JP6471510B2 - Microcomputer - Google Patents

Description

  The present invention relates to a microcomputer configured to execute a program after confirming the validity of the program.

  2. Description of the Related Art Conventionally, in a microcomputer having a plurality of CPUs (cores), it has been proposed to detect an abnormality of a CPU by causing each CPU to execute the same program and comparing the execution results (for example, patents). Reference 1).

  In this proposal, when an abnormality occurs in one of the two CPUs, that fact can be detected. For example, when there is one CPU and an illegal program is stored in the memory In this case, the fact cannot be detected, and the CPU executes an illegal program.

  On the other hand, in order to prevent this problem, for example, when a program is written to the memory, a validity check flag is stored in the same storage area as the program, and when the program is executed, the flag is normal. It is conceivable to determine whether or not.

  That is, if the flag is normal, it is determined that the program stored in the same storage area is also normal, and the execution of the program is permitted. Otherwise, the execution of the program is prohibited.

  Similarly, in order to realize secure program startup, a value for validation is calculated using the entire program stored in the memory, and it is determined whether or not the calculated value is a normal value. By doing so, it is possible to confirm the validity of the program.

JP 2013-84219 A

  However, with the former method, it is appropriate if the validity check flag indicates the normality of the program due to bit corruption even though no legitimate program is written in the memory. Sex determination cannot be performed normally and an illegal program may be executed.

  In the latter method, since the validity of the entire program is judged, an illegal program is not executed, but it takes time to judge the validity. There is a problem that the delay time until the program is executed becomes longer after the release.

  The present invention has been made in view of these problems, and allows the microcomputer to accurately determine the validity of the program, and to reduce the delay time until the program can be executed by the validity determination. The purpose is to.

  In the microcomputer of the present invention, a plurality of programs classified according to the functional safety level are stored in the memory in a state where a protection function for prohibiting the execution of the programs is set.

  When the arithmetic processing unit executes the program stored in the memory, first, a validity check is performed to determine the validity of the program in order from the program having the lowest functional safety level. When the validity check confirms that there is no problem with the program, the protection function for the program is canceled and execution of the program is started.

  Therefore, according to the present invention, all programs to be executed by the arithmetic processing unit are collectively stored in the memory and the validity check is performed, compared with the case where the program is started after the microcomputer is started. The delay time until execution can be shortened.

  In the present invention, the validity check of the program is executed in order from the program with the lowest functional safety level. Therefore, for example, even if a part of the program has an abnormality and the abnormality cannot be confirmed by the first validity check, and the corresponding program is executed, a problem caused by the abnormality can be minimized.

  In other words, according to the present invention, it is possible to check the program abnormality by executing the program validity checks in order, stop the program execution, or execute the fail-safe subprogram. .

  Therefore, according to the present invention, it is possible to reduce the delay time from the start of the microcomputer to the execution of the program, while suppressing the decrease in safety due to the execution of an unauthorized program.

  For this reason, if the microcomputer of the present invention is applied to a control device for driving and controlling various control objects such as an electronic control device mounted on a vehicle, the control object can be controlled more safely. Become. In this case, the delay time from when the power supply to the control device is turned on to when the power-on reset of the microcomputer is canceled and control of the controlled object is started can be shortened.

It is a block diagram showing the structure of the electronic control apparatus of embodiment. It is a flowchart showing the program execution procedure of a microcomputer. It is a time chart showing the change of the memory protection state accompanying a program execution. It is a time chart showing the relationship between the validity check implemented for every program, and the starting timing of each program.

Embodiments of the present invention will be described below with reference to the drawings.
The present invention is not construed as being limited in any way by the following embodiments. An aspect in which a part of the configuration of the following embodiment is omitted as long as the problem can be solved is also an embodiment of the present invention. Moreover, all the aspects which can be considered in the limit which does not deviate from the essence of the invention specified only by the wording described in the claims are embodiments of the present invention. Further, the reference numerals used in the description of the following embodiments are also used in the claims as appropriate, but this is used for the purpose of facilitating the understanding of the present invention, and limits the technical scope of the present invention. Not intended.

  An electronic control unit (ECU) 10 according to the present embodiment shown in FIG. 1 is mounted on a vehicle, for example, for controlling an in-vehicle device such as an engine and a transmission as a control object 2, and as a control arithmetic device. And a microcomputer 20.

