JP6358019B2 - Arithmetic apparatus, arithmetic method, and arithmetic program - Google Patents

Description

  The present invention relates to the technical field of a microprocessor or the like that performs self-diagnosis.

  Many elements constituting the microprocessor are semiconductors, and the semiconductors may break down due to a crystal state or a cause such as aging. In particular, a smart card for security purposes and a microprocessor used in the fields of in-vehicle, aviation, space, etc. for functional safety are required to have a high-precision failure detection capability. As an effective means for detecting a failure, self-diagnosis of a microprocessor is known. This can be done by checking the memory and register writing and reading capabilities (for example, after writing some data, whether the written data and the read data match), or computing capability (for example, running a random number generator continuously) Even if the same value is not output even if RSA encryption is executed, an expected answer is output). Such self-diagnosis is executed, for example, every time the microprocessor is started. This is executed during a process called startup processing or bootstrap processing, and it is important to try to operate normally every time the microprocessor starts up and to use elements that have been confirmed to operate normally. Is to execute. Further, the self-diagnosis in the IC card on which the microprocessor is mounted is executed before the output of the initial response information (ATR) performed to the external device after the activation of the IC card (Patent Document 1). reference).

JP 2006-252284 A

  However, some areas of the volatile memory that stores the stack used by the microprocessor during self-diagnosis and registers that temporarily store data read from the memory for self-diagnosis Because it is used for self-diagnosis, it cannot be the subject of inspection. For this reason, a failure that occurs in a part of this volatile memory is detected accidentally by some factor other than self-diagnosis, which is a problem particularly in product fields that require high-precision failure detection capability. It was.

  Accordingly, the present invention has been made in view of the above problems and the like, and provides an arithmetic device, an arithmetic method, and an arithmetic program capable of efficiently executing an inspection of a region used for self-diagnosis. With the goal.

  In order to solve the above-mentioned problem, the invention according to claim 1 is directed to a plurality of arithmetic units including a first arithmetic unit and a second arithmetic unit, and to perform a data write / read capability check on each of the arithmetic units. An arithmetic device comprising: a non-volatile memory for storing a program for execution; and a volatile memory having a work area for temporarily storing data, wherein the volatile memory further includes the first calculation. A plurality of stack areas including a first stack area for storing data used by the unit during the inspection and a second stack area for storing data used by the second arithmetic unit during the inspection; The first arithmetic unit checks the write and read capabilities of the second stack area, and the second arithmetic unit is the first stack unit. Examining the writing and reading performance of the region, at least one of said first arithmetic unit second arithmetic unit is characterized by inspecting said writing and reading performance of the work area.

  According to a second aspect of the present invention, in the arithmetic device according to the first aspect, each of the arithmetic units includes a register for temporarily storing data, and the first arithmetic unit includes the second arithmetic unit. The writing and reading ability of the register included in the arithmetic unit is further checked, and the second arithmetic unit further checks the writing and reading ability of the register included in the first arithmetic unit.

  According to a third aspect of the present invention, in the arithmetic device according to the first or second aspect, the first arithmetic unit inspects the writing and reading ability of a part of the work area, and the second arithmetic unit The arithmetic unit checks the writing and reading ability of the remaining area excluding the partial area in the work area.

  The invention according to claim 4 stores a plurality of arithmetic units including a first arithmetic unit and a second arithmetic unit, and a program for causing each of the arithmetic units to execute a data write / read capability check. A non-volatile memory; a work area for temporarily storing data; a first stack area for storing data used by the first arithmetic unit during the inspection; and the second arithmetic unit during the inspection. A volatile memory having a plurality of stack areas including a second stack area for storing data to be used, wherein the first arithmetic unit writes the second stack area to the write And checking the read capability, and the second arithmetic unit writes and reads the first stack area. A method for inspecting and capacity, at least one of said second arithmetic unit and the first operation unit, characterized in that it comprises the steps of: inspecting said writing and reading performance of the work area.

  The invention according to claim 5 stores a plurality of arithmetic units including a first arithmetic unit and a second arithmetic unit, and a program for causing each of the arithmetic units to execute a data write / read capability check. A nonvolatile memory, a work area for temporarily storing data, a first stack area for storing data used by the first arithmetic unit for the inspection, and data used for the inspection by the second arithmetic unit And a volatile memory having a plurality of stack areas including a second stack area for storing the second stack area, wherein the first arithmetic unit checks the write and read capabilities of the second stack area. And the second arithmetic unit inspects the write and read capabilities of the first stack area. , Characterized in that to execute the steps at least one of said second arithmetic unit and the first operation unit inspects the writing and reading performance of the work area.

