JP6466269B2 - Electronic control device and stack area usage monitoring method - Google Patents

Description

  The present invention relates to an electronic control device using a stack area and a method for monitoring the use of the stack area.

  In the electronic control unit, a part of RAM (Random Access Memory) is used as a stack area. This stack area is used when data being processed in the electronic control device is temporarily saved (see, for example, Patent Document 1).

JP 2008-184912 A

In ISO 26262, standards for functional safety of vehicles are set. In this standard, a safety level called ASIL (Automotive Safety Integrity Level) is defined. There are five levels of safety, ASIL-D, ASIL-C, ASIL-B, ASIL-A, and QM in descending order of safety standards. And in order to implement | achieve the said functional safety, this safety | security level is allocated for every task, for example, It is calculated | required that although the allocated level is low, the failure does not affect a higher level. For this reason, in the electronic control device, data temporarily saved in the stack area by a task to which a high safety level (for example, ASIL-D) is assigned has a lower safety level (for example, QM). Prevent access by assigned tasks. For example, a plurality of stack areas are secured, and at least one stack area used by the task is allocated according to the ASIL level of the task.

  In such a case, it is necessary to monitor whether or not the allocated stack area is properly used. In such monitoring, even if monitoring is performed at a predetermined timing in the task to be executed, it is impossible to find anything other than an abnormality at that timing, so there is a possibility that reliability is lowered and functional safety cannot be realized. In addition, if monitoring is performed at different timings among the tasks to be executed, the tasks become complicated, processing takes time, and other control of the vehicle is affected, and functional safety may not be realized.

  Therefore, an electronic control apparatus and a stack area usage monitoring method that can monitor whether a task appropriately uses a stack area allocated to the task in order to realize functional safety.

In order to solve the above-described problem, an electronic control device includes a memory and a processor, and when the processor executes the first task by a periodic interrupt, a plurality of the first tasks are secured in the memory. Whether at least one stack area pre-assigned to the first task is used among the stack areas, and whether the first task uses at least one stack area pre-assigned to the first task Are monitored by a second task that occurs at random timing that is not correlated with the timing of occurrence of a periodic interrupt.

  According to the electronic control device, it is possible to monitor whether a task appropriately uses the stack area allocated to the task, and functional safety can be realized.

It is a block diagram which shows embodiment of an electronic controller. It is a figure which shows the structure of the stack area | region of the said electronic controller. It is a figure which shows the flow at the time of the said electronic control apparatus performing a task. It is a figure which shows the flow at the time of the said electronic control apparatus performing the task which monitors use of a stack area. It is the figure which showed the timing which the said electronic control unit monitors use of a stack area.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.
FIG. 1 is a diagram illustrating an embodiment of an electronic control device 100 mounted on an automobile. The electronic control device 100 performs various controls of the vehicle, and controls, for example, an internal combustion engine. The electronic control device 100 includes a plurality of CPUs (Central Processing Units) 110, a plurality of local memories 120, and a global memory 130.

  The CPU 110 can read out detection values and the like of various sensors connected to the electronic control device 100 and calculate a target value for vehicle control. Specifically, the CPU 110 receives signals from various sensors including a crank angle sensor, a cam angle sensor, a water temperature sensor, a throttle sensor, an air flow sensor, and an air-fuel ratio sensor (not shown), and an electronic throttle valve, Data necessary for various controls such as a fuel injection valve and an ignition coil can be calculated.

  Connected to the CPU 110 are a local memory 120 provided in the CPU 110 and a global memory 130 accessible by all the CPUs 110. The local memory 120 corresponds to the CPU 110 on a one-to-one basis, and is used only for execution of the corresponding CPU 110. The local memory 120 is provided with a stack area 122 for holding data by a LIFO (Last In First Out) system and other various memory areas.

  The electronic control device 100 has a plurality of modes with different access restrictions on the stack area when executing a task. This access restriction is determined according to a level based on a safety standard. In the present embodiment, there are a supervisor mode (SVM: supervisor mode) and a user mode (UM: user mode) as a plurality of modes, and an access authority is assigned to each mode to achieve access restriction. In SVM, a task whose safety level is ASIL-D, C, B, or A is executed. In UM, a task whose safety level is QM is executed. In other words, in the electronic control device 100, the tasks are classified into groups based on a predetermined rule such as a safety level, and are executed in a mode corresponding to the group.

