JP5756413B2 - Control device - Google Patents

Description

  The present invention relates to a write protection in which a logic in an integrated circuit is configured so that only a specific safety-designed program can access a safety-related part register in a control device having a safety-related part that executes a safety function. The present invention relates to a control device having a function.

  International standards for functional safety, ISO013849 and IEC61508, make it necessary to design a system so that safety-related parts that perform safety functions are not affected by failures of non-safety-related parts that perform normal functions or design errors. Looking for.

  For this reason, in a control device having a safety-related unit, when a CPU accesses a safety-related register in an integrated circuit or a work RAM for safety processing with writing, a specific subroutine that acquires a privilege level, In general, the logic of an integrated circuit is constructed so as to allow access only to a subroutine that executes a write sequence in a predetermined special procedure.

  On the other hand, since most types of embedded use CPUs in recent years do not have a privileged mode for system management, the protection method using the privileged mode cannot be easily used.

  FIG. 4 is a block diagram showing a configuration example of a control device having a conventional write protection function. In this example, the CPU 1 incorporates hardware for managing the privilege level, and a different privilege level is given to the interrupt processing routine to be called for each type of hardware interrupt. Further, the privilege level given to the interrupt processing routine being executed is transmitted to the outside using the privilege level signal 17. An example of the CPU 1 having such a function is 68000 manufactured by the former Motorola. Safety-related registers 81 to 8N are mounted in the integrated circuit 6, and for the write signals WRS1 to WRSN for these registers, the address decoder 15 performs the address bus 3 of the CPU 1, the write control signal WRN4, and the read control signal. It is generated based on RDN5.

  The address decoder 15 is configured to be able to output a write signal from the safety-related register 81 to the safety-related register 8N only during a period in which an access protection cancellation signal from the protection cancellation determination unit 16 described later is input. .

  In the integrated circuit, an access protection start register 11, an access protection release register 12, and a privilege level setting register 18 are provided as registers for performing settings related to access protection. The privilege level signal 17 of the CPU 1 described above is input to the CPU privilege level comparison unit 19, and only when the set value of the privilege level setting register 18 matches the logical value “1” in the protection release determination unit 16 at the subsequent stage. Is output. On the other hand, the set reset flip-flop 16a in the protection release determination unit 16 is supplied with a set pulse by writing a predetermined bit pattern on the data bus 2 to the access protection start register 11, and the access protection release register 12 is configured such that a reset pulse is supplied by writing a predetermined bit pattern on the data bus 2. The output of the set / reset flip-flop 16a is logically ORed with the output of the CPU privilege level comparison unit 19 by the OR gate 16b to generate the above access protection release signal.

FIG. 5 is a flowchart showing the execution contents of the safety-related processing routine in the CPU and the operation of each part of the block diagram of FIG. 4 in the embodiment of FIG.
In the flowchart of FIG. 5, the safety-related part processing routine on the left is executed in a state where the privilege level and the interrupt priority level are low. For example, it is assumed that the safety-related part processing routine is assigned to privilege level 2 and interrupt priority level 2. At the start of processing, the safety-related part processing routine writes the privilege level 2 in the privilege level setting register 18 of FIG. 4 and then writes in the access protection release register 12. As a result, the write protection for the safety-related register 8N is released from the safety-related register 81, and the safety-related part processing routine executes the subsequent safety-related processing.

  On the other hand, when an interrupt having a higher interrupt priority and privilege level than this routine, eg, privilege level 4, occurs, the process shown in the center of the flowchart of FIG. 5 is started. When the hardware in the CPU 1 accepts an interrupt signal, the privilege level switching process by the hardware is executed, and the privilege level signal 17 changes from the privilege level 2 to the privilege level 4. As a result, the CPU privilege level comparison unit 19 changes from match determination to mismatch determination, and the logic level changes from 1 to 0. For this reason, in the interrupt processing routine after acceptance of the interrupt, the protection cancellation signal of the protection cancellation determination unit 16 is turned off, and writing to the safety-related protection register group is temporarily protected, and an error occurs in the non-safety-related processing routine. To prevent the writing process from being performed.

