. If there are other operating cores such as the core 3, the fact that the core 1 has stopped is notified.

(b) Notify other ECUs via the in-vehicle network. Other ECUs perform processing such as recording abnormality detection and turning on a warning lamp.
(ii) When it is determined that there is an abnormality in the core 2, the monitoring core (core 2) is in a mode in which the core 2 itself is monitored. The core n is activated, and an abnormality is notified to these cores. Thereby, the core 1 or the core n can perform the same fail-safe process as the core 2.
(iii) If it is determined that both core 1 and core 2 are abnormal, the entire microcomputer is reset. Or, if there are other cores that are operating, such as cores m and n, or cores 3 and 4, stop cores 1 and 2 and assign the tasks of cores 1 and 2 to these cores. .

  The exception processing unit 37 corresponds to an exception handler or an exception processing routine, and performs processing to return to the instruction next to the exception occurrence (the instruction next to the ST instruction). Specifically, when an exception occurs, the context is saved and the context is restored. Alternatively, a process for masking an interrupt due to an exception is performed.

[Operation procedure]
FIG. 7 is a flowchart illustrating an example of a procedure in which the cores 1 and 2 perform the abnormality determination process. The procedure of the abnormality determination process for the core 1 and the core 2 is the same, but each is shown separately for explanation. The processing of the core 1 will be described.
S10-1: First, the data writing unit 34 writes operation data to the address A. As a result, the core 1 can pass the calculation data to the core 2. The core 1 is permitted to write by the access permission / denial information 23.
S20-1: The data reading unit 35 reads calculation data from the address A. This process is unnecessary for the core 1 but is necessary for the core 2 and is therefore included in the abnormality determination process. By doing so, the abnormality determination process executed by the core 1 and the core 2 can be made the same.
S30-1: The data calculation unit 31 performs calculation using the read calculation data and generates comparison data.
S40-1: The data holding unit 32 holds the comparison data.
S50-1: The data writing unit 34 writes the comparison data to the address B. As a result, the core 1 can pass the comparison data as the calculation result to the core 2.
S60-1: The data reading unit 35 reads the comparison data from the address B. This process is unnecessary for the core 1 but is necessary for the core 2 and is therefore included in the abnormality determination process.
S70-1: The data comparison unit 36 compares the comparison data read from the address B with the held comparison data and determines whether or not they match.
S80-1: If they do not match, the abnormality processing unit 33 performs fail-safe processing. If they match, the abnormality determination process ends.

Next, an abnormality determination process (task B) is assigned to the core 2.
S10-2: First, the data writing unit 34 writes the calculation data to the address A. Since the core 2 is not permitted to write by the access permission / rejection information 23, an exception occurs. Thereafter, the process returns to S20-2.
S20-2: The data reading unit 35 reads calculation data from the address A. Thereby, the core 1 and the core 2 can be calculated using the same calculation data.
S30-2: The data calculation unit 31 performs calculation using the read calculation data and generates comparison data.
S40-2: The data holding unit 32 holds the comparison data.
S50-2: The data writing unit 34 writes the comparison data to the address B. Since the core 2 is not permitted to be written by the MPU 20, an exception occurs. Thereafter, the process returns to S60-2.
S60-2: The data reading unit 35 reads the comparison data from the address B. Thereby, the core 2 can acquire the calculation result of the core 1.
S70-2: The data comparison unit 36 compares the comparison data read from the address B with the held comparison data, and determines whether or not they match.
S80-2: If they do not match, the abnormality processing unit 33 performs fail-safe processing. If they match, the abnormality determination process ends.

  As described above, the microcomputer of this embodiment does not require a specific comparison circuit or the like because the core performs comparison processing. Further, since the core 1 and the core 2 can execute control tasks other than the abnormality determination process, one core is not occupied by abnormality monitoring unlike the lockstep CPU.

  Even if the cores 1 and 2 execute the same abnormality determination process, the core 2 is prohibited from writing using the function of the MPU 20, and the core 1 writes the operation data to the RAM 14 and the core 2 reads it. Thus, the cores 1 and 2 can perform calculations using the same calculation data. Similarly, since the core 1 writes the comparison data to the RAM 14 and the core 2 reads the data, the core 2 can compare the calculation result of the core 1 with the calculation result of the own core.

  In addition, by prohibiting the writing of the core 2 by using the function of the MPU 20 and the processing necessary for both the cores 1 and 2 such as writing to and reading from the RAM being described in the abnormality determination processing, the core 1 and the core 2 can execute the same abnormality determination process, and the program size (ROM capacity) can be saved.

  In the present embodiment, for the sake of explanation, task B is determined to be abnormality determination processing. However, if the control task has calculation data and calculation processing, it is possible to perform abnormality determination processing simply by adding, reading, and comparing to the RAM 14, and therefore abnormality determination processing using the control task is also possible. is there.

[Other examples]
When there are three or more cores, an abnormality can be similarly determined. For example, the core 2 is a monitoring core. In this case, the access permission / denial information 23 of the MPU 20 describes an access restriction that permits reading and writing of the core 1 and cores 3 to n but prohibits writing of the core 2.

