WO2015045507A1

WO2015045507A1 - Vehicular control device

Info

Publication number: WO2015045507A1
Application number: PCT/JP2014/065838
Authority: WO
Inventors: 統宙月舘; 成沢　文雄; 祐石郷岡; 朋仁蛯名; 昌義川津
Original assignee: 日立オートモティブシステムズ株式会社
Priority date: 2013-09-30
Filing date: 2014-06-16
Publication date: 2015-04-02
Also published as: JP2015067107A

Abstract

The purpose of the present invention is to provide a vehicular control device capable of ensuring safety while suppressing process load even when a plurality of software with different safety levels are operated. The present invention is characterized by being provided with: a storage unit; a software control unit that controls operation of a plurality of software stored in the storage unit; an operation mode switch unit that switches operation mode of the software control unit between a privilege mode and a non-privilege mode; and an access right switch unit that switches access right of each software with respect to the storage unit.

Description

Vehicle control device

The present invention relates to a vehicle control device.

Many vehicle control systems in recent years are from an ECU that operates electronic vehicle control equipment, that is, an electronic control unit (Electronic Control Unit), and an in-vehicle LAN (Local Area Network) that enables communication between multiple ECUs. It is configured.

Vehicle control systems are becoming increasingly sophisticated, distributed, and complicated due to reduced environmental loads and safety requirements. As a result, the importance of standardizing the software architecture of the ECU, electronic control of the safety device, and the mechanism for ensuring its safety is increasing.

For example, since a car manufacturer prepares a dedicated ECU for each distributed function, a plurality of ECUs are mixed in one vehicle control system. By introducing a standardized software architecture of the vehicle control device, it is easy to construct a vehicle control system by combining ECUs with different specifications. In the AUTOSAR architecture, modularization is performed in units of functions that depend on the microcomputer, algorithms for sensor and actuator control processing, and in units of setting parameters. Therefore, even if the microcomputer is changed, the target module can be modified. This can be done without modifying other modules.

Also, functional safety mechanisms have been introduced into vehicle control systems in conjunction with the electronic control of safety devices in vehicle control equipment. Here, functional safety is an idea of ensuring safety by causing the system to transition to the safe side when a problem occurs in the system. For example, in functional safety standard ISO26262 for automobiles, ASIL (Automatic Safety Integrity Level) which is a safety level is provided.

General vehicle control systems are composed of various control applications to meet the demands for cost increase suppression and performance optimization, and software with various safety levels are mixed. The functional safety standard ISO 26262 is required to prevent interference between software having different safety requirements. Specifically, it is to prevent QM software with a low safety level from running out of control and accessing a memory storing software with a high safety level such as ASILD and destroying data. Therefore, in order to comply with the functional safety standard ISO26262 in a general vehicle control system, a mechanism for preventing interference between software is required.

As an example of such a mechanism, Patent Document 1 proposes switching an operation mode between a user mode and a kernel mode when executing a task having a different safety level.

JP 2012-247978 A

However, in the above prior art, when the operation mode is switched to execute a task with a different safety level, an interrupt process with a heavy load is performed. Therefore, the above conventional technique has a problem that even if safety can be ensured, overhead increases.

Therefore, an object of the present invention is to provide a vehicle control device that can ensure safety while suppressing a processing load even when a plurality of software having different safety levels are operated.

The present invention relates to a storage unit, a software control unit that controls operations of a plurality of software stored in the storage unit, and an operation mode switching that switches an operation mode of the software control unit between a privileged mode and a non-privileged mode. And an access authority switching unit that switches an access authority of each software to the storage unit.

According to the present invention, even when a plurality of software having different safety levels are operated, safety can be ensured while suppressing a processing load.

