JP6469599B2 - Memory management system - Google Patents

Description

  The present invention relates to a memory management system.

In recent years, many vehicle controls are performed by an electronic control unit (ECU) that operates electronic vehicle control equipment. Due to sophistication of requirements related to vehicle control such as automatic driving, the functions required of ECUs are becoming more sophisticated and complicated.
On the other hand, vehicle control of automobiles also requires safety for avoiding malfunction of software and hardware of the apparatus. In order to show the degree of safety of the program, ISO 26262 defines an index called ASIL that can be certified by performing safety design and safety verification during the development process. The control program that controls the operation of each device mounted on the vehicle can increase the safety level, but in the advanced image processing functions and machine learning for realizing automatic driving, the processing is complicated, so the whole It is difficult to be safe. Therefore, in the future automatic driving system, it is required to load a vehicle control program with a high degree of safety and an advanced information processing program with a relatively low degree of safety, and to move them in cooperation.
By the way, the ECU includes a main memory, that is, a physical memory as one of the components. The physical memory can be classified into a plurality of types from the viewpoint of coping with accidental errors, and the reliability with respect to errors differs depending on the type. Since a highly reliable memory is expensive, a plurality of types of memories with different reliability are often used together in the ECU.
Patent Document 1 discloses a basic mechanism for restricting access to memory used by each program when a highly safe vehicle control program and a low safety program are run on the same computer.

JP-A-2015-67107

  In the invention described in Patent Document 1, it is not possible to prevent the operation of a highly secure program from being hindered by an accidental error that occurs in the physical memory.

  According to the first aspect of the present invention, a memory management system is configured to access a CPU, a plurality of physical memories having different reliability with respect to errors, and a plurality of programs executed by the CPU and having different safety. A storage unit that stores a shared memory management table in which information relating to the shared memory created in the physical memory is recorded; and a shared memory management unit that manages access to the shared memory by the program. The memory management table includes information related to the reliability of the shared memory, and the shared memory management unit refers to the shared memory management table, and the reliability corresponding to the reliability of the shared memory and the safety of the program And accessing the shared memory by the program based on the comparison result To management.

  According to the present invention, it is possible to prevent the operation of a highly secure program from being hindered by an accidental error occurring in the physical memory, and to improve the availability of a highly secure program.

Block diagram showing the configuration of the shared memory management system 8 The figure showing the function regarding the shared memory of OS7B as a function block The figure which shows an example of the program management table 12 The figure which shows an example of the safety degree correspondence table 16 The figure which shows an example of the physical memory reliability table 15 The figure which shows an example of the shared memory management table 14 A flowchart showing processing of the memory management initialization unit 19 Flow chart showing processing of shared memory creation unit 18 Flow chart showing processing of shared memory management unit 17 The flowchart which shows the process of the memory abnormality detection part 20 The figure which shows an example of the shared memory management table 14A in the modification 3. The flowchart which shows the process of the shared memory management part 17 in the modification 3. The flowchart which shows the process of the shared memory creation part 18 in 2nd Embodiment. The flowchart which shows the process of the shared memory management part 17 in 3rd Embodiment. The figure which shows an example of the memory abnormality recording table 21 The flowchart which shows operation | movement of the shared memory management part 17 in 4th Embodiment.

<Items common to the embodiments: types of physical memory>
The physical memory records information based on the presence or absence of charges stored in the memory cells. There is a known problem that this charge is accidentally rewritten by external factors such as neutrons from the universe, so-called soft error. In order to deal with this problem, physical memory capable of detecting and correcting soft errors has been developed. From the viewpoint of detection and correction of soft errors, for example, physical memory can be classified into the following three types having different reliability against soft errors.

1) Non-parity memory A physical memory that is specialized in storing information and does not have a special configuration for the purpose of detecting the occurrence of an error and correcting the error.
2) Memory with parity Physical memory having a parity bit storage area for detecting the occurrence of a soft error. For example, when storing 8 bits of data, 1 parity bit is stored in the physical memory in association with the 8 bits of data so that the total number of high bits is an even number.
3) Memory with ECC A physical memory having a storage area of ECC bits that enables detection and correction (ECC) of soft errors. For example, when 8-bit data is stored, 2-bit ECC bits are calculated and stored in association with the 8-bit data. In this case, a 1-bit soft error can be detected and corrected, and a 2-bit soft error can be detected only. The number of bits that can be corrected can be increased by increasing the number of ECC bits.
Hereinafter, the parity bits and the ECC bits may be collectively referred to as “additional bits”.
In the embodiments described below, these three will be described, but the present invention is also applicable to physical memories other than the above three such as chip sparing.

(First embodiment)
Hereinafter, a first embodiment of a shared memory management system will be described with reference to FIGS.
FIG. 1 is a block diagram showing a configuration of a shared memory management system 8 according to the present invention. The shared memory management system 8 includes a CPU 1, a plurality of physical memories, a memory controller 6, and a storage unit 7. The CPU 1, the memory controller 6, and the storage unit 7 are connected by a data bus 5.

The shared memory management system 8 includes a plurality of physical memory slots, and can connect physical memories having different reliability and capacity against soft errors. In this embodiment, it is assumed that three physical memories 3a, 3b, and 3c are provided. Hereinafter, when it is not necessary to distinguish between the physical memories 3a, 3b, and 3c, they are collectively referred to as a physical memory 3.
In this specification, the shared memory is a storage area secured in one of the physical memories and managed on the premise that it is accessed from a plurality of programs. In order to distinguish from the shared memory, a storage area secured in the physical memory and assumed to be accessed only from a single program 7A is referred to as non-shared memory.

  The physical memory 3 includes a volatile storage area that can be read and written at high speed, and a small-capacity nonvolatile storage area that stores SPD (Serial Presence Detect) information. The SPD information is information indicating the characteristics of the physical memory, and is, for example, the size, that is, the storage capacity, the presence / absence of parity bits, the number of bits that can be corrected for errors, and the operating frequency. In the present embodiment, when the CPU 1 includes a volatile storage area, the volatile storage area is also treated as one of the physical memories 3. When the CPU 1 includes a volatile storage area, the SPD information is stored in the read-only area of the CPU 1. Therefore, whether or not the physical memory is arranged in the same semiconductor as the CPU 1 can be determined based on the SPD information.

