DE102012207215A1 - Method and device for monitoring functions of a computer system, preferably an engine control system of a motor vehicle - Google Patents

Abstract

The invention relates to a method for monitoring functions of a computer system, preferably an engine control system of a motor vehicle, which has at least two arithmetic units (2, 3), wherein at least one first arithmetic unit (3) is operated in a safe mode. In a method in which the independence between the monitored function and monitoring is given, a monitoring level (12) of a computer program (1) processed processing program is operated on the operated in the safe mode first computing unit (3), which an application level ( 11) of the computer program monitored.

Description

State of the art

The invention relates to a method for monitoring functions of a computer system, preferably an engine control system of a motor vehicle, which has at least two arithmetic units, wherein at least one first arithmetic unit is operated in a safe mode.

In safety-related applications, in particular in motor vehicles, it is customary to monitor functions of the computer program with safety-relevant properties. For this purpose, specially provided monitoring functions are used. These monitoring functions either validate the results of the functions to be monitored or check critical resources. The monitoring function itself is often classified as particularly important and worthy of protection. Therefore, the monitoring functions are self-monitored, such as in a three-level concept used in engine control in automobiles.

According to the DE 10 2005 037 230 A1 a method for monitoring functions of a computer system having at least two execution units is known, wherein between at least two operating modes of the execution units is switched and a first operating mode corresponds to a comparison mode in which the two execution units execute the same or similar commands, program segments or programs and output signals of the two Execution units are compared and a second operating mode, which corresponds to a performance mode in which the execution units execute different commands, program segments or programs in parallel, and a first function is monitored by a second monitoring function. The monitoring function is executed in comparison mode on at least two execution units. This further safeguards the monitoring. However, this method is not feasible on all computer architectures, since it requires a switch between the operating modes.

In the future, in particular due to the validity of the ISO 26262 to meet increased safety requirements. These safety requirements relate to the independence and demonstration of independence of monitored function and monitoring.

Disclosure of the invention

The invention is thus based on the object of specifying a method for monitoring functions of a computer system, in which the independence between monitored function and monitoring is given and which is executable on general computer architectures.

According to the invention, the object is achieved by operating a monitoring level of a computer program executed on the computer system, which monitors an application level of the computer program, on the first computer operated in the safe mode. This has the advantage that the monitoring level is processed on a different arithmetic unit than the function to be monitored in the form of the application level. The fact that the monitoring level is processed on an arithmetic unit which is operated in a safe mode, which means that the functioning of the arithmetic unit is checked for operational safety, ensures that the monitoring level always operates reliably. At the same time, proof of independence of monitored function and monitoring can be provided. In addition, this method has a multi-core capability, and it ensures an optimal handling of the selected computer architectures, the method is not limited to selected computer architectures.

Advantageously, the secured mode is realized by a lockstep operation or a fault-redundant operation. As a result, this method can be executed on a general type of computer architecture, since the monitoring level is always processed on a secure computing unit and there is at least one further arithmetic unit that does not necessarily have to be protected on which, for example, the functions of the application level are processed. By securing the monitoring level, it can be considered more trustworthy than other parts of the computer program.

In one embodiment, the computer program is divided into, belonging to the monitoring level computing program parts and in the monitoring level not belonging computing program parts, in particular the belonging to the monitoring level computational program parts are checked for affiliation to the monitoring level and after confirming affiliation to the monitoring level of these computational program parts of processing on the be assigned in the safe mode operated computing unit. Through these measures, the reliability of the The functions performed by the monitoring level are further increased and ensured that these functions are processed on the first processing unit operated in the safe mode.

In a variant, further safety-relevant computation program parts belonging to the application level and / or to a security level monitoring the monitoring level are processed by the arithmetic unit operated in the safe mode. This is particularly advantageous whenever the processing unit operated in the safe mode is not fully utilized by the functions of the monitoring level. In order to achieve an approximately uniform utilization of the first, operated in the safe mode computing unit and the second processing unit, which is not secured, it is advantageous if safety-relevant computational program parts of the application level and the security level, which monitors the monitoring level, also on the first Arithmetic unit to be processed.

In a further development, the computation program parts which do not belong to the monitoring level are subdivided into whether they are monitored by the monitoring level or not, wherein the computation program parts of the second arithmetic unit not monitored by the monitoring level, which does not have a safe mode, are supplied for processing. This allows a good separation of monitored and unmonitored functions, as they are processed on different arithmetic units. Spatial independence is achieved by the distribution to different arithmetic units since the monitoring is performed by a different hardware element than the execution of the monitored functions.