  The ECU 10 also has an input circuit 14 for taking in detection signals from various sensors 4 provided on the control target, and an output for outputting a drive control signal to the actuator 6 provided on the control target 2. A circuit 16 is provided.

  In addition, the ECU 10 receives power from a communication circuit 18 that communicates with another control device or an external server via a network 8 such as an in-vehicle LAN, or an internal circuit that receives power from an in-vehicle battery (not shown). A power supply circuit 12 that generates a power supply voltage Vcc for driving is also provided.

The microcomputer 20 includes a CPU 22, a RAM 24, a flash memory 26, an input / output unit 28, and a bus line 29 that connects these units.
The input circuit 14, the output circuit 16, and the communication circuit 18 are connected to the input / output unit 28 of the microcomputer 20, and the microcomputer 20 captures various information such as the operation state of the control target 2 from the input circuit 14 and the communication circuit 18. The control amount of the control object 2 is calculated.

  Further, the microcomputer 20 outputs a control signal corresponding to the calculated control amount from the output circuit 16, thereby driving the actuator 6 of the controlled object 2 and controlling the controlled object to a predetermined state.

  A program to be executed by the CPU 22 such as a control program for controlling the control target 2 is classified into a plurality of programs according to the functional safety level in the flash memory 26 which is a rewritable nonvolatile memory. Is remembered.

  The functional safety level is set such that an important program that requires functionality and safety is set to a higher level. In this embodiment, for example, the functional safety level is derived from IEC61508 which is an industrial functional safety standard. It is set in accordance with the functional safety standard “ISO26262” for automobiles.

  In this functional safety standard “ISO26262”, the potential risks of each function of the vehicle are classified by ASIL (Automotive Safety Integrity Level), and QIL (quality control: not related to safety) to ASIL_D (with safety). A wide range of classification levels ranging from the most relevant) is assigned. The height (size) of this functional safety level is as follows.

QM <ASIL_A <ASIL_B <ASIL_C <ASIL_D
In the present embodiment, a program having the lowest relevance to control safety among programs executed by the microcomputer 20 (for example, a program for initial setting of general-purpose registers of the microcomputer 20) is flashed as a QM. Stored in the memory 26.

  Further, programs related to control safety are classified into ASIL_A, ASIL_B,... According to the required functional safety level, and stored in the flash memory 26.

In FIG. 1, (*) given to each level represents program data.
In the following description, in this embodiment, it is assumed that the programs to be executed by the CPU 22 are classified into three, QM, ASIL_A, and ASIL_C, in order from the low level.

  In addition, each program QM, ASIL_A, ASIL_C classified as described above has an expected value M (a validity check) for determining whether the program data stored in the flash memory 26 is normal (validity check). M1, M2, M3) shown in the figure are set.

The expected value M is stored in the same storage area of the flash memory 26 together with the program data of each program QM, ASIL_A, ASIL_C.
Further, in the present embodiment, in order to be able to judge the validity of each program QM, ASIL_A, ASIL_C more accurately, the validity check is performed based on the target program and lower level programs. A determination value is calculated for this purpose.

  For this reason, the expected value M set for each program is set so as to include the contents of a program at a lower level than that program unless the corresponding program is the lowest level (QM in this embodiment). Yes.

The expected value M and the determination value at the time of validity check are calculated from the target program data using a known encryption algorithm such as AES or MISTY.
The programs QM, ASIL_A, and ASIL_C are restricted (protected) by the memory protection function set for each storage area of the flash memory 26, respectively.

  As this memory protection function, a general memory protection function that protects reading and writing to the memory may be used, and a protection function (execution that prohibits execution of a program by writing an inexecutable mark in the storage area) (Protection) may be used. For example, program execution protection using an operating system or security software can be used.

  For this reason, after the microcomputer 20 is activated, the CPU 22 checks the validity of each program stored in the flash memory 26 in order from the program with the lowest functional safety level (QM in this embodiment). I do.

  When the CPU 22 confirms that the program is normal by the validity check, it releases the protection function for the program, executes the program, and determines that the program is abnormal by the validity check. Perform fail-safe processing.

  Hereinafter, the procedure for the CPU 22 to execute each of the programs stored in the flash memory 26 after the microcomputer 20 is started will be described with reference to the flowchart shown in FIG.