The storage unit 7 stores a plurality of programs 7A and an operating system (hereinafter referred to as OS) 7B.
The CPU 1 reads the program 7A stored in the storage unit 7 into the physical memory 3 and executes it. The CPU 1 requests the memory controller 6 to access the physical memory 3, for example, creation of the shared memory, reading / writing of the shared memory, and reading / writing of the non-shared memory based on an instruction of the program 7A. In FIG. 1, only one CPU 1 exists, but the shared memory management system 8 may include a plurality of CPUs to ensure redundancy.

  The memory controller 6 is an interface for connecting the physical memory 3 to the data bus 5, and includes a memory abnormality detection unit 20. The basic functions of the memory controller 6 are realized by hardware logic provided in the memory controller 6, and advanced functions such as shared memory processing are realized by the OS 7B, that is, software. Functions related to the shared memory will be described later. The basic functions of the memory controller 6 are reading / writing by designating an address to the physical memory 3 of the memory controller 6 and memory abnormality detection of the memory abnormality detection unit 20.

  The memory abnormality detection unit 20 performs processing of parity bits and ECC bits. For example, when the memory controller 6 writes data to the memory with parity, the memory abnormality detection unit 20 calculates the parity bit, and the memory controller 6 writes the parity bit associated with the data together with the data to the memory with parity. . When the memory controller 6 reads data from the memory with parity, when the memory controller 6 reads the parity bit associated with the data together with the data, the memory abnormality detection unit 20 checks the consistency of the parity bit. If there is consistency between the data and the parity bit, no abnormality is detected and no special processing is performed. When there is no consistency between the data and the parity bit, that is, when a soft error is detected, an interrupt instruction for stopping the processing by the CPU 1 is output. The memory abnormality detection unit 20 performs the same processing when the memory controller 6 accesses the memory with ECC, and if an error is detected during reading, the error is corrected within a correctable range and the data is output to the CPU 1. If correction is impossible, the CPU 1 outputs an interrupt instruction for stopping the processing. For example, in an ECC memory capable of 1-bit correction, when the memory abnormality detection unit 20 detects that 2 bits have been rewritten, the error instruction is exceeded and an interrupt instruction is output to the CPU 1.

  The function of the memory abnormality detection unit 20 is, for example, CoreLink DMC-400 Dynamic Memory Controller Technical Reference Manual (http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0466c/apas07s01.html ) Etc.

(Functions related to shared memory)
A function related to the shared memory realized by the OS 7B, that is, software will be described. FIG. 2 shows the three functions realized by the OS 7B as function blocks, and also shows information created and used by these function blocks.
With the three functional blocks representing the functions realized by the OS 7B, the shared memory management unit 17 in charge of processing related to reading and writing of the shared memory, the shared memory creation unit 18 that creates the shared memory, and preparations for creating the shared memory are performed. This is a memory management initialization unit 19.

  The information created and used by these three functional blocks is a program management table 12, a shared memory management table 14, a physical memory reliability table 15, and a safety level correspondence table 16. A broken line in FIG. 2 indicates that reading is performed, and a solid line in the drawing indicates that creation or writing is performed. The program management table 12, the shared memory management table 14, the physical memory reliability table 15, and the safety correspondence table 16 are arranged in the physical memories 3a, 3b, and 3c having the highest reliability.

The memory management initialization unit 19 reads SPD information from all the physical memories 3 connected to the shared memory management system 8 every time the shared memory management system 8 is activated, and performs the physical memory reliability table 15 in the procedure described later. Create
Based on a shared memory creation request from the program 7A, the shared memory creation unit 18 creates a shared memory according to a procedure described later, and writes information about the created shared memory into the shared memory management table 14.
Based on the shared memory read / write request from the program 7A, the shared memory management unit 17 determines whether access is possible, as will be described later. When it is determined that access is possible, the address of the shared memory is specified and read / write is executed by the basic function of the memory controller 6, and when it is determined that access is impossible, an error is output.

In the program management table 12, the program identifier for identifying the program 7A and the safety level of the program are recorded in association with each other. The program identifier is a unique character string for identifying the program 7A, and the character string itself has no meaning. The safety degree is an index indicating the magnitude of risk when the program 7A has a defect, for example, classified using ASIL (Automotive Safety Integrity Level) in ISO 26262, and QM <ASIL0 <ASIL1 <ASIL2 < It shows that a risk is so large on the right side in order of ASIL3. Information recorded in the program management table 12 is static and cannot be rewritten in principle.
FIG. 3 is a diagram illustrating an example of the program management table 12. FIG. 3 shows that the four programs whose program identifiers are AAA, BBB, CCC, and DDD have the safety levels of ASIL2, QM, QM, and ASIL1, respectively.

In the safety degree correspondence table 16, the reliability of the physical memory 3 required for each safety degree of the program 7A is recorded in association with each other. The information recorded in the safety degree correspondence table 16 is static and cannot be rewritten in principle. As will be described later, a physical memory accessible by a certain program is a memory having a reliability higher than the reliability corresponding to the safety level of the program.
FIG. 4 is a diagram showing an example of the safety level correspondence table 16. The reliability of the physical memory 3 is represented by a number, for example. The larger the reliability of the physical memory 3 is, the higher the reliability with respect to an error is, and it indicates that data abnormality due to a soft error is less likely to occur. From FIG. 4, for example, it can be seen that the physical memory 3 accessible by the program having the safety level ASIL 1 is the physical memory 3 having the reliability 3 or 4.

The physical memory reliability table 15 stores, for each physical memory 3 installed in the shared memory management system 8, correspondence with the address space managed by the OS 7B and the reliability of the physical memory. The correspondence of the address space can be expressed by, for example, the head address and the area size, that is, the size. However, the correspondence of the address space may be represented by a start address and an end address. The physical memory reliability table 15 is created every time the shared memory management system 8 is activated by the memory management initialization unit 19. For example, when the physical memory 3 constituting the shared memory management system 8 is replaced, a new physical memory reliability table 15 is created by the memory management initialization unit 19.
FIG. 5 is a diagram illustrating an example of the physical memory reliability table 15. In the example shown in FIG. 5, it can be seen that the shared memory management system 8 includes three physical memories, and the reliability of each physical memory is 0, 1, and 3.

