JP5598417B2 - RAM value guarantee device and RAM value guarantee program - Google Patents

Description

  The present invention relates to a RAM value guarantee device and a RAM value guarantee program provided with a guarantee technique for guaranteeing data in a RAM (Random Access Memory).

  For error detection and error correction processing of the stored value of the RAM, a mirror check and a three-side check technique are used (see, for example, Patent Documents 1 and 2). The mirror check is a technique for preparing two data storage areas, storing the same data in each of them, and collating the data. The three-sided check indicates a technique for preparing three data storage areas, storing data in each of them, collating the data, and determining that the data is correct if at least two or more match, and correcting the data.

JP 2004-21520 A Japanese Patent Laid-Open No. 11-85221

  However, when the mirror check technique is applied, it can be detected that the data storage area is destroyed, but error correction cannot be performed. In the three-sided check, a true value is known when one data storage area is destroyed, but a true value is not known when two data storage areas are destroyed. When the three-side check technique is applied, the storage capacity of the RAM increases.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a RAM value guarantee device and a RAM value guarantee program capable of guaranteeing the stored value of the RAM while suppressing the storage capacity of the RAM. is there.

  According to the first aspect of the present invention, the RAM includes a predetermined storage area, and the program storage area includes a program area for accessing the RAM. The backup area is provided corresponding to a predetermined storage area and can be set to an update permission / prohibition state. The register holds the update permission / prohibition state of the backup area. The program counter stores the address of an instruction to be executed by the program stored in the program storage area. Then, when monitoring the address indicated by the program counter and confirming that the address of the program counter transitions to the program area that starts accessing the predetermined storage area of the RAM, the data in the predetermined storage area is compared with the data in the backup area, When the data is different, the data in the predetermined storage area of the RAM is updated with the data in the backup area, so that the data in the predetermined storage area can be replaced with correct data.

  When it is confirmed that the address of the program counter has transitioned outside the predetermined storage area of the RAM, the backup area is set to an update-permitted state in the register immediately before the transition, and the data in the backup area is updated with the data in the predetermined storage area. Since the backup area is set to a prohibited state in the register after the update process, the rewritten data in the predetermined storage area can be saved in the backup area. Therefore, data that becomes true can be backed up, and the stored value of the RAM can be guaranteed. In addition, since the three-surface check is not required, the storage capacity of the RAM can be suppressed.

  According to the second aspect of the present invention, the RAM includes a non-guaranteed RAM area that is allocated by a section and has a guaranteed RAM area and a storage value guarantee level lower than that of the guaranteed RAM area. The program storage area includes a guaranteed program area corresponding to the guaranteed RAM area and a non-guaranteed program area corresponding to a non-guaranteed RAM area other than the guaranteed program area. The backup RAM area is provided corresponding to the guarantee RAM area and includes a backup area that can be set in an update permission / prohibition state. The program counter stores the address of an instruction to be executed by the program stored in the program storage area.

  When the address indicated by the program counter is monitored and it is confirmed that the address of the program counter transitions from the non-guaranteed program area to the guaranteed program area in the program storage area, the data in the guaranteed RAM area and the data in the backup area in the backup RAM area If the data is different, the guaranteed RAM area data is updated with the backup area data in the backup RAM area, and the program counter address transitions from the guaranteed program area to the non-guaranteed program area in the program storage area. If this is confirmed, the backup area in the backup RAM area corresponding to the guaranteed RAM area is set to the update-permitted state in the backup RAM area in the register immediately before the transition. Allow update. Then, the backup area data in the backup RAM area is updated with the data in the guaranteed RAM area, and the backup area in the backup RAM area corresponding to the guaranteed RAM area is updated by setting the backup area to a prohibited state in the register after the update process. Ban. Thereby, the stored value of the RAM can be guaranteed while suppressing the storage capacity of the RAM.

  According to the third aspect of the present invention, the RAM update permission / prohibition is performed by using a function built in the microcomputer main body. In this case, the stored value of the RAM can be guaranteed without modifying the hardware of the microcomputer.

  According to the fourth aspect of the present invention, when the address transition is confirmed by monitoring the program counter, the address of the program counter is confirmed by judging which area of the sectioned area is indicated. Therefore, it is possible to easily determine which area of the program is to be executed.

  According to the fifth aspect of the invention, the application program for comparing the data in the guarantee RAM area and the data in the backup RAM is executed when the transition from the non-guaranteed program area to the guarantee program area is recognized. It has been incorporated. Therefore, the timing for comparing the data in the guaranteed RAM area and the data in the backup RAM area is set in the application program. Therefore, it is possible to easily detect unauthorized access to the guaranteed RAM area when executing a program in the non-guaranteed program area.