  According to the present invention, the first arithmetic unit is configured to inspect the writing and reading ability of the second stack area, and the second arithmetic unit is configured to inspect the writing and reading ability of the first stack area. The stack area used for self-diagnosis can be efficiently inspected.

FIG. 2A is a diagram illustrating a schematic configuration example of an IC chip C. FIG. The IC chip C is an example of the arithmetic device of the present invention. (B) is a diagram illustrating a configuration example of a storage area of the RAM 3. (C) is a figure which shows an example of the source | sauce of the test | inspection program in a self-diagnosis. FIG. 2 is a diagram illustrating a processing flow relating to self-diagnosis of the core 1 and the core 2 when the IC chip C is activated.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The embodiment described below is an embodiment when the present invention is applied to an IC chip including a plurality of cores which are microprocessors.

  First, a schematic configuration of the IC chip according to the present embodiment will be described with reference to FIG. FIG. 1A is a diagram illustrating a schematic configuration example of the IC chip C. The IC chip C is an example of the arithmetic device of the present invention. The IC chip C is used by being mounted on a cash card, a credit card, an employee card or the like. Alternatively, the IC chip C is incorporated in a communication device such as a smartphone or a mobile phone. The IC chip C may be configured by being directly incorporated on the circuit board of the communication device.

  As shown in FIG. 1A, the IC chip C includes a core 1, a core 2, a RAM (Random Access Memory) 3, a flash memory 4, a ROM (Read Only Memory) 5, and an I / O circuit 6. Composed. The core 1 is an example of a first arithmetic unit. The core 2 is an example of a second arithmetic unit. The core 1 and the core 2 are configured to be capable of parallel processing. The core 1, the core 2, the RAM 3, the flash memory 4, the ROM 5, and the I / O circuit 6 are connected to the bus 7. The bus 7 includes an address bus and a data bus. The flash memory 4 and the ROM 5 are an example of a nonvolatile memory. Instead of the flash memory 4, "Electrically Erasable Programmable Read-Only Memory" may be applied.

  FIG. 1B is a diagram illustrating a configuration example of a storage area of the RAM 3. As shown in FIG. 1B, the RAM 3 (an example of a volatile memory) includes a core 1 stack area 31, a core 2 stack area 32, and a general-purpose area 33 for temporarily storing data. The core 1 stack area 31 is an example of a first stack area that stores reference data used by the core 1 during execution of self-diagnosis. The core 2 stack area 32 is an example of a second stack area that stores reference data used by the core 2 during execution of self-diagnosis. The stack area has a feature that the first input data is output later (First In, Last Out). The reference data used during the execution of self-diagnosis includes, for example, the length of data to be subjected to self-diagnosis, arguments for calling functions during self-diagnosis, and the address (address) of the caller of the function, etc. , And a return address.

  The flash memory 4 includes a program memory and a data memory. The program memory stores (stores) a plurality of instruction codes constituting a program to be executed by the core 1 and the core 2. Various data are stored in the data memory. Various programs include a self-diagnosis program. The self-diagnosis program is a program for causing the core 1 and the core 2 to execute self-diagnosis including inspection of data writing and reading ability. The ROM 5 may store a part of the program stored in the flash memory 4.

  FIG. 1C is a diagram illustrating an example of a source of an inspection program in self-diagnosis. When the core 1 performs the write / read capability test, “Start Addr” illustrated in FIG. 1C indicates the test start address (start address) of the stack area 32 for the core 2. That is, the core 1 stack area 32 is inspected by the core 1. When the core 2 performs a write / read capability test, “Start Addr” shown in FIG. 1C indicates the test start address of the core 1 stack area 31. That is, the core 2 stack area 31 is inspected by the core 2. “Length” shown in FIG. 1C indicates the length of data to be inspected (that is, corresponding to the size of the stack area). “Test Addr” shown in FIG. 1C indicates a test target address (from a test start address to a test end address). Then, according to the self-diagnosis program shown in FIG. 1C, after the data “5A (h)” (h indicates a hexadecimal number) is written in the inspection target area corresponding to the inspection target address, the inspection target Data is read from the area, and it is checked whether the read data matches the written data “5A (h)”. If the two data do not match, the operation is stopped (“HALT”). On the other hand, if the two data match, the data “A5 (h)” is written in the inspection target area corresponding to the inspection target address, and then the data is read from the inspection target area. It is checked whether the written data “A5 (h)” matches. If the two data do not match, the operation is stopped (“HALT”). On the other hand, if the two data match, the process proceeds to the next inspection target address, and the same processing as described above is performed (the processing loop is repeated). In this way, the data writing and reading ability is inspected for the entire stack area. In the example of FIG. 1C, the inspection target area is a stack area, but the registers in the core 1 and the core 2 (registers that temporarily store data) may be the inspection target area. In this case, the check of the register in the core 2 is executed by the core 1, and the check of the register in the core 1 is executed by the core 2.