The shared memory management table 14 records information about the shared memory being created, that is, the top address, size, shared memory identifier, and reliability of the shared memory in the address space managed by the OS 7B. The shared memory identifier is an identifier determined in advance so that different programs share the memory. The reliability of the shared memory is the reliability of the physical memory in which the shared memory is stored.
FIG. 6 is a diagram illustrating an example of the shared memory management table 14. In the example shown in FIG. 4, it can be seen that four shared memories having shared memory identifiers SH_A, SH_B, SH_C, and SH_D are created.

(Operation of the memory management initialization unit 19)
The creation of the physical memory reliability table 15 by the memory management initialization unit 19 will be described.
FIG. 7 is a flowchart showing an initialization process of the memory management initialization unit 19 that operates when the shared memory management system 8 is activated. The execution subject of each step described below is the CPU 1 of the shared memory management system 8.
In step S501, the physical memory reliability table 15 is cleared to zero, that is, the recorded information is deleted, and the process proceeds to step S502.
The subsequent steps S502 to S509 are repeated by the number of physical memories 3 connected to the shared memory management system 8, and the physical memory 3 to be processed is changed in order.

In step S502, the SPD information of the physical memory 3 to be processed is read. In the subsequent step S502A, the reliability of the physical memory to be processed is temporarily set to zero, and the process proceeds to step S503.
In step S503, based on the SPD information read in step S502, it is determined whether or not the physical memory to be processed has a parity bit or an ECC bit. If it is determined that any of them is provided, the process proceeds to step S504, and if none is provided, that is, if it is determined to be non-parity, the process proceeds to step S509.
In step S504, the reliability of the physical memory is temporarily set to 1, and the process proceeds to step S505.

In step S505, it is determined whether or not the physical memory to be processed has an ECC bit. If it is determined that the physical bit includes an ECC bit, the process proceeds to step S506. If it is determined that the physical bit does not include an ECC bit, the process proceeds to step S509.
In step S506, the correctable bit number is added to the reliability of the physical memory to be processed, and the process proceeds to step S507. For example, if 2 bits can be corrected, the reliability of the physical memory 3 is 3.
In step S507, it is determined whether the physical memory to be processed is arranged in the same semiconductor as the CPU1. This determination can be made based on the aforementioned SPD information. If it is determined that they are disposed within the same semiconductor, the process proceeds to step S508. If it is determined that they are not disposed within the same semiconductor, the process proceeds to step S509.

  In step S508, 1 is further added to the reliability of the physical memory added in step S506. Here, there are two reasons for adding the reliability. The first reason is that when the physical memory is arranged in the same semiconductor as the CPU 1, the capacity of the physical memory is small and the probability of being affected by neutron beams is low. The second reason is that if they are arranged on the same silicon die, the wiring length is short and is not easily influenced by noise during communication. Next, the process proceeds to step S509.

In step S509, the following three pieces of information related to the physical memory to be processed are written in the physical memory reliability table 15. That is, the start address of the physical memory in the memory space managed by the OS 7B, the size of the physical memory included in the SPD information read in step S502, and the reliability of the physical memory calculated in steps S502A to S508. The start address of the physical memory in the memory space managed by the OS 7B is zero (0x0000) if the physical memory information is not written in the physical memory reliability table 15, and if the physical memory information is written. This is a value obtained by adding the size of the lowermost physical memory to the lowermost physical memory start address.
Steps S502 to S509 described above are repeated for each physical memory 3 connected to the shared memory management system 8, and when this is finished, the flowchart shown in FIG.

(Operation of shared memory creation unit 18)
Allocation of shared memory by the shared memory creation unit 18 and addition to the shared memory management table 14 will be described.
FIG. 8 is a flowchart showing the processing performed by the shared memory creating unit 18 when the memory controller 6 receives a shared memory creation command from the program 7A. The execution subject of each step described below is the CPU 1 of the shared memory management system 8.
In step S601, the identifier of the program 7A that has requested creation of the shared memory, the identifier of the shared memory that is requested to be created, and the size of the shared memory that is requested to be created are read, and the process proceeds to step S602.

In step S602, the program management table 12 is read, and the process proceeds to step S603.
In step S603, the degree of safety corresponding to the identifier of the program 7A read in step S601 is specified using the program management table 12, and the process proceeds to step S604.
In step S604, the safety degree correspondence table 16 is read, and the process proceeds to step S605.
In step S605, the reliability corresponding to the safety degree specified in step S603 is specified using the safety degree correspondence table 16, and the process proceeds to step S606.

In step S606, the shared memory management table 14 and the physical memory reliability table 15 are read, and the process proceeds to step S607.
In step S607, with reference to the shared memory management table 14 and the physical memory reliability table 15, an area that has a reliability higher than the reliability specified in step S605 and has not yet been allocated to the shared memory (hereinafter, unallocated). The physical memory 3 having an area) larger than the requested size is specified. When a plurality of physical memories 3 are specified, the physical memory 3 having the lowest reliability among the specified physical memories 3 is selected. Next, the process proceeds to step S608.
In step S608, it is determined whether or not the physical memory 3 satisfying the condition in step S607 has been identified. If it can be identified, the process proceeds to step S609, and if it cannot be found, the process proceeds to step S611.

In step S609, the start address of the unallocated area of the physical memory 3 specified in step S607, the requested shared memory size, the shared memory identifier, and the reliability of the specified physical memory 3 are written in the shared memory management table 14. Proceed to step S610. Writing the memory area information to the shared memory management table 14 creates a shared memory and creates a new shared memory management table 14 in which information about the created shared memory is recorded. Then, the newly created shared memory management table 14 is stored in the storage unit 7.
In step S610, the address of the created shared memory is output to the program that requested the creation of the shared memory, and the flowchart of FIG. 8 ends.
In step S611, an error indicating that the shared memory could not be secured is output to the program that requested the creation of the shared memory, and the flowchart of FIG. 8 ends.