  According to the invention described in claim 6, when it is confirmed that the address of the program counter transitions from the first guaranteed program area to the second guaranteed program area in the program storage area, the first of the backup RAM area is stored in the register immediately before the transition. The backup area is set to an update-permitted state, the data in the first backup area in the backup RAM area is updated with the data in the first guarantee RAM area in the guarantee RAM area, and the first backup area in the backup RAM area is updated with respect to the register after the update process Is set to the prohibited state. Therefore, since the program operation (for example, control) can be performed for each of the divided areas, it becomes possible to perform a highly relevant program operation (for example, control) for each area, and the convenience of the system can be improved.

  According to the seventh aspect of the present invention, when the application program for comparing the data in the guarantee RAM area and the data in the backup RAM has recognized the transition from the first guarantee program area to the second guarantee program area. Built to do. Therefore, the timing for comparing the data in the first guarantee RAM area in the guarantee RAM area and the data in the first backup area in the backup RAM area is set in the application program. Therefore, it is possible to easily detect unauthorized access to the guaranteed RAM area when executing a program in the non-guaranteed program area.

1 is an electrical configuration diagram schematically illustrating a system according to an embodiment of the present invention. Application program flowchart showing access to each program area and each RAM area A flowchart showing the flow of OS processing (program counter monitoring logic) executed by the CPU

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The system 1 is mainly realized by a microcomputer (hereinafter abbreviated as a microcomputer) 3 in the engine ECU 2. The microcomputer 3 includes a ROM 4, a RAM 5, a program counter 6, a RAM update permission / prohibition setting register 7, and a CPU 8, and the engine ECU 2 controls the control target A. The control target A is, for example, a diesel engine that employs a common rail system, and the engine ECU 2 realizes a control system for the diesel engine.

  The ROM 4 is provided with a non-guaranteed program area 9 and a guaranteed program area 10 as program storage areas. The guarantee program area 10 stores a program that requires a high degree of guarantee of various stored values stored in the RAM 5 to be used. The guarantee program area 10 is divided into a RAM_A group update permission area 10a, a RAM_B group update permission area 10b,. The control program is assigned to a predetermined continuous memory area according to the section information for each area 9 or 10.

  The engine ECU 2 calculates the required injection amount according to the opening degree of the accelerator pedal of the driver. In the guarantee program area 10, the injection amount is calculated by calculating the required torque from the accelerator opening degree and the engine speed. And a control program for monitoring torque are stored.

  The non-guaranteed program area 9 stores a program for performing arithmetic processing that may have a low degree of guarantee of the stored value of the RAM 5 to be used. The engine ECU 2 realizes an exhaust gas treatment system for a diesel engine, but the non-guaranteed program area 9 includes an exhaust gas by regeneration of the post-processing control (for example, regeneration of DPF (Diesel Particulate Filter), SCR (Selective Catalytic Reduction). A processing program such as (purification control) is stored.

  The readable / writable RAM 5 is provided with a non-guaranteed RAM area 11, a guaranteed RAM area 12, and a backup RAM area 13. The RAM 5 can set the non-guaranteed RAM area 11, the guaranteed RAM area 12, and the backup RAM area 13 in units of blocks by using the functions built in the microcomputer 3. It is good to provide.

  In the guarantee RAM area 12 of the RAM 5, each data group is stored by dividing its storage capacity into, for example, blocks of the same capacity, such as a RAM_A group 12a, a RAM_B group 12b.

  The non-guaranteed RAM area 11 is an information storage area that is permitted to be accessed (read / write) only from the program in the non-guaranteed program area 9, and the guaranteed RAM area 12 is accessible (read / write) only from the program in the guaranteed program area 10. It is set as an information storage area permitted for.

  The backup RAM area 13 is provided with a memory capacity larger than the reserved memory capacity of the guarantee RAM area 12, and the backup RAM area 13 is configured to back up the stored contents of the guarantee RAM area 12. These areas 11 to 13 are allocated to predetermined memory areas based on section information. The backup RAM area 13 is configured so that update permission / prohibition can be set for each block by the RAM update (reading) permission / prohibition setting register 7. In this way, software partitioning is performed. The RAM update permission / prohibition setting register 7 holds the update permission state / prohibition state of the backup RAM area 13. The register 7 can individually set update permission / prohibition states of a plurality of backup areas such as the RAM_A group backups 13a, 13b.

