Controls

Abstract

The control device (100) comprises: a first operation unit (101) which performs safety control on a drive device (430); a second operation unit (102) which performs standard control on the drive device (430); and a storage unit (103) which can be accessed by either the first operation unit (101) or the second operation unit (102) and comprises a first storage area (1031) which stores data related to safety control and a second storage area (1032) which stores data related to standard control. The first operation unit (101) can access either the first storage area (1031) or the second storage area (1032), while the second operation unit (102) can access the second storage area (1032) and access to the first storage area (1031) is restricted.

Description

Technical Field

[0001] The present invention relates to a control device, and more particularly to a control device for controlling a driving device. Background Art

[0002] In recent years, in order to use equipment and machinery safely at various production sites, a control device having a calculation unit that performs safety control of a drive device in addition to a calculation unit that performs standard control of a drive device is known from the viewpoint of ensuring safety.

[0003] For example, in International Publication No. 2015 / 145562 (Patent Document 1), a controller is disclosed, which includes a drive CPU (Central Processing Unit) for performing drive control related to a drive device, and a safety CPU for performing safety control related to the drive device. In addition, Patent Document 1 also discloses that the drive CPU and the safety CPU can be implemented by a dual-core processor.

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: International Publication No. 2015 / 145562 Summary of the invention

[0007] Problems to be solved by the invention

[0008] If the drive CPU and the safety CPU can be implemented by a dual-core processor as in the controller disclosed in Patent Document 1, the space saving and cost reduction of the device can be achieved. However, when the computing unit for standard control and the computing unit for safety control coexist, research is required to ensure safety, especially from the perspective of protecting the data used for safety control, but no consideration is made in the controller described in Patent Document 1.

[0009] An object of the present invention is to solve the above-mentioned problems and to provide a control device capable of ensuring safety even when a computing unit that performs standard control and a computing unit that performs safety control coexist.

[0010] Means for solving problems

[0011] According to an example of the present disclosure, a control device for controlling a drive device is provided. The control device includes: a first operation unit that performs safety control on the drive device; a second operation unit that performs standard control on the drive device; and a storage unit that can be accessed by any one of the first operation unit and the second operation unit and includes a first storage area that stores data related to safety control and a second storage area that stores data related to standard control. The first operation unit can access any one of the first storage area and the second storage area, while the second operation unit can access the second storage area, and access to the first storage area is restricted.

[0012] According to the disclosure, even when the first operation unit that performs safety control and the second operation unit that performs standard control coexist, the second operation unit is restricted from accessing the first storage area that stores data related to safety control. Therefore, the safety control will not be affected by the second operation unit that performs standard control, and safety can be ensured.

[0013] In the above disclosure, the control device has a plurality of microcontroller units (MCUs). The first operation unit is a processor core that performs safety control, and the second operation unit is a processor core that performs standard control. The plurality of microcontroller units each include a processor core that performs safety control, and at least any one of the plurality of microcontroller units includes a processor core that performs standard control.

[0014] According to the present disclosure, by making a processor core that executes safety control and a processor core that executes standard control coexist in a single microcontroller unit, it is possible to achieve space saving and cost reduction of the device.

[0015] In the above disclosure, mutual monitoring is performed between the processor cores executing safety control included in each of the plurality of microcontroller units.

[0016] According to this disclosure, further safety can be ensured by performing mutual monitoring among a plurality of processor cores that execute safety control.

[0017] In the above disclosure, the control device has a microcontroller unit (MCU). The first operation unit is a processor core that performs safety control, and the second operation unit is a processor core that performs standard control. The microcontroller unit includes a plurality of processor cores that perform safety control and includes at least one processor core that performs standard control.

[0018] According to the present disclosure, by making a processor core that executes safety control and a processor core that executes standard control coexist in a single microcontroller unit, it is possible to achieve space saving and cost reduction of the device.

[0019] In the above disclosure, the control device has a data table that specifies permission and prohibition of access to storage addresses of the storage unit. Based on the data table, the first operation unit can access the storage addresses of any one of the first storage area and the second storage area, while the second operation unit can access the storage addresses of the second storage area, while access to the storage addresses of the first storage area is restricted.

[0020] According to the present disclosure, access by the second computing unit to the first storage area storing data related to safety control can be restricted based on the data table defining permission and prohibition of access to the storage address of the storage unit.

[0021] In the above disclosure, the first operation unit can access either the first storage area or the second storage area based on a predetermined command, while the second operation unit can access the second storage area based on a predetermined command, and access to the first storage area is restricted.

[0022] According to this disclosure, when the second operation unit accesses based on a predetermined command, unlike when the first operation unit accesses based on a predetermined command, access by the second operation unit to the first storage area storing data related to safety control can be restricted.

[0023] In the above disclosure, as modes for defining permission and prohibition of access to the storage unit, a first mode and a second mode in which access is restricted compared to the first mode are provided. Regardless of the first mode or the second mode, access by the second computing unit to the first storage area is restricted.

[0024] According to this disclosure, whether the mode for defining permission and prohibition of access to the storage unit is the first mode or the second mode in which access is restricted compared to the first mode, access to the first storage area storing data related to security control can be restricted.

[0025] In the above disclosure, the first operation unit is a processor core that performs safety control, and the second operation unit is a processor core that performs standard control. As a coprocessor that assists a processor including a processor core that performs standard control and a processor core that performs safety control, the control device further includes a monitoring processor that monitors access of the processor to the first storage area and the second storage area. The second operation unit is restricted from accessing the first storage area by the monitoring processor.

[0026] According to this disclosure, by monitoring access to the first storage area and the second storage area by a processor including the first and second operation units, access by the second operation unit to the first storage area storing data related to safety control can be restricted. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic diagram showing an application example of the control device of the present embodiment.

[0028] Figure 2 It is a schematic diagram showing a hardware configuration example of the control device according to the first embodiment.

[0029] Figure 3 This is a schematic diagram for explaining a first example of the access restriction method in the control device according to the first embodiment.

[0030] Figure 4 This is a schematic diagram for explaining a first example of the access restriction method in the control device according to the first embodiment.

[0031] Figure 5 This is a schematic diagram for explaining a second example of the access restriction method in the control device according to the first embodiment.

[0032] Figure 6 This is a schematic diagram for explaining a second example of the access restriction method in the control device according to the first embodiment.

[0033] Figure 7 This is a schematic diagram for explaining a third example of the access restriction method in the control device according to the first embodiment.