In a further embodiment, the computation program parts belonging to the monitoring level or the computation program parts belonging to the application level and / or the security level are combined into at least one security object, preferably a runtime object, which is managed by an operating system. This summary allows the security objects to be run via the operating system that runs the first secure unit operating in safe mode. By a suitable strategy of the operating system, for example by a time-controlled strategy, a temporal independence between monitoring and monitored object can be represented very well.

Advantageously, the at least one security object accesses a defined, exclusively for the security object provided storage area of the first, operated in the safe mode computing unit. Thus, the security objects have their own memory area, on which only these can access. Such a memory limit further increases the independence between monitoring and monitored object.

In one embodiment, the memory area provided for the security object is protected by a memory protection unit, wherein it is preferably ensured that no computer program that is being processed on the second arithmetic unit accesses the memory area. By ensuring that no computer program that is running on another computer unit can access the memory areas of the first computer unit, it is guaranteed even in the presence of errors on the second computer unit that the security objects remain unaffected at all times. As a result, an extremely high degree of reliability and the freedom of influence of the second arithmetic unit are displayed on the first arithmetic unit operating in the safe mode.

In a further refinement, at least one element of a monitoring periphery of the computer system directly accesses only the first computing unit operated in the safe mode. As a result of this special connection of the periphery, the influence of the second arithmetic unit on the first arithmetic unit or the elements of the monitoring periphery controlled by it is further suppressed, in particular whenever they are connected to the first arithmetic unit in such a way that they are configured by the latter be read out or controlled.

A development of the invention relates to a device for monitoring functions of a computer system, preferably an engine control system of a motor vehicle, which has at least two arithmetic units, wherein at least one first arithmetic unit is operated in a safe mode. In a device in which the independence and the proof of independence of monitored function and monitoring is given, means are provided which operate on the operated in the safe mode first computing unit a monitoring level of processed on the computer system computer program, which is an application level of the computer program supervised. This has the advantage that the monitoring level is processed on a different arithmetic unit than the function to be monitored in the form of the application level, whereby the independence between monitored function and monitoring function given is. This separation is independent of the computer architecture used.

Advantageously, the first arithmetic unit in the safe mode forms a lockstep pair with a third arithmetic unit, the first and the third arithmetic unit processing the same program sequences whose output signals are evaluated for error monitoring in a comparator. This embodiment allows a structurally simple monitoring of the surveillance level.

The invention allows numerous embodiments. One of them will be explained in more detail with reference to the figures shown in the drawing.

It shows:

1 : An embodiment of the device according to the invention

2 : a safety concept for an engine control system of a motor vehicle

3 : a flow chart for the method according to the invention

1 shows a computer architecture, as used in an engine control unit of a motor vehicle. The computer architecture is called a microprocessor 1 formed and contains three computer units designated as computer core 2 . 3 . 4 , The arithmetic unit 2 is directly with a system bus 5 connected while the arithmetic units 3 and 4 via a comparator 6 to the system bus 5 are connected. Thereby the arithmetic unit becomes 3 from the arithmetic unit 4 supervised. The computing units 3 and 4 form a so-called lockstep pair within the microprocessor 1 , The use of such a lockstep pair protects the software running on this lockstep pair against errors in the hardware of a computer core. It will be on the arithmetic units 3 and 4 The same program steps and data are processed in parallel. The signals of the two arithmetic units 3 . 4 then be in the comparator 6 compared. Once one of the two computing units involved 3 . 4 a different result than the partner calculation unit 3 . 4 to the comparator 6 This is done by the comparator 6 detected and triggered a corresponding error signal. This error signal is in turn used to determine the safe state of the microprocessor 1 manufacture.

By means of in 1 shown microprocessor 1 Motor control systems are monitored, which have a three-level concept. The three-level concept, which in 2 is shown has in a first application level 11 All application functions of the engine control. In the surveillance level 12 become the application functionalities of the application level 11 monitored by monitoring functions while the security level 13 again the functions of the monitoring level 12 supervised.

In the, the application functionalities comprehensive application level 11 As a particularly safety-relevant part, the calculation of the torque to be set by the engine takes place. This moment affects the acceleration of the vehicle. In the simplest safety case, only too high a torque is critical and this is from the second level of monitoring 12 to detect by means of the monitoring functions. In somewhat more complex cases, too small a moment, for example, can be classified as safety-relevant and must then also be taken from the monitoring level 12 be determined.