  The ECU 10 is connected to the microcomputer 20 after the power is supplied from the vehicle-mounted battery to the ECU 10 until the power supply voltage Vcc generated by the power supply circuit 12 is stabilized and the microcomputer 20 can operate normally. A power-on reset circuit 19 that holds the reset state is provided.

  For this reason, the microcomputer 20 (specifically, the CPU 22) starts the program start determination process shown in FIG. 2 when the power-on reset by the power-on reset circuit 19 is released (see time t0 shown in FIG. 3).

  As shown in FIG. 2, in the program start determination process, first, in S110, a determination value calculation process for calculating the determination value of the validity of each program QM, ASIL_A, ASIL_C is started.

  As described above, the determination value calculation process is a process of calculating a determination value for each program from program data including a lower-level program using an encryption algorithm such as AES or MISTY.

  Next, in S120, the process waits until the determination value of the program QM having the lowest functional safety level is calculated in the determination value calculation process started in S110, and whether or not the program QM is normal based on the determination value. Perform a validity check to determine whether or not

  That is, in S120, the determination value of the program QM calculated by the determination value calculation process is collated with the expected value M1 stored in the same storage area as the program QM. QM is determined to be normal.

  When it is determined in S120 that the program QM is normal (in other words, there is no problem with validity), the process proceeds to S130, and the memory protection function for the storage area of the program QM in the flash memory 26 is released. (Refer to time t1 shown in FIG. 3).

In subsequent S140, the program QM is read from the storage area of the flash memory 26 from which the memory protection function has been released, and execution of the program QM is started.
Next, when the execution of the program QM is started in S140, the process proceeds to S150, waits for the determination value of the program ASIL_A to be calculated in the determination value calculation process, and the validity of the program ASIL_A is based on the determination value. Check.

  In S150, as in S120, the determination value of the program ASIL_A and the expected value M2 stored in the same storage area as the program ASIL_A are collated, and if they match, the program ASIL_A is normal. to decide.

  If it is determined in S150 that the program ASIL_A is normal, the process proceeds to S160, and the memory protection function for the storage area of the program ASIL_A in the flash memory 26 is released (see time t2 shown in FIG. 3).

In subsequent S170, the program ASIL_A is read from the storage area of the flash memory 26 from which the memory protection function has been released, and execution of the program ASIL_A is started.
Next, when the execution of the program ASIL_A is started in S170, the process proceeds to S180, waits for the determination value of the program ASIL_C to be calculated in the determination value calculation process, and the validity of the program ASIL_C is based on the determination value. Check.

  In S180, as in S120 and S150, the determination value of the program ASIL_C is collated with the expected value M3 stored in the same storage area as the program ASIL_C. If these match, the program ASIL_C is normal. Judge that there is.

  When it is determined in S180 that the program ASIL_C is normal, the process proceeds to S190, and the memory protection function for the storage area of the program ASIL_C in the flash memory 26 is released (see time t3 shown in FIG. 3).

In subsequent S200, the program ASIL_C is read from the storage area of the flash memory 26 from which the memory protection function has been released, and execution of the program ASIL_C is started.
When the execution of the program ASIL_C is started in this way, the protection function for all the programs stored in the flash memory 26 is released, and the execution of all the programs is started. Therefore, the program start determination process is ended. .

  On the other hand, if it is determined in the validity check in S120, S150, or S180 that the program QM, ASIL_A, or ASIL_C is not normal, the process proceeds to S210.

In S210, execution of a predetermined fail-safe process is started so that the controlled object 2 can be safely controlled, and the program start determination process is ended.
As described above, in the microcomputer 20 of the present embodiment, the plurality of programs QM, ASIL_A, and ASIL_C classified according to the functional safety level are stored in the flash memory 26 in a state where the protection function is set. Yes.

  When the CPU 22 executes the program in the flash memory 26, as shown in FIG. 3, it is determined whether or not the program QM having a low functional safety level is in order from the program ASIL_A to ASIL_C.

  Each time the CPU 22 determines that each of the programs QM, ASIL_A, and ASIL_C is normal (time points t1, t2, and t3), it releases the protection function for the corresponding program and starts executing the program.

  For this reason, according to the microcomputer 20 of the present embodiment, the program to be executed is stored in the memory in a lump, and the validity check of the entire program is performed. The delay time until the program is executed can be shortened.