  Generally, a program stored in a program storage area has a large number of instructions and various instructions exist in a complicated manner. Although the program (software) does not cause a random failure like an electronic component, it causes a problem due to a bug that cannot be tested, resulting in a problem called Systematic Failure. It is difficult for a program (software) to completely eliminate such a bug.

  Therefore, a program in the guaranteed program area 10 accesses (reads / writes) the non-guaranteed RAM area 11 due to an influence of some human program design mistake, bug verification error, or the like. Can access (read / write) the guaranteed RAM area 12.

  Then, for example, a program stored in the non-guaranteed program area 9 accesses the guaranteed RAM area 12 and is rewritten with incorrect data. Thereafter, the program in the guaranteed program area 10 accesses the rewritten data to obtain data. , The erroneous data is continuously propagated by referring to the wrong data, and in the worst case, it leads to a malfunction of the control program in the guaranteed program area 10. Therefore, in this embodiment, problems are prevented on the basis of periodically and cyclically monitoring the value of the program counter 6 by the OS (operating system).

  FIG. 2 shows an access method of each program area and each RAM area together with the flow of the application program. FIG. 3 is a flowchart showing the processing flow of the OS executed by the CPU 8 (monitoring logic of the program counter 6).

  In a diesel engine control system that employs a common rail system, fuel is pressurized with a high-pressure pump and stored in a common rail, and then injected into the combustion chamber with an injector using a solenoid or piezoelectric element. In this case, the engine ECU 2 performs control by calculating a required injection amount according to the opening degree of the accelerator pedal of the driver according to the control program stored in the guarantee program area 10 (hereinafter referred to as injection control). (Omitted). Then, the engine ECU 2 performs post-processing control (hereinafter referred to as post-processing control) such as DPF regeneration in the exhaust gas post-processing system stored in the non-guaranteed program area 9. Therefore, as shown in FIG. 2, the program in the guaranteed program area 10 and the program in the non-guaranteed program area 9 are repeatedly executed in the engine ECU 2.

  The program stored in the ROM 4 is assigned to a predetermined area of the memory by section definition. The program storage area is determined according to this allocation. The data storage area in the RAM 5 is also allocated to a predetermined area of the memory by section definition. In accordance with this allocation, a data storage area is determined for each block, for example. The diesel engine control system is realized by sequentially executing the programs in the non-guaranteed program area 9 and the guaranteed program area 10.

  After the injection control is performed, post-processing control is performed. In this post-processing control, the CPU 8 of the engine ECU 2 performs read / write processing according to the program in the non-guaranteed program area 9 and data in the non-guaranteed RAM area 11. To do. Since the guarantee RAM area 12 can be accessed from the program in the non-guaranteed program area 9 even when the program in the non-guaranteed program area 9 is being executed, the data in the guarantee RAM area 12 is unintended in accordance with the above-described problem. May be rewritten.

  During this time, the CPU 8 refers to the program counter 6 by the OS and recognizes the execution address of the next program to be executed. The CPU 8 can recognize the transition (movement) from the non-guaranteed program area 9 to the guaranteed program area 10 by recognizing the execution address of the program by the OS (see the area crossing condition S1 in FIG. 3).

  When the CPU 8 recognizes the transition of the execution address from the non-guaranteed program area 9 to the guaranteed program area 10 (S1: YES in FIG. 3), the data storage value of the guarantee RAM area 12 and the data storage value of the backup RAM area 13 are determined. It is determined whether or not they match (S2 in FIG. 3). At this time, if all data values in the guarantee RAM area 12 and all data values in the backup RAM area 13 match each other (S2 in FIG. 3: YES), the routine is exited. However, if they do not match (S2 in FIG. 3: NO), it is detected as an unauthorized access, and the data storage value in the backup RAM area 13 corresponding to the guarantee RAM area 12 is copied (S3). Therefore, if the guarantee RAM area 12 is rewritten by executing a program in the non-guaranteed program area 9, it is recognized that the guarantee RAM area 12 has been illegally accessed and guaranteed with accurate data in the backup RAM area 13. Data in the RAM area 12 can be rewritten.

  During execution of the program in the predetermined RAM_A group update permission area 10a, the CPU 8 passes through the update permission area 10a and immediately before executing the program in the RAM_B group update permission area 10b (S4: NO), the guaranteed RAM area 12 The calculation can be performed using the data storage value of the RAM_A group 12a (S5), and control can be executed.