It is a lineblock diagram of a control device for vehicles concerning an embodiment of the present invention. It is a figure which shows the example of the memory protection area access authority setting management table of the control apparatus for vehicles. It is a figure which shows the example of the memory protection area access authority management table of the control apparatus for vehicles. It is a figure which shows the example of the memory protection area active state management table of the control apparatus for vehicles. It is a figure which shows the example of the memory protection area active pattern management table of the control apparatus for vehicles. It is a figure which shows the example of the operation mode management table of the control apparatus for vehicles. It is a figure which shows the example of the safety degree level and operation mode of the software which operate | move with the control apparatus for vehicles. It is a figure which shows the example of the program switching ID management table of the control apparatus for vehicles. It is a figure which shows the example of the last program ID management table of the control apparatus for vehicles. It is a figure which shows the example of the table size management table of the control apparatus for vehicles. It is a figure which shows the example of the last operation mode flag management table of the control apparatus for vehicles. It is a figure which shows the example of the save data management table for interruption processes of the control apparatus for vehicles. It is a figure which shows the example of the software control part of the control apparatus for vehicles. It is a figure which shows the example of the operation | movement flow of the MPU setting part of the control apparatus for vehicles. It is a figure which shows the example of the operation | movement flow of the operation mode switching part of the control apparatus for vehicles. It is a figure which shows the example of the operation | movement flow of the access authority switching part of the control apparatus for vehicles. It is a figure which shows the other example of the safety level of the software which operate | moves with the control apparatus for vehicles, and another example of operation mode.

FIG. 1 is a configuration diagram of a vehicle control apparatus according to an embodiment of the present invention. Hereinafter, the control device for a vehicle will be described based on the ECU 1 that is a device for controlling the engine. The engine control unit ECU1 includes an arithmetic unit (CPU) 11, a memory 12 as a storage unit, an input / output circuit 13, a CAN controller 14, a throttle sensor 15, and a pedal sensor 16.

The arithmetic unit (CPU) 11 includes a CPU core 111 and a memory protection unit (MPU) 112. The CPU core 111 is a processor (Central Processing Unit) that executes a plurality of software (sometimes referred to as “programs” in this embodiment) stored (stored) in the memory 12. The arithmetic unit (CPU) 11 has operation modes called privileged mode and non-privileged mode, and both operation modes can be switched by interrupt processing. Note that although the number of CPU cores 111 is one, the number of CPU cores 111 may be plural.

The memory protection device (MPU) 112 is a device that mainly manages access authority to the memory 12, and includes an access authority violation monitoring unit that monitors software access authority. To manage access authority is to set access authority in an arbitrary area in the address space of the memory 12, and to validate or invalidate the setting. Further, the access to the memory 12 is monitored, and if there is an abnormality (that is, violation), the processing of the CPU core 111 is invalidated or stopped so that the processing result is not reflected. Equivalent functions can also be configured using hardware such as circuit devices. In addition, the memory protection device (MPU) 112 includes a storage area setting unit that divides the memory 12 and sets a plurality of storage areas. A memory protection area described later is an area set by the storage area setting unit.

The memory 12 has a program area 121 and a data storage area 122. The program area 121 stores a software control unit 1121, an access authority switching unit 1212, an operation mode switching unit 1213, and an MPU setting unit 1214. The data storage area 122 includes a memory access authority management table 1220010 described later with reference to FIG. 2, a memory protection area access authority management table 1220021 described with reference to FIG. 3, a memory protection area active state management table 1220030 described with reference to FIG. The memory protection area activation pattern management table 1220040 described, the operation mode management table 1220050 described in FIG. 6, the program switching ID management table 1220060 described in FIG. 8, the previous program ID management table 1220070 described in FIG. 9, and described in FIG. The table size management table 1220080, the previous operation mode flag management table 1220090 described in FIG. 11, and the save data management table for interrupt processing 12200100 described in FIG. 12 are stored.

In the present embodiment, the configuration of the engine control ECU 1 is an ECU architecture compatible with the functional safety standard ISO 26262, but the configuration is not limited thereto. For example, you may provide the non-volatile memory (backup ram) for storing data, a water temperature sensor, etc.

The table stored in the data storage area 122 of the engine control device 1 will be described below.

FIG. 2 is a diagram showing an example of the memory access authority management table 1220010. The memory access authority management table 1220010 is a table for managing setting information of default access authority for the memory 12 managed by the MPU, and includes a head address field 1220011, a tail address field 1220012, a privileged mode write field 1220013, and a privileged mode execution field. 1220014, a privileged mode read field 1220015, a non-privileged mode write field 1220016, a non-privileged mode execution field 1220017, and a non-privileged mode read field 1220018. For convenience of explanation, in this embodiment, the memory access authority management table 1220010 is used to manage the setting information of the default access authority for the memory 12, but the present invention is not limited to this.