[0034] Figure 8 It is a schematic diagram showing a hardware configuration example of a control device according to the second embodiment.

[0035] Fig. 9 This is a schematic diagram for explaining a first example of the access restriction method in the control device according to the second embodiment.

[0036] Fig.10 This is a schematic diagram for explaining a second example of the access restriction method in the control device according to the second embodiment.

[0037] Fig.11 This is a schematic diagram for explaining a third example of the access restriction method in the control device according to the second embodiment. DETAILED DESCRIPTION

[0038] The embodiments of the present invention will be described in detail with reference to the accompanying drawings. In addition, the same or corresponding parts in the drawings are denoted by the same reference numerals and their description will not be repeated.

[0039] [A. Application examples]

[0040] An example of a scenario in which the present invention is applied will be described.

[0041] Figure 1Schematic diagram showing an application example of the control device 100 of the present embodiment. The control system 1 of the present embodiment provides a safety function specified in, for example, IEC 61508. The control system 1 mainly includes the control device 100, a safety device 300, and a drive device 430.

[0042] The control device 100 is typically composed of a programmable logic controller (PLC) or the like, executes a predetermined user program on input data obtained from the control object, and gives instructions to the control object based on output data calculated by executing the user program. Figure 1 In the illustrated example, the controlled objects include a driving device 430 and a driver 420 that drives the driving device 430 .

[0043] For example, when a predetermined driving condition is satisfied, the control device 100 outputs a standard instruction for controlling the drive device 430 to the driver 420, thereby driving or stopping the drive device 430. In addition, the control device 100 controls the position, speed, etc. of the drive device 430 based on a feedback signal from the drive device 430. In addition, the drive device 430 is assumed to be a servo motor driven by the driver 420, but is not limited to a servo motor, and may also be other types of drive devices. In this embodiment, such control of the drive device 430 and the driver 420 by the control device 100 is also referred to as "standard control".

[0044] The control device 100 performs control for ensuring the safety of the operator in the control system 1 in addition to the above-mentioned standard control.

[0045] For example, when the control device 100 receives a safety input from the safety device 300 (an emergency stop switch, a safety door switch, a safety light curtain, etc.), it outputs a safety instruction to the safety relay 410. The safety relay 410 is arranged on the power supply line for the driver 420, and performs control for cutting off the power supply based on the safety instruction from the control device 100. As a result, the power supply to the driver 420 is cut off, so that the drive device 430 stops. Such control of the drive device 430 and the driver 420 by the control device 100 via the safety relay 410 is also referred to as "safety control". In addition, as a safety control, the control device 100 can also control the position, speed, etc. of the drive device 430 by adjusting the power to the drive device 430.

[0046] The support device 500 communicably connected to the control device 100 provides the control device 100 with user programs respectively related to the standard control and the safety control to be executed by the control device 100 .

[0047] The control device 100 includes a first operation unit 101 for executing the above-mentioned safety control on the drive device 430, and a second operation unit 102 for executing the above-mentioned standard control on the drive device 430. The control device 100 further includes a storage unit 103, which can be accessed by any one of the first operation unit 101 and the second operation unit 102, and includes: a first storage area 1031 for storing data related to the safety control; and a second storage area 1032 for storing data related to the standard control.

[0048] The "first operation unit" and the "second operation unit" may be processor cores included in a specified processor, or may be the processor or the CPU itself. In addition, the "first operation unit" and the "second operation unit" may be processor cores both included in a single processor, or may be processor cores included in a plurality of processors.

[0049] In this specification, the terms "standard control" and "safety control" are used in contrast. "Standard control" is a general term for processing for controlling a control object such as the drive device 430 according to a predetermined required specification. On the other hand, "safety control" is a general term for processing for preventing equipment or machinery in the control system 1 from threatening human safety. "Safety control" is designed to meet the requirements for realizing safety functions specified in IEC 61508 and the like.

[0050] In the control device 100 configured in this manner, the first operation unit 101 can access either the first storage area 1031 storing data related to safety control or the second storage area 1032 storing data related to standard control, and executes safety control by accessing these storage areas.

[0051] Here, as described above, safety control is specified in IEC 61508 and the like, and programs and data related to safety control are pre-designed on the manufacturer side of the control device 100. Therefore, if the second operation unit 102 accesses the first storage area 1031 based on the program or data of the standard control, safety may not be ensured. Therefore, in the control device 100 of the present embodiment, the second operation unit 102 can access the second storage area 1032 storing data related to the standard control, while access to the first storage area 1031 storing data related to safety control is restricted. For example, in the control device 100, when the access destination of the second operation unit 102 is the first storage area 1031, the access of the second operation unit 102 to the first storage area 1031 is restricted by performing exception processing.

[0052] Therefore, even when the first operation unit 101 that performs safety control and the second operation unit 102 that performs standard control coexist, the access of the second operation unit 102 to the first storage area 1031 that stores data related to safety control is restricted. Therefore, the second operation unit 102 that performs standard control will not affect the data related to safety control stored in the first storage area 1031, thereby ensuring safety.

[0053] [B. First embodiment]

[0054] The control device 100 according to the first embodiment will be described.

[0055] <a1. Example of hardware configuration of control device>

[0056] Figure 2 1 is a schematic diagram showing an example of the hardware configuration of the control device 100 according to the first embodiment. Figure 2 As shown, the control device 100 has a plurality of microcontroller units (MCU) and a plurality of RAMs (Random Access Memory) corresponding to the plurality of MCUs. In the present embodiment, the control device 100 has MCU 110 and MCU 120, RAM 115 corresponding to MCU 110, and RAM 125 corresponding to MCU 120. In addition, the number of MCUs and RAMs is not limited to two, and three or more may be provided.

[0057] The control device 100 also includes a storage 130, a USB controller 140, a memory card interface 150, and a local bus interface 160. These components are connected to processor buses 1051 and 1052 via a bridge 1053. The MCU 110 is connected to the processor bus 1051, and the MCU 120 is connected to the processor bus 1052.

[0058] The storage 130 stores various programs and data, such as a safety program 132 related to safety control created by a user according to a required safety function and a standard program 134 related to standard control created by a user according to a control target.

[0059] The USB controller 140 exchanges data with the support device 500 and the like via a USB connection.

[0060] The memory card interface 150 is configured to write data to a received memory card and read various data (log, trace data, etc.) from the memory card.