  Thereafter, since the CPU 8 monitors the program counter 6, it can be grasped when the program transits from the RAM_A group update permission area 10a to another RAM_B group update permission area 10b. The CPU 8 sets the RAM_A group backup 13a in the update permission state for the RAM update permission / prohibition setting register 7 immediately before the program transits to the RAM_B group update permission area 10b (S1: NO and S4: YES). After the update of the RAM_A group backup 13a in the RAM area 13 is permitted (S6), the data storage value of the RAM_A group 12a in the guaranteed RAM area 12 is updated to the corresponding RAM_A group backup 13a (S7). Then, update of the RAM_A group backup 13a is prohibited in the RAM update permission / prohibition setting register 7, thereby prohibiting the update of the RAM_A group backup 13a in the backup RAM area 13 (S8).

  Subsequently, even when the program in the RAM_B group update permission area 10b is executed, such an operation is repeated. This is repeated until the execution of the program in the guaranteed program area 10 is completed. Thereafter, immediately before the program counter 6 transitions to the non-guaranteed program area 9 (S1: NO and S4: YES), the CPU 8 permits the register 7 to update the corresponding backup area and then stores the data in the backup area. The value is updated, and the update of the backup area is prohibited (S6 to S8). In this way, the data in the guarantee RAM area 12 is protected.

  If the conventional technique is applied, it is conceivable to store all the data in the guarantee RAM area 12 in three areas in order to perform the three-surface check. However, if these data are held for three areas, the data storage capacity of the RAM 5 is enormous. Amount. According to the present embodiment, since only two sides of the guarantee RAM area 12 and the backup RAM area 13 are required, the storage capacity can be suppressed.

  According to the present embodiment, the CPU 8 monitors the address indicated by the program counter 6 by the OS and confirms that the address of the program counter 6 transitions from the non-guaranteed program area 9 to the guaranteed program area 10. Are compared with all data in the backup RAM area 13, and when the data is different, the data in the guarantee RAM area 12 is updated with the data in the backup RAM area 13.

  Further, the CPU 8 monitors the address indicated by the program counter 6 by the OS, and confirms that the address of the program counter 6 transits from the RAM_A group update permission area 10a to the RAM_B group update permission area 10b even in the guaranteed program area 10. Immediately before the transition, the RAM_A group backup (backup area) 13a in the backup RAM area 13 is allowed to be updated, the data in the RAM_A group backup 13a is updated with the data in the RAM_A group 12a in the guaranteed RAM area 12, and the RAM_A group backup is performed after the update process. The update of 13a is prohibited. As a result, the contents of the RAM_A group backup 13a are protected. Such a process is repeated in the RAM_B group (10b, 12b, 13b). Thereby, the stored values of the guaranteed RAM areas 12a, 12b,.

  Further, since the update permission / prohibition setting of the RAM 5 is performed by using a function built in the microcomputer 3, the stored values of the guaranteed RAM areas 12a, 12b... Of the RAM 5 without modifying the hardware of the microcomputer 3. Can guarantee.

  Further, when the transition of the execution address of the program is confirmed by monitoring the program counter 6, when the value of the program counter 6 is confirmed by judging which area of the sectioned area is confirmed, It is possible to easily determine whether to execute the program in this area.

  Since the guarantee program area 10, the guarantee RAM area 12, and the backup RAM area 13 are each divided into a plurality of areas, the control program can be executed for each of the divided areas. Another highly relevant control program can be executed. Thereby, the convenience of the system can be improved.

  The program for comparing the data in the guaranteed RAM area 12 (RAM_A group 12a, RAM_B group 12b...) With the data in the backup RAM 13 (RAM_A group backup 13a, RAM_B group backup 13b...) Transitions from the area 10a to the area 10b. As shown in FIG. 5, the program is incorporated so as to be performed when a transition is made to another update permission area, or when a transition from the guaranteed program area 10 to the non-guaranteed program area 9 is recognized.

  In this case, the timing for comparing the data in the guarantee RAM area 12 and the data in the backup area of the backup RAM area 13 (RAM_A group backup 13a, RAM_B group backup 13b...) Is set in the program. Therefore, unauthorized access to the guaranteed RAM area 12 can be easily detected during program execution in the non-guaranteed program area 9.

  In the drawings, 1 is a system, 2 is an engine ECU, 3 is a microcomputer, 4 is a ROM, 5 is a RAM, 6 is a program counter, 7 is a RAM update enable / disable setting register (register), 8 is a CPU, and 9 is a non-printer. Guaranteed program area, 10 is guaranteed program area, 10a is RAM_A group update permission area, 10b is RAM_B group update permission area, 11 is non-guaranteed RAM area, 12 is guarantee RAM area, 12a is RAM_A group, 12b is RAM_B group, 13 Indicates a backup RAM area, 13a indicates a RAM_A group backup, and 13b indicates a RAM_B group backup.