The start address field 1220011 holds a start address indicating a memory managed by the memory protection unit (MPU) 112. The tail address field 1220012 holds an address indicating the tail of the memory managed by the memory protection unit (MPU) 112. The privileged mode write field 1220013 holds a value for determining whether the arithmetic unit (CPU) 11 can write to an area (hereinafter referred to as a memory protection area) designated by a head address and a tail address in the privileged mode. Here, a value of 0 or 1 is held, and when 0, writing is impossible, and when 1, writing is possible. The privileged mode execution field 1220014 holds a value for determining whether the processing unit (CPU) 11 can execute processing for the memory protection area in the privileged mode. Here, a value of 0 or 1 is held. If 0, the process cannot be executed. If 1, the process can be executed. The privileged mode read field 1220015 holds a value for determining whether the arithmetic unit (CPU) 11 can read from the memory protection area in the privileged mode. Here, a value of 0 or 1 is held, and when 0, reading is impossible, and when 1, reading is possible. The non-privileged mode write field 1220016 holds a value for determining whether the arithmetic unit (CPU) 11 can write to the memory protection area in the non-privileged mode. Here, a value of 0 or 1 is held, and when 0, writing is impossible, and when 1, writing is possible. The non-privileged mode execution field 1220017 holds a value for determining whether the processing unit (CPU) 11 can execute processing for the memory protection area in the non-privileged mode. Here, a value of 0 or 1 is held. If 0, the process cannot be executed. If 1, the process can be executed. The non-privileged mode read field 1220018 holds a value for determining whether or not the arithmetic unit (CPU) 11 can read the memory protection area in the non-privileged mode. Here, a value of 0 or 1 is held. If 0, the process cannot be executed. If 1, the process can be executed. Here, the default access authority of the memory area 12 allows privileged mode writing, execution, and reading, but non-privileged mode writing, execution, and reading are not permitted. For example, writing, execution, and reading may be permitted in privileged mode and non-privileged mode.

FIG. 3 is a diagram showing an example of the memory protection area access authority management table 1220020. The memory protection area access authority setting management table 1220020 is a table for managing access authority setting information for the memory 12 managed by the MPU. The memory protection area number field 1220021, the head address field 1220022, the tail address field 1220023, the privilege mode It consists of a write field 1220024, a privileged mode execution field 1220025, a privileged mode read field 1220026, a non-privileged mode write field write 1220027, a non-privileged mode execute field 1220028, and a non-privileged mode read field 1220029. For convenience of explanation, in the present embodiment, the memory protection area access authority management table 1220020 is used to manage access authority setting information for the memory 12, but the present invention is not limited to this.

The memory protection area access authority management table 1220020 has a plurality of memory protection areas 1 to 4, and the access authority switching unit sets different access authorities for each memory protection area. Further, although the

memory protection areas

2 and 3 are actually the same area, the access authority switching unit sets different access authorities for the

memory protection areas

2 and 3 according to the security level of the software.

The memory protection area number field 1220021 holds the area number of the memory protection area managed by the memory protection unit (MPU) 12. Here, a total of four areas can be set as the memory protection area, but this is not a limitation. The start address field 1220022 holds a start address indicating a memory protection area managed by the memory protection unit (MPU) 112. The tail address field 1220023 holds an address indicating the tail of the memory protection area managed by the memory protection unit (MPU) 112. The privileged mode write field 1220024 holds a value for the arithmetic unit (CPU) 11 to determine whether or not writing to the memory protection area is possible. Here, a value of 0 or 1 is held, and when 0, writing is impossible, and when 1, writing is possible.

Privileged mode execution field 1220025 holds a value for determining whether the processing unit (CPU) 11 can execute processing for the area specified by the head address and the tail address in the privileged mode. Here, a value of 0 or 1 is held. If 0, the process cannot be executed. If 1, the process can be executed.

