MICROCOMPUTER

Abstract

Microcomputer that features: a memory (26) that stores a program in a protected state which activates a protection function that prevents the program from being executed; and an arithmetic processor (22) that performs a validity check on the program stored in memory to determine whether the program contains any anomalies, and the protection function is deactivated if the validation check determines that the program does not contain anomalies, and then the program is executed, whereby the memory stores several programs (QM, ASIL_A, ASIL_C) which are classified according to functional safety levels in the protection state that activates the protection function; and the arithmetic processor The validity check of the programs is performed program by program in sequence, starting with a program whose functional safety level is low (S120, S150, S180), and The protection function for a program is deactivated (S130, S160, S190) if the validation check determines that the program does not contain an anomaly, and then the program is executed (S140, S170, S200).

Description

TECHNICAL AREA

[0001] The present invention relates to a microcomputer that checks the validity of a program and then executes the program. STATE OF THE ART

[0002] A microcomputer containing multiple CPUs (cores) has been proposed that causes the CPUs to execute the same program and compares the execution results to detect anomalies in the CPUs (see, for example, JP 2013-84219A). This microcomputer can detect an anomaly occurring in either of two CPUs. Conversely, if only one CPU is present and an illegal program is stored in memory, the illegal program will not be detected, and the CPU may execute the illegal program. To prevent this, according to a first example, when a program is written to memory, a validity check flag can be stored in the same memory location as the program. At the time of program execution, it can be determined whether the flag is normal or not.

[0003] If the flag is normal, it is determined that the program stored in the same memory area is normal, thus allowing its execution. If the flag is not normal, the program's execution is prevented.

[0004] Similarly, according to a second example, to ensure program startup, an entire program stored in memory can be used to calculate a value for validation. Determining whether the calculated value is a normal value allows for verification of the program's validity.

[0005] Furthermore, US patent 2015 / 0317198A1 discloses an onboard electronic control device. A CPU periodically performs a memory check and, if an error is detected in the memory contents, writes the number of detected errors to an error counter memory unit and resets itself. Immediately after the CPU reset and before the first memory check, an error determination unit determines whether the number of errors stored in the error counter memory reaches at least an error determination threshold. If the number of errors is at least equal to the error determination threshold, an error response unit causes the CPU to execute a specific error response program from the programs stored in memory.

[0006] DE 10 2010 062 963 A1 discloses a device installed in a vehicle for monitoring a target section within the vehicle. In the device, an execution unit performs a specific process to respond to an anomaly in the target section, and an instruction unit instructs the execution unit to perform the specific process when the anomaly occurs in the target section. A determination unit determines when the specific process requires verification. A verification unit instructs the execution unit to perform the specific process, regardless of whether an anomaly occurs in the target section, whenever it is determined that the specific process must be performed, thus verifying whether an anomaly occurs in the specific process. SUMMARY

[0007] In the first example mentioned above, even if no legitimate program is written to memory, an anomaly such as bit corruption can cause the validation flag to indicate that the program is not normal. This prevents the validation check from being executed normally, thus allowing the illegal program to run.

[0008] In the second example mentioned above, the validity is determined by the entire program, which prevents the execution of an illegal program. However, this requires time to determine validity, which means that a delay increases after activation (power-on or switching on of the power supply) of a microcomputer until the program is executed (especially after a power-on reset state is released).

[0009] It is an object of the present invention to provide a microcomputer that can accurately determine the validity of a program and, furthermore, prevent the validity check from increasing the time delay before the program is executed. This object is achieved by a microcomputer with the features of independent claim 1. The dependent claims are directed to advantageous embodiments of the invention.