  The I / O circuit 6 serves as an interface with an external terminal. In the case of the contact type IC chip C, the I / O circuit 6 includes, for example, eight terminals C1 to C8. For example, the C1 terminal is a power supply terminal, the C2 terminal is a reset terminal, the C3 terminal is a clock terminal, the C5 terminal is a ground terminal, and the C7 terminal is a terminal for communicating with an external terminal. On the other hand, in the case of the non-contact type IC chip C, the I / O circuit 6 includes, for example, an antenna and a modulation / demodulation circuit. Examples of external terminals include IC card issuing machines, ATMs, ticket gates, authentication gates, and the like. Alternatively, when the IC chip C is incorporated into a communication device, the external terminal corresponds to a control unit that functions as the communication device.

  The core 1 includes an arithmetic unit 11, an internal memory 12, a program counter 13, and an interrupt controller 14. The core 2 includes an arithmetic unit 21, an internal memory 22, a program counter 23, and an interrupt controller 24. Each of the arithmetic units 11 and 21 includes an instruction register and a decoder. Each of the internal memories 12 and 22 includes a data register. The program counters 13 and 23 hold addresses on the program memory where instruction codes to be executed next are stored. The interrupt controller 14 and the interrupt controller 24 are configured to be able to transmit and receive data without going through the bus 7.

  The arithmetic units 11 and 21 fetch (acquire) the instruction codes stored at the addresses indicated by the program counters 13 and 23 from the program memory in the flash memory 4 into the instruction register. Then, the arithmetic units 11 and 21 interpret (decode) the acquired instruction code by a decoder and execute processing according to the interpreted instruction code (for example, execute arithmetic processing such as four arithmetic operations and logical operations). Is stored in the data registers of the internal memories 12 and 22. Each time the instruction code is executed by the arithmetic units 11 and 21, the program counters 13 and 23 advance the address by, for example, 3 bytes or 4 bytes. Thereby, a program composed of a plurality of instruction codes is executed. The interrupt controller 14 can access the internal memory 12 and writes the data read from the data register in the internal memory 12 to the data memory in the flash memory 4. On the other hand, the interrupt controller 24 is accessible to the internal memory 22 and writes the data read from the data register in the internal memory 22 to the data memory in the flash memory 4. Further, the interrupt controller 14 can cancel the sleep of the core 2 by sending a sleep cancel command to the interrupt controller 24 of the core 2 when the core 2 is sleeping. On the other hand, the interrupt controller 24 can cancel the sleep of the core 1 by sending a sleep cancel command to the interrupt controller 14 of the core 1 when the core 1 is sleeping.

  Next, with reference to FIG. 2, a self-diagnosis at the time of activation of the IC chip C according to the present embodiment will be described. FIG. 2 is a diagram illustrating a processing flow relating to self-diagnosis of the core 1 and the core 2 when the IC chip C is activated. The process illustrated in FIG. 2 is started when a reset is received from an external terminal, for example.

  First, the core 2 sleeps (step S21). In the sleep state, the power supply to the core 2 is limited and the power saving state is established, and the arithmetic unit 21 stops fetching and processing the instruction code, but the interrupt controller 24 receives and processes the instruction from the interrupt controller 14. It is possible. On the other hand, the core 1 executes an inspection of the core 2 stack area 32 (inspection of data writing and reading ability) (step S1). In this inspection, the core 1 first stores reference data (for example, the length, argument, address, etc. of data to be inspected) in the core 1 stack area 31 used during the inspection. Then, the core 1 sequentially uses the reference data stored in the core 1 stack area 31 for each inspection target area from the inspection start address to the inspection end address in the core 2 stack area 32 as described above. Then, data is written and read, and it is checked whether the written data matches the read data.

  Then, the core 1 determines whether or not the core 2 stack area 32 is normal (step S2). For example, when both data match in all the inspection target areas, the core 1 determines that the core 2 stack area 32 is normal (step S2: YES), and proceeds to step S3. On the other hand, for example, if the two data do not match in any one of the inspection target areas, the core 1 determines that the stack area 32 for the core 2 is not normal (step S2: NO) and stops operating (step S11).