The privileged mode read field 1220026 holds a value for determining whether the arithmetic unit (CPU) 11 can read data from the memory area in the privileged mode. Here, a value of 0 or 1 is held, and when 0, reading is impossible, and when 1, reading is possible. The non-privileged mode write field 1220027 holds a value for determining whether the arithmetic unit (CPU) 11 can write to the memory protection area in the non-privileged mode. Here, a value of 0 or 1 is held, and when 0, writing is impossible, and when 1, writing is possible. The non-privileged mode execution field 1220028 holds a value for determining whether the processing unit (CPU) 11 can execute processing for the memory protection area in the non-privileged mode. Here, a value of 0 or 1 is held. If 0, the process cannot be executed. If 1, the process can be executed. The non-privileged mode read field 1220029 holds a value for determining whether or not the arithmetic unit (CPU) 11 can read the memory protection area in the non-privileged mode. Here, a value of 0 or 1 is held. If 0, the process cannot be executed. If 1, the process can be executed. Here, the access authority to the memory 12 whose range is not specified by the head address 220022 and the tail address 220023 is set to the default access authority set in the memory access authority management table 1220010.

FIG. 4 is a diagram showing an example of the memory protection area active state management table 1220030. The memory protection area activation state management table 1220030 is a table for managing whether the access authority set in the memory protection area by the memory protection unit (MPU) 112 is valid or invalid. The memory protection area number field 1220031, the activation state field 1220032.

The memory protection area number field 1220031 holds the area number of the memory protection area managed by the memory protection unit (MPU) 112. Here, the memory protection area is four areas, but the number of areas is not limited to this.

The active state field 1220032 holds the value of the active state of the memory protection area managed by the memory protection unit (MPU) 112. Here, a value of 0 or 1 is held, and in the case of 0, the access authority setting set in the corresponding memory area is invalid, and in the case of 1, the access authority setting set in the corresponding memory area is valid. Become. When the value of the active state holds 0, the access authority set in the corresponding memory area is the default access authority in the memory protection area access authority management table 1220010.

FIG. 5 is a diagram showing an example of the memory protection area activation pattern management table 1220040. The memory protection area activation pattern management table 1220040 is a memory protection area activation state setting pattern set in the activation state field 1220032 of the memory protection area activation state management table 1220030. The memory protection area number field 1220041 and the activation pattern 1 field 1220042 , An active pattern 2 field 1220043.

As shown in the memory protection area activation pattern management table 1220040 of FIG. 5, the access authority switching unit manages a plurality of access authority patterns set for each of a plurality of memory protection areas as an activation pattern 1 and an activation pattern 2. By switching patterns, individual access authorities for a plurality of memory protection areas are switched at once.

The memory protection area number field 1220041 holds the area number of the memory protection area managed by the memory protection unit (MPU) 112. Here, the memory protection area is four areas, but the number of areas is not limited to this.

The active pattern 1 field 1220042 is one of the setting patterns of the active state of the memory protection area set in the active state field 1220032 of the memory protection area active state management table 1220030. Although the active state is set for all the memory areas here, the active state may be set only for a part of the memory areas. The active pattern 2 field 1220043 is one of the setting patterns of the active state of the memory protection area set in the active state field 1220032 of the memory protection area active state management table 1220030. Although the active state is set for all the memory areas here, the active state may be set only for a part of the memory areas.

FIG. 6 is a diagram showing an example of the operation mode management table 1220050. The operation mode management table 1220050 is a table for managing the operation mode of the arithmetic unit (CPU) 11 and includes an operation mode flag field 1220051.

The operation mode flag field 1220051 holds a value indicating the operation mode of the arithmetic unit (CPU) 11. Here, a value of 0 or 1 is held, and when 0 is held, the operation mode of the arithmetic unit (CPU) 11 indicates a privileged mode, and when 1 is held, a non-privileged mode is indicated.

In this embodiment, each software is classified according to the classification by the operation mode separately from the classification based on the general safety level (ASIL, QM). This will be described with reference to FIG. Specifically, each software includes privileged mode operation software (ASILOS) operable in the privileged mode, and non-privileged mode operation software (ASIL applications 1-2, QM applications 1-3) operable in the non-privileged mode. It is divided into. Further, the non-privileged mode operation software is further divided into a plurality of stages according to the safety level. In FIG. 7, the non-privileged mode operation software is divided into

ASIL applications

1 and 2 having a relatively high safety level and QM applications 1 to 3 having a relatively low security level.

