Information processing apparatus and information processing method

Abstract

Provided is a technique for continuously verifying a highly reliable function unit. An information processing device includes a verification function unit that, in a verification execution environment that is a secure execution environment with respect to a system execution environment, injects verification data into an input unit to execute a highly reliable function unit, and performs operation verification of the highly reliable function unit based on output from an output unit in a case where the highly reliable function unit is executed. The information processing device includes a time management function unit that manages a timing at which operation verification is performed and a maximum execution time of operation verification.

Description

Technical Field

[0001] This disclosure relates to information processing apparatus and information processing methods. Background Technology

[0002] In a typical automatic control system, multiple functions collaborate and integrate to perform cognition, judgment, and control. An example of such an automatic control system is an autonomous driving system, which generates optimal control parameters based on the vehicle's surroundings, and an engine control unit, brake control unit, and steering control unit that respectively implement engine control, braking control, and steering control. If an anomaly occurs at some point in this autonomous driving system, it cannot continue autonomous driving. Therefore, in order to continue even in such a situation, the automatic control system requires maintenance actions (fail operations) until a safe state is reached, and a transition to the safe state (fail-safe operations).

[0003] Furthermore, in automated control systems, as the level of autonomy increases, the scope of responsibility the system bears also expands. For example, in automated driving, there are levels of automation defined by SAE (Society of Automotive Engineers) International, and the scope of responsibility the system bears increases with each level.

[0004] In contrast, for example, a system architecture is proposed that uses highly reliable functional units (high-reliability functions) such as (1) a monitoring mechanism, (2) an error detection / correction function, (3) a majority mechanism, and (4) a multi-redundant system to provide security guarantees in the event of a failure. However, regarding these highly reliable functional units (high-reliability functions), some, such as (4), do not operate for a long period of time after the product leaves the factory until a failure occurs, while others, such as (1) to (3), do not input data that deviates from the normal data range. Therefore, there is a problem that the overall normal functioning of the system cannot be adequately guaranteed until a failure occurs.

[0005] To address this issue, Patent Document 1 proposes a system that can continuously inspect the fault detection system itself, which detects faults in electronic devices. Furthermore, Patent Document 2 proposes a system and method for verifying the integrity of electronic devices.

[0006] Existing technical documents

[0007] Patent documents

[0008] Patent Document 1: Japanese Patent Application Publication No. 7-264266

[0009] Patent Document 2: Japanese Patent Publication No. 2018-519705 Summary of the Invention

[0010] Patent Document 1 verifies the normality of the signal receiving circuit of the fault monitor that displays information during a fault and the fault signal transmission path from the electronic device, but it does not consider continuous operation verification of the highly reliable functional unit that operates together with the program running on the system. Patent Document 2 uses a safe execution environment to verify system tampering, but similarly, it does not consider operation verification of the highly reliable functional unit. Therefore, there is a problem that when verification data is injected into the operating system for verification, it is impossible to perform the verification in a planned, safe, and secure manner without hindering the processing of the operating program.

[0011] Therefore, this disclosure was made in view of the problems mentioned above, and its purpose is to provide a technique for continuously verifying highly reliable functional units.

[0012] This disclosure provides an information processing apparatus comprising: a plurality of highly reliable functional units, each having an input unit and an output unit; a normal function unit capable of performing processing in a system execution environment, wherein during the execution of the processing, the highly reliable functional unit corresponding to the processing is invoked, and data used in the execution of the highly reliable functional unit is injected into the input unit; a verification table holding injected verification data used in the action verification of the highly reliable functional unit; a verification function unit executing the highly reliable functional unit by injecting the injected verification data into the input unit in a verification execution environment that is a safe execution environment relative to the system execution environment, and performing the action verification of the highly reliable functional unit based on the output from the output unit when the highly reliable functional unit is executed; and a time management function unit managing the timing of the execution of the action verification and the maximum execution time of the action verification.

[0013] According to this disclosure, the operation verification of highly reliable functional units is performed in a verification execution environment that is a secure execution environment relative to the system execution environment, and the timing of the operation verification and the maximum execution time of the operation verification are managed. Based on this structure, the highly reliable functional units can be continuously verified.

