FR3038749A1 - METHOD FOR CONTROLLING AN ELECTRONIC CALCULATION UNIT OF A MOTOR VEHICLE, ELECTRONIC COMPUTING UNIT AND CORRESPONDING MOTOR VEHICLE - Google Patents

Abstract

The control method of an electronic computing unit (1) of a motor vehicle according to the invention is of the type of those based on a first operating system (9) conforming to a first level of requirement in terms of security of the ISO 26262 standard, a first application program interface (10), a first event manager of a real-time environment and first peripheral drivers (11) executed by a central computing unit (3) of a microprocessor (2) further comprising a memory protection unit (4). According to the invention, the method also implements a second application program interface (15), a second event manager (14) and a second device driver (12) specific to the memory protection unit. and distinct from the first operating system.

Description

METHOD FOR CONTROLLING AN ELECTRONIC CALCULATION UNIT OF A MOTOR VEHICLE, ELECTRONIC CALCULATION UNIT AND VEHICLE

AUTOMOBILE CORRESPONDENTS TECHNICAL FIELD OF THE INVENTION.

The present invention relates to a method for controlling an electronic computing unit of a motor vehicle. The invention also relates to an electronic computing unit capable of implementing this method, as well as the motor vehicle comprising this electronic computing unit. BACKGROUND ART OF THE INVENTION.

Nowadays, operating systems (or OS, acronym in English terminology "Operating System") embedded are commonly used in electronic computing units (ECU or "Electronics Computing Unit" in English terminology) of motor vehicles. In general, it comes down to an operating system, the sequence of tasks, the processing of interruptions, and the management of resources.

The classic issues of embedded operating systems are the time response capability (ie real-time determinism) and extensibility (ie the portability of low-end microprocessors to high-end microprocessors).

With regard to automotive software, the ISO 26262 standard establishes a formal framework for the functional safety of modules. ISO 26262 states that the safety and security of the software must be considered systematically throughout the software development cycle.

A level of requirement in terms of safety, or AS IL defined by the standard (acronym for "Automotive Safety Integrity Level" in English terminology), is attributed on the basis of the risk of the occurrence of a dangerous event taking into account account the periodicity of the situation, the impact of any damage, and to what extent this situation can be controlled and managed.

With the arrival of ISO 26262, embedded operating systems are subject to a new set of requirements to meet safety requirements. As a result, traditional automotive implementations have been redesigned and new security OS solutions have been introduced to the market with significant costs.

The ISO 26262 standard defines four ASILs indicated by letters from A to D, the latter corresponding to the lowest risk and the highest security requirement level. A level of security requirement indicated by QM ("Quality Management" ie "Quality Management") is assigned to non-critical functions.

An operating system that meets the requirements of ISO 26262 is called "Safety OS". Compared to a "QM OS" (that is, an OS with classic quality management), a "Safety OS" provides protection functions for space and time protections. On the one hand, time protection is intended to control the launch rate, execution time and locking / unlocking resources shared by a program. On the other hand, the purpose of the spatial protections is to control access rights to the RAM memory (acronym for "Random Access Memory" in English terminology, ie "random access memory"). Flash type memory, and peripherals.

A memory protection is a feature of an OS that supports the implementation of spatial protections, most often on a memory protection unit, or MPU (acronym in English terminology of "Memory Protection Unit"), the microprocessor.

When enabled, the MPU monitors the instruction and data buses of the CPU, or CPU (Central Processing Unit), the microprocessor, and accesses to the RAM, Flash and devices are controlled. Access is granted when the access rights (read, write, or execute) are valid. However, when the access rights are restricted, any access violation triggers an MPU error, stops the CPU and program execution.

It is up to the implementation of the Safety OS to offer the appropriate services to initialize and reset the MPU registers.

In the state of the art, it is known that a memory protection implementing an MPU makes it possible to detect and take into account a faster error; the impact on the CPU load is reduced since most of the processing is done by the hardware.

In response to the challenges posed by the development of embedded operating systems, automakers and OEMs have for the most part adopted a standard software architecture: AUTOSAR.