Explaining based on the safety level classification, software with the same ASIL (ASILOS and ASIL applications 1 and 2) is further divided into a plurality of stages according to the safety level, and the software with the relatively low safety level (ASIL applications 1 and 2) are classified into the same non-privileged mode operation software as the QM application.

This can be said to be a state where each software is divided into three stages of high, medium and low according to the safety level.

Thus, in this embodiment, the software classification is devised, and the range of software that operates in the non-privileged mode is one of the software of the safety level ASIL that is normally assumed to operate in the privileged mode. Has been expanded to include parts.

Then, when the software operated by the software control unit is switched between the privileged mode operation software and the non-privileged mode operation software, the operation mode switching unit switches the operation mode. On the other hand, when the software operated by the software control unit is switched between software operating in the same operation mode, the access authority switching unit switches the access authority according to the security level of the software.

FIG. 8 is a diagram showing an example of the program switching ID management table 1220060. The program switching ID management table 1220060 is a table for managing IDs assigned to realize partitioning between software in a program executed by the arithmetic unit (CPU) 11. It consists of a field 1220061, a program name field 1220062, a safety level field 1220063, an operation mode field 1220064, and a program switching field ID 1220065.

Program No. A field 1220061 is a number assigned to software executed in the engine control ECU 1.

The program name field 1220062 is a name of software executed in the engine control ECU 1.

The safety level field 1220063 is a safety level assigned to software executed in the engine control ECU 1. Here, the safety level is broadly classified into ASIL and QM, and the safety level for software assigned ASIL is higher than software assigned QM.

By the way, the safety level is set based on the magnitude of the effect on the system when an abnormality occurs in the software. Software with a high safety level is a high level of safety required for operation. Means that.

The operation mode field 1220064 indicates the operation mode of the arithmetic unit (CPU) 11 that is obtained when the corresponding program is executed. Here, the operation in the privileged mode is assigned to the OS and some applications, and the other applications operate in the non-privileged mode.

The program switching ID field 1220065 holds the program switching ID of the program that operated last time. The program switching ID is uniquely determined by the combination of the ASIL level and the execution operation mode. Here, 1 is assigned to a program whose ASIL level is ASIL and the execution operation mode is privileged mode, 2 is assigned to a program whose ASIL level is ASIL and execution operation mode is non-privileged mode, and the ASIL level is QM. Although 3 is assigned to a program whose operation mode is non-privileged mode, the setting of the program switching ID is not limited to this.

FIG. 9 is a diagram showing an example of the previous program switching ID management table 1220070. The previous program switching ID management table 1220070 includes a previous program switching ID field 1220071.

The previous program switching ID field 1220071 holds the value of the program switching ID of the program that was operated last time.

FIG. 10 is a diagram showing an example of the table size management table 1220080. The table size management table 1220080 includes a name field 1220081, a total number field 1220082, a program number field 1220083, and a memory protection area number field 1220084.

The name field 1220081 is a name of a target managed by the table size management table 1220080.

The total number field 1220082 represents the total number of objects managed by the table size management table 1220080.

The program number field 1220083 indicates the maximum number of program IDs managed by the program switching ID management table 1220060.

The memory protection area number field 1220084 indicates the maximum number of memory protection area numbers managed by the memory protection area access authority management table 1220020.

FIG. 11 is a diagram showing an example of the previous operation mode flag management table 1220090. The previous operation mode flag management table 1220090 is a table for managing a value indicating the operation mode of the arithmetic unit (CPU) 11 of the previously executed program, and includes a previous operation mode flag field 1220091.

The previous operation mode flag field 1220091 holds a value indicating the operation mode of the arithmetic unit (CPU) 11 of the previously executed program. Here, a value of 0 or 1 is held, and when 0 is held, the operation mode of the arithmetic unit (CPU) 11 when the previous program was executed is a privileged mode, and when 1 is held, a non-privileged mode is held. Indicates.

FIG. 12 is a diagram showing an example of the interrupt processing save data management table 1220100. The interrupt processing save data management table 1220100 is a table for managing data saved during interrupt processing by the OS, and includes an operation mode field 1220101 and a program counter field 1220102.

The operation mode field 1220101 holds a value indicating the operation mode of the arithmetic unit (CPU) 111 immediately before the OS interrupt process. Here, a value of 0 or 1 is held, and when 0 is held, the operation mode of the arithmetic unit (CPU) 11 indicates a privileged mode, and when 1 is held, a non-privileged mode is indicated.