The stack area 122 provided in the local memory 120 is divided into two areas, a QM stack area 124 and an ASIL stack area 126. That is, two stack areas are secured in the local memory 120. A task to which a UM is assigned can access only the QM stack area 124, and access to the ASIL stack area 126 is prohibited. The task to which the SVM is assigned can access the ASIL stack area 126 and the QM stack area 124. Such access restriction for each task can be realized by hardware such as a memory management unit. In the present embodiment, there are three types of access: read, write, and execute, and all these accesses are prohibited or permitted collectively. However, for example, it is possible to set to permit a part of access such as prohibiting writing and execution but allowing only reading. In each mode, permission or prohibition can be set for each stack area and for each access type.
In the present embodiment, two stack areas are secured in the local memory 120, but the electronic control unit can secure a plurality of stack areas in the local memory.

Next, the stack area 122 will be described in detail with reference to FIG.
In the stack area 122, for example, data is accumulated in the direction of increasing addresses. In FIG. 2, the upward direction is the direction in which the address value increases. In the stack area 122, as shown in FIGS. 2A and 2B, memory areas are allocated in the order of the ASIL stack area 126 and the QM stack area 124 from the smallest address. That is, the stack area 122 is provided with a stack area having a lower importance level on the side where data is accumulated. In other words, each stack area 122 is allocated in a direction in which stack data is accumulated from a stack area having a high degree of importance among the divided stack areas.

  Further, as shown in FIG. 2, in this stack area 122, the first stack pointer indicating the most recently stored data ASIL-2 in the ASIL stack area 126 and the latest stored in the QM stack area 124 are stored. The second stack pointer indicating the data QM-3 can be switched according to the mode. FIG. 2A shows a case where an SVM task is being executed. In this case, the electronic control apparatus 100 can switch between the first stack pointer and the second stack pointer. When the SVM task is executed, the QM stack area 124 and the ASIL stack area 126 can be accessed. FIG. 2B shows a case where a UM task is being executed. In this case, the electronic control unit 100 uses the second stack pointer. When the QM task is executed, access to the ASIL stack area 126 is prohibited.

  In this way, in the electronic control unit 100, at least one stack area among a plurality of stack areas secured in the local memory 120 is allocated in advance as a stack area to be used for the task when the CPU 110 executes the task. . At least one stack area used by the task is set for each group in which the task is classified according to a predetermined rule such as a safety level. Thereby, functional safety in the electronic control unit 100 is realized.

  Further, in the task executed by the electronic control device 100 configured as described above, the mode cannot be changed in a direction in which the authority is higher than the assigned mode. For example, a UM task cannot change the mode from UM to SVM.

Here, a flow when the electronic control apparatus 100 executes a task will be described with reference to FIG.
First, this flow is activated in SVM mode. At this time, since the flow starts with SVM, the electronic control unit 100 uses the first stack pointer indicating the most recently stored data in the ASIL stack area 126. Then, the initial program is executed (S101).

Next, in executing the program, a UM task may be executed, and the mode may be switched from SVM to UM accordingly. At this time, first, the electronic control unit 100 switches the stack pointer to the second stack pointer indicating the most recently stored data in the QM stack area 124 (S102). Then, the electronic control unit 100 switches the mode from SVM to UM (S103).
Then, after the mode transitions to UM, the electronic control unit 100 executes the QM task, and uses the QM stack area 124 as the stack area (S104).

  For example, as a QM task, there is a target torque calculation task that calculates a target torque from an accelerator opening and calculates a target throttle opening of an electronic throttle based on the target torque. Hereinafter, an example in which the target torque calculation task is performed will be described.

  In this target torque calculation task, the electronic control device 100 first reads the output of the accelerator opening from the accelerator pedal sensor. Then, the electronic control unit 100 calculates a target torque from the accelerator opening. Then, the electronic control unit 100 calculates the target throttle opening so that the calculated target torque is obtained, and controls the electronic control throttle based on the target throttle opening.

  Next, it is necessary to detect whether an abnormality has occurred in the control of such an electronically controlled throttle. Therefore, separately from the target torque, the current torque is calculated, and the target torque is compared with the current torque to determine whether an abnormality has occurred. Here, the task for making such a determination has a safety level higher than QM (for example, ASIL-C). Therefore, this task cannot be done in UM and needs to be done in SVM. Therefore, the electronic control unit 100 performs processing by issuing an interrupt command and interrupting the SVM abnormality detection task (interrupt processing 1).

  In the interrupt process 1, first, the electronic control unit 100 needs to use the first stack pointer indicating the data in the ASIL stack area 126 because the abnormality detection task is performed by the SVM. In this example, since the QM task is executed before the interruption and the second stack pointer is used, the electronic control unit 100 switches the stack pointer and uses the first stack pointer to use the stack area. The processing is performed using the ASIL stack area 126 (S201). Next, the electronic control unit 100 calculates the current torque based on outputs from various sensors. Then, the electronic control unit 100 compares the target torque with the current torque and determines whether or not an abnormality has occurred (S202).