In the surveillance level 12 the monitoring of this moment expires. This can for example be done by the monitoring level 12 also calculates a moment or an upper and / or lower bound for the moment and then checks if that from the application layer 11 calculated moment with that in the monitoring level 12 calculated moment or within tolerated limits. Another possibility is that of the application level 11 Calculated torque with other sensor signals, such as the driver request detection, plausibility. It can also be used a determined from a map barrier. If the monitoring functions of the monitoring level 12 notice that from the application level 11 calculated moment is wrong in a safety-relevant way, then it can initiate appropriate countermeasures to establish a safe state. Such countermeasures include, for example, the shutdown, the triggering of a reset or the limitation of the moment.

The security level 13 it should be the functionality and the actual functioning of the surveillance level 12 monitor. Only if it is ensured that the surveillance level 12 actually works, it can be assumed that by the surveillance level 12 Implemented monitoring actually prevents a safety-critical state. The correct and error-free functioning of the monitoring level 12 is therefore of great importance for such a security concept.

For this reason, the monitoring functions become the monitoring level 12 on the lockstep pair, consisting of the computing units 3 . 4 , finished. The software sees the two arithmetic units 3 . 4 , which work in a safe mode, only as one core. In addition to the formation of a lockstep pair, further hedging methods are the calculation units 3 . 4 known, such as a fault-redundant CPU or even a TMR structure (Triple Modular Redundancy).

If the from the surveillance level 12 ongoing monitoring functions on this secured lockstep pair 3 . 4 be processed, then this software is the monitoring level 12 protected in a special way. Their correct functioning, even in the presence of errors of the second processing unit 2 , can be assumed. In particular, even other hedging measures, for example, in the security level 13 are present, and errors of the arithmetic units 2 . 3 discover, be reduced, implemented more efficiently or even omitted.

The assignment of the software stored as a computer program for the execution on the arithmetic units 2 . 3 . 4 can then be made according to the following flowchart. In the block 7 will that be on the microprocessor 1 ongoing computer program in the various known three levels 11 . 12 . 13 disassembled. In the block 8th a predefined computer program part is checked, whether this to the monitoring level 12 the safety concept of the motor vehicle belongs. If this is the case, then in the block 9 this program part of the Lockstep pair 3 . 4 assigned for editing. Does the examined computer program part not belong to the monitoring level 12 , then finds no fixed assignment of the processing program parts to be processed to a computing unit 2 or 3 instead (block 10 ).

In addition, beyond the surveillance level 12 other computer programs that are classified as particularly relevant for safety or security are also aware of the lockstep pair operating in the safe mode (arithmetic unit) 3 . 4 ) be brought to expiration. Calculation program parts of the security level can be added to these computer program parts 13 but also selected calculation program parts of the application level 11 , such as diagnoses.

In order to achieve a simplification from a development point of view, a summary of the in the block 7 of the 3 Split computational program parts to one or more security objects possible. Such security objects can then be handled by a single operating system, which has the computing units 3 and 4 operates, operated. Such bundling from the operating system perspective allows a combination of the method according to the invention with other protective or encapsulation mechanisms. By means of a suitable scheduling strategy, for example a time-controlled strategy, a temporal independence between monitoring and monitored object can thus also be very well represented and argued. In this case, the individual functions are independent of their affiliation to the levels 11 . 12 . 13 in intervals of 5 ms, 10ms, etc. divided. This is particularly advantageous when functional interrupts are not on the monitored arithmetic unit 3 be executed. This also allows a division of the functions into the computer program functions, which not only run along temporal differences but also along the safety-related relevance.

A special advantage is given when in the block 7 the computer program not only in functions of the monitoring level 12 or features that are not at the monitoring level 12 belonging, is decomposed, but if at the not to the surveillance level 12 belonging to the computer program parts still takes place a further decomposition to the effect whether a given part of the calculation program through the monitoring level 12 is monitored or not. If an independence, for example in the form of a "Freedom from Interference" argument, as in the Standard ISO 26262 is required to be demonstrated between the monitoring and the monitored functions, then it is advantageous to the monitored functions, in this case the functions that are not part of the program part of the monitoring level 12 belong on the independent second arithmetic unit 2 to expire. This spatial independence over the distribution to several computing units 2 . 3 represents an additional argument, since the monitoring is performed by a different hardware element than the execution of the monitored functions. This is especially the case when on the lockstep pair (arithmetic unit 3 . 4 ) only the monitoring itself and / or the monitoring of the security-related computation program parts of the level 13 expires. This ensures that the application-related functions of the application level 11 on the arithmetic unit 2 be performed.