The program counter field 1220102 is an address of the memory executed by the arithmetic unit (CPU) 111 immediately before the OS interrupt process.

The above table is stored in the storage area 122 of the engine control ECU 1 of the first embodiment.

The operation flow of the program stored in the program area 121 of the engine control ECU 1 will now be described.

FIG. 13 is an operation flow of the software control unit 1211. Hereinafter, each step of FIG. 13 will be described. The diagnosis setting information transmission execution unit 1211 substitutes 0 for i (S1211000). The diagnostic setting information confirmation data generation unit 1211 adds 1 to i (S1211001). The software control unit 1211 determines whether i exceeds the total number of programs managed by the table size management table 1220080 (S1211002). If i exceeds the total number of programs, the process ends. If not, the process proceeds to S1211003. The software control unit 1211 calls the MPU setting unit 1215 described later with reference to FIG. 11 (S1211003). Thereby, the operation mode of the arithmetic unit (CPU) 11 corresponding to the program to be executed is changed, and the active state of the memory protection area allocated to the memory 12 is changed, thereby realizing memory protection. The software control unit 1211 stores the program number corresponding to i in the program switching ID management table 1220060. The program is executed, and the process proceeds to step 1211001 (S1211004).

FIG. 14 is an operation flow of the MPU setting unit 1215. Hereinafter, each step of FIG. 14 will be described. The MPU setting unit 1215 reads the program number ID equal to i from the program switching ID management table 1220060. The program switching ID is acquired (S1215000). The MPU setting unit 1215 acquires the previous program switching ID from the previous program switching ID management table 1220070 (S1215001). The MPU setting unit 1215 compares the acquired program switching ID with the previous program switching ID (S1215002). If both values are equal, the process proceeds to step 1215006, and if different, the process proceeds to step 1215003. The MPU setting unit 1215 proceeds to S1215004 if one of the acquired program switching ID and the previous program execution ID is 1, and proceeds to S1215005 if different. The MPU setting unit 1215 calls an operation mode switching unit 1213 shown in FIG. 15 described later, and switches the operation mode of the arithmetic unit (CPU) (S1215004). The MPU setting unit 1215 calls an access authority switching unit 1212 shown in FIG. 13 described later, changes the active state of the memory area, and switches the access authority to the memory 12 (S1215005). The MPU setting unit 1215 updates the previous program ID in the previous program switching ID management table 1220070 with the current program ID (S1215006), and ends the process.

FIG. 15 is an operation flow of the operation mode switching unit 1213. Hereinafter, each step of FIG. 15 will be described. The operation mode switching unit 1213 acquires the operation mode flag of the arithmetic unit (CPU) 11 from the operation mode flag management table 1220050 (S1213000). The operation mode switching unit 1213 performs OS interrupt processing, and saves the current program counter and operation mode flag in the interrupt processing save data management table 1220100 (S1213001). The operation mode switching unit 1213 acquires an operation mode flag from the interrupt processing saved data management table 1220100 (S1213002). The operation mode switching unit 1213 inverts the value of the acquired operation mode flag and updates the operation mode flag in the interrupt processing save data management table 1220100 with the inverted value (S1213003). The operation mode switching unit 1213 ends the interrupt processing by the OS, acquires the operation mode flag and the program counter saved from the interrupt processing saved data management table 1220100 (S1213004), updates the program counter and the operation mode flag, and performs processing. finish.