  Next, when the processing of the non-safety related processing routine is finished and the interrupt return processing is started, the privilege level signal 17 output from the CPU 1 is restored from the privilege level 4 to the privilege level 2, so Changes to 1 to allow writing to the safety-related registers.

  In this way, by adopting the configuration of FIG. 4, even if an interrupt with a high privilege level and a higher interrupt priority level is activated at any timing, protection processing is temporarily resumed during the transition to interrupt processing. Thus, erroneous access to the safety-related registers in the interrupt processing is prevented.

JP 2009-020880 A JP 2008-047129 A

  In the conventional control device as shown in FIG. 4, an external pin for outputting the current privilege mode of the CPU 1 from the CPU 1 is necessary, but recent high performance embedded use CPUs do not have the privilege mode itself. In addition, although it has a plurality of interrupt priorities, it does not have a function of outputting the current interrupt mask level to an external pin, so that the interrupt mask level cannot be used by an external circuit as a substitute for the privilege level.

  An object of the present invention is to provide a non-safety-related processing routine when a non-safety-related processing routine having a higher interrupt priority than a processing routine that executes a safety function is activated in a CPU that does not have an external pin that outputs a privileged mode. On the other hand, it is an object of the present invention to provide a control device that protects an access release state to a safety-related register from being taken over.

  The control device according to the present invention sets the current stack pointer value in the stack address setting register of the integrated circuit and releases the protection immediately before the safety-related processing routine releases the access protection to the safety-related register in the integrated circuit. During the middle period, when the integrated circuit monitors that the CPU accesses the stack, when the upper interrupt is operated and the stack pointer is saved, the same address is read and until the stack returns. A desired operation is realized by temporarily resuming access protection.

  According to the present invention, even if the CPU does not have a configuration for managing the privilege level, it is possible to prevent access to safety-related registers due to interrupt processing with a high priority.

It is a figure which shows an example of embodiment of the control apparatus which concerns on this invention. It is a figure which shows an example of the CPU processing algorithm in this embodiment. It is a figure which shows an example of the state transition diagram of the access protection determination part in this embodiment. It is a figure which shows an example of the conventional access protection circuit. It is a figure which shows an example of the CPU processing algorithm in the conventional access protection circuit.

  Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

  An example of an embodiment of a control device having a write protection function from a non-safety related part of the present invention will be described based on the block diagram of FIG. 1 and the flowchart of FIG. In the integrated circuit 6, N registers from safety-related registers 1 to safety-related registers N (reference numerals 81 to 8N) are mounted as control registers related to safety functions, and are non-safety executed by the CPU 1. It is necessary to prevent the related processing routine from performing write access to these safety related registers 81 to 8N by mistake. Here, in the present embodiment, the “safety-related processing routine” is a specific program designed to be safe and refers to a routine that is permitted to access the safety-related registers 81 to 8N. On the other hand, the “non-safety-related processing routine” is a program other than the safety-related processing routine and refers to a routine that is not permitted to access the safety-related registers 81 to 8N.

  The above-described safety-related registers 81 to 8N are mounted inside the integrated circuit 6, and the write signals WRS1 to WRSN for each of these safety-related registers 81 to 8N are the address bus 3 of the CPU 1 and the write control signal WRN4, It is generated by the address decoder 15 based on the read control signal RDN5. The address decoder 15 is configured to be able to output a write signal for the safety-related registers 81 to 8N only during a period in which an access protection cancellation signal from the protection cancellation determination unit 7 described later is input.