[0061] The local bus interface 160 exchanges data with any device such as the safety relay 410 , the driver 420 , and the safety device 300 connected to the control device 100 via the local bus.

[0062] The MCU 110 includes a processor 116 , a secure ROM (Read Only Memory) 112 , and a standard ROM 114 .

[0063] The processor 116 is a multi-core processor including a safety core 1162 and a standard core 1164. The safety core 1162 is an example of a "first operation unit" and performs control operations related to safety control. The standard core 1164 is an example of a "second operation unit" and performs control operations related to standard control. In this way, by making the safety core 1162 related to safety control and the standard core 1164 related to standard control coexist in a single processor 116, it is possible to achieve space saving and cost reduction of the device.

[0064] The safety ROM 112 stores a safety system program 1122 for realizing basic functions related to safety control, and is connected to the safety core 1162 .

[0065] The standard ROM 114 stores a standard system program 1142 for realizing basic functions related to standard control, and is connected to the standard core 1164 .

[0066] The MCU 120 includes a processor 126 , a secure ROM 122 , and a standard ROM 124 .

[0067] The processor 126 is a multi-core processor including a safety core 1262 and a standard core 1264. The safety core 1262 is an example of a "first operation unit" and performs control operations related to safety control. The standard core 1264 is an example of a "second operation unit" and performs control operations related to standard control.

[0068] In this way, by making the safety core 1262 related to safety control and the standard core 1264 related to standard control coexist in a single processor 126, the device can be space-saving and cost-reduced compared to including the safety core and the standard core in different processors.

[0069] The safety ROM 122 stores a safety system program 1222 for realizing basic functions related to safety control, and is connected to the safety core 1262 .

[0070] The standard ROM 124 stores a standard system program 1242 for realizing basic functions related to standard control, and is connected to a standard core 1264 .

[0071] The control device 100 is configured so that the operations and states of the processors 116 and 126 are mutually monitored by cross communication. Thus, even if an abnormality occurs in either the processor 116 or the processor 126, the abnormality is detected.

[0072] For example, the processor 116 and the processor 126 execute programs in parallel. In addition, the processor 116 and the processor 126 each have a watchdog timer (not shown). The processor 116 periodically resets its own watchdog timer, and the processor 126 also periodically resets its own watchdog timer. The processor 116 monitors whether the watchdog timer is reset periodically through the processor 126, and the processor 126 monitors whether the watchdog timer is reset periodically through the processor 116, so that the processors monitor each other for abnormalities.

[0073] For example, when the processors 116 and 126 are executing programs in parallel, they mutually confirm the calculation results of the control operations related to the execution of the programs, thereby monitoring each other for abnormalities. That is, when a certain abnormality occurs in one processor and the calculation result of the control operation is incorrect, it will become inconsistent with the calculation result of the control operation in the other processor, so the other processor can detect that the abnormality has occurred in one processor by detecting the inconsistency of the calculation results.

[0074] In this way, by performing mutual monitoring between multiple safety cores 1162 and safety cores 1262 that perform safety control, greater safety can be ensured.

[0075] The control device 100 performs processing such as cutting off the power supply to the processor in which the abnormality occurs, thereby preventing the execution of safety control in the abnormal state. In this way, the multiple processors 116 and 126 set independently can detect the occurrence of abnormalities by monitoring the actions and states of each other. In particular, the safety cores 1162 and 1262 perform safety control for ensuring safety, so the safety level can be further improved by monitoring each other.

[0076] RAM 115 is an example of a "storage unit". The storage area of ​​RAM 115 includes a secure storage area 1152 and a standard storage area 1154. The secure storage area 1152 is an example of a "first storage area" and stores data for executing security control. The standard storage area 1154 is an example of a "second storage area" and stores data for executing standard control.

[0077] The safety core 1162 of the processor 116 reads the safety system program 1122 stored in the safety ROM 112 and executes it in the storage area in the RAM 115, thereby realizing safety control. Similarly, the standard core 1164 of the processor 116 reads the standard system program 1142 stored in the standard ROM 114 and executes it in the storage area in the RAM 115, thereby realizing standard control.

[0078] In this way, the secure core 1162 and the standard core 1164 of the processor 116 execute the secure control or the standard control by accessing the RAM 115, but the access from the secure core 1162 to the standard storage area 1154 is permitted, and on the other hand, the access from the standard core 1164 to the secure storage area 1152 is restricted from the viewpoint of ensuring security. For example, in the control device 100, when the access destination of the standard core 1164 is the secure storage area 1152, the access of the standard core 1164 to the secure storage area 1152 is restricted by performing exception processing.

[0079] This prevents the data related to security control stored in the secure storage area 1152 from being abnormal due to access by the standard core 1164, thereby ensuring security.

[0080] RAM 125 is an example of a "storage unit". The storage area of ​​RAM 125 includes a secure storage area 1252 and a standard storage area 1254. The secure storage area 1252 is an example of a "first storage area" and stores data for executing security control. The standard storage area 1254 is an example of a "second storage area" and stores data for executing standard control.

[0081] The safety core 1262 of the processor 126 reads the safety system program 1222 stored in the safety ROM 122 and executes it in the storage area in the RAM 125, thereby realizing safety control. Similarly, the standard core 1264 of the processor 126 reads the standard system program 1242 stored in the standard ROM 124 and executes it in the storage area in the RAM 125, thereby realizing standard control.

[0082] In this way, the secure core 1262 and the standard core 1264 of the processor 126 execute the secure control or the standard control by accessing the RAM 125, but the access from the secure core 1262 to the standard storage area 1254 is permitted, and on the other hand, the access from the standard core 1264 to the secure storage area 1252 is restricted from the viewpoint of ensuring security. For example, in the control device 100, when the access destination of the standard core 1264 is the secure storage area 1252, the access of the standard core 1264 to the secure storage area 1252 is restricted by performing exception processing.

[0083] This prevents the data related to security control stored in the secure storage area 1252 from being abnormal due to access by the standard core 1264, thereby ensuring security.

[0084] <b1. First example of access restriction method in control device>

[0085] Figure 3 and Figure 4 is a schematic diagram for explaining a first example of an access restriction method in the control device 100a of the first embodiment. Figure 3 In the hardware configuration example of the control device 100a shown in FIG. Figure 2 The same components and functions as those in the hardware configuration example of the control device 100 shown are denoted by the same reference numerals, and description thereof will be omitted.