FIG. 16 is an operation flow of the access authority switching unit 1212. Hereinafter, each step of FIG. 16 will be described. The access authority switching unit 1212 receives the program number corresponding to i from the program switching ID management table 1220060. The program switching ID is acquired (S1212000). The access authority switching unit 1212 acquires the previous program switching ID from the previous program switching ID management table 1220070 (S1212001). The access authority switching unit 1212 substitutes 0 for j (S1212002). The access authority switching unit 1212 compares the combination of the acquired program ID and the previous program ID (S1212003). If the combination is (1, 3) or (3, 1), the process proceeds to step 1212004. Otherwise, the process proceeds to step 1212007. move on. In the case of Yes in S1212003, the access authority switching unit 1212 adds 1 to j (S1212004). The access authority switching unit 1212 sets the active state of the same memory protection area number as j of the memory protection area activation state management table 1220030 to the value of the activation pattern 2 of the same memory protection area number as j of the memory protection area activation pattern management table 1220040. (S1212005). The access authority switching unit 1212 compares the number of memory protection areas in the table size management table 1220080 with j (S1212006), and proceeds to step 1212006 when the number of memory areas is smaller than j. In the case of No in S1212003, the access authority switching unit 1212 adds 1 to j (S1212007). The access authority switching unit 1212 sets the active state of the same memory protection area number as j in the memory protection area activation state management table 1220030 to the value of the activation pattern 1 having the same memory protection area number as j in the memory protection area activation pattern management table 1220040. (S1212008). The access authority switching unit 1212 compares the number of memory protection areas in the table size management table 1220080 with j (S1212009), and proceeds to step 1212006 if the number of memory areas is smaller than j. The access authority switching unit 1212 updates the previous program switching ID in the previous program switching ID management table 1220070 with the value of the acquired program switching ID (S1212010).

Next, operations performed by the vehicle control apparatus of the present embodiment will be described with reference to FIG.

First, the software control unit 1211 has a program no. 1, the software “QM application 1” of the safety level QM that operates in the non-privileged mode is operated. During the execution of the QM application 1, the software control unit 1211 displays the program number. 2, software “ASIL application 1” of the safety level ASIL operating in the non-privileged mode is to be operated. At this time, since “QM application 1” and “ASIL application 1” have the same operation mode in the non-privileged mode, the operation mode switching by the operation mode switching unit is unnecessary, but the safety level is different. Therefore, the access authority switching unit switches the access authority. Here, in the method of switching the operation mode based on the safety level (that is, whether the safety level is ASIL or QM), the operation mode is changed when the software to be operated is changed from “QM application 1” to “ASIL application 1”. The operation mode must be switched by the switching unit. However, in the present embodiment, the operation mode switching process with a large processing load (overhead) is not required, and the access authority switching process is sufficient. Therefore, when the software is changed from “QM application 1” to “ASIL application 1”. Speed up the process.

Next, the software control unit 1211 reads the program number. 3, software “ASILOS” of the safety level ASIL operating in the non-privileged mode is to be operated. At this time, since the operation mode differs between “ASIL application 1” and “ASILOS”, the operation mode switching unit switches the operation mode. Here, operation mode switching processing with a large processing load occurs.

Next, the software control unit 1211 reads the program number. 4, software “QM application 2” of safety level QM operating in the non-privileged mode is to be operated. At this time, since “ASILOS” and “QM application 2” have different operation modes, the operation mode switching unit switches the operation mode. Here again, the operation mode switching process with a large processing load occurs.

Next, the software control unit 1211 reads the program number. 5, the software “ASIL application 2” having the safety level ASIL operating in the non-privileged mode is to be operated. Conventionally, it is necessary to switch the operation mode by the operation mode switching unit. However, in this embodiment, it is not necessary to switch the operation mode, and the access authority switching unit switches the access authority.

Next, the software control unit 1211 reads the program number. 6, software “QM application 3” having a safety level QM operating in the non-privileged mode is to be operated. Here, in the method of switching the operation mode based on the safety level, it is necessary to switch the operation mode by the operation mode switching unit. However, in this embodiment, the operation mode switching is unnecessary, and the access authority switching unit grants the access authority. Switch.

In this way, the software to be operated is program No. In the above example of sequentially changing from 1 to 6, the operation mode switching, which was conventionally required four times, can be performed only twice in the present embodiment. As described above, according to the present embodiment, it is possible to reduce the load (overhead) of the entire vehicle control performed while the operating software is sequentially changed.

In general, the software used for vehicle control is more secure with a lower degree of safety than one with a higher degree of safety. Therefore, by adopting memory protection by switching access authority between softwares with a relatively low degree of safety, it is possible to narrow down the objects that require operation mode switching to software with a relatively high degree of safety. That is, it is possible to increase the safety level that requires operation mode switching. Therefore, as a whole, the number of operation mode switching can be reduced.