  Inside the integrated circuit 6, a stack address setting register 10, an access protection start register 11, and an access protection release register 12 are provided as registers for performing settings related to access protection. In the stack address setting register 10, an increment value (4 for a 32-bit CPU) when the stack is stacked by 1 is added to the current stack pointer value written by the CPU 1, and the stack address write determination unit 13 and the stack address read The comparison address value is supplied to the determination unit 14.

  The stack address write determination unit 13 detects that the CPU 1 starts interrupt processing, saves the status register to the stack address, and sends a set pulse to the set terminal of the upper interrupt detection flip-flop 7a in the protection release determination unit 7. Supply. The stack address read determination unit 14 detects that the CPU 1 has started the interrupt recovery process and has performed the status register recovery operation from the stack address, and the reset terminal of the upper interrupt detection flip-flop 7a in the protection release determination unit 7 Is supplied with a reset pulse via an OR gate 7C.

  A set pulse is supplied to the set / reset flip-flop 7b in the protection release determination unit 7 by writing a predetermined bit pattern on the data bus 2 to the access protection start register 11, and the set pulse on the predetermined data bus 2 The reset pulse is supplied by writing the bit pattern into the access protection cancellation register 12. The output of the set / reset flip-flop 7b is logically ANDed with the negative logic output of the higher-order interrupt detection flip-flop 7a by the AND gate 7d to generate the access protection release signal.

  FIG. 2 is a flowchart showing the execution contents of the safety-related processing routine in the CPU 1 and the operation of each part of the block diagram of FIG. In the flowchart of FIG. 2, the left safety-related part processing routine is executed in a state where the interrupt priority level is lower than that of the non-safety-related part processing routine. The safety-related processing routine reads the address of the current stack pointer in the CPU 1 and writes it in the stack address setting register 10 in the integrated circuit 6 immediately before write access to the safety-related register groups 81 to 8N. Next, the access protection release register 12 is accessed for writing. As a result, the upper interrupt detecting flip-flop 7a is reset and the flip-flop 7b is set. Since both inputs of the AND gate 7d change to “1”, the access protection release signal changes to “1”. The address decoder 15 permits access to the safety related registers 81 to 8N by canceling the mask processing of the write access signals WRS1 to WRSN for the safety related register group only while the access protection release signal of “1” is input. To do.

  The safety-related processing routine has priority over the interrupt level at which the safety-related processing routine is executed after the first write access to the safety-related registers 81 to 8N until the n-th access is performed. When an interrupt request signal having a higher rank is input, the processing in the second column from the left in FIG. 2 is started. When the CPU 1 accepts an interrupt with a higher priority, the hardware of the CPU 1 reads the interrupt vector table, subtracts the stack pointer, and then writes the status register to the address of the stack pointer. The stack address write determination unit 13 in the integrated circuit 6 compares the set value of the stack address setting register 10 with the address bus 3 for the write access to the external address space by the non-safety related processing routine for the stack pointer address. Detect with. When the write processing to the stack is detected, the upper interrupt detection flip-flop 7a is set, and the access protection release signal that is the output of the logical product gate 7d changes to “0”, so that the safety related registers 81 to 8N Write access to is again temporarily masked. Next, after saving the program counter to the stack, a non-safety related part software processing routine, that is, a non-safety related processing routine is executed. Within this processing routine, write access to the safety related registers is prohibited. Therefore, even if a write access is erroneously performed to these registers, no trouble occurs in the safety function.

  When the execution of the non-safety related processing routine is completed, the saved program counter value is read from the stack pointer address, and then the status register value is read from the stack pointer address. At this time, the stack address read determination unit 14 in the integrated circuit 6 compares the set value of the stack address setting register 10 with the value of the address bus 3 to detect that the interrupt return processing is being performed, The interrupt detection flip-flop 7a is reset. As a result, the access protection release signal, which is the output of the AND gate 7d, changes to “1” again, and the write protection is released.