[0086] like Figure 3 As shown, the MCU 110a of the control device 100a includes an MMU (Memory Management Unit) 117 connected to the processor 116. The MMU 117 has a memory protection function to prevent the cores in the processor 116 from accessing the storage area not allocated to themselves. Specifically, in the MMU 117, Figure 4 The conversion table 600 shown is set at startup, and the control device 100 a uses the conversion table 600 to restrict access to the secure storage area 1152 by the standard core 1164 .

[0087] For example, the standard ROM 114 includes restriction data 1144 for restricting access of the standard core 1164 to the secure storage area 1152. When the MCU 110a is activated, the restriction data 1144 is set in the MMU 117, thereby constructing a conversion table 600 corresponding to the standard core 1164. Although not shown in the figure, data for constructing the conversion table 600 is also stored in the secure ROM 112, and when the MCU 110a is activated, the data is set in the MMU 117, thereby constructing a conversion table 600 corresponding to the secure core 1162.

[0088] The conversion table 600 is an example of a "data table". Figure 4 As shown, it includes attribute information for determining which type it is, the secure core 1162 or the standard core 1164 , and a virtual address converted into a physical address of the RAM 115 .

[0089] For example, the physical address of the RAM 115 is divided into a physical address range 1 for the system (e.g., 0000 to 3FFF), a physical address range 2 for security control (e.g., 4000 to 4FFF), a physical address range 3 for standard control (e.g., 5000 to 5FFF), a physical address range 4 for security control (e.g., 6000 to 6FFF), and a physical address range 5 for standard control (e.g., 7000 to 7FFF). The physical address range 2 and the physical address range 4 for security control are address ranges corresponding to the secure storage area 1152. The physical address range 3 and the physical address range 5 for standard control are address ranges corresponding to the standard storage area 1154.

[0090] The virtual addresses of the conversion table 600 are divided into virtual address range 1 for security control (e.g., 0000 to 0FFF), virtual address range 2 for standard control (e.g., 1000 to 1FFF), virtual address range 3 for security control (e.g., 2000 to 2FFF), and virtual address range 4 for standard control (e.g., 3000 to 3FFF), in addition to the address range of the system part. Virtual address range 1 can be converted into physical address range 2, virtual address range 2 can be converted into physical address range 3, virtual address range 3 can be converted into physical address range 4, and virtual address range 4 can be converted into physical address range 5.

[0091] The secure core 1162 and the standard core 1164 can access the physical address of the RAM 115 by accessing the virtual address allocated to the translation table 600 .

[0092] Here, the virtual address sets access permission or prohibition for the security core 1162 and the standard core 1164. For example, the security core 1162 is allowed to access not only the virtual address range 1 and virtual address range 3 for security control, but also the virtual address range 2 for standard control. On the other hand, the standard core 1164 is allowed to access the virtual address range 2 and virtual address range 4 for standard control, but is prohibited (restricted) from accessing the virtual address range 1 and virtual address range 3 for security control.

[0093] In this way, in the conversion table 600 set by the MMU 117, the access of the standard core 1164 to the virtual address range 1 and the virtual address range 3 for security control is restricted, and therefore, the access of the standard core 1164 to the physical address range 2 and the physical address range 4 (i.e., the secure storage area 1152) for security control in the RAM 115 corresponding to the virtual address range 1 and the virtual address range 3 is also restricted. Thus, based on the conversion table 600 that specifies permission and prohibition of access to the physical address of the RAM 115, it is possible to restrict the access of the standard core 1164 to the secure storage area 1152 storing data related to security control.

[0094] Similarly, the MCU 120a of the control device 100a includes an MMU 127 connected to the processor 126. The MMU 127 has a memory protection function similar to the MMU 117, and prevents the cores in the processor 126 from accessing the memory area not allocated to themselves. Specifically, in the MMU 127, similar to the MMU 117, the MMU 127 is set at startup. Figure 4 The control device 100a uses the conversion table 600 to restrict the access of the standard core 1264 to the secure memory area 1252. The conversion table 600 of the MMU 127 has the same structure and function as the conversion table 600 of the MMU 117, and therefore the description thereof is omitted.

[0095] In this way, in the conversion table 600 set by the MMU 127, the access of the standard core 1264 to the virtual address range 1 and the virtual address range 3 for security control is restricted, and therefore, the access of the standard core 1264 to the physical address range 2 and the physical address range 4 (i.e., the secure storage area 1252) for security control in the RAM 125 corresponding to the virtual address range 1 and the virtual address range 3 is restricted. Thus, based on the conversion table 600 that specifies permission and prohibition of access to the physical address of the RAM 125, it is possible to restrict the access of the standard core 1264 to the secure storage area 1252 storing data related to security control.

[0096] In addition, Figure 3 and Figure 4 In the first example of the access restriction method shown, a common conversion table 600 is used in the secure core and the standard core to set access permission or prohibition based on attribute information, but a conversion table 600 for the secure core and a conversion table 600 for the standard core may also be provided.

[0097] In addition, Figure 3 and Figure 4 In the first example of the access restriction method shown, MMU is used, but MPU (Memory Protection Unit) having a memory protection function like MMU can also be used. In addition, in MPU, no conversion from virtual address to physical address is performed, so according to each address range corresponding to the physical address, access permission or prohibition can be set for the security core and the standard core respectively.

[0098] <c1. Second example of access restriction method in control device>

[0099] Figure 5 and Figure 6 is a schematic diagram for explaining a second example of the access restriction method in the control device 100b of the first embodiment. Figure 5 In the hardware configuration example of the control device 100b shown in FIG. Figure 2 The same reference numerals are used for the same components and functions as those in the hardware configuration example of the control device 100 shown in the figure, and their descriptions are omitted. Figure 6 In the figure, RAM is illustrated as an example of a "storage unit", but the "storage unit" is not limited to volatile memories such as RAM, and non-volatile memories such as ROM may also be applied. In addition, any storage medium may be applied as long as it includes a storage area for storing data related to safety control or data related to standard control.

[0100] like Figure 5 and Figure 6 As shown, the MCU 110 b of the control device 100 b restricts the access of the standard core 1164 to the secure storage area 1152 .