(Operation of shared memory management unit 17)
The access to the shared memory according to the request from the program by the shared memory management unit 17 will be described.
FIG. 9 is a flowchart showing processing when the shared memory management unit 17 requests the shared memory address from the program.
In step S701, the identifier of the program 7A that requested access and the identifier of the shared memory to be accessed are read, and the process proceeds to step S702.

In step S702, the program management table 12 is read, and the process proceeds to step S703.
In step S703, the degree of safety corresponding to the identifier of the program 7A read in step S701 is specified using the program management table 12, and the process proceeds to step S704.
In step S704, the safety degree correspondence table 16 is read and the process proceeds to step S705.
In step S705, the reliability corresponding to the safety specified in step S703 is specified using the safety correspondence table 16, and the process proceeds to step S706.

In step S706, the shared memory management table 14 is read, and the process proceeds to step S707.
In step S707, the reliability of the shared memory to be accessed is specified. That is, with reference to the shared memory management table 14 read in step S706, the shared memory reliability corresponding to the identifier of the shared memory to be accessed read in step S701 is specified. Next, the process proceeds to step S708.

In step S708, it is determined whether an access condition is satisfied. Here, the reliability of the shared memory identified in step S707 is compared with the reliability corresponding to the safety level of the program 7A identified in step S703, and the reliability of the shared memory to be accessed requests access. It is determined whether or not the reliability corresponds to the safety level of 7A. As a result, if the reliability of the shared memory to be accessed is equal to or higher than the reliability corresponding to the safety level of the program 7A that requested access, it is determined that the access condition is satisfied, and the process proceeds to step S709. Is not satisfied, and the process proceeds to step S710.
For example, when the program 7A having the identifier “BBB” requests access to the shared memory having the shared memory identifier “SH_B”, the determination is made as follows. That is, referring to the program management table 12, the safety level of the program 7A having the identifier “BBB” is “QM”, and referring to the physical memory reliability table 15, the reliability corresponding to the safety level “QM” is “1”. It is. Referring to the shared memory management table 14, since the reliability of the shared memory with the shared memory identifier “SH_B” is “2”, it can be determined that “2”> “1” and that the condition of step S708 is satisfied. That is, since the reliability of the shared memory with the shared memory identifier “SH_B” to be accessed is higher than the reliability corresponding to the safety level “QM” of the program 7A with the identifier “BBB” that requested access, the access condition It can be judged that

In step S709, the shared memory is accessed in accordance with a request from the program 7A, a signal indicating the end of output of read data or write is output, and the flowchart of FIG. 9 ends.
In step S710, which is executed when a negative determination is made in step S708, an error indicating that access is denied is output to the program 7A that requested access, and the flowchart of FIG. 9 is terminated.
In step S709, the shared memory management unit 17 may output the start address of the shared memory to the program 7A without performing the access to the shared memory. In the above example, “0x1000”, which is the start address of the shared memory with the shared memory identifier “SH_B”, is output.

(Operation of the memory abnormality detection unit 20)
The operation of the memory abnormality detection unit 20, that is, processing of parity bits and ECC bits will be described.
FIG. 10 is a flowchart showing the operation of the memory abnormality detection unit 20. The memory abnormality detection unit 20 starts the operation when the memory controller 6 is requested to access the memory, that is, read and write from the program 7A.

In step S1101, it is determined whether the physical memory 3 to be processed is a non-parity memory. When the processing target is a non-parity memory, the memory abnormality detection unit 20 does not need to perform processing, so the program 7A shown in FIG. If the processing target is not a non-parity memory, that is, if it is a memory with parity or an ECC memory, the process proceeds to step S1102.
In step S1102, the memory controller 6 determines whether the purpose of access requested is read or write. If it is determined to be read, the process proceeds to step S1103. If it is determined to be write, the process proceeds to step S1107.

In step S1103, the data at the designated address and additional bits, that is, parity bits or ECC bits are read from the physical memory 3, and the process proceeds to step S1104.
In step S1104, verification of the additional bit, that is, the consistency between the data read in step S1103 and the additional bit is confirmed, and if possible, the data is corrected using the ECC bit. Next, the process proceeds to step S1105.
In step S1105, it is determined whether or not an error has been detected by verifying the additional bits in step S1104. If it is determined that an error has been detected, the process proceeds to step S1106. In step S1106, the CPU 1 is interrupted to notify the error detection, and the flowchart of FIG. On the other hand, if it is determined in step S1105 that no error is detected, nothing is done and the flowchart of FIG. In this step, if the error is within a range that can be corrected by the ECC bits, the error is handled as not detected.

In step S1107, which is executed when it is determined that the requested access is a write, an additional bit, that is, a parity bit or an ECC bit is calculated, and the process proceeds to step S1108.
In step S1108, the data and the additional bits calculated in step S1107 are written into the processing target memory, and the flowchart of FIG.

According to the first embodiment described above, the following operational effects are obtained.
(1) The shared memory management system 8 accesses the physical memory 3 to be accessed from the CPU 1, a plurality of physical memories 3 having different reliability with respect to errors, and a plurality of programs 7A executed by the CPU 1 and having different safety. A storage unit 7 that stores a shared memory management table 14 in which information about the created shared memory is recorded, and a shared memory management unit 17 that manages access to the shared memory by the program 7A are provided. The shared memory management table 14 includes the reliability of the shared memory that is information related to the reliability of the shared memory. The shared memory management unit 17 refers to the shared memory management table 14 (step S707 in FIG. 9), compares the reliability of the shared memory with the reliability corresponding to the safety of the program 7A (step S708 in FIG. 9), Based on the comparison result, access to the shared memory by the program 7A is managed (steps S709 and S710 in FIG. 9). Since it did in this way, it can prevent that the operation | movement of the highly safe program 7A is prevented by the accidental error which arises on the physical memory 3, and can improve the availability of the highly safe program 7A.