[0010] According to one aspect of the present invention, a microcomputer is provided which includes a memory and an arithmetic processor. The memory stores a program in a protected state, which enables a protection function that prevents the program from executing. The arithmetic processor performs a validity check on the program stored in the memory to determine whether the program contains anomalies. If the validity check determines that the program contains no anomalies, the processor locks or disables the protection function and then executes the program. Here, the memory stores multiple programs, which are classified according to functional safety levels in the protected state that activates the protection function.The arithmetic processor performs the validity check of the programs one after the other in a sequence, starting with a program whose functional safety level is low, and locks or disables the protection function for a program if the validity check determines that the program does not have an anomaly, and then executes the program.

[0011] This aspect can reduce the delay time from activating a microcomputer to executing a program compared to a case where all programs to be executed by an arithmetic processor are stored in a single memory and a validation check is performed.

[0012] This aspect performs program validity checks in sequence, starting with programs whose functional safety level is low. A part of a program may contain an anomaly, and this anomaly may not be detected by the first validity check, thus allowing the program to execute. Even in such a case, any resulting inconvenience can be minimized.

[0013] That is, the aspect of the present invention performs the validity check of programs in a sequence; this configuration can detect an anomaly in a program, stop the execution of the program and execute a subroutine for failover protection.

[0014] Furthermore, this aspect can therefore reduce the delay time from the activation of a microcomputer to the execution of the program, while preventing a deterioration of security due to the execution of an illegal program.

[0015] The microcomputer of the component can, for example, use a controller to reliably control various control targets, such as an electronic control unit mounted in a vehicle. This can reduce the delay time until the control of the control target begins after the microcomputer's power-on reset state is triggered following the start of power supply to the controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above and further problems, features, and advantages of the present invention will become clear with reference to the following detailed description and the accompanying drawings. These show: Fig. 1 a block diagram representing a configuration of an electronic control unit of an embodiment; Fig. 2 a flowchart that represents the execution of a microcomputer's program; Fig. 3. A timing diagram showing changes in a memory protection state in connection with the execution of a program; and Fig. 4 a time diagram that shows the relationship between a validation check performed for a given program and a start time of a given program. DETAILED DESCRIPTION

[0017] Fig. Figure 1 represents an electronic control unit (ECU) 10 of an embodiment of the present invention. The ECU 10, which can be installed in a vehicle to control vehicle-specific units such as an internal combustion engine and a transmission as control targets 2, contains a microcomputer 20 as a computing device for control.

[0018] The ECU 10 contains an input circuit 14 for receiving detection signals from various sensors 4 located in the control target 2, and an output circuit 16 for outputting control signals to control an actuator 6 located in the control target 2.

[0019] The ECU 10 also includes a communication circuit 18, which communicates with other control devices or an external server via a network 8, for example a vehicle's own LAN, and a power supply circuit 12, which receives electrical energy from a vehicle's own battery (not shown) and generates a power supply voltage Vcc for controlling internal circuits.

[0020] The microcomputer 20 contains a CPU 22, a RAM 24, a flash memory 26, an input / output unit 28 and a bus line 29 that connects these units together.

[0021] The input circuit 14, the output circuit 16, and the communication circuit 18 are connected to the input / output unit 28 in the microcomputer 20. The microcomputer 20 retrieves various pieces of information, such as the operating state of the control target 2, from the input circuit 14 and the communication circuit 18 and calculates a control variable for the control target 2.

[0022] The microcomputer 20 outputs a control signal according to the calculated control variable to / via the output circuit 16 in order to control the actuator 6 in the control target 2, to control the control target 2, and to control the control target 2 into a predetermined state.

[0023] Programs to be executed by the CPU 22, which contain a control program for controlling the control target 2, are stored program by program in the flash memory 26 of a rewritable non-volatile memory. Such programs are stored in the flash memory 26 classified into several types according to functional safety levels.

[0024] The functional safety level specifies the requirements regarding functionality and safety. If a program is more critical and requires higher functionality and safety, the functional safety level assigned to it will be higher. The implementation sets the functional safety level in accordance with the ISO 26262 functional safety standard for vehicles, which is derived from IEC 61508, an industrial functional safety standard.