  Further, separately from the determination of the abnormality, it is determined whether or not there is an abnormality in the execution order and execution timing of the tasks, and the task for performing the action is executed. This task has a safety level higher than QM (eg, ASIL-C). Therefore, this task needs to be done in SVM. Therefore, when it is necessary to perform such a functional operation abnormality determination during the processing in step 202 of the interrupt processing 1, an interruption process 2 which is a functional operation abnormality determination task is further executed. Since this functional operation abnormality determination task is performed by the SVM, it is first determined whether or not the first stack pointer is used. In this example, since the process is performed during the interrupt process 1, the first stack pointer is already used and the ASIL stack area 126 is used as the stack area. Therefore, the stack pointer is not switched (S301). Then, an abnormality determination task for the functional operation is performed (S302). Since the processing to return after the end of the task is processing in SVM, the electronic control unit 100 returns to the interrupt processing 1 without switching the stack pointer from the first stack pointer (S303).

  The electronic control apparatus 100 returns the process to the interrupt process 1 and restarts the process. When the interrupt process 1 is completed, the electronic control device 100 switches the stack pointer to the second stack pointer because the returning task is a UM task, and performs processing using the QM stack area 124 as the stack area. This is performed (S203). Thereafter, the electronic control unit 100 resumes and executes the target torque calculation task.

  Here, in the control in the electronic control unit 100, mode transition to a special mode such as rewriting of a program may be required, and transition from UM to SVM assigned higher importance may occur. However, in the electronic control unit 100, the QM task cannot make a mode transition from the QM to the SVM. Here, in the present embodiment, the transition from the low importance mode to the high importance mode is performed by interrupt processing by interrupting the SVM task. Specifically, the electronic control unit 100 issues an interrupt command (S105), thereby interrupting the SVM task, and makes a mode transition from QM to SVM (S401). Then, after the mode transition, the SVM task switches the stack pointer to the first stack pointer and performs processing using the ASIL stack area 126 as the stack area (S106), and the electronic control unit 100 operates in the special mode. Execute processing etc.

  As described above, the electronic control unit 100 secures a plurality of stack areas, performs interrupt processing according to the task to be executed, and executes the program by appropriately switching the stack pointer and the stack area.

Here, when a plurality of stack areas are secured, the electronic control unit 100 can monitor whether the stack area is appropriately used according to the group to which the task belongs when the task is executed. it can.
Such a task for monitoring is executed by interrupt processing. This interrupt process will be described with reference to FIGS.
FIG. 4 shows a concept representing a case where a task (interrupt process 4) for monitoring whether or not the stack area is properly used is performed as an interrupt process in the flow in which the interrupt process 1 and the interrupt process 2 are executed. FIG. Note that the interrupt processes 1 and 2 described above are processes executed as regular interrupts.

  The flow shown in FIG. 4 starts from a state where the interrupt processing 1 which is a periodic interrupt is interrupted. Then, since the interrupt process 1 is executed, the electronic control unit 100 switches the stack pointer to the first stack pointer, and performs processing using the ASIL stack area 126 as the stack area (S501). . Then, the electronic control apparatus 100 records execution task information indicating a task to be executed before executing the task in an appropriate memory (S502). Thereafter, interrupt processing 1 is executed (S503).

  Here, during execution of interrupt processing 1, the task being executed uses a stack area that is allocated in advance according to the group to which the task belongs at a timing that does not correlate with the timing at which the periodic interrupt is executed. Interrupt processing 4 for monitoring whether or not In the present embodiment, the electronic control unit 100 executes the interrupt process 4 at a timing at which a rising edge and a falling edge are detected in an engine rotation sensor such as a crank angle sensor.

  In this interrupt process 4, the electronic control unit 100 refers to a table showing tasks belonging to a group and a pre-assigned stack area to be used for the tasks of the group. It is monitored whether or not a stack area allocated in advance according to the group to which the task belongs is used.

  For example, first, the execution task information is read (S601). The electronic control device 100 refers to a table in which tasks belonging to a group and a stack area address range allocated in advance according to the group are shown for each group, and based on the group to which the execution task information belongs. Thus, the address range of the stack area allocated in advance according to the group is read. When the stack pointer indicates the range of the pre-assigned address that has been read, the electronic control device 100 uses the stack area pre-assigned according to the group to which the execution task belongs. judge. On the other hand, if the stack pointer indicates outside the range of the pre-assigned address that has been read, the electronic control apparatus 100 does not use the pre-assigned stack area according to the group to which the execution task belongs. judge. If the electronic control device 100 determines that the execution task is using the stack area allocated in advance according to the group to which the execution task belongs, the electronic control device 100 ends the interrupt and returns to the original processing. On the other hand, when the electronic control device 100 determines that the execution task does not use the stack area allocated in advance according to the group to which the execution task belongs, for example, the electronic control device 100 notifies the external device of an error or is not shown. An error is recorded in a non-volatile memory (flash memory or the like) (S602).