(2) When the reliability of the shared memory is higher or the same as the reliability corresponding to the safety of the program 7A (step S708: Yes in FIG. 9), the shared memory management unit 17 transfers to the shared memory by the program 7A. Is permitted (step S709 in FIG. 9). On the other hand, when the reliability of the shared memory is lower than the reliability corresponding to the safety of the program 7A (step S708: No in FIG. 9), the access to the shared memory by the program 7A is denied (step S710 in FIG. 9).
Therefore, each program 7A stored in the storage unit 7 does not access a shared memory that does not satisfy the reliability corresponding to the safety level of each program 7A, and thus is safe due to an error that occurs in a physical memory with low reliability. It is possible to prevent the operation of the highly reliable program 7A from being hindered.

(3) The shared memory management system 8 selects one of the plurality of physical memories 3 based on the safety level of the program 7A that has requested creation of the shared memory, creates the shared memory in the selected physical memory 3, and creates the shared memory. A shared memory creation unit 18 for creating a shared memory management table 14 in which information related to the shared memory is recorded and storing the shared memory management table 14 in the storage unit 7.
Therefore, a shared memory is not created in the physical memory 3 with an unnecessarily high safety level.

(4) The memory management initialization part 19 which determines the reliability of the said physical memory 3 based on the information provided in the non-volatile storage area with which the physical memory 3 is provided, ie, SPD information, is provided. The memory management initialization unit 19 determines the reliability of all the physical memories 3 connected to the shared memory management system 8 every time the shared memory management system 8 is activated, and stores the reliability in the storage unit 7.
Therefore, the error detection capability and error correction capability can be calculated as the reliability of the physical memory based on the SPD information. Further, when the configuration of the physical memory 3 connected to the shared memory management system 8 is changed, the information on the physical memory 3 added to the storage unit 7 can be added without waiting for the user to change the setting.

The first embodiment described above may be modified as follows.
(Modification 1)
The reliability of the physical memory shown in the first embodiment and the safety corresponding to the safety of the program 7A are examples, and reliability and safety other than those described above may be used. For example, the reliability of the physical memory may be set to 6 levels or more, or may be set to 4 levels or less. Moreover, you may use other than ASIL defined by ISO26262 for the safety degree corresponding to the safety degree of the program 7A.

(Modification 2)
The program management table 12 and the safety level correspondence table 16 may be integrated, and the program identifier and the reliability required for the shared memory used by the program 7A may be associated and stored. Further, the information stored in the program management table 12 and / or the safety level correspondence table 16 may be stored in combination with the shared memory management table 14 or the physical memory reliability table 15.
That is, the shared memory management system 8 only needs to store the information of the program management table 12, the shared memory management table 14, the physical memory reliability table 15, and the safety level correspondence table 16, and the stored form does not matter.
Further, the reliability of the shared memory may not be recorded in the shared memory management table 14. That is, by comparing the start address and size of the physical memory reliability table 15 with the start address and size of the shared memory management table 14, it is possible to determine in which physical memory each shared memory is created. Thereby, the reliability of each shared memory can be known from the reliability of the physical memory. For this reason, the reliability of the shared memory is not necessarily required in the shared memory management table 14. When the shared memory reliability is not recorded in the shared memory management table 14, in the shared memory management table 14, the start address and the size correspond to information related to the shared memory reliability.

(Modification 3)
The shared memory management table may be a shared memory management table 14A that further includes a column (hereinafter, “access permission column”) in which identifiers of accessible programs are stored. In this case, when the shared memory management unit 17 determines that the program that requested access is accessible to the shared memory (FIG. 9, step S708: YES), the shared memory management table 14A includes a row of the shared memory to be accessed. The program identifier of the program to be accessed is recorded as access permission information indicating that the program is permitted to access the shared memory. From the next time onward, since the identifier of the program is described in the access permission column of the shared memory management table 14A, it can be easily determined that access is possible.

FIG. 11 is a diagram illustrating an example of the shared memory management table 14A. The column of “access permission program” shown at the right end of FIG. 11 is the above-mentioned access permission column, in which a program identifier as access permission information is recorded. A program whose program identifier is written in the access permission column can easily determine that the shared memory can be accessed by referring to the access permission column.
FIG. 12 is a flowchart showing the operation of the shared memory management unit 17 in the third modification. The difference from the first embodiment is that steps S781 and S782 are executed after step S702, and step S780 is executed after step S709.

  In step S781, it is determined whether the program identifier read in step S701 is described in the access permission column in the row having the shared memory identifier read in step S701 of the shared memory management table 14A. If it is determined that it is described, the process proceeds to step S782 to access the shared memory in the same manner as in step S709. If it is determined that it is not described, the process proceeds to step S702, and processing is performed in the same manner as in the first embodiment until step S708.

In step S780 executed after step S709, the following processing is performed so that the processing in step S781 described above can be performed. That is, the identifier of the program permitted to access, that is, the program identifier read in step S701 is added to the access permission column of the row having the shared memory identifier read in step S701 in the shared memory management table 14A. This is the end of the flowchart of FIG.
According to the third modification, the following effects can be obtained.

(1) If the reliability of the shared memory is higher or the same as the reliability corresponding to the safety of the program 7A (step S708: Yes in FIG. 12), the shared memory management unit 17 transfers to the shared memory by the program 7A. As the access permission information indicating that the access is permitted, the program identifier of the program 7A is added and recorded in the access permission column of the shared memory management table 14A (step S780 in FIG. 12). If the program identifier is recorded in the access permission column of the shared memory management table 14A (step S781: Yes in FIG. 12), the shared memory management unit 17 permits the program 7A to access the shared memory based on this. (Step S782 in FIG. 12).
Therefore, the shared memory management unit 17 can easily determine that the program 7A is permitted to access the shared memory by referring to the access permission column of the shared memory management table 14A.

(Modification 4)
The reliability of the physical memory 3 recorded in the physical memory reliability table 15 may be set based on other than SPD information. For example, the reliability may be increased or decreased based on the circuit design of the shared memory management system 8 or the characteristics of the physical memory 3 not described in the SPD information. For example, the reliability may be increased by “1” by covering the physical memory 3 with lead.

(Modification 5)
In the first embodiment described above, the shared memory management unit 17, the shared memory creation unit 18, and the memory management initialization unit 19 are functional blocks realized by the OS 7B stored in the storage unit 7. However, the shared memory management unit 17, the shared memory creation unit 18, and the memory management initialization unit 19 may be realized by other software, or may be realized by an ASIC (application specific integrated circuit) or an FPGA (Field Programmable Gate Array). It may be realized.