[0014] The purpose, features, solutions, and advantages of this disclosure will become more apparent from the following detailed description and accompanying drawings. Attached Figure Description

[0015] Figure 1 This is a block diagram showing the structure of the information processing device according to Embodiment 1.

[0016] Figure 2 This is a diagram showing an example of the contents of the high reliability function verification table of Implementation Method 1.

[0017] Figure 3 This is a diagram showing an example of the contents of the high-reliability functional status table of Implementation Method 1.

[0018] Figure 4 This is a flowchart illustrating the operation of the verification planning unit in Implementation Method 1.

[0019] Figure 5 This is a flowchart illustrating the operation of the verification execution unit in Embodiment 1.

[0020] Figure 6 This is a flowchart illustrating the operation of the verification data injection unit in Embodiment 1.

[0021] Figure 7 This is a flowchart illustrating the operation of the output management unit in Embodiment 1.

[0022] Figure 8 This is a flowchart illustrating the operation of the action log acquisition unit in Embodiment 1.

[0023] Figure 9 This is a flowchart illustrating the operation of the integrity determination unit in Embodiment 1.

[0024] Figure 10 This is a flowchart illustrating the deactivation action of the time management function unit in Embodiment 1.

[0025] Figure 11 This is a block diagram showing the structure of the information processing device according to Embodiment 2.

[0026] Figure 12 This is a block diagram showing the structure of the information processing device according to Embodiment 3.

[0027] Figure 13 This is a block diagram illustrating the hardware structure of a modified information processing device.

[0028] Figure 14 This is a block diagram illustrating the hardware structure of a modified information processing device.

[0029] (Symbol Explanation)

[0030] 1000: Information processing device; 1100: System execution environment; 1110: Operation mode management function unit; 1111: Fault operation function unit; 1120: Normal function unit; 1130: High reliability function unit; 1131: Input unit; 1132: Output unit; 1200: Safe execution environment; 1210: High reliability function verification function unit; 1211: Verification planning unit; 1212: Verification execution unit; 1213: Verification data injection unit; 1214: Output management unit; 1215: Operation log acquisition unit; 1216: Soundness determination unit; 1217: Display unit; 1220: High reliability function verification form; 1230: Time management function unit; 1240: High reliability function status form. Detailed Implementation

[0031] <Implementation Method 1>

[0032] Figure 1 This is a block diagram showing the structure of the information processing apparatus 1000 of Embodiment 1. Furthermore, the information processing apparatus 1000 may also be, for example, an information processing apparatus for an automatic control system (not shown) such as an autonomous driving system of an autonomous vehicle.

[0033] In the information processing apparatus 1000, a system execution environment 1100 and a secure execution environment 1200 are defined. The system execution environment 1100 is an environment that performs normal functions corresponding to the functional requirements of the system. The secure execution environment 1200 is a verification execution environment that is substantially isolated from the system execution environment 1100 and whose secure execution is guaranteed relative to the system execution environment 1100. The information processing apparatus 1000 is positioned between the system execution environment 1100 and the secure execution environment 1200, and has a secure data path 1300 that ensures secure data communication.

[0034] The system execution environment 1100 includes an operation mode management function unit 1110, a normal function unit 1120, and multiple high-reliability function units 1130. Furthermore, as described later, each of the operation mode management function unit 1110, the normal function unit 1120, and the multiple high-reliability function units 1130 can be either dedicated hardware or functions executed by software such as programs.

[0035] The action mode management function unit 1110 manages the action modes that can be performed by the system within the system execution environment 1100, among the multiple action modes that can be performed by the system. For example, among the multiple action modes of an autonomous driving system, there are general road autonomous driving mode, highway autonomous driving mode, automatic parking mode, manual driving mode, etc.

[0036] The operation mode management function unit 1110 includes a fault-response operation function unit 1111, which performs system operation functions by switching the operation mode of the system operation in the event of a partial system failure. The operation modes switched by the fault-response operation function unit 1111 may include, for example, manual modes such as manual driving mode.