[0101] Specifically, if Figure 6 As shown, as a mode indicating the state of the processor 116, a privileged mode and a user mode are respectively provided for the secure core 1162 and the standard core 1164. In addition, in the access setting to the RAM 115, the privileged mode and the user mode are also specified in the secure storage area 1152 and the standard storage area 1154, respectively. The privileged mode is an example of the "first mode", and the user mode is an example of the "second mode".

[0102] When the user mode is set for the security core 1162 and the standard core 1164, respectively, access to the storage area designated as the privileged mode is prohibited when the specified instructions in the applications 1162p and 1164p are executed. That is, when the user mode is set, the access is further restricted compared to when the privileged mode is set.

[0103] For example, when the security core 1162 is set to user mode, when the specified command in the application 1162p is executed, access is allowed to the storage area designated as user mode in each of the secure storage area 1152 and the standard storage area 1154, whereas access is prohibited to the storage area designated as privileged mode in each of the secure storage area 1152 and the standard storage area 1154.

[0104] In addition, for example, when the standard core 1164 is set to user mode, when a specified instruction in the application 1164p is executed, access to the storage area designated as user mode in the standard storage area 1154 is allowed, whereas access to the storage area designated as privileged mode in the standard storage area 1154 is prohibited.

[0105] Here, it should be noted that, regardless of whether the privileged mode or the user mode is set, the standard core 1164 is restricted from accessing the storage area designated as either the privileged mode or the user mode in the secure storage area 1152. For example, when the access destination of the standard core 1164 is the secure storage area 1152, the access of the standard core 1164 to the secure storage area 1152 is restricted by performing exception processing.

[0106] That is, when the security core 1162 accesses the RAM 115 based on the specified command in the application 1162p, as shown in FIG. Figure 6 As shown, any one of the secure storage area 1152 and the standard storage area 1154 can be accessed. On the other hand, when the standard core 1164 accesses the RAM 115 based on the same prescribed command in the application 1164p, as shown in FIG. Figure 6 As shown, the standard storage area 1154 can be accessed, while access to the secure storage area 1152 is restricted.

[0107] In this way, unlike the case where the security core 1162 accesses based on a prescribed command, when the standard core 1164 accesses based on the same prescribed command, it is possible to limit the standard core 1164's access to the secure storage area 1152 that stores data related to security control.

[0108] In addition, regardless of whether the mode that specifies permission and prohibition of access to the storage area of ​​RAM 115 is the privileged mode or the user mode in which access is further restricted compared to the privileged mode, the standard core 1164 can be restricted from accessing the secure storage area 1152 that stores data related to security control.

[0109] Likewise, if Figure 5 and Figure 6 As shown, the MCU 120b of the control device 100b restricts the access of the standard core 1264 to the secure storage area 1252. In addition, Figure 6 The mode indicating the state of the processor 126 and the access setting to the RAM 125 shown are the same as the mode indicating the state of the processor 116 and the access setting to the RAM 115 described above, and therefore description thereof will be omitted.

[0110] In the case where the security core 1262 accesses the RAM 125 based on the specified command in the application 1262p, as shown in FIG. Figure 6 As shown, any one of the secure storage area 1252 and the standard storage area 1254 can be accessed. On the other hand, when the standard core 1264 accesses the RAM 125 based on the same prescribed command in the application 1264p, as shown in FIG. Figure 6As shown, the standard memory area 1254 can be accessed, but access to the secure memory area 1252 is restricted. For example, when the access destination of the standard core 1264 is the secure memory area 1252, the access of the standard core 1264 to the secure memory area 1252 is restricted by performing exception processing.

[0111] In this way, unlike the case where the security core 1262 accesses based on a prescribed command, when the standard core 1264 accesses based on the same prescribed command, it is possible to limit the standard core 1264's access to the secure storage area 1252 that stores data related to security control.

[0112] In addition, regardless of whether the mode that specifies permission and prohibition of access to the storage area of ​​RAM 125 is the privileged mode or the user mode in which access is further restricted compared to the privileged mode, the standard core 1264 can be restricted from accessing the secure storage area 1252 that stores data related to security control.

[0113] <d1. Third example of access restriction method in control device>

[0114] Figure 7 is a schematic diagram for explaining a third example of the access restriction method in the control device 100c of the first embodiment. Figure 7 In the hardware configuration example of the control device 100c shown in FIG. Figure 2 The same components and functions as those in the hardware configuration example of the control device 100 shown are denoted by the same reference numerals, and description thereof will be omitted.

[0115] like Figure 7 As shown, the MCU 110c of the control device 100c includes a monitoring processor 119 connected to the processor 116. The monitoring processor 119 is a coprocessor that assists the processor 116 and is composed of an FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), etc. The monitoring processor 119 monitors access to the storage area of ​​the RAM 115 for each of the security core 1162 and the standard core 1164 included in the processor 116. In addition, the monitoring processor 119 is not limited to being included in the MCU 110c, and the processor 116 of the MCU 110c can also be monitored from the outside of the MCU 110c.

[0116] Specifically, the monitoring processor 119 allows the secure core 1162 to access the secure storage area 1152, allows the secure core 1162 to access the standard storage area 1154, allows the standard core 1164 to access the standard storage area 1154, and prohibits the standard core 1164 from accessing the secure storage area 1152. For example, when the monitoring processor 119 detects that the access destination of the standard core 1164 is the secure storage area 1152, the access of the standard core 1164 to the secure storage area 1152 is restricted by performing exception processing.

[0117] Thus, the monitoring processor 119 that monitors the access of the processor 116 to the secure memory area 1152 and the standard memory area 1154 can limit the access of the standard core 1164 to the secure memory area 1152 .

[0118] Likewise, if Figure 7 As shown, the MCU 120c of the control device 100c includes a monitoring processor 129 connected to the processor 126. The monitoring processor 129 is a coprocessor that assists the processor 126 and is composed of an FPGA, an ASIC, etc. The monitoring processor 129 monitors access to the storage area of ​​the RAM 125 for each of the security core 1262 and the standard core 1264 included in the processor 126. In addition, the monitoring processor 129 is not limited to being included in the MCU 120c, and the processor 126 of the MCU 120c can also be monitored from the outside of the MCU 120c.

[0119] Specifically, the monitoring processor 129 allows the secure core 1262 to access the secure storage area 1252, allows the secure core 1262 to access the standard storage area 1254, allows the standard core 1264 to access the standard storage area 1254, and prohibits the standard core 1264 from accessing the secure storage area 1252. For example, when the monitoring processor 129 detects that the access destination of the standard core 1264 is the secure storage area 1252, the access of the standard core 1264 to the secure storage area 1252 is restricted by performing exception processing.