(Modification 6)
In the first embodiment described above, the program management table 12, the shared memory management table 14, the physical memory reliability table 15, and the safety level correspondence table 16 are arranged in the physical memory 3 with the highest reliability. . However, these are not limited to the physical memory 3 and may be arranged in a dedicated storage area provided in the memory controller 6, for example.

(Modification 7)
In the first embodiment described above, the reliability corresponding to the safety level of the program is specified, and the specified reliability is compared with the reliability of the shared memory. However, the method for comparing the safety level of the program and the reliability level of the shared memory is not limited to this. A safety level corresponding to the reliability of the shared memory may be specified, and the specified safety level may be compared with the safety level of the program. Furthermore, the comparison may be performed using a third index other than the safety level and the reliability level. That is, the value of the third index corresponding to the degree of safety of the program is specified, the value of the third index corresponding to the reliability of the shared memory is specified, and the values of the specified third index are compared with each other Also good.

(Second Embodiment)
A second embodiment of the shared memory management system will be described with reference to FIG. In the following description, the same components as those in the first embodiment are denoted by the same reference numerals, and different points will be mainly described. Points that are not particularly described are the same as those in the first embodiment. In the present embodiment, when a shared memory is created, the shared memory is created based on the highest safety level among the safety levels corresponding to the safety levels of the programs 7A accessing the shared memory. This is different from the first embodiment.

(Constitution)
The hardware configuration of the shared memory management system 8 is the same as that of the first embodiment. It is a part of the OS 7B stored in the storage unit 7, and the operation of the shared memory creation unit 18 is different from that of the first embodiment.
In the present embodiment, when the program 7A outputs a shared memory creation command to the memory controller 6, in addition to the identifier of the shared memory, identifiers of all the programs 7A that may access the shared memory are displayed. Output to the memory controller 6.

(Operation of shared memory creation unit 18)
FIG. 13 is a flowchart showing processing performed by the shared memory creating unit 18 when the memory controller 6 receives a shared memory creation command from the program 7A in the second embodiment. The execution subject of each step described below is CPU1. The same processes as those in FIG. 8 in the first embodiment are denoted by the same step numbers, and description thereof is omitted.
In step S801, the identifiers of all programs 7A accessing the shared memory to be created, the identifiers of the shared memory requested to be created, and the size of the shared memory requested to be created are read, and the process proceeds to step S802.

In step S802, the program management table 12 is read, and the process proceeds to step S803.
In step S803, the degree of safety corresponding to the identifier of each program 7A read in step S801 is specified using the program management table 12, and the process proceeds to step S804.
In step S804, the highest safety degree among the safety degrees specified in step S803 is specified, and the process proceeds to step S604.
The processing after step S604 is the same as that of the first embodiment except for the following one point. That is, the highest safety level specified in step S804 is read as the safety level specified in step S603 in the first embodiment.

According to the second embodiment described above, the following operational effects can be obtained.
(1) The shared memory management system 8 selects one of the plurality of physical memories 3 based on the highest safety degree among the safety degrees of the plurality of programs 7A that access the shared memory, and sets the selected physical memory as the selected physical memory. A shared memory creation unit 18 is provided that creates a shared memory and creates a shared memory management table 14 in which information about the created shared memory is recorded and stores the shared memory management table 14 in the storage unit 7.
In the first embodiment described above, among the plurality of programs 7A accessing the shared memory, the program 7A having the highest degree of safety needs to output a shared memory creation command. However, in this embodiment, even if any program 7A outputs a shared memory creation command, a shared memory that can be accessed by any of the shared memories is created.
Even if the program 7A, which was not scheduled at the time of creating the shared memory, accesses the shared memory, the shared memory management unit 17 operates in the same manner as in the first embodiment. Accessability can be determined from the relationship between the degree of security and the degree of safety of the program 7A.

(Modification of the second embodiment)
On the premise that only a program scheduled in advance, that is, a program whose program identifier is output when the shared memory is created, is not accessed to the shared memory, the shared memory management unit 17 determines whether to access the shared memory for each program. May be.

(Third embodiment)
A third embodiment of the shared memory management system will be described with reference to FIG. In the following description, the same components as those in the first embodiment are denoted by the same reference numerals, and different points will be mainly described. Points that are not particularly described are the same as those in the first embodiment. In the present embodiment, when reading data from the shared memory that does not meet the safety standard of the program 7A, the memory abnormality detection unit 20 is temporarily disabled so as not to generate a CPU interrupt. It differs from the first embodiment in that a soft error is detected.

(Constitution)
The hardware configuration of the shared memory management system 8 is the same as that of the first embodiment. It is a part of the OS 7B stored in the storage unit 7, and the operation of the shared memory management unit 17 is different from that of the first embodiment.
Further, in the present embodiment, when the program 7A accesses the shared memory to the memory controller 6, in addition to the shared memory identifier, the purpose of access, that is, reading or writing is transmitted to the shared memory management unit 17.

(Outline of processing)
The memory abnormality detection unit 20 detects a soft error using a parity bit or an ECC bit, and outputs an interrupt instruction to the CPU 1 when the soft error cannot be corrected. This interrupt process is useful in that it informs of the occurrence of an unintended soft error, but it is desirable because other processes are also interrupted if it is clear in advance that the reliability of the physical memory 3 to be read is low. Absent. Therefore, when reading data from the physical memory 3 with low reliability, the CPU interrupt function by the memory abnormality detection unit 20 is temporarily invalidated. Further, by providing the shared memory management unit 17 with the function of calculating and verifying parity bits as in the memory abnormality detection unit 20, a soft error is detected as in the conventional case.
The above-mentioned “when it is clear in advance that the reliability of the physical memory 3 to be read is low” means, for example, the physical memory in which the shared memory is arranged rather than the reliability corresponding to the safety level of the program 7A. This is a case where the reliability of 3 is low.

FIG. 14 is a flowchart illustrating a process executed when the shared memory management unit 17 requests access to the shared memory from the program 7A in the third embodiment. The same processes as those in the first embodiment are denoted by the same step numbers and description thereof is omitted.
In step S901, the identifier of the program 7A that requested access, the identifier of the shared memory, and the purpose of access are read, and the process proceeds to step S902.