  On the other hand, when the return processing from the interrupt is completed and the execution of the safety-related processing routine is resumed, the write protection is released, so that the write access to the safety-related registers 81 to 8N is resumed normally. When the desired n-th write access is completed, the safety-related processing routine writes the access protection start register 11 and prohibits other routines from performing write access to the safety-related registers 81 to 8N. Thereafter, until the access protection release register 12 is write-accessed again in the safety-related processing routine or until the safety-related processing routine is called again, write access to the safety-related registers 81 to 8N is performed in other non-safety-related processing routines. Protection continues so that no attempt is made.

  The right column in FIG. 2 represents the state of the protection cancellation determination unit 7 in the integrated circuit 6, and FIG. 3 shows this state as a state transition diagram. In FIG. 3, the access protection determination unit 7 has three states S1 to S3, and is in the access protection state S1 when the power is turned on. The safety-related processing routine makes a transition to the protection release state S2 by writing to the access protection cancellation register 12 and the stack address setting register 10, and the safety-related processing routine writes to the access protection start register 11 to access protection state. Return to S1.

  On the other hand, when an interrupt having a higher interrupt priority is accepted by the CPU 1 during the period in the protection release state S2 and the stack is saved, the state transits to the temporary protection state S3 to execute protection. The temporary protection state S3 is configured to automatically return to the protection release state S2 by detecting stack return processing from the same stack address. A path for making a transition from S3 to S1 is prepared for the recovery process from the abnormal state.

  As described above, the stack address write determination unit 13 monitors the address of the stack pointer set in the stack address setting register 10 by the configuration shown in FIG. Sends a signal for temporarily resuming access protection to the protection cancellation determination unit 7. In addition, when the upper interrupt processing is completed in this state, the stack address read determination unit 14 detects the reading of the stack at the end of the interrupt and operates to release the access protection again. Regardless of the timing, the safe processing routine can execute an operation for canceling access protection in an arbitrary processing section, and the state in which access protection is canceled does not occur during execution of the upper interrupt. Therefore, even if a higher-level interrupt is activated at an arbitrary timing, the protection process is temporarily resumed during the period of transition to the interrupt process, and the safety-related registers can be prevented from being erroneously accessed in the interrupt process.

  1 CPU, 2 data bus, 3 address bus, 4 write control signal (WRN), 5 read control signal (RDN), Integrated circuit, 7 Protection release determination unit, 81 to 8N Safety related register, 91 to 9M Normal register, 10 Stack address setting register, 11 Access protection start register, 12 Access protection release register, 13 Stack address write determination unit, 14 Stack address Read determination unit, 15 address decoder.

Claims (4)

In a control device equipped with an integrated circuit having an access protection function for a safety-related register for control related to a safety function,
The integrated circuit comprises:
Saving access to the stack when an interrupt with a higher priority than the safety-related processing routine is accepted while the access protection is released while the CPU is executing a safety-related processing routine in which access to the safety-related register is permitted A stack address write determination unit that temporarily resumes access protection by detecting an operation;
A stack address read determination unit for canceling access protection to the safety-related register by detecting a return operation from the stack that is performed when the processing of the high priority interrupt is completed by the CPU;
A control device comprising: The control device according to claim 1,
The integrated circuit comprises:
An address decoder that permits access to the safety-related registers only while an access protection release signal is input;
A protection cancellation determination unit that outputs an access protection cancellation signal to the address decoder in response to detection of a return operation from the stack by the stack address read determination unit;
A control device comprising: The control device according to claim 1,
The integrated circuit includes a stack address setting register in which a stack pointer value is set when the CPU accesses the safety-related register,
The control device, wherein the stack address write determination unit detects a save operation to the stack by comparing a set value of the stack address setting register with a value of the address bus of the CPU. The control device according to claim 1,
The integrated circuit includes a stack address setting register in which a stack pointer value is set when the CPU accesses the safety-related register,
The control apparatus according to claim 1, wherein the stack address read determination unit detects a return operation from the stack by comparing a set value of the stack address setting register with a value of the address bus of the CPU.

Images