  Next, the interrupt process 4 for monitoring the stack ends, and the process returns to the interrupt process 1. Then, during the execution of the interrupt process 1, as described above, the interrupt process 2 which is a function operation abnormality determination task is executed as a periodic interrupt. The interrupt processing 2 is an SVM task, and the ASIL stack area 126 is used as the stack area. Since the first stack pointer has already been used in the interrupt process 1, the electronic control unit 100 does not perform stack pointer switching (S504). Then, the electronic control unit 100 records the execution task information of the interrupt process 2 as in S502 (S505). Thereafter, the electronic control unit 100 executes the interrupt process 2.

  Here, during the execution of the interrupt process 2, the electronic control unit 100 performs an interrupt process 4 for detecting an edge in the engine rotation sensor and monitoring the stack, for example. The electronic control unit 100 reads out the execution task information in this interrupt process (S603). Based on the read execution task information, the electronic control unit 100 determines whether the execution task uses a stack area allocated in advance according to the group to which the execution task belongs, and performs the same processing as S602 (S604). Thereafter, the electronic control unit 100 ends the interrupt process 4 and returns to the execution of the interrupt process 2.

The relationship among time, execution task, used stack area, and stack monitoring task execution timing in an example of performing such task monitoring will be described with reference to FIG.
First, the relationship between the execution task and the stack area used will be described. Interrupt processing 1 which is a periodic interrupt is executed at time t1. The stack area used in this case is the ASIL stack area. Next, interrupt processing 2 is executed at time t2. The stack area used in this case is the ASIL stack area as in the interrupt processing 1. At time t3, the interrupt process 2 ends and the process returns to the interrupt process 1. Furthermore, interrupt processing 1 ends at time t4 and returns to the normal task. At this time, the stack pointer is switched to indicate the QM stack area. Next, at time t5, interrupt processing 1 is executed by a scheduled interrupt during normal task execution. In contrast, the stack monitoring task generates an interrupt when an edge is detected in the engine rotation sensor (t11 to t16), and executes the stack monitoring task. Here, the edge detection timing in the engine rotation sensor does not correlate with the interrupt timings of interrupt processing 1 which is a periodic interrupt and interrupt processing 2 which is a periodic interrupt. In this way, by using the stack monitoring task at the edge detection timing in the engine rotation sensor that does not correlate with the regular interrupt timing, it is possible to monitor the use of the stack area at a random timing that is not regular. it can.

  In the present specification, a dual processor configured with two CPUs has been described. However, the stack area described in the present embodiment is also applied to a multiprocessor configured with three or more CPUs each having a local memory. be able to. Further, when a local memory is connected to each core in the multi-core processor, the stack area described in the present embodiment can be provided in each local memory.

  In this embodiment, the case where the control is executed in two modes divided into two importance levels has been described. However, the electronic control apparatus is provided with three or more importance classifications, and the importance classifications are classified. The mode may be divided according to the number and a plurality of stack areas may be secured.

  In the present specification, the term “scheduled” does not only mean a predetermined time interval but also includes a meaning determined at a predetermined timing in a predetermined procedure.

  100: Electronic control unit, 122: Stack area

Claims (6)

In an electronic control device comprising a memory and a processor,
When the processor executes the first task by a scheduled interrupt, at least one of the plurality of stack areas reserved in the memory is assigned to the first task in advance for the first task. Two stack areas are used,
Whether or not the first task uses at least one stack area pre-assigned to the first task is generated at a random timing that is not correlated with the occurrence timing of the regular interrupt To be monitored by
An electronic control device characterized by that. The second task uses the at least one stack area pre-allocated by the first task via whether or not a stack pointer points to the at least one pre-allocated stack area. Monitoring whether or not
The electronic control device according to claim 1. At least one stack area used by the first task is set based on a group obtained by classifying the first task according to a predetermined rule;
The electronic control device according to claim 1, wherein the electronic control device is an electronic control device. The random timing is a timing based on the output of the engine rotation sensor.
The electronic control device according to claim 1, wherein the electronic control device is an electronic control device. The timing based on the output of the engine rotation sensor is an edge detection timing in the engine rotation sensor.
The electronic control device according to claim 4. When the electronic control unit executes the first task by a scheduled interruption, at least the first task of the plurality of stack areas secured in the memory is assigned to the first task. One stack area is used,
Whether or not the first task uses at least one stack area pre-assigned to the first task is generated at a random timing that is not correlated with the occurrence timing of the regular interrupt To be monitored by
A method for monitoring the use of the stack area.