Claims (8)

A RAM having a predetermined storage area;
A program storage area comprising a program area for accessing the RAM;
A backup area provided corresponding to the predetermined storage area and settable in an update permit / prohibit state;
A register for holding an update permission / prohibition state of the backup area;
A program counter for storing an address of an instruction to be executed by the program stored in the program storage area,
Monitoring the address indicated by the program counter;
When it is confirmed that the address of the program counter transits to the program area where the access to the predetermined storage area of the RAM starts, the data in the predetermined storage area is compared with the data in the backup area. Update the data in the predetermined storage area of the RAM with the data in the backup area,
When it is confirmed that the address of the program counter shifts outside the predetermined storage area of the RAM, immediately before the transition, the backup area is set in an update-permitted state in the register, and the data in the backup area is stored in the predetermined storage area. A RAM value guaranteeing apparatus that updates with data and sets the backup area in a prohibited state in the register after update processing. A RAM having a non-guaranteed RAM area allocated by a section and having a non-guaranteed RAM area and a guaranteed degree of stored value lower than the guaranteed RAM area;
A program storage area including a guaranteed program area corresponding to the guaranteed RAM area, and a non-guaranteed program area corresponding to a non-guaranteed RAM area other than the guaranteed program area;
A backup RAM area provided with a backup area which is provided corresponding to the guarantee RAM area and can be set in an update-permitted / prohibited state;
A register for holding an update permission / prohibition state of the backup RAM area;
A program counter for storing an address of an instruction to be executed by the program stored in the program storage area,
Monitoring the address indicated by the program counter;
When it is confirmed that the address of the program counter transitions from the non-guaranteed program area to the guaranteed program area of the program storage area, the data in the guaranteed RAM area is compared with the data in the backup area in the backup RAM area, and the data Are different from each other, the data in the guarantee RAM area is updated with the data in the backup area in the backup RAM area,
When it is confirmed that the address of the program counter transitions from the guaranteed program area to the non-guaranteed program area of the program storage area, the backup area of the backup RAM area is set to the update permitted state in the register immediately before the transition, and the backup A RAM value guaranteeing apparatus, wherein data in a backup area in a RAM area is updated with data in the guarantee RAM area, and the backup area in the backup RAM area is set to a prohibited state in the register after update processing.   3. The RAM value guarantee apparatus according to claim 1, wherein the update permission / prohibition is performed using a function built in the microcomputer body. When checking the address transition by monitoring the program counter,
4. The RAM value guaranteeing apparatus according to claim 1, wherein the RAM is assured by determining which area of the sectioned area the value of the program counter indicates. Wherein when a transition from non-guaranteed program area to the Guarantee region recognized by the application program, claims, characterized in comparing the data of the backup area of data and the backup RAM area of the warranty RAM area 2 Symbol placement of RAM value assurance device. The guarantee RAM area is divided into a plurality of areas including a first guarantee RAM area and a second guarantee RAM area,
The program storage area includes a first guaranteed program area and a second guaranteed program area corresponding to the divided first guaranteed RAM area and second guaranteed RAM area, respectively.
The backup RAM area includes a first backup area and a second backup area corresponding to the divided first guarantee RAM area and second guarantee RAM area,
In the register, the update permission / prohibition state can be set for each of the divided first backup area and second backup area,
When it is confirmed that the address of the program counter transitions from the first guaranteed program area to the second guaranteed program area in the program storage area, the first backup area in the backup RAM area is set to the update permitted state in the register immediately before the transition. Set, update the data in the first backup area in the backup RAM area with the data in the first guarantee RAM area in the guarantee RAM area, and set the first backup area in the backup RAM area to the prohibited state in the register after the update process claim 2 or 5 SL placing the RAM value assurance device characterized by.   When the transition from the first guaranteed program area to the second guaranteed program area is recognized in the application program, the data in the first guaranteed RAM area in the guaranteed RAM area and the data in the first backup area in the backup RAM area The RAM value guaranteeing device according to claim 6, wherein: To the microcomputer,
A procedure for monitoring the address indicated by the program counter;
When it is confirmed that the address of the program counter transitions from the non-guaranteed program area to the guaranteed program area in the program storage area, the data in the guaranteed RAM area is compared with the data in the backup RAM area. A procedure for updating data in the guarantee RAM area with data in the backup RAM area;
When it is confirmed that the address of the program counter transitions from the guaranteed program area to the non-guaranteed program area in the program storage area, the backup area update in the backup RAM area is permitted immediately before the transition, and the backup area data is transferred to the guaranteed RAM area. And a procedure for prohibiting updating of the backup area in the backup RAM area after the update process.

Images