[0037] Normally, the functional unit 1120 undertakes the system action functions that perform the processing of action modes managed by the action mode management functional unit 1110. In addition, the system action functions are also referred to as system processing functions.

[0038] Multiple high-reliability functional units 1130 ( Figure 1 The high-reliability functional units 1130-1 to 1130-n1 have functions that make the processing functions of the normal functional unit 1120 highly reliable. These highly reliable functions include, for example, (1) a monitoring mechanism, (2) an error detection / correction function, (3) most mechanisms, and (4) a multi-redundancy system. Each of the multiple high-reliability functional units 1130 has, as an interface with the normal functional unit 1120, an input unit 1131 that accepts data input from the normal functional unit 1120, and an output unit 1132 that handles data output to the normal functional unit 1120.

[0039] The normal function unit 1120 includes a high reliability function call-out unit 1121, which calls out the high reliability function unit 1130. Thus, the normal function unit 1120 can call out (execute) the high reliability function unit 1130 corresponding to its own processing during its own execution, and inject (input) the data used in the execution of the high reliability function unit 1130 into the input unit 1131. Furthermore, in Figure 1 One general function unit 1120 is shown, but the number of general function units 1120 is not limited to this. Multiple general function units 1120 that perform system operation functions may also be provided in the information processing device 1000.

[0040] The secure execution environment 1200 includes a high-reliability function verification unit 1210, a high-reliability function verification table 1220, a time management function unit 1230, and a high-reliability function status table 1240. Furthermore, as described later, each of the high-reliability function verification unit 1210 and the time management function unit 1230 can be either dedicated hardware or functions executed by software such as programs.

[0041] The high-reliability function verification form 1220, which serves as a verification form, holds the injected verification data used in the operation verification of the high-reliability function unit 1130.

[0042] The high-reliability function verification unit 1210, as a verification function unit, verifies whether the high-reliability function unit 1130, which operates in parallel with the normal function unit 1120, is operating healthily and whether the overall system is functioning normally. Specifically, under the safe execution environment 1200, the high-reliability function verification unit 1210 injects (inputs) the aforementioned injected verification data into the input unit 1131 and executes the high-reliability function unit 1130. Furthermore, the high-reliability function verification unit 1210 verifies the operation of the high-reliability function unit 1130 based on the output from the output unit 1132 when the high-reliability function unit 1130 has been executed.

[0043] The Time Management Function 1230 manages the timing of action verification and the maximum execution time of action verification.

[0044] In the high reliability function status table 1240, which is a status table, status data indicating whether the high reliability function unit 1130 is normal is maintained as the result of the action verification performed by the high reliability function verification function unit 1210.

[0045] The following describes the high reliability function verification function unit 1210, the high reliability function verification form 1220, the time management function unit 1230, and the high reliability function status form 1240.

[0046] Figure 2 This is a diagram showing an example of the contents of the high reliability function verification table 1220 of this embodiment 1.

[0047] The high reliability function unit 1130 has the inherent verification data entry 2000 (in Figure 2 In the example, verification data entries 2000-1 to 2000-n2 are used. In the high-reliability function verification table 1220, the content of the data required for action verification is set for each verification data entry 2000. Additionally, in the high-reliability function verification table 1220, for each action mode 2300 that can be managed by the action mode management function unit 1110 (in... Figure 2 In the example, action modes 2300-1 to 2300-n3) are used to set the content of the data required for action verification. However, based on the combination of the verification data entry 2000 of the high reliability function unit 1130 and the action mode 2300, the content of the data required for action verification is not set to "external to the verification object".

[0048] Figure 2 The high reliability function verification form 1220 in the example includes verification action timing, injected verification data, expected output data, expected action log, output control flags, and maximum verification time.