The developments of AUTOSAR (acronym in English terminology of "AUTomotive Open System ARchitecture", that is to say "Architecture of Automotive Open System") aim at fulfilling all the requirements of the ISO 26262 standard from the modules basic software ("AUTOSAR basic software" or "AUTOSAR BSW") freely accessible, but developed only at the QM requirement level.

It follows that the implementation of an MPU has most often been associated with the need to purchase a "Safety OS" type operating system, such as "AUTOSAR Safety", with a cost impact. important on the project budget.

In addition, the verification of ISO 26262 compliance of different layers of the OS is often made difficult by the disparity of contributors and the absence of source codes.

To overcome this drawback, it has been proposed techniques for testing commercial OS, and their compliance with the ISO 26262 standard, even if executables only are available.

Such a technique is described in particular in the "Binary-Level Fault Injection for AUTOSAR Systems", Mafijul Md. Islam et al., 2014 Tenth European Dependable Computing Conference, p.138-141, 2014, IEEE.

The technique is evaluated on an electronic computing unit comprising a microprocessor of the company Freescale MPC5567 series operating under AUTOSAR.

The microprocessor MPC5567 includes a Memory Management Unit (MMU), which is an MPU with an additional address translation function.

The described technique does not need to know either the OS connectors, or the event handler calls from its real-time environment, and considers the OS as a black box.

However, this technique, looking at the OS globally as a black box, does not distinguish between the normative constraints on the base OS and those related to the implementation of an MPU.

In this way, the use of a basic OS having a level of requirement in terms of QM security associated with a specific memory protection mechanism outside the OS of higher criticality level is not considered in this case. article to meet the need for a "Safety OS".

However, this decoupling of the OS and the memory protection mechanism would allow automakers and OEMs to integrate memory protection while retaining their usual QM OS in their projects, and correspond to a need for cost reduction. GENERAL DESCRIPTION OF THE INVENTION

The present invention therefore aims to satisfy this need.

It relates specifically to a method for controlling a motor vehicle electronic computing unit of the type of those based on a first operating system complying with a first level of security requirement of the ISO 26262 standard, a first application program interface, a first event manager of a real-time environment and first device drivers executed by a CPU of a microprocessor further comprising a memory protection unit.

The method according to the invention also implements a second application program interface, a second event manager and a second device driver, specific to this memory protection unit, and distinct from the first operating system.

According to the invention, the first operating system, the second event manager and the second driver are equivalent to a second operating system complying with a second level of security requirement of the ISO 26262 standard greater than first level of requirement in terms of security.

In the method of the invention, the first level of requirement in terms of security is preferably rated QM.

In the method of the invention again, the second driver uses first task connectors and second interrupt connectors of the first operating system.

The control method of a motor vehicle electronic calculation unit according to the invention comprises a first step calling a first function of the second application program interface initializing at least one register of the memory protection unit.

The method according to the invention further comprises a second step calling a second function of the second application program interface initiating a task protection.

The method according to the invention further comprises a third step calling a third function of the second application program interface initiating an interrupt protection.

According to the invention, the second event handler transmits to the second application program interface violations of the protection of the tasks and the protection of the interrupts. The invention also relates to a motor vehicle electronic calculation unit adapted to my implementation of the control method described above.

This electronic computing unit is of the type comprising a microprocessor comprising at least a central computing unit and a memory protection unit associated with at least one program memory, at least one data memory, and at least one interface. 'entries exits.

At least one program memory stores first computer codes representative of an operating system conforming to a QM-rated security requirement of ISO 26262, a first application program interface, and a first event manager of a real-time environment and first peripheral drivers adapted to be connected to the at least one input / output interface, executed by the at least one central computing unit.

According to the invention, the at least one program memory further stores second computer codes representative of a second application program interface, a second event manager and a second driver specific to the application program. memory protection unit separate from the first computer codes.

A motor vehicle comprising at least one electronic computing unit will benefit from the invention described above.

These few essential specifications will have made obvious to the skilled person the advantages provided by the control method of a motor vehicle electronic calculation unit according to the invention, as well as by the corresponding electronic computing unit, and by the motor vehicle comprising such an electronic computing unit, compared to the state of the prior art.

The detailed specifications of the invention are given in the following description in conjunction with the accompanying drawings. It should be noted that these drawings have no other purpose than to illustrate the text of the description and do not constitute in any way a limitation of the scope of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a block diagram of a software architecture of an electronic computing unit according to the invention.