  In step S3, the core 1 performs an inspection of a register in the core 2 (a register included in the core 2). In this test, the core 1 first stores the reference data used during the test in the core 1 stack area 31. Then, the core 1 uses the reference data stored in the stack area 31 for the core 1 and uses the register including the instruction register and the data register in the core 2 as an inspection target area via the interrupt controller 14 and the interrupt controller 24. Then, data is written and read, and it is checked whether the written data matches the read data.

  Then, the core 1 determines whether or not the register (inspection target area) in the core 2 is normal (step S4). For example, when both data match in all the inspection target areas, the core 1 determines that the register in the core 2 is normal (step S4: YES), and proceeds to step S5. On the other hand, for example, if both data do not match in any one register, the core 1 determines that the register is not normal (step S4: NO), and stops operating (step S11).

  In step S <b> 5, the core 1 sends a sleep release command to the core 2 via the interrupt controller 14 and the interrupt controller 24. Then, the core 1 sleeps (step S6).

  When the core 2 receives the sleep cancel command from the core 1, the core 2 cancels the sleep (step S22). Then, the core 2 executes the inspection of the core 1 stack area 31 (step S23). In this inspection, the core 2 first stores the reference data used during the inspection in the core 2 stack area 32. Then, the core 2 sequentially uses the reference data stored in the core 2 stack area 32 for each inspection target area from the inspection start address to the inspection end address in the core 1 stack area 31 as described above. Then, data is written and read, and it is checked whether the written data matches the read data.

  Then, the core 2 determines whether or not the stack area 31 for the core 1 is normal (step S24). If the core 2 determines that the stack area 31 for the core 1 is normal (step S24: YES), the process proceeds to step S25. On the other hand, when the core 2 determines that the stack area 31 for the core 1 is not normal (step S24: NO), the core 2 stops operating (step S31).

  In step S <b> 25, the core 2 performs a check of a register in the core 1 (a register included in the core 1). In this inspection, the core 2 first stores the reference data used during the inspection in the core 2 stack area 32. The core 2 uses the reference data stored in the stack area 32 for the core 2 and uses the register including the instruction register and the data register in the core 1 as the inspection target area via the interrupt controller 24 and the interrupt controller 14. Then, data is written and read, and it is checked whether the written data matches the read data.

  Then, the core 2 determines whether or not the register (inspection target area) in the core 1 is normal (step S26). When the core 2 determines that the register in the core 1 is normal (step S26: YES), the process proceeds to step S27. On the other hand, when it is determined that the register is not normal (step S26: NO), the core 2 stops operating (step S31).

  In step S27, the core 2 sends a sleep release command to the core 1 via the interrupt controller 24 and the interrupt controller 14, and proceeds to step S28. When the core 1 receives the sleep release command from the core 2, the core 1 releases the sleep (step S7). Then, the core 1 performs an inspection of the general-purpose area 33 (Step S8). For example, the core 1 checks the writing and reading ability of a part of the general-purpose area 33. Here, for example, if the general-purpose area 33 is an area from the address “1000 (h)” to “2FFF (h)”, the core 1 has the address “1000 (h)” to “1FFF (h)”. The region up to is the inspection target region (that is, a part of the general-purpose region 33). In this case, the core 1 first stores the reference data used during the inspection in the core 1 stack area 31. Then, using the reference data stored in the core 1 stack area 31, the core 1 sequentially writes and reads data in the inspection target area, and whether the written data matches the read data. Check. In this case, the remaining areas other than a part of the general-purpose area 33 are checked by the core 2. In addition, you may comprise so that the core 1 or the core 2 may check the whole area | region in the general purpose area | region 33. FIG.

  Then, the core 1 determines whether or not the general-purpose area 33 (inspection target area) is normal (step S9). For example, when both data match in all the inspection target areas, the core 1 determines that the general-purpose area 33 is normal (step S9: YES), and proceeds to step S10. On the other hand, for example, if the two data do not match in any one of the inspection target areas, the core 1 determines that the general-purpose area 33 is not normal (step S9: NO) and stops operating (step S11).

  On the other hand, the core 2 executes the inspection of the general-purpose area 33 in step S28. For example, as described above, the core 2 inspects the writing and reading capabilities of the remaining area except for a part of the area inspected by the core 1 as an inspection target area. In this case, the core 2 first stores the reference data used during the inspection in the core 2 stack area 32. Then, using the reference data stored in the core 2 stack area 32, the core 2 sequentially writes and reads data in the inspection target area, and whether the written data matches the read data. Check.