[0049] The verification action timing indicates the timing (time) at which the high reliability function verification function unit 1210 begins the verification of the high reliability function unit 1130's operation. The injected verification data, as described above, is the data injected (input) into the input unit 1131 of the high reliability function unit 1130. The expected output data indicates the expected output, i.e., the expected value, from the output unit 1132 when the high reliability function verification function unit 1210 executes the high reliability function unit 1130. The expected action log indicates the expected action log of the high reliability function unit 1130 when the high reliability function verification function unit 1210 executes the high reliability function unit 1130.

[0050] The output control flag indicates whether the high reliability function 1130 should be invoked and executed by the normal function unit 1120 after the high reliability function verification function unit 1210 executes the high reliability function 1130. In other words, the output control flag indicates whether a control migration to transfer the control of the high reliability function 1130 to the normal function unit 1120 should be performed after the high reliability function verification function unit 1210 executes the high reliability function 1130. For example, if a verification operation timing is set, an output control flag that does not perform a control migration can also be set. For example, if a verification operation timing is not set, an output control flag that performs a control migration can also be set.

[0051] The maximum verification time represents the maximum allowable time for the operation verification of the high reliability function unit 1130.

[0052] Next, a detailed explanation will follow. Figure 1 The high reliability function verification function unit 1210 includes a verification planning unit 1211, a verification execution unit 1212, a verification data injection unit 1213, an output management unit 1214, an action log acquisition unit 1215, a soundness determination unit 1216, and a display unit 1217.

[0053] The verification planning unit 1211 determines the high reliability function unit 1130 of the verification target from multiple high reliability function units 1130 according to the verification action timing of the high reliability function verification form 1220, and plans the timing for performing the action verification of the high reliability function unit 1130 of the verification target.

[0054] The verification data injection unit 1213 injects (inputs) the injection verification data of the high reliability function verification form 1220 into the input unit 1131 of the high reliability function unit 1130 of the verification object.

[0055] The verification execution unit 1212 executes the high reliability function unit 1130 of the verification object, which is injected with the verification data, at a timed schedule planned by the verification planning unit 1211.

[0056] When the verification execution unit 1212 executes the high reliability function unit 1130 of the verification object, the output management unit 1214 obtains the output (output value data) of the output unit 1132 of the high reliability function unit 1130 of the verification object. In addition, the output management unit 1214 controls the operation of the output unit 1132 of the high reliability function unit 1130 of the verification object in a manner that the high reliability function unit 1130 of the verification object is executed by the normal function unit 1120, according to the output control flag of the high reliability function verification form 1220.

[0057] When the verification execution unit 1212 executes the high reliability function unit 1130 of the verification object, the action log acquisition unit 1215 acquires the action log of the high reliability function unit 1130 of the verification object.

[0058] The robustness determination unit 1216 compares the output obtained by the output management unit 1214 with the expected output data in the high-reliability function verification table 1220, and compares the action log obtained by the action log acquisition unit 1215 with the expected action log in the high-reliability function verification table 1220. Furthermore, based on the results of these comparisons, the robustness determination unit 1216 determines the robustness of the high-reliability function unit 1130 of the verification object, and thus performs action verification of the high-reliability function unit 1130. Each time action verification is performed, the robustness determination unit 1216 of the high-reliability function verification function unit 1210 updates the aforementioned status data maintained in the high-reliability function status table 1240.

[0059] The display unit 1217 displays information to the user and others. In addition, in this embodiment 1, the display unit 1217 is included in the high reliability function verification function unit 1210, but it may not be included in the high reliability function verification function unit 1210.

[0060] The verification planning unit 1211 sets the verification action timing for the time management function unit 1230, and the verification execution unit 1212 sets the maximum verification time for the time management function unit 1230. Thus, the time management function unit 1230 manages the timing of the verification action and the maximum execution time. Through this management performed by the time management function unit 1230, the high-reliability function verification function unit 1210 performs the verification of the high-reliability function unit 1130's actions in parallel with the processing of the normal function unit 1120 without hindering its operation.

[0061] Figure 3 This is a diagram showing an example of the contents of the high-reliability functional status table 1240 of this embodiment 1.