[0120] Thus, the monitoring processor 129 that monitors the access of the processor 126 to the secure memory area 1252 and the standard memory area 1254 can restrict the access of the standard core 1264 to the secure memory area 1252 .

[0121] [C. Second embodiment]

[0122] A control device 200 according to the second embodiment will be described.

[0123] <a2. Example of hardware configuration of control device>

[0124] Figure 8 It is a schematic diagram showing a hardware configuration example of a control device 200 according to the second embodiment. Figure 2 The control device 100 of the first embodiment shown in FIG. 1 includes a safety core in each of the plurality of MCUs and at least one of the plurality of MCUs includes a standard core. Figure 8 The control device 200 of the second embodiment shown is different from the control device 200 in that a single MCU includes a plurality of safety cores and at least one standard core.

[0125] Specifically, if Figure 8 As shown, the control device 200 includes one MCU 210 and a RAM 215 corresponding to the MCU 210. In addition, the MCU and the RAM are not limited to one, and two or more may be provided.

[0126] In addition, the control device 200 includes a storage 230 , a USB controller 240 , a memory card interface 250 , and a local bus interface 260 . These components are connected via a processor bus 205 .

[0127] The storage 230, the USB controller 240, the memory card interface 250, and the local bus interface 260 each have Figure 2 The storage 130, USB controller 140, memory card interface 150, and local bus interface 160 shown in the figure have the same structure. In addition, the storage 230 stores various programs or data such as a safety program 232 related to safety control created by the user according to the required safety function and a standard program 234 related to standard control created by the user according to the control object.

[0128] MCU 210 includes a processor 216 , a secure ROM 212 , a secure ROM 214 , a standard ROM 222 , and a standard ROM 224 .

[0129] The processor 216 is a multi-core processor, including a safety core 2162, a safety core 2164, a standard core 2262, and a standard core 2264. The safety core 2162 and the safety core 2164 are each an example of a "first operation unit" and perform control operations related to safety control. The standard core 2262 and the standard core 2264 are each an example of a "second operation unit" and perform control operations related to standard control.

[0130] In this way, by allowing the safety core 2164 and safety core 2162 related to safety control and the standard core 2262 and standard core 2264 related to standard control to coexist in a single processor 216, the device can be space-saving and cost-effective compared to including the safety core and the standard core in different processors.

[0131] The safety ROM 212 stores a safety system program 2122 for realizing basic functions related to safety control, and is connected to the safety core 2162 .

[0132] The safety ROM 214 stores a safety system program 2142 for realizing basic functions related to safety control, and is connected to the safety core 2164 .

[0133] The standard ROM 222 stores a standard system program 2222 for realizing basic functions related to standard control, and is connected to the standard core 2262 .

[0134] The standard ROM 224 stores a standard system program 2242 for realizing basic functions related to standard control, and is connected to the standard core 2264 .

[0135] RAM 215 is an example of a "storage unit". The storage area of ​​RAM 215 includes a secure storage area 2152 and a standard storage area 2252. The secure storage area 2152 is an example of a "first storage area" and stores data for executing security control. The standard storage area 2252 is an example of a "second storage area" and stores data for executing standard control.

[0136] The safety core 2162 reads the safety system program 2122 stored in the safety ROM 212 and executes it in the storage area in the RAM 215, thereby realizing safety control. The safety core 2164 reads the safety system program 2142 stored in the safety ROM 214 and executes it in the storage area in the RAM 215, thereby realizing safety control. Similarly, the standard core 2262 reads the standard system program 2222 stored in the standard ROM 222 and executes it in the storage area in the RAM 215, thereby realizing standard control. The standard core 2264 reads the standard system program 2242 stored in the standard ROM 224 and executes it in the storage area in the RAM 215, thereby realizing standard control.

[0137] In this way, the secure cores 2162, 2164 and the standard cores 2262, 2264 of the processor 216 execute the secure control and the standard control by accessing the RAM 215, but the secure cores 2162, 2164 are allowed to access the standard storage area 2252, while the standard cores 2262, 2264 are restricted from accessing the secure storage area 2152 from the viewpoint of ensuring security. For example, in the control device 200, when the access destination of the standard cores 2262, 2264 is the secure storage area 2152, the access of the standard cores 2262, 2264 to the secure storage area 2152 is restricted by performing exception processing.

[0138] This prevents the data related to security control stored in the secure storage area 2152 from being abnormal due to access by the standard cores 2262 and 2264, thereby ensuring security.

[0139] <b2. First example of access restriction method in control device>

[0140] Fig. 9 is a schematic diagram for explaining a first example of an access restriction method in the control device 200a of the second embodiment. Fig. 9 In the hardware configuration example of the control device 200a shown in FIG. Figure 8 The same components and functions as those in the hardware configuration example of the control device 200 shown in the figure are assigned the same reference numerals, and their descriptions are omitted. Fig. 9 In the first example of the access restriction method in the control device 200a of the second embodiment shown in FIG. Figure 3 as well as Figure 4 Description of the same configuration and functional parts as the first example of the access restriction method in the control device 100a of the first embodiment will be omitted.

[0141] like Fig. 9 As shown, the MCU 210a of the control device 200a includes MMUs 2172, 2174, 2272, and 2274 connected to the processor 216. The MMU 2172 is connected to the security core 2162, the MMU 2174 is connected to the security core 2164, the MMU 2272 is connected to the standard core 2262, and the MMU 2274 is connected to the standard core 2264. Figure 3 The MMU 117 and MMU 127 shown also have a memory protection function to prevent the cores in the processor 216 from accessing the storage area not allocated to themselves. Specifically, in MMU 2272 and 2274, Figure 4 The conversion table 600 shown is set at startup, and the control device 200 a uses the conversion table 600 to restrict access to the secure storage area 2152 by the standard core 2264 .

[0142] In this way, in the conversion table 600 set by the MMU 2272, 2274, the access of the standard cores 2262, 2264 to the virtual address range for security control is restricted, and as a result, the access of the standard cores 2262, 2264 to the physical address range for security control in the RAM 215 corresponding to the virtual address range (i.e., the secure storage area 2152) is restricted. Thus, based on the conversion table 600 that specifies permission and prohibition of access to the physical address of the RAM 215, it is possible to restrict the access of the standard cores 2262, 2264 to the secure storage area 2152 storing data related to security control.