[0025] The functional safety standard "ISO 26262" classifies potential risks associated with a vehicle's functions by assigning an ASIL (Automotive Safety Integrity Level), which encompasses classification levels ranging from QM (quality management: no relation to safety) to ASIL_D (maximum relation to safety). The level of each ASIL is expressed as follows: QM < ASIL_A < ASIL_B < ASIL_C < ASIL_D.

[0026] In this embodiment, among the programs executed by the microcomputer 20, a program that has the least relation to the safety of the control (for example, a program for the initial setting of a general register in the microcomputer 20) is stored as QM in the flash memory 26.

[0027] Programs that have any relationship to the safety of the controller are classified as ASIL_A, ASIL_B, ... according to a required functional safety level and stored in the flash memory 26.

[0028] In Fig. The symbol (*) indicates at each level that the data is program data. The following describes programs that are classified by the CPU 22 into three levels: QM, ASIL_A, and ASIL_C, starting from the lowest level.

[0029] Each of the classified programs QM, ASIL_A and ASIL_C is assigned an expected value M (M1, M2 and M3 in Fig. 1) to determine a validity (validity check) regarding whether program data stored in the flash memory 26 is normal or not assigned.

[0030] The expected value M is stored in the same memory area in the flash memory 26 as the program data of the respective programs QM, ASIL_A and ASIL_C.

[0031] To determine the validity of the respective programs QM, ASIL_A and ASIL_C even more precisely, the embodiment calculates a determination value based on a target program and a program at a lower level than the target program.

[0032] If the relevant program is not located at the lowest level (in the embodiment: QM), the expected value M, which is set for each program, therefore contains data from the program at the lower level.

[0033] The expected value M and the value determined for the validity check are calculated from target program data using a known cryptographic algorithm such as AES (Advanced Encryption Standard) or MISTY. The execution of the respective programs QM, ASIL_A, and ASIL_C is limited (protected) by a memory protection function that is enabled (i.e., activated) in each of the respective memory areas in the flash memory 26.

[0034] The memory protection function can be a general memory protection function to protect a read / write operation to / in a memory, a protection function (execution protection) that prevents the execution of a program by writing a non-executable marker to a memory area, or an execution protection function of a program that uses an operating system or security software.

[0035] After the microcomputer 20 is started, the CPU 22 performs a validity check in order of the program of the lowest functional safety level (in the embodiment: QM) by determining whether each of the programs stored in the flash memory 26 is normal or not.

[0036] If the validation check determines that a program is normal, CPU 22 releases (that is, disables or removes) the program's protection function and then executes the program. If the validation check determines that a program is abnormal, CPU 22 performs a predetermined failover process.

[0037] The following describes a procedure for executing the respective programs in the flash memory 26 after the microcomputer 20 is started using the CPU 22, based on the flowchart of the Fig. 2 described.

[0038] The ECU 10 has a power-on reset circuit 19 which keeps the microcomputer 20 in a reset state for a period of time which lasts from the time the power supply from a vehicle battery to the ECU 10 is supplied until the time at which the power supply voltage Vcc generated by the power supply circuit 12 becomes stable to allow normal operation of the microcomputer 20.

[0039] When the power-on / reset circuit 19 releases (disables) the microcomputer 20 (i.e., the CPU 22) starts a program start determination process in Fig. 2 (see time t0 in Fig. 3).

[0040] According to Fig. 2. The program start determination process first starts a determination value calculation process in S110 to calculate a determination value for the validity of the programs QM, ASIL_A and ASIL_C.

[0041] The determination value calculation process calculates a determination value from program data containing a low-value program for each of the programs (program by program) using a cryptographic algorithm such as AES or MISTY.

[0042] In S120, the system waits until a target value for the QM program, whose functional safety level is the lowest, is calculated by the target value calculation process started in S110, and a validity check is performed based on the target value to determine whether the QM program is normal or not.

[0043] In S120, the determined value for the program QM, calculated in the determined value calculation process, is verified (or compared) with the expected value M1, which is stored in the same memory area as the program QM. If the values ​​match, it is determined that the program QM is normal.