  Then, the core 2 determines whether or not the general-purpose area 33 (inspection target area) is normal (step S29). If the core 2 determines that the general-purpose area 33 is normal (step S29: YES), the process proceeds to step S30. On the other hand, when it is determined that the general-purpose area 33 is not normal (step S29: NO), the core 2 stops operating (step S31). Note that the processing in steps 8 and S9 in the core 1 and the processing in steps S28 and S29 in the core 2 are performed in parallel. Thus, the core 1 and the core 2 stand by in a command reception standby state (steps S10 and S30). In addition, in the self-diagnosis, the core 1 and the core 2 do not output the same value even if the computation capability (for example, the random number generator is continuously executed, or whether the RSA encryption is output as expected) ) May be configured to move to steps S10 and S30.

  As described above, according to the embodiment, the core 1 inspects the core 2 stack area 32, the core 2 inspects the core 1 stack area 31, and at least one of the core 1 and the core 2 is Since the general-purpose area 33 is configured to be inspected, the stack area used for self-diagnosis can be efficiently inspected. Further, according to the configuration in which the core 1 inspects a part of the general-purpose area 33 and the core 2 inspects the remaining area of the general-purpose area 33, the self-diagnosis time can be shortened. Further, according to the configuration in which the core 1 inspects the register in the core 2 and the core 3 inspects the register in the core 1, the inspection of the register used for self-diagnosis can be efficiently executed. .

  In the above embodiment, the IC chip C having two cores has been described as an example, but the present invention can be applied to an IC chip C having three or more cores. In the above embodiment, the IC chip C is described as an example of the arithmetic device. However, the present invention may be applied to, for example, an embedded microcomputer other than the IC chip C.

1 Core 2 Core 3 RAM
4 Flash memory 5 ROM
6 I / O circuits 11 and 21 Arithmetic units 12 and 22 Internal memory 13 and 23 Program counters 14 and 24 Interrupt controller C IC chip

Claims (5)

A plurality of arithmetic units including a first arithmetic unit and a second arithmetic unit;
A non-volatile memory for storing a program for causing each of the arithmetic units to execute a data write and read capability check;
Volatile memory having a work area for temporarily storing data;
An arithmetic device comprising:
The volatile memory further includes a first stack area for storing data used during the inspection by the first arithmetic unit, and a second memory for storing data used by the second arithmetic unit during the inspection. A plurality of stack areas including a stack area,
The first arithmetic unit inspects the write and read capabilities of the second stack area, the second arithmetic unit inspects the write and read capabilities of the first stack area, and the first arithmetic unit At least one of the arithmetic unit and the second arithmetic unit inspects the writing and reading ability of the work area. Each of the arithmetic units includes a register for temporarily storing data,
The first arithmetic unit further checks the write and read capability of the register included in the second arithmetic unit, and the second arithmetic unit determines the write and read capability of the register included in the first arithmetic unit. The arithmetic unit according to claim 1, further inspecting.   The first arithmetic unit checks the writing and reading ability of a part of the work area, and the second arithmetic unit writes and writes the remaining area of the work area excluding the part of the work area. The arithmetic unit according to claim 1, wherein the reading capability is inspected. A plurality of arithmetic units including a first arithmetic unit and a second arithmetic unit;
A non-volatile memory for storing a program for causing each of the arithmetic units to execute a data write and read capability check;
A work area for temporarily storing data, a first stack area for storing data used by the first arithmetic unit during the inspection, and data used by the second arithmetic unit during the inspection are stored. A volatile memory having a plurality of stack areas including a second stack area;
An arithmetic method in a processor comprising:
The first computing unit testing the write and read capabilities of the second stack area;
The second computing unit testing the write and read capabilities of the first stack area;
At least one of the first arithmetic unit and the second arithmetic unit inspects the writing and reading ability of the work area;
The calculation method characterized by including. A plurality of arithmetic units including a first arithmetic unit and a second arithmetic unit;
A non-volatile memory for storing a program for causing each of the arithmetic units to execute a data write and read capability check;
A work area for temporarily storing data, a first stack area for storing data used by the first arithmetic unit for the inspection, and a second for storing data used for the inspection by the second arithmetic unit. A volatile memory having a plurality of stack areas including a stack area of
A processor comprising
The first computing unit testing the write and read capabilities of the second stack area;
The second computing unit testing the write and read capabilities of the first stack area;
At least one of the first arithmetic unit and the second arithmetic unit inspects the writing and reading ability of the work area;
An arithmetic program characterized in that is executed.

Images