[0143] <c2. Second example of access restriction method in control device>

[0144] Fig.10 is a schematic diagram for explaining a second example of the access restriction method in the control device 200b of the second embodiment. Fig.10 In the hardware configuration example of the control device 200b shown in FIG. Figure 8 The same components and functions as those in the hardware configuration example of the control device 200 shown in the figure are assigned the same reference numerals, and their descriptions are omitted. Fig.10 In the second example of the access restriction method in the control device 200b of the second embodiment shown in FIG. Figure 5 as well as Figure 6 The same configuration and function as the second example of the access restriction method in the control device 100b of the first embodiment shown in FIG. 1 are omitted from the description. Fig.10 In the example shown, Figure 6 Similarly, in the example shown, RAM is illustrated as an example of a "storage unit", but the "storage unit" is not limited to volatile memories such as RAM, and non-volatile memories such as ROM may also be applied. In addition, any storage medium may be applied as long as it includes a storage area for storing data related to safety control or data related to standard control.

[0145] like Fig.10 As shown, the MCU 210 b of the control device 200 b restricts the access of the standard cores 2262 , 2264 to the secure storage area 2152 .

[0146] Specifically, in the control device 200b, if Figure 6As shown, as a mode indicating the state of the processor 216, a privileged mode and a user mode are respectively set for the secure cores 2162 and 2164 and the standard cores 2262 and 2264. In addition, in the access setting to the RAM 215, the privileged mode and the user mode are also specified in the secure storage area 2152 and the standard storage area 2252, respectively. The privileged mode is an example of the "first mode", and the user mode is an example of the "second mode".

[0147] For each of the secure cores 2162, 2164 and the standard cores 2262, 2264, when the user mode is set, when the specified command in the application 2162p, 2164p, 2262p, 2264p is executed, access to the storage area designated as the privileged mode is prohibited. That is, when the user mode is set, the access is further restricted compared to when the privileged mode is set.

[0148] In addition, when the security cores 2162 and 2164 access the RAM 215 based on the specified commands in the applications 2162p and 2164p, as shown in FIG. Figure 6 As shown, any one of the secure storage area 2152 and the standard storage area 2252 can be accessed. On the other hand, when the standard cores 2262 and 2264 access the RAM 215 according to the same prescribed command in the applications 2262p and 2264p, as shown in FIG. Figure 6 As shown, the standard storage area 2252 can be accessed, while access to the secure storage area 2152 is restricted.

[0149] In this way, unlike the case where the security cores 2162 and 2164 access based on prescribed commands, when the standard cores 2262 and 2264 access based on the same prescribed commands, the access of the standard cores 2262 and 2264 to the secure storage area 2152 storing data related to security control can be restricted.

[0150] In addition, regardless of whether the mode that specifies permission and prohibition of access to the storage area of ​​RAM 215 is the privileged mode or the user mode in which access is further restricted compared to the privileged mode, it is possible to restrict the access of the standard cores 2262 and 2264 to the secure storage area 2152 that stores data related to security control.

[0151] <d2. Third example of access restriction method in control device>

[0152] Fig.11 2 is a schematic diagram for explaining a third example of the access restriction method in the control device 200c of the second embodiment. Fig.11 In the hardware configuration example of the control device 200c shown in FIG. Figure 8The same components and functions as those in the hardware configuration example of the control device 200 shown in the figure are assigned the same reference numerals, and their descriptions are omitted. Fig.11 In the third example of the access restriction method in the control device 200c of the second embodiment shown in FIG. Figure 7 The description of the same configuration and function as the third example of the access restriction method in the control device 100 c of the first embodiment will be omitted.

[0153] like Fig.11 As shown, the MCU 210c of the control device 200c includes a monitoring processor 219 connected to the processor 216. The monitoring processor 219 is a coprocessor that assists the processor 216 and is composed of an FPGA, an ASIC, etc. The monitoring processor 219 monitors access to the storage area of ​​the RAM 215 for each of the security cores 2162, 2164 and the standard cores 2262, 2264 included in the processor 216. In addition, the monitoring processor 219 is not limited to being included in the MCU 210c, and the processor 216 of the MCU 210c can also be monitored from the outside of the MCU 210c.

[0154] Specifically, the monitoring processor 219 allows the secure cores 2162 and 2164 to access the secure storage area 2152, allows the secure cores 2162 and 2164 to access the standard storage area 2252, allows the standard cores 2262 and 2264 to access the standard storage area 2252, and prohibits the standard cores 2262 and 2264 from accessing the secure storage area 2152. For example, when the monitoring processor 219 detects that the access destination of the standard cores 2262 and 2264 is the secure storage area 2152, the access of the standard cores 2262 and 2264 to the secure storage area 2152 is restricted by performing exception processing.

[0155] Thus, the monitoring processor 219 that monitors the access of the processor 216 to the secure memory area 2152 and the standard memory area 2252 can restrict the access of the standard cores 2262 and 2264 to the secure memory area 2152 .

[0156] [D. Note]

[0157] As described above, the present embodiment includes the following disclosure.

[0158] [Structure 1]

[0159] A control device (100, 200) controls a driving device (430), the control device (100, 200) comprising:

[0160] a first operation unit (101) for executing safety control on the driving device;

[0161] a second operation unit (102) for executing standard control on the drive device; and

[0162] a storage unit (103) which can be accessed by any one of the first operation unit and the second operation unit and includes a first storage area (1031) storing data related to the safety control and a second storage area (1032) storing data related to the standard control,

[0163] The first operation unit can access either the first storage area or the second storage area.

[0164] On the other hand, the second computing unit can access the second storage area, but access to the first storage area is restricted.

[0165] [Structure 2]

[0166] In the control device (100) of structure 1,

[0167] The control device (100) comprises a plurality of microcontroller units (MCU) (110, 120).

[0168] The first operation unit is a processor core (1162, 1262) that executes the safety control.

[0169] The second operation unit is a processor core (1164) that executes the standard control.

[0170] Each of the plurality of microcontroller units includes a processor core (116) for executing the safety control,

[0171] At least any one of the plurality of microcontroller units includes a processor core (1164, 1264) that executes the standard control.

[0172] [Structure 3]

[0173] In the control device (100) of structure 2,

[0174] Mutual monitoring is performed between the processor cores executing the safety control included in each of the plurality of microcontroller units.