[0062] The high reliability function unit 1130 has 3000 inherent state data entries (in) of the high reliability function unit 1130. Figure 3 In the example, state data entries 3000-1 to 3000-n2 are used. In the high reliability function state table 1240, the state of the high reliability function verification function unit 1210 is maintained for each state data entry 3000. In addition, in the high reliability function state table 1240, for each action mode 3300 that can be managed by the action mode management function unit 1110 (in... Figure 3 In the example, the action modes 3300-1 to 3300-n3 maintain the state of the high reliability function verification function unit 1210 and the action mode availability status entry 3100.

[0063] For each operation mode 3300, the maintained state includes at least one of the following: usability data, normal state data, abnormal state data, and operation mode availability data. Usability data indicates whether the high-reliability function unit 1130 is being used in operation mode 3300. Figure 3 The usability data, indicated by "Use," indicates that the high-reliability function unit 1130 is used in operation mode 3300, such as the normal function unit 1120. Figure 3 The "not used" status data indicates that the high-reliability function unit 1130, such as the normal function unit 1120, is not used in operation mode 3300. Normal status data indicates that the high-reliability function unit 1130, which is being used, is functioning normally. Abnormal status data indicates that the high-reliability function unit 1130, which is being used, is malfunctioning.

[0064] The action mode enable / disable data indicates whether the operation of the high-reliability function unit 1130 used in action mode 3300 is in a enabled state. If any of the high-reliability function units 1130 used in action mode 3300 contains abnormal state data, then the action mode enable / disable state entry 3100 retains the "No" indicating that the above operation is not enabled. On the other hand, if no abnormal state data is found in any of the high-reliability function units 1130 used in action mode 3300, then the action mode enable / disable state entry 3100 retains the "Enabled" indicating that the above operation is enabled.

[0065] Here, we envision a scenario where the high-reliability function unit 1130, used in the operation mode managed by the operation mode management function unit 1110, contains abnormal status data in the high-reliability function status table 1240. In this case, when a fault occurs, the operation function unit 1111 switches to the operation mode operated by the system, and the display unit 1217 displays the abnormality.

[0066] <Action>

[0067] <Verification of the Planning Department's Actions>

[0068] Figure 4 This is a flowchart illustrating the operation of the verification planning unit 1211 in Embodiment 1. The verification planning unit 1211 starts operating in the safe execution environment 1200 when the operation mode managed by the operation mode management function unit 1110 begins and changes.

[0069] In step S1, the verification planning unit 1211 obtains the current action mode managed by the action mode management function unit 1110 under the system execution environment 1100.

[0070] In step S2, the verification planning unit 1211, based on the operation mode obtained in step S1, determines the high reliability function unit 1130 that is not outside the verification target as the high reliability function unit 1130 to be verified from the high reliability function verification table 1220.

[0071] In step S3, the verification planning unit 1211 checks the verification action timing from the high reliability function verification table 1220 regarding the operation mode obtained in step S1, and confirms whether the verification action timing is set. If it is determined that the verification action timing is set, the process proceeds to step S4; if it is determined that the verification action timing is not set, the process proceeds to step S5.

[0072] In step S4, the verification planning unit 1211 sets the verification action timing as the start time of the verification execution unit 1212 to the time management function unit 1230. As a result, the action verification is performed asynchronously with the operation of the normal function unit 1120. Afterwards, the process proceeds to step S6.

[0073] In step S5, the verification planning unit 1211 registers the execution of the verification execution unit 1212 with the high reliability function call-out unit 1121 of the normal function unit 1120, in a manner that verification is performed when the high reliability function unit 1130 is called up by the normal function unit 1120. In this case, the verification execution unit 1212 is executed when the normal function unit 1120 is in operation. After step S5, the process proceeds to step S6.

[0074] In step S6, if there are multiple high-reliability functional units 1130 for the verification objects, the verification planning unit 1211 determines whether step S4 or step S5 has been performed for all high-reliability functional units 1130 for all verification objects. If it is determined that step S4 or step S5 has been performed for all high-reliability functional units 1130 for all verification objects, Figure 4 The action ends if the condition is met; otherwise, the process returns to step S2.

[0075] By performing step S4 or step S5 on the high-reliability function unit 1130 for all verification objects, the timing for executing the operation verification of the high-reliability function unit 1130 for all verification objects can be planned. Alternatively, the timing can be planned such that the high-reliability function unit 1130 for verification objects for which operation verification has not yet been performed is executed first.

[0076] <Verify the actions of the execution department>

[0077] Figure 5 This is a flowchart illustrating the operation of the verification execution unit 1212 in Embodiment 1. Furthermore, in Figure 5 The diagram also shows the operation of the time management function unit 1230. During the process... Figure 4 After the action, the verification execution unit 1212 starts operating in the safe execution environment 1200 according to the timing planned by the verification planning unit 1211.

[0078] In step S11, the verification execution unit 1212 obtains the maximum verification time from the high reliability function verification table 1220 based on the combination of the current operation mode and the verification data entry 2000 of the high reliability function unit 1130 of the verification object. Furthermore, the verification execution unit 1212 sets the obtained maximum verification time as the maximum execution time for operation verification to the timer of the time management function unit 1230, and the time management function unit 1230 starts the timer. For the high reliability function unit 1130 of the verification object for which the timing has been set by the verification planning unit 1211, the maximum verification time is set, the timer is set, and the timer is started. The verification execution unit 1212 performs the following steps for the high reliability function unit 1130 of the verification object for which the maximum verification time has been set, the timer has been set, and the timer has been started: Figure 5 The processing after step S12.

[0079] In step S12, the verification execution unit 1212 causes the verification data injection unit 1213 to execute.

[0080] In step S13, the verification execution unit 1212 causes the high reliability function unit 1130 of the verification object, which has been injected with the verification data, to operate and execute.

[0081] In step S14, the verification execution unit 1212 causes the output management unit 1214 to execute, and the output management unit 1214 obtains the output of the high reliability function unit 1130 that operates during step S13.

[0082] In step S15, the verification execution unit 1212 causes the action log acquisition unit 1215 to execute, and the action log acquisition unit 1215 acquires the action logs of the high reliability function unit 1130, the normal function unit 1120 and the system during the operation period of steps S12 to S14.

[0083] In step S16, the verification execution unit 1212 causes the integrity determination unit 1216 to execute. After step S16, Figure 5 The action ended.

[0084] <Verify the actions of the data injection department>

[0085] Figure 6 This is a flowchart illustrating the operation of the verification data injection unit 1213 in Embodiment 1. The verification data injection unit 1213 operates in step S12 of the verification execution unit 1212. Figure 5 After being retrieved from the system, it begins to operate in the secure execution environment 1200.

[0086] In step S21, the verification data injection unit 1213 obtains injected verification data from the high reliability function verification table 1220 based on the combination of the current operation mode and the verification data entry 2000 of the high reliability function unit 1130 of the verification object.

[0087] In step S22, the verification data injection unit 1213 injects the injected verification data obtained in step S21 into the input unit 1131 of the high reliability function unit 1130 of the verification object. Afterwards, Figure 6 The action ended.

[0088] <Actions of the Output Management Department>

[0089] Figure 7 This is a flowchart illustrating the operation of the output management unit 1214 in Embodiment 1. The output management unit 1214 performs step S14 of the verification execution unit 1212. Figure 5 After being retrieved from the system, it begins to operate in the secure execution environment 1200.

[0090] In step S31, the output management unit 1214 obtains the output (output value data) from the output unit 1132 of the high reliability function unit 1130 of the verification object.

[0091] In step S32, the output management unit 1214 obtains the output control flag from the high reliability function verification table 1220 based on the combination of the current operating mode and the verification data entry 2000 of the high reliability function unit 1130 of the verification object.

[0092] In step S33, the output management unit 1214 determines whether the acquired output control flag indicates a control migration (performing a normal process). If the output control flag does not indicate a control migration, the process proceeds to step S34; if the output control flag indicates a control migration, the process proceeds to step S35.

[0093] In step S34, the output management unit 1214 discards the output obtained in step S31 and does not perform control transfer. That is, the output management unit 1214 does not transfer the control of the high reliability function unit 1130 to the normal function unit 1120 of the call-out source. For example, if the processing of step S4 (setting the verification operation timing) is performed instead of the processing of step S5 (the processing of registering the execution of the verification execution unit 1212 to the high reliability function call-out unit 1121 of the normal function unit 1120), the operation verification is performed asynchronously with the operation of the normal function unit 1120. Therefore, in such a case, the output unit control flag can also be set by executing step S34. After step S34, Figure 7 The action ended.

[0094] In step S35, the output management unit 1214 does not discard the output obtained in step S31, and performs control transfer after the high reliability function unit 1130 is executed by the verification execution unit 1212. That is, the output management unit 1214 transfers control of the high reliability function unit 1130 to the normal function unit 1120 of the call-out source. For example, in the case of the process in step S5 (the process of registering the execution of the verification execution unit 1212 to the high reliability function call-out unit 1121 of the normal function unit 1120), the verification execution unit 1212 is executed when the normal function unit 1120 is in operation. Therefore, in such a case, the output unit control flag can also be set by executing step S35. After step S35, Figure 7 The action ended.

[0095] <Action Log Acquisition Section Actions>

[0096] Figure 8 This is a flowchart illustrating the operation of the action log acquisition unit 1215 in Embodiment 1. The action log acquisition unit 1215 performs step S15 of the verification execution unit 1212. Figure 5 After being retrieved from the system, it begins to operate in the secure execution environment 1200.

[0097] In step S41, the action log acquisition unit 1215 acquires the action logs of the high-reliability function unit 1130, the normal function unit 1120, and the system during steps S12 to S14. Afterwards, Figure 8 The action ended.

[0098] <The Actions of the Sanity Assessment Department>

[0099] Figure 9 This is a flowchart illustrating the operation of the integrity determination unit 1216 in Embodiment 1. The integrity determination unit 1216 performs the verification execution unit 1212's step S16 (… Figure 5 After being retrieved from the system, it begins to operate in the secure execution environment 1200.

[0100] In step S51, the integrity determination unit 1216 obtains the expected output data from the high reliability function verification table 1220 based on the combination of the current operation mode and the verification data entry 2000 of the high reliability function unit 1130 of the verification object.

[0101] In step S52, the integrity determination unit 1216 compares the expected output data obtained in step S51 with the output of the high reliability function unit 1130 obtained in step S31 of the output management unit 1214, and determines whether the two are equivalent. If they are determined to be equivalent, the process proceeds to step S53; if they are determined to be unequal, the process proceeds to step S56.

[0102] In step S53, the sanity determination unit 1216 obtains the expected action log from the high reliability function verification table 1220 based on the combination of the current operation mode and the verification data entry 2000 of the high reliability function unit 1130 of the verification object.

[0103] In step S54, the integrity determination unit 1216 compares the expected action log obtained in step S53 with the action log obtained in step S41 of the action log acquisition unit 1215, and determines whether the two are equivalent. If they are determined to be equivalent, the process proceeds to step S55; if they are determined to be unequal, the process proceeds to step S56.

[0104] In step S55, the sanity determination unit 1216 checks whether the combination of the current operating mode and the status data entry 3000 of the high-reliability function unit 1130 of the verification object remains "not used" in the high-reliability function status table 1240. Furthermore, unless the sanity determination unit 1216 confirms that it remains "not used," the content of the high-reliability function status table 1240 for the aforementioned combination is updated to "Use: Normal." Thus, normal status data is maintained in the high-reliability function status table 1240. Afterwards, Figure 9 The action ended.

[0105] In step S56, the sanity determination unit 1216 checks whether the combination of the current operating mode and the status data entry 3000 of the high reliability function unit 1130 of the verification object remains "not used" in the high reliability function status table 1240. Furthermore, if the sanity determination unit 1216 confirms that it remains "not used," the content of the high reliability function status table 1240 for the aforementioned combination is updated to "Used: Abnormal." Thus, abnormal status data is maintained in the high reliability function status table 1240.

[0106] In step S57, the integrity determination unit 1216 causes the display unit 1217 to execute, and the display unit 1217 displays a warning that the operation of the high reliability function unit 1130 used in the current operation mode is not in a working state, that is, an abnormality.

[0107] In step S58, the sanity determination unit 1216 delegates control to the motion function unit 1111 when the motion mode management function unit 1110 malfunctions, and the motion function unit 1111 switches the motion mode when malfunctioning. Afterwards, Figure 9 The action ended.

[0108] <Action of the time management function when the timer exceeds the maximum verification time>

[0109] Figure 10 This is a flowchart illustrating the event handling process performed by the time management function unit 1230 of this embodiment 1 when the timer's timing exceeds the maximum verification time set in step S11 of the verification execution unit 1212. This is performed under the secure execution environment 1200. Figure 10 The action.

[0110] In step S61, the time management function unit 1230 is released from the time management function unit 1230 in step S4 ( Figure 4 All startup settings of the verification execution unit 1212 set in the configuration file.

[0111] In step S62, the time management function unit 1230 is deactivated from the high reliability function call-out unit 1121 in step S5 ( Figure 4 All execution settings of the verification execution unit 1212 registered in ) are then processed. Figure 10 The action ended.

[0112] In addition, the Time Management Function Department 1230 is conducting... Figure 10 In the event of an operation, the display unit 1217 can also display a warning.

[0113] <Summary of Implementation Method 1>

[0114] According to the information processing apparatus 1000 of this embodiment 1 described above, the operation verification of the high-reliability function unit 1130 is performed under the condition of managing timing and the maximum execution time of operation verification in the secure execution environment 1200. With this structure, the operation verification of the high-reliability function unit 1130, which is executable in the processing of the normal function unit 1120, can be performed in a planned, safe, and secure manner without hindering the processing of the normally executing function unit 1120. Therefore, it is possible to continuously verify, prove, and guarantee the system's fault tolerance and availability.

[0115] Furthermore, the verification execution timing can be set for each high-reliability functional unit 1130 that can be executed in the processing execution of the normal functional unit 1120 on the system, so the operation verification of the high-reliability functional unit 1130 can be performed at an appropriate time.

[0116] Furthermore, it is possible to set verification content for each action mode of the system, so that appropriate verification can be performed on the action mode.

[0117] <Implementation Method 2>

[0118] Figure 11 This is a block diagram showing the structure of the information processing apparatus 1000 according to Embodiment 2. Hereinafter, for constituent elements that are the same as or similar to the constituent elements described above, the same or similar reference numerals will be added, and the different constituent elements will be mainly described.

[0119] In this second embodiment, the system execution environment 1100, secure execution environment 1200, and secure data path 1300 of embodiment 1 are respectively changed to VM system execution environment 1100a, VM verification execution environment 1200a, and VM inter-data communication path 1300a. VM is short for Virtual Machine. In this second embodiment, the VM verification execution environment 1200a is implemented as a secure verification execution environment that is substantially isolated from the VM system execution environment 1100a through the virtual machine function.

[0120] Even with the information processing apparatus 1000 described in Embodiment 2, it is possible to continuously verify the high-reliability function unit 1130 in the same manner as in Embodiment 1. Furthermore, the system execution environment and the verification execution environment can be substantially separated through the OS container function, which enables the construction of substantially isolated application execution environments on an OS (Operating System).

[0121] <Implementation Method 3>

[0122] Figure 12 This is a block diagram showing the structure of the information processing apparatus 1000 according to Embodiment 3. Hereinafter, for constituent elements that are the same as or similar to the constituent elements described above, the same or similar reference numerals will be added, and the different constituent elements will be mainly described.

[0123] In this third embodiment, the system execution environment 1100, secure execution environment 1200, and secure data path 1300 of embodiment 1 are respectively changed to CPU system execution environment 1100b, CPU verification execution environment 1200b, and CPU inter-process data communication path 1300