[0044] If S120 determines that the program QM is normal, in other words, if there is no anomaly (i.e., no problem with validity), the routine proceeds to S130, where the memory protection function for the memory area of ​​the program QM in flash memory 26 is deactivated (see time t1 in Fig. 3).

[0045] In S140, the program QM is read from the memory area in the flash memory 26, for which the memory protection function is disabled, and then the execution of the program QM is started.

[0046] After the QM program starts executing in S140, S150 waits for the calculation of the target value for the ASIL_A program in the target value calculation process. Based on this target value, the validity check of the ASIL_A program is then performed.

[0047] In S150, as in S120, the determined value for the program ASIL_A is compared with the expected value M2, which is stored in the same memory area as the program ASIL_A. If the values ​​match, it is determined that the program ASIL_A is normal.

[0048] If S150 determines that the program ASIL_A is normal, the memory protection function for the memory area of ​​the program ASIL_A in flash memory 26 is deactivated in S160 (see time t2 in Fig. 3).

[0049] In S170, the program ASIL_A is read from the memory area of ​​the flash memory 26, for which the memory protection function has been deactivated, and the execution of the program ASIL_A is started.

[0050] After the execution of program ASIL_A starts in S170, S180 waits for the calculation of the target value for program ASIL_C in the target value calculation process. Based on this target value, the validity check of program ASIL_C is then performed.

[0051] In S180, as in S120 and S150, the determined value for the program ASIL_C is compared with the expected value M3, which is stored in the same memory area as the program ASIL_C. If the values ​​match, it is determined that the program ASIL_C is normal.

[0052] If S180 determines that the program ASIL_C is normal, the memory protection function for the memory area of ​​the program ASIL_C in flash memory 26 is deactivated in S190 (see time t3 in Fig. 3).

[0053] In S200, the program ASIL_C is read from the memory area of ​​the flash memory 26, for which the memory protection function has been enabled, and then the execution of the program ASIL_C is started.

[0054] The start of the execution of the program ASIL_C indicates that all protection functions for all programs in the flash memory 26 are deactivated and the execution of all programs has started; thus, the program start determination process ends.

[0055] If, on the other hand, it is determined that the program QM, ASIL_A or ASIL_C is not normal in the validity check in S120, S150 or S180, the routine proceeds to S210.

[0056] In S210, the execution of a predetermined failover process is started to safely control the control target 2; thus, the program start determination process ends.

[0057] As described above, in the microcomputer 20 of the embodiment, the programs QM, ASIL_A and ASIL_C, which are classified according to the functional safety levels, are stored in a state in which the protection function is set (activated) in the flash memory 26.

[0058] When the CPU 22 executes a program in the flash memory 26, the system determines, in order from program QM, which has a low functional safety level, through program ASIL_A, to program ASIL_C, whether the respective programs are normal or not, as described in Fig. 3 is shown.

[0059] Each time it is determined that the respective program QM, ASIL_A and ASIL_C is normal (time points t1, t2, t3), the CPU 22 deactivates the protection function for the corresponding program and starts the execution of the program.

[0060] The microcomputer 20 of the embodiment can thus shorten the delay time from the activation of the microcomputer 20 to the execution of the program compared to a case in which a program to be executed is stored in a memory in its entirety and the validity check is performed for the entire program.

[0061] At the time of calculating the determination value for the validity check for the respective programs QM, ASIL_A and ASIL_C, the CPU 22 uses not only data from a program to be checked, but also data from a program whose functional safety level is lower than that of the program to be checked.

[0062] The validity check of the program, whose functional safety level is high, therefore uses all programs whose functional safety levels are lower than that of the program; the validity check of the program can thus be performed more accurately.

[0063] The calculation time for the determined value of a program with a high functional safety level is longer than that for a program with a lower functional safety level. This is because the amount of data used to calculate the determined value is larger.