A further possibility for expansion of the considered method consists in the targeted additional use of a memory protection unit in the form of an MPU (Memory Protection Unit). In particular, a two-stage MPU, which has an additional safety MPU on the system bus 5 or on a slave side of the microprocessor 1 can be realized, used. If the security objects have their own memory area (for example, in a flash, RAM, ROM) that only these security objects are allowed to access, then you can use this memory limit by programming the safety protection unit in the microprocessor 1 accelerate. This can be improved even further by realizing this via the second layer of the MPU or the Safety MPU. This can be guaranteed that on this memory area to be protected specifically no computer programs that rely on the computing unit 2 run, even at all, even in the presence of computer program errors on the arithmetic unit 2 or largely any hardware errors. It can thus in an extremely great reliability, the inefficiency of the arithmetic unit 2 on the secure computing unit 3 being represented.

The independence between monitoring and monitored function can also be further improved if a monitoring periphery, for example in the form of special sensors, directly to the computing unit 3 is connected so that these sensors from the arithmetic unit 3 be configured and read or controlled without the computing unit 2 has an influence on it. This represents a further argument for the independence between monitoring and the object to be monitored. This also applies, in particular, to triggering the shutdown path. This can then possibly very well be represented as redundant controllable.

By means of the proposed method the independence and the proof of the independence of supervised function and monitoring function are reliably guaranteed. In addition, this method is multicore suitable, where it can be used for very general computer architectures.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102005037230 A1 [0003]

Cited non-patent literature

• ISO 26262 [0004]
• Standard ISO 26262 [0032]

Claims (11)

Method for monitoring functions of a computer system, preferably an engine control system of a motor vehicle, which comprises at least two arithmetic units ( 2 . 3 ), wherein at least one first arithmetic unit ( 3 ) is operated in a safe mode, characterized in that on the operated in the safe mode first computing unit ( 3 ) a monitoring level ( 12 ) one on the computer system ( 1 ) processed processing program which an application level ( 11 ) of the computer program. A method according to claim 1, characterized in that the safe mode is realized by a lockstep operation or a fault-redundant operation. Method according to claim 1 or 2, characterized in that the computer program in, the monitoring level ( 12 ) and in the monitoring level ( 12 ) are disassembled, in particular those relating to the surveillance level ( 12 ) belongs to their belonging to the monitoring level ( 12 ) and after confirmation of affiliation to the surveillance level ( 12 ) these computational program parts for processing the, operated in the safe mode computing unit ( 3 ) be assigned to. A method according to claim 3, characterized in that further safety relevant to the application level ( 11 ) and / or one, the surveillance level ( 12 ) monitoring security level ( 13 ) belonging computing program parts of the operated in the safe mode computing unit ( 3 ) to be edited. Method according to claim 3 or 4, characterized in that the non-monitoring level ( 12 ) are subdivided according to whether they are from the monitoring level ( 12 ) or not, not from the surveillance level ( 12 ) supervised arithmetic program parts of a second arithmetic unit ( 2 ), which does not have a safe mode, are supplied for processing. Method according to at least one of the preceding claims, characterized in that the monitoring level ( 12 ) belonging to computer program parts or the safety-relevant application level ( 11 ) and / or the security level ( 13 ) belonging computing program parts to at least one security object, preferably a runtime object, which is managed by an operating system. A method according to claim 6, characterized in that the at least one security object to a defined, provided exclusively for the security object memory area of the first, operated in the safe mode computing unit ( 3 ) accesses. Method according to Claim 7, characterized in that the memory area provided for the at least one security object is protected by a security protection unit, wherein it is preferably ensured that no computer program, which is stored on the second arithmetic unit ( 2 ), accesses the memory area. Method according to at least one of the preceding claims, characterized in that at least one element of a monitoring periphery of the computer system ( 1 ) directly only the first, working in the safe mode computing unit ( 3 ) accesses. Device for monitoring functions of a computer system, preferably an engine control system of a motor vehicle, which has at least two computing units ( 2 . 3 ), wherein at least one first arithmetic unit ( 3 ) is operated in a safe mode, characterized in that means ( 1 ), which are based on the first arithmetic unit operated in the safe mode ( 3 ) a monitoring level ( 12 ) operate a processed on the computer system computer program which an application level ( 11 ) of the computer program. Apparatus according to claim 10, characterized in that the first arithmetic unit ( 3 ) in the safe mode with a third processor ( 4 ) forms a lockstep pair, wherein the first and the third arithmetic unit ( 3 . 4 ), process the same program sequences whose output signals for error monitoring in a comparator ( 6 ) be evaluated.

Images