In step S902, it is determined whether the purpose of access is reading. If it is determined that the data is read, the process differs depending on whether the reliability of the shared memory satisfies the reliability level corresponding to the safety level of the program 7A. Therefore, the process proceeds to step S702 for the determination. If it is determined that it is not reading, that is, writing, the parity bit is always calculated and written regardless of the reliability described above, and the process proceeds to step S911.
In steps S702 to S707, as described in the first embodiment, the reliability corresponding to the safety level of the program 7A and the reliability of the shared memory to be accessed are specified. In a succeeding step S708, it is determined whether or not the reliability of the shared memory to be accessed is equal to or higher than the reliability corresponding to the safety level of the program 7A. If it is determined that the condition is satisfied, the process proceeds to step S910. If it is determined that the condition is not satisfied, the process proceeds to step S903.

In step S903, the CPU interrupt by the memory abnormality detection unit 20 is temporarily invalidated, and the process proceeds to step S904.
In step S904, data and a parity bit associated with the data are read from the shared memory to be accessed in a state where the CPU interruption by the memory abnormality detection unit 20 is invalidated, and the process proceeds to step S905.
In step S905, the CPU interruption by the memory abnormality detection unit 20 is validated, and the process proceeds to step S906.
In step S906, the consistency between the data read in step S904 and the parity bit is verified. For example, if the sum of the number of high bits included in the data read in step S904 and the number of high bits of the parity bits is an even number, it is determined that the data matches. Next, the process proceeds to step S907.

In step S907, it is determined whether the parity bits are matched in step S906. If it is determined that they are consistent, the process proceeds to step S908. If it is determined that they are not consistent, that is, a soft error is detected, the process proceeds to step S909.
In step S908, since no soft error has been detected, the data read in step S904 is output to the program 7A that made the access request, and the flowchart of FIG. 14 ends.
In step S909, a soft error has occurred in the program 7A that made the access request, and an error indicating that reading has failed is output, and the flowchart of FIG. 14 ends.

In step S911 executed when the purpose of access is writing, the shared memory management table 14 is read, and the process proceeds to step S912.
In step S912, the address of the shared memory to be accessed is specified using the identifier of the shared memory to be accessed and the shared memory management table 14.
In step S913, data to be written is received from the program 7A that has requested access to the shared memory, the parity bit of the data is calculated, and the flow proceeds to step S914.
In step S914, the data and the parity bit calculated in step S913 are written to the address specified in step S912, and the flowchart of FIG.

According to the third embodiment described above, the following operational effects can be obtained.
(1) When the program 7A writes data to the shared memory (FIG. 14, Step S902: Yes), the shared memory management unit 17 uses a data modification detection code for detecting modification of data, such as a parity bit. The data and the data alteration detection code are calculated and written in the shared memory (FIG. 14, steps S911 to S914). When the program 7A reads data from the shared memory, the shared memory management unit 17 determines that the reliability of the shared memory is lower than the reliability corresponding to the safety of the program 7A (FIG. 14, Step S708: No), interrupt processing to the CPU 1 by the memory abnormality detection unit 20 is invalidated (step S903 in FIG. 14). In this state, the data and the data alteration detection code are read from the shared memory to determine whether or not the data has been altered (step S906 in FIG. 14).
For this reason, it is possible to detect a soft error even though no CPU interrupt is generated by the memory abnormality detection unit 20. That is, even if a shared memory created in a physical memory with low reliability is accessed, the operation of a highly secure program is not hindered, and the availability of a highly secure program can be improved.

(Fourth embodiment)
A fourth embodiment of the shared memory management system will be described with reference to FIGS. In the following description, the same components as those in the first embodiment are denoted by the same reference numerals, and different points will be mainly described. Points that are not particularly described are the same as those in the first embodiment. In the present embodiment, the first embodiment is mainly that, when the memory abnormality detection unit 20 detects an abnormality, the occurrence of the abnormality is recorded instead of generating a CPU interrupt, and a soft error is detected based on the recording. And different.
The physical memory 3 used in the present embodiment is limited to a memory other than a non-parity memory, that is, a memory with parity or a memory with ECC.

(Constitution)
The hardware configuration of the shared memory management system 8 is the same as that of the first embodiment. It is a part of the OS 7B stored in the storage unit 7, and the operation of the shared memory management unit 17 is different from that of the first embodiment.
Further, in the present embodiment, when the program 7A accesses the shared memory to the memory controller 6, in addition to the shared memory identifier, the purpose of access, that is, reading or writing is transmitted to the shared memory management unit 17.

(Outline of processing)
As described in the first embodiment, the memory abnormality detection unit 20 detects a soft error using a parity bit in a memory with parity and using an ECC bit in a memory with ECC. When the memory abnormality detection unit 20 detects a soft error, it records the address where the soft error is detected in a memory abnormality recording table 21 described later.
FIG. 15 is a diagram illustrating an example of the memory abnormality recording table 21. In the memory abnormality recording table 21, the address of the memory where the soft error is detected is recorded. In the example shown in FIG. 15, a soft error is detected at two addresses.

  The shared memory management unit 17 can determine the presence or absence of a soft error from the presence or absence of a difference in the memory abnormality recording table 21 before and after reading data from the shared memory. In other words, if there is no change in the memory abnormality recording table 21 before and after reading data from the shared memory, it can be determined that a soft error has not occurred, and if there is a change in the memory abnormality recording table 21 before and after reading data from the shared memory. It can be determined that a soft error has occurred.

(flowchart)
FIG. 16 is a flowchart illustrating processing executed when the shared memory management unit 17 requests access to the shared memory from the program 7A in the fourth embodiment. The same steps as those in the first embodiment and the third embodiment are denoted by the same step numbers, and description thereof is omitted.
If it is determined in step S902 that the purpose of access is write, the process proceeds to step S911, the shared memory management table 14 is read to specify the write address (step S912), and the data is written to the shared memory (step S1000). At this time, the parity bit or ECC bit of the written data is calculated by the memory abnormality detection unit 20.