Figure 2 illustrates in detail the control method of the electronic computing unit shown in Figure 1.

Figures 3, 4 and 5 respectively illustrate first, second and third stages of the control method according to the invention. DESCRIPTION OF THE PREFERRED EMBODIMENT OF THE INVENTION

In the preferred embodiment of the invention, shown in FIG. 1, the electronic computing unit 1 of a motor vehicle in question comprises a microprocessor 2 comprising a central computing unit 3, a memory protection unit 4 and an input / output interface 5. The electronic computing unit 1 acquires data from sensors of the vehicle and transmits commands to equipment, or in general exchanges information with peripherals, by means of an interface network communication device 6 between the input / output interface 5 and an on-board network 7.

To do this, in a manner known per se, the electronic computing unit is controlled by software modules 8 executed on the microprocessor 2 on which is implemented a standardized operating system 9 of the AUTOSAR type, specifically designed for the applications of the computer. automobile.

The software modules 8 developed according to the needs of the users communicate with the operating system 9 via a first standardized application program interface 10, and communicate with the peripherals by means of appropriate first drivers 11 provided by the manufacturers.

The choice of a basic version of the operating system 9, such as AUTOSAR BSW, would limit costs but would not allow the computing unit 1 to meet the requirements of ISO 26262 for degrees of accuracy. 'requirement higher than QM because this basic version does not handle memory protection mechanism.

While being based on an operating system 9 on the QM side, the control method of the electronic computing unit 1 according to the invention manages the memory protection unit 4 of the microprocessor 2, as the software architecture clearly shows. of Figure 1.

A second driver 12 specific to the memory protection unit 4 makes it possible to control the operating system 9 by means of its connectors 13 if a second event manager 14, also specific to the memory protection unit 4, reports a memory violation event.

A second application program interface 15 allows the user to program the memory protection unit 4 and report the cause of the memory violation to the software modules 8.

FIG. 2 shows the integration of the second application program interface 15, the second driver 12 and the second event manager 14 into the control method according to the invention of the electronic calculation unit 1.

At the start 16 of the electronic computing unit 1, a launch code 17 launches the operating system 9 and a configuration of the memory protection unit 4.

To do this, a first function MPU_lnit () of the second application program interface 15 is called 18 in order to initialize the registers of the memory protection unit 4.

Figure 3 shows a corresponding first call sequence managed by the second event manager 14.

In the course of execution 19 of one of the software modules 8 of the computer unit 1 by the operating system 9, a second function MPU_SetTaskProtection () of the second application program interface 15 is invoked at 20 time of launching a task 21 by providing a first OS_PreTaskHook () start of task connector 22 of the operating system 9.

As is clearly shown in a second call sequence shown in FIG. 4, this is also managed by the second event manager 14.

After triggering of the execution of the task 21 and its completion 24, a first reset MPU_ResetTaskProtection () 25 of the memory protection unit 4 is called by providing a first end of task connector OS_PostTaskHook () 26 of the system. exploitation 9.

Since the software modules 9 in automobile applications essentially work in a real-time environment, the interrupt vectors are also protected in the control method of an electronic computing unit 1 according to the invention.

For this purpose, a third function MPU_SetlsrProtection () of the second application program interface 15 is invoked 27 at the start of an interrupt routine 28 by providing a second interrupt start connector OS_PrelsrHook (). 29 of the operating system 9.

As is clearly shown in a third call sequence shown in FIG. 5, this is also managed by the second event manager 14.

After triggering execution of the interrupt routine 28 and completion 31, a second reset MPU_ResetlsrProtection () 32 of the memory protection unit 4 is called by providing a second end-of-interruption connector OS_PostlsrHook (). 33 of the operating system 9. The memory protection unit 4 is dynamically configured at each change of context during the operation 19 of the electronic computing unit 1. The memory protection unit 4 is initialized first by the first function MPU_lnit () 18 of the second application program interface 15, then the second and third functions MPU_SetTaskProtection () 20, MPU_SetlsrProtection () 27 are called to initialize the registers of the memory protection unit 4 with new rights access for each task 21 and interrupt routine 28, respectively.