As described above, in a normal software architecture, software with different safety levels is mixed in one task, and when partitioning is applied to software with different safety requirements, access restriction by the memory protection unit (MPU) occurs. . In the conventional method, the access authority switching process is realized by an interrupt function of the OS that interrupts the process being executed. Therefore, in the existing software, the access authority managed by the memory protection unit (MPU) is frequently switched. There was concern about increased overhead due to interruptions.

On the other hand, according to the present embodiment, even when a plurality of pieces of software having different safety levels are operated, safety can be ensured while suppressing the processing load. That is, by flexibly controlling the active state of the memory protection area managed by the memory protection device 112, it is possible to realize memory protection between software of different safety levels in the operation mode of the same arithmetic unit (CPU) 11. . In addition, by utilizing the switching of the operation mode of the arithmetic unit (CPU) 11 and the setting of the active state of the memory protection area managed by the memory protection device 112, it is possible to switch the memory access authority at a low speed with less OS interrupt frequency. can do.

If the vehicle control device detects an access authority violation, the vehicle control device may notify the driver accordingly. For example, a vehicle control system in which a plurality of vehicle control devices including a vehicle control device for a user interface are connected via an in-vehicle network will be described as an example. , Violation) is detected, the abnormality information is transmitted to the user interface vehicle control device, and the user interface vehicle control device which has received the abnormality information issues a command regarding a warning to the driver.

Also, a backup memory for storing access abnormality information may be provided in the vehicle control device, and when there is a violation of authority in software access, it may be stored in the backup memory. In this case, the analysis tool is connected to the vehicle control device via the in-vehicle network, and a message requesting memory access abnormality information is transmitted from the analysis tool, so that the vehicle control device that receives this message accesses the memory. By transmitting the abnormality information to the analysis tool, the memory access abnormality information can be extracted.

In the above embodiment, the software that can operate in the privileged mode is ASILOS, and the non-privileged mode operation software is divided into a plurality of stages according to the safety level. The mode operation software may be divided into a plurality of stages according to the safety level. In this case, in the same privilege mode, the access authority switching unit switches the access authority according to the software security level. As an example, as shown in FIG. 17, the ASIL OS and the ASIC-C application are privileged mode operation software, and the non-privileged mode operation software is an ASIL-B application, an ASIL-A application, and a QM application. .

Claims

A storage unit;
A software control unit for controlling operations of a plurality of software stored in the storage unit;
An operation mode switching unit that switches an operation mode of the software control unit between a privileged mode and a non-privileged mode;
A vehicle control apparatus comprising: an access authority switching unit that switches an access authority of each software to the storage unit.
Each of the software is divided into privileged mode operation software operable in a privileged mode and non-privileged mode operation software operable in a non-privileged mode,
When switching the software that the software control unit operates between the privileged mode operation software and the non-privileged mode operation software, the operation mode switching unit switches the operation mode,
When the software operated by the software control unit is switched between software operating in the same operation mode, the access authority switching unit switches the access authority according to the degree of safety of the software. Item 2. The vehicle control device according to Item 1.
The vehicle control device according to claim 1, wherein the non-privileged mode operation software is divided into a plurality of stages according to safety.
An access authority violation monitoring unit for monitoring the access authority of the software;
The vehicle control device according to claim 1, wherein when the access authority violation monitoring unit detects an access authority violation, the process is stopped.
An access right violation monitoring unit for monitoring the access right of the software;
2. The vehicle control device according to claim 1, wherein when the access authority violation monitoring unit detects an access authority violation, information on the violation is stored.
A storage area setting unit configured to divide the storage unit and set a plurality of storage areas;
The vehicle control apparatus according to claim 1, wherein the access authority switching unit sets different access authorities for the plurality of storage areas.
A storage area setting unit configured to divide the storage unit and set a plurality of storage areas;
The vehicle control apparatus according to claim 1, wherein the access authority switching unit sets different access authorities for the same storage area among the plurality of storage areas in accordance with a degree of software safety.
The access authority switching unit manages a plurality of access authority patterns set for each of the plurality of storage areas,
The vehicle control device according to claim 6, wherein the individual access authority to the plurality of storage areas is switched at once by switching the pattern.
The vehicle control device according to claim 1, wherein the access authority switching unit resets the access authority set for the storage unit during execution of the software.