[0064] The target value for the respective programs QM, ASIL_A and ASIL_C is calculated by the target value calculation process, which starts immediately after the activation of microcomputer 20. As described in Fig.As shown in Figure 4, the calculation of the determined value for a program whose functional safety level is high continues even during the execution of a program whose functional safety level is lower than that of the program.

[0065] Such a configuration can prevent the calculation time of the determined value from becoming 20 after the microcomputer has started, which would delay the start of the program, even if the calculation of the determined value for a program with a high functional safety level uses data from a program with a lower functional safety level than that of the program.

[0066] Although one embodiment of the present invention has been described above, the present invention is not limited to this embodiment, but can assume various modes without deviating from the scope of the present invention.

[0067] The described embodiment, for example, calculates the determination value for the validity check of a program in the flash memory 26 using data from the target program or the program in question and data from a program whose functional safety level is lower than that of the program in question or the target program.

[0068] Alternatively, the target value for each program stored in the flash memory 26 can be calculated using only data from one target program. This case can determine an expected value in the memory area for each program using only data from the target program.

[0069] The described embodiment assumes that a determination value for a validity check of a program is calculated in parallel for each program in the flash memory 26 in a determination value calculation process that is started immediately after the start of the microcomputer 20.

[0070] Alternatively, the determination values ​​for the programs in the flash memory 26 can be executed in a sequence starting with a program whose functional safety level is low, as with the validity checks.

[0071] This case can increase the time required to perform a validity check of a program with a high functional safety level after the microcomputer 20 has started, if a determination value is calculated by including data from the program with a low functional safety level. The determination value calculation for each program can also use only data from the target program.

[0072] The described embodiment includes the microcomputer 20 in the ECU 10, which is mounted in a vehicle and used to control vehicle instruments. The present invention can be used to control a different control target instead of a vehicle, and also to execute a predetermined calculation process for office work.

[0073] The present invention can achieve similar effects when applied to a microcomputer that can classify execution programs according to functional safety levels as in the embodiment.

[0074] While the present invention has been described with reference to its preferred embodiments, it is understood that the invention is not limited to these preferred embodiments and designs. The present invention covers various modifications and equivalent arrangements. While various combinations and configurations are preferred, further combinations and configurations, including more, fewer, or a single element, are also possible within the scope of the claims.

Claims

[1] Microcomputer which features: a memory (26) that stores a program in a protected state which activates a protection function that prevents the program from being executed; and an arithmetic processor (22) that performs a validity check on the program stored in memory to determine whether the program contains any anomalies, and the protection function is deactivated if the validation check determines that the program does not contain anomalies, and then the program is executed, whereby the memory stores several programs (QM, ASIL_A, ASIL_C) which are classified according to functional safety levels in the protection state that activates the protection function; and the arithmetic processor The validity check of the programs is performed program by program in sequence, starting with a program whose functional safety level is low (S120, S150, S180), and The protection function for a program is deactivated (S130, S160, S190) if the validation check determines that the program does not contain an anomaly, and then the program is executed (S140, S170, S200). [2] Microcomputer according to claim 1, wherein Each time the validation check determines that a program does not contain anomalies, the arithmetic processor disables the protection function for the program and then starts the program's execution; and The arithmetic processor performs a validity check for another program during the execution of the program. [3] Microcomputer according to claim 1 or 2, wherein the arithmetic processor performs a validity check for each of the programs by means of: Performing a predetermined arithmetic operation based on data in a memory area in the memory that stores a first program to be checked, and data in a memory area in the memory that stores a second program whose functional safety level is lower than that of the first program to be checked; and then Verifying an arithmetic result of the arithmetic operation against an expected value stored in memory. [4] Microcomputer according to any one of claims 1 to 3, wherein if, as a result of the validity check for a program, it is determined that the program has an anomaly, the arithmetic processor executes a predetermined failover process in a state (S210) in which the protection function for the program is kept activated.

Images