  The CPU 22 calculates not only the data of the program to be checked but also the program whose function safety level is lower than that program when calculating the determination value for the validity check of each program QM, ASIL_A, ASIL_C. Use data.

  For this reason, the validity check of a program with a high functional safety level uses all programs with a lower functional safety level than that program, and the validity check of the program can be executed more accurately. .

  On the other hand, the calculation time of the determination value of the program having a high functional safety level is longer than the calculation time of the determination value of a program having a lower functional safety level than that program. This is because the amount of data used for calculating the determination value increases.

  However, the determination values of the programs QM, ASIL_A, and ASIL_C are calculated by a determination value calculation process that is started immediately after the microcomputer 20 is activated. As shown in FIG. 4, the calculation of the determination value of the program having a high functional safety level is continued even during execution of the program having a lower functional safety level than that program.

  For this reason, even if the data of the program having a lower functional safety level than that program is used to calculate the determination value of the program having a higher functional safety level, the calculation time of the determination value after the activation of the microcomputer 20 is increased. The program can be prevented from being delayed until the program starts.

As mentioned above, although one Embodiment of this invention was described, this invention is not limited to the said embodiment, A various aspect can be taken in the range which does not deviate from the summary of this invention.
For example, in the above embodiment, when calculating the determination value for checking the validity of the program stored in the flash memory 26, the data of the target program and the data of the program whose functional safety level is lower than that program It explained as using.

  On the other hand, the determination value of each program stored in the flash memory 26 may be calculated using only the data of the target program. In this case, the expected value stored in the storage area of each program may be set using only the data of the target program.

  In the above-described embodiment, the determination value for checking the validity of the program stored in the flash memory 26 is calculated in parallel for each program in the determination value calculation process started immediately after the microcomputer 20 is started. As explained.

On the other hand, the determination value of each program stored in the flash memory 26 may be executed in order from the program with the lowest functional safety level, as in the validity check.
In this case, if the determination value is calculated including the data of the program having a low functional safety level, it takes a long time to execute the validity check of the program having a high functional safety level after the microcomputer 20 is started. . Therefore, in this case, the determination value of each program may be calculated using only the data of the target program.

  Further, in the above embodiment, the microcomputer 20 is described as being incorporated in the ECU 10 mounted on the vehicle and used to control the on-vehicle device. However, the present invention controls the control target other than the vehicle. It may be used. Further, for example, it may be used to execute a predetermined calculation process for office work.

  That is, the present invention can be applied in the same manner as in the above-described embodiment and can obtain the same effect as long as it is a microcomputer that can classify an execution program into a plurality according to the functional safety level.

  DESCRIPTION OF SYMBOLS 2 ... Control object, 4 ... Sensor, 6 ... Actuator, 8 ... Network, 10 ... ECU, 12 ... Power supply circuit, 14 ... Input circuit, 16 ... Output circuit, 18 ... Communication circuit, 19 ... Power-on reset circuit, 20 ... Microcomputer, 22 ... CPU, 24 ... RAM, 26 ... flash memory, 28 ... input / output unit, 29 ... bus line.

Claims (3)

A memory (26) in which a program is stored in a state where a protection function prohibiting the execution of the program is set;
An operation for executing the validity check for judging the validity of the program stored in the memory and canceling the protection function when the validity check confirms that there is no problem with the program. A processing unit (22);
With
In the memory, a plurality of programs (QM, ASIL_A, ASIL_C) classified according to the functional safety level are stored in a state where the protection function is set,
The arithmetic processing unit performs validity checks of the plurality of programs in order from the program with the lowest functional safety level (S120, S150, S180), and confirms that there is no problem with the programs in the validity check. every time that, by releasing the protection function for the program (S130, S160, S190), and starts the execution of the program (S140, S170, S200), during the execution of the program, the relative other programs A microcomputer that performs a validity check . The arithmetic processing unit includes:
The validity check of each program is performed on the data in the storage area of the memory in which the program to be checked is stored and the memory in which the program having a lower functional safety level than the program to be checked is stored. The microcomputer according to claim 1, wherein the microcomputer is implemented by performing a predetermined calculation based on data in a storage area and collating the calculation result with an expected value stored in the memory. The arithmetic processing unit includes:
The predetermined fail-safe process (S210) is executed in a state in which the protection function for the program is retained when it is determined that there is a problem with the program as a result of the validity check of the program. Or the microcomputer of Claim 2 .