  The scheduler assigns the abnormality determination process to the core 1 after assigning the abnormality determination process to the core 1. Thereby, the abnormality of the core 1 or the core 2 can be detected. The scheduler assigns the abnormality determination process to the core 3 and then assigns the abnormality determination process to the core 2. Thereby, the abnormality of the core 3 or the core 2 can be detected.

  The scheduler repeats the same processing until the core n is reached. As described above, after assigning the abnormality determination process to any one of the plurality of cores, if the abnormality determination process is assigned to the core 2 for which writing is prohibited by the MPU 20, each of the cores can be detected even if there are three or more cores. A core abnormality can be detected.

  Further, the access permission information 23 described above stipulates that the core 1 is permitted to read and write, and the core 2 is prohibited from writing. However, the access permission / rejection of the core 1 and the core 2 in the access permission / denial information 23 can be reversed. For example, when the microcomputer is activated, the OS rewrites the access permission information 23 of the core 1 to the core 2 and the access permission information 23 of the core 2 to the core 1, so that the core 1 can be used as a monitoring core. In this case, if the scheduler assigns the abnormality determination process to the core 1 after assigning the abnormality determination process to the core 2, the core 1 can monitor the core 2.

  The same applies to the case where there are three or more cores. For example, when the microcomputer is activated, the OS can rewrite the access permission information 23 to switch the monitoring core.

11 processor 12 ROM
14 RAM
20 MPU (Memory Protection Unit)
31 Data Calculation Unit 32 Data Holding Unit 34 Data Writing Unit 35 Data Reading Unit 36 Data Comparison Unit 100 Microcomputer

Claims (5)

A plurality of CPUs and storage means accessible by each CPU;
An access control means for prohibiting the second CPU from writing data into the storage means ,
As a means for each CPU to realize each CPU by executing a common abnormality detection program,
Data writing means for writing operation data to the first address of the storage means;
A data reading means for reading the operational data from the first address of said storage means,
A data calculating means for generating an operation result data performing an operation on said calculation data for data reading means has read,
The data writing means writes to the second address of the storage means, and the data reading means compares the calculation result data read from the second address of the storage means with the calculation result data generated by the data calculation means. A comparison means ,
Operation result data written by the data writing unit of the first CPU to the second address of the storage unit in a state where the second CPU is prohibited from writing to the storage unit by the access control unit Is read by the data reading means of the second CPU, so that the comparing means of the second CPU is operated by the data calculating means of the first CPU and the data of the second CPU. An information processing apparatus that compares calculation result data obtained by calculation means . It said data writing means of the first CPU writes the calculation data to the first address of said storage means,
Wherein said data reading means in the first CPU reads the operation data from the first address of said storage means,
The data arithmetic unit of the first CPU generates a operation result data subjected to the arithmetic operation to the arithmetic data which the data reading means has read,
It said data writing means of the first CPU writes the calculation result data to said second address of said storage means,
The data writing unit of the second CPU writes the operation data to the first address of the storage unit in a state where writing to the storage unit by the second CPU is prohibited by the access control unit. I can't write ,
Wherein said data reading means of the second CPU reads the operation data from the first address of said storage means,
The data arithmetic unit of the second CPU generates a operation result data performing an operation on said data reading means has read arithmetic data of the second CPU,
The data writing unit of the second CPU writes the operation result data to the second address of the storage unit in a state where the writing to the storage unit by the second CPU is prohibited by the access control unit. I can't write ,
Said data reading means of said second CPU reads the operation result data from the second address of said storage means,
Wherein the comparison means of the second CPU compares the calculation result data by the data reading means of the second CPU has read, the operation result data, wherein the data calculation means is generated in the second CPU, it The information processing apparatus according to claim 1. If the said comparison means of the second CPU is that the calculation result data by the data reading means of the second CPU has read, the second of said operation result data the data computing means is generated by the CPU do not match,
Furthermore, a normal operation result expected value data and the second of said data arithmetic means has generated operation result data of the CPU, or the expected value data and the data reading means said memory means of said second CPU said second comparing operation result data read from the address to determine which of whether there is abnormality in the first CPU or said second CPU,
The information processing apparatus according to claim 1, wherein the information processing apparatus is an information processing apparatus. The access control means has access permission information that defines, for each CPU, permission to read from or write to the storage means,
The information processing apparatus according to any one of claims 1 to 3, wherein the access permission / rejection information is rewritten so that a CPU in which reading and writing is permitted and a CPU in which writing is prohibited are switched. A plurality of CPUs and storage means accessible by each CPU;
An access control means for prohibiting a second CPU from writing data to the storage means, and an abnormality determination method for an information processing apparatus,
As the steps executed by the means realized by each CPU by executing the common abnormality detection program for each CPU,
A step of writing data for calculation to the first address of the storage means;
A step of reading data for operation from the first address of the storage means;
Data calculation means, and generating an operation result data performing an operation on said calculation data for data reading means has read,
Comparing means, the data writing means writes to the second address of the storage means, and the data reading means reads the operation result data read from the second address of the storage means, and the calculation results generated by the data operation means Comparing the data , and
The calculation result written by the data writing unit of the first CPU to the second address of the storage unit in a state where the second CPU is prohibited from writing to the storage unit by the access control unit The data reading means of the second CPU reads the data, so that the comparison means of the second CPU performs calculation result data by the data calculation means of the first CPU and the second CPU. An abnormality determination method for comparing calculation result data by a data calculation means .

Images