If an affirmative determination is made in step S902, in steps S702 to S707, as described in the first embodiment, the reliability corresponding to the safety level of the program 7A and the reliability of the shared memory to be accessed are determined. Identified. In a succeeding step S708, it is determined whether or not the reliability of the shared memory to be accessed is equal to or higher than the reliability corresponding to the safety level of the program 7A. If it is determined that the condition is satisfied, the process proceeds to step S910. If it is determined that the condition is not satisfied, the process proceeds to step S1001.
In step S1001, the memory abnormality recording table 21 is cleared, that is, all information stored in the memory abnormality recording table 21 is deleted, and the process proceeds to step S1002.
In step S1002, the CPU interruption by the memory abnormality detection unit 20 is temporarily invalidated, and the process proceeds to step S1004.

In step S1003, data is read from the shared memory to be accessed. At this time, the parity bit or ECC bit associated with this data is read by the memory abnormality detection unit 20 and is recorded in the memory abnormality recording table 21 when an abnormality is detected. Next, the process proceeds to step S1004.
In step S1004, CPU interruption by the memory abnormality detection unit 20 is validated, and the process proceeds to step S1005.
In step S1005, it is determined whether any abnormality is recorded in the memory abnormality recording table 21, that is, whether a soft error is detected. If it is determined that an abnormality has been recorded, the process proceeds to step S909 and an error is output. If it is determined that no abnormality has been recorded, the process proceeds to step S908 and the program 7A that requested access to the data read in step S1003. Output to. This is the end of the flowchart of FIG.

According to the fourth embodiment described above, the following operational effects can be obtained.
(1) The memory abnormality detection unit 20 calculates a data modification detection code for detecting data modification when the program 7A writes data to the shared memory, and stores the data and the data modification detection code in the shared memory. Write.
When the program 7A reads data from the shared memory, the memory abnormality detection unit 20 reads the data and the data modification detection code from the shared memory and determines whether the data has been modified.
The shared memory management unit 17 determines whether data has been altered based on the determination result of the memory abnormality detection unit 20. As described above, in the third embodiment, the shared memory management unit 17 performs the parity bit calculation and the parity bit matching check. However, in the present embodiment, the memory abnormality detection unit 20 uses the hardware logic to execute them. Perform the process.
Therefore, it is possible to reduce the processing load of the shared memory management system 8 as a whole.

The above-described embodiments and modifications may be combined.
Although various embodiments and modifications have been described above, the present invention is not limited to these contents. Other embodiments conceivable within the scope of the technical idea of the present invention are also included in the scope of the present invention.

3, 3a, 3b, 3c ... Physical memory 6 ... Memory controller 7 ... Storage unit 7A ... Program 8 ... Shared memory management system 12 ... Program management table 14, 14A ... Shared memory management table 15 ... Physical memory reliability table 16 ... Safety Degree correspondence table 17 ... Shared memory management unit 18 ... Shared memory creation unit 19 ... Memory management initialization unit 20 ... Memory abnormality detection unit 21 ... Memory abnormality recording table

Claims (8)

CPU,
Multiple physical memories with different reliability for errors,
A storage unit for storing a shared memory management table in which information related to the shared memory created in the physical memory for accessing from a plurality of programs executed by the CPU and having different safety is stored;
A shared memory management unit for managing access to the shared memory by the program,
The shared memory management table includes information related to reliability of the shared memory,
The shared memory management unit refers to the shared memory management table to compare the reliability of the shared memory with the reliability corresponding to the safety of the program, and based on the comparison result, the shared by the program A memory management system that manages access to memory. The memory management system according to claim 1,
The shared memory management unit
Allowing access to the shared memory by the program if the reliability of the shared memory is higher than or equal to the reliability corresponding to the safety of the program;
A memory management system that denies access to the shared memory by the program when the reliability of the shared memory is lower than the reliability corresponding to the safety of the program. The memory management system according to claim 2,
The shared memory management unit indicates that access to the shared memory by the program is permitted when the reliability of the shared memory is higher than or equal to the reliability corresponding to the safety of the program Add permission information to the shared memory management table and record it,
When the access permission information is recorded in the shared memory management table, the shared memory management unit permits the program to access the shared memory based on the access permission information. The memory management system according to claim 1,
A memory abnormality detection unit that detects an abnormality in information stored in the physical memory when the physical memory is accessed and causes the CPU to generate an interrupt process;
The shared memory management unit, when the program reads data from the shared memory, if the reliability of the shared memory is lower than the reliability corresponding to the safety of the program, the memory abnormality detection unit The memory management system which invalidates the interruption process to the CPU by. The memory management system according to claim 4,
The shared memory management unit calculates a data modification detection code for detecting modification of the data when the program writes data to the shared memory, and the shared memory management unit calculates the data and the data modification detection code. Write to memory,
The shared memory management unit, when the program reads data from the shared memory, if the reliability of the shared memory is lower than the reliability corresponding to the safety of the program, the memory abnormality detection unit A memory management system that reads the data and the data modification detection code from the shared memory and determines whether or not the data has been modified in a state in which the interrupt process to the CPU by is disabled. The memory management system according to claim 4,
The memory abnormality detection unit calculates a data modification detection code for detecting modification of the data when the program writes data to the shared memory, and the data and the data modification detection code are shared. Write to memory,
The memory abnormality detection unit, when the program reads data from the shared memory, reads the data and the data modification detection code from the shared memory to determine whether the data has been modified,
The shared memory management unit is a memory management system that determines whether the data has been altered based on a determination result of the memory abnormality detection unit. The memory management system according to claim 1,
Select one of the plurality of physical memories based on the degree of safety of the program that has requested creation of the shared memory, create the shared memory in the selected physical memory, and record information about the created shared memory A memory management system further comprising a shared memory creation unit that creates the shared memory management table and stores the shared memory management table in the storage unit. The memory management system according to claim 1,
Select one of the plurality of physical memories based on the highest safety level among the safety levels of the plurality of programs that access the shared memory, create the shared memory in the selected physical memory, and create A memory management system further comprising: a shared memory creation unit that creates the shared memory management table in which information related to the shared memory that has been recorded is stored in the storage unit.

Images