[0175] [Structure 4]

[0176] In the control device (200) of structure 1,

[0177] The control device (200) has a microcontroller unit (MCU) (210).

[0178] The first operation unit is a processor core (2162, 2164) that executes the safety control.

[0179] The second operation unit is a processor core (2262, 2264) that executes the standard control.

[0180] The microcontroller unit includes a plurality of processor cores for executing the safety control and includes at least one processor core for executing the standard control.

[0181] [Structure 5]

[0182] In the control device (100a, 200a) of any one of Configurations 1 to 4,

[0183] The control device (100a, 200a) has a data table (600) which specifies permission and prohibition of access to a storage address of the storage unit.

[0184] Based on the data table, the first operation unit can access a storage address of any one of the first storage area and the second storage area.

[0185] On the other hand, the second operation unit can access the storage address of the second storage area, but access to the storage address of the first storage area is restricted.

[0186] [Structure 6]

[0187] In the control device (100b, 200b) of any one of Configurations 1 to 4,

[0188] The first operation unit can access any one of the first storage area and the second storage area based on a predetermined command.

[0189] On the other hand, the second operation unit can access the second storage area based on the predetermined command, but access to the first storage area is restricted.

[0190] [Structure 7]

[0191] In the control device (100b, 200b) of structure 6,

[0192] As modes for determining whether access to the storage unit is permitted or prohibited, a first mode and a second mode in which access is restricted compared to the first mode are provided.

[0193] Regardless of whether the mode is the first mode or the second mode, access by the second calculation unit to the first storage area is restricted.

[0194] [Structure 8]

[0195] In the control device (100c, 200c) of any one of Configurations 1 to 4,

[0196] The first operation unit is a processor core (1162, 1262, 2162, 2164) that executes the safety control.

[0197] The second operation unit is a processor core (1164, 1264, 2164, 2264) that executes the standard control.

[0198] The control device (100c, 200c) further comprises a monitoring processor (119, 129, 219) as a coprocessor assisting a processor (116, 126, 216) including a processor core for executing the standard control and a processor core for executing the safety control, for monitoring access of the processor to the first storage area and the second storage area.

[0199] The second computing unit is restricted from accessing the first storage area by the monitoring processor.

[0200] [E. Advantages]

[0201] According to the control device 100 of this embodiment, even when the first operation unit 101 that performs safety control and the second operation unit 102 that performs standard control coexist, the second operation unit 102 is restricted from accessing the first storage area 1031 related to safety control. Therefore, the safety control will not be affected by the second operation unit 102 that performs standard control, and safety can be ensured.

[0202] The embodiments disclosed this time should be considered as illustrative in all aspects and not restrictive. The scope of the present invention is indicated by the claims rather than the above description, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0203] Description of symbols

[0204] 100, 100a, 100b, 100c, 200, 200a, 200b, 200c: control device; 101: first operation unit; 102: second operation unit; 103: storage unit; 1051, 1052, 205: processor bus; 110, 120, 110a, 120a, 110b, 120b, 110c, 120c, 210: MCU; 112, 122, 212, 214: security RO M; 114, 124, 222, 224: standard ROM; 115, 125, 215: RAM; 116, 126, 216: processor; 119, 129, 219: monitoring processor; 130, 230: storage; 132, 232: security program; 134, 234: standard program; 140, 240: USB controller; 150, 250: memory card interface; 160, 260: local bus interface; 30 0: Safety device; 410: Safety relay; 420: Driver; 430: Drive device; 500: Support device; 600: Conversion table; 1031: First storage area; 1032: Second storage area; 1053: Bridge; 1122, 1222, 2122, 2142: Safety system program; 1142, 1242, 2222, 2242: Standard system program; 1144: Restricted data; 1152, 1252 , 2152: secure storage area; 1154, 1254, 2252: standard storage area; 1162, 1262, 2162, 2164: secure core; 1162p, 1164p, 1262p, 1264p, 2162p, 2164p, 2262p, 2264p: application; 1164, 1264, 2262, 2264: standard core; 2172, 2174, 2272, 2274: MMU.

Claims

1. A control device for controlling a driving device, the control device comprising: a first operation unit for executing safety control on the drive device; a second operation unit that performs standard control on the drive device; and a storage unit that can be accessed by any one of the first operation unit and the second operation unit and includes a first storage area for storing data related to the safety control and a second storage area for storing data related to the standard control, The first operation unit can access either the first storage area or the second storage area. On the other hand, the second computing unit can access the second storage area, but access to the first storage area is restricted. The control device has a plurality of microcontroller units. The first computing unit is a processor core that executes the safety control. The second operation unit is a processor core that executes the standard control. Each of the plurality of microcontroller units includes a processor core for executing the safety control, At least any one of the plurality of microcontroller units includes a processor core for executing the standard control, Mutual monitoring is performed between the processor cores executing the safety control included in each of the plurality of microcontroller units.

2. The control device according to claim 1, wherein: The control device has a microcontroller unit, The first computing unit is a processor core that executes the safety control. The second operation unit is a processor core that executes the standard control. The microcontroller unit includes a plurality of processor cores for executing the safety control and includes at least one processor core for executing the standard control.

3. The control device according to claim 1 or 2, wherein: The control device has a data table that specifies permission and prohibition of access to the storage address of the storage unit. Based on the data table, the first operation unit can access a storage address of any one of the first storage area and the second storage area. On the other hand, the second operation unit can access the storage address of the second storage area, but access to the storage address of the first storage area is restricted.

4. The control device according to claim 1 or 2, wherein: The first operation unit can access any one of the first storage area and the second storage area based on a predetermined command. On the other hand, the second operation unit can access the second storage area based on the predetermined command, but access to the first storage area is restricted.

5. The control device according to claim 4, wherein: As modes for determining whether access to the storage unit is permitted or prohibited, a first mode and a second mode in which access is restricted compared to the first mode are provided. Regardless of whether the mode is the first mode or the second mode, access by the second calculation unit to the first storage area is restricted.

6. The control device according to claim 1 or 2, wherein: The first computing unit is a processor core that executes the safety control. The second operation unit is a processor core that executes the standard control. The control device further includes a monitoring processor for monitoring access of the processor to the first storage area and the second storage area as a coprocessor assisting a processor including a processor core for executing the standard control and a processor core for executing the safety control. The second computing unit is restricted from accessing the first storage area by the monitoring processor.

Images