By adding such a memory protection mechanism 4, 12, 14, 15 outside the operating system 9 on the QM side, the method according to the invention makes it possible to obtain another equivalent operating system 34 having a level of requirement in terms of higher security, while limiting costs.

It goes without saying that the invention is not limited to the single preferred embodiment described above.

In particular, the cited AUTOSAR BSW operating system is only one example of QM-rated operating systems that can be implemented in an embedded system. The only restriction is that the operating system chosen is sufficiently open for the task and interrupt connectors to be used.

The above description implicitly relates to an electronic computing unit 1 comprising a single microprocessor 2 with a single central computing unit 3. A similar description could relate to an electronic computing unit 1 comprising co-processors and / or, a or multi-core microprocessors, especially in redundant hardware or software architectures where data protection issues / instructions in shared memories are particularly important.

It is considered that the microprocessor 2 comprises a memory protection unit or MPU 4. The person skilled in the art knows microprocessors, such as the reference microprocessor MPC5567, already mentioned, which includes a memory management unit or MMU. As already indicated, a MMU is an MPU 4 with an additional address translation function, but remains, for memory protection functions, an MPU 4. The present description could therefore be applied without modification to an electronic computing unit 1 comprising a microprocessor 2 provided with a MMU.

These other embodiments are not outside the scope of the present invention insofar as they result from the claims below.

Claims (10)

1) A method for controlling an electronic computing unit (1) of a motor vehicle of the type based on a first operating system (9) conforming to a first level of requirement in terms of security of the ISO standard 26262, a first application program interface (10), a first event manager of a real-time environment and first peripheral drivers (11) executed by a central computing unit (3) of a microprocessor ( 2) further comprising a memory protection unit (4), characterized in that it furthermore implements a second application program interface (15), a second event manager (14) and a second driver (12) device specific to said memory protection unit (4) and separate from said first operating system (9). 2) A method for controlling a motor vehicle electronic calculation unit according to claim 1, characterized in that said first operating system (9), said second event manager (14) and said second driver (11) are equivalent to a second operating system (34) conforming to a second level of security requirement of ISO 26262 above said first level of security requirement. 3) A method of controlling an electronic computing unit (1) of a motor vehicle according to claim 2, characterized in that said first level of requirement in terms of security is rated QM. 4) A method of controlling an electronic computer calculation unit (1) of a motor vehicle according to any one of claims 1 to 3 above, characterized in that said second driver (12) uses first task connectors (13; , 26) and second interrupt connectors (13; 29, 33) of said first operating system (9). 5) A method for controlling an electronic computer calculation unit (1) of a motor vehicle according to claim 4, characterized in that it comprises a first step calling a first function (18) of said second interface of application programs ( 15) initializing at least one register of said memory protection unit (4). 6) A method for controlling a motor vehicle electronic computing unit (1) according to claim 5, characterized in that it further comprises a second step calling a second function (20) of said second program interface. application (15) initiating job protection (21). 7) A method of controlling an electronic computer unit (1) of a motor vehicle according to claim 6, characterized in that it further comprises a third step calling a third function (27) of said second program interface of application (15) initiating interrupt protection (28). 8) A method for controlling a motor vehicle electronic computing unit (1) according to claim 7, characterized in that said second event manager (14) transmits to said second application program interface (15) violations of said job protection (21) and said interrupt protection (28). 9) electronic computing unit (1) of a motor vehicle adapted to my implementation of the control method according to any one of claims 1 to 8 above, said electronic computing unit (1) being of the type comprising a microprocessor (2) comprising at least a central processing unit (3) and a memory protection unit (4) associated with at least one program memory, at least one data memory, and at least one input / output interface (5), said at least one program memory storing first computer codes representative of an operating system (9) conforming to a security requirement level QM of ISO 26262, of a first application program interface (10), a first event manager of a real-time environment and first peripheral drivers (11) adapted to be connected to the at least one input / output interface (5). ), ex cut by said at least one central computing unit (3), characterized in that said at least one program memory further stores second computer codes representative of a second application program interface (15), a second event manager (14) and a second driver (12) specific to said memory protection unit (4) separate from said first computer codes (9, 10, 11). 10) Motor vehicle, characterized in that it comprises at least one electronic computing unit (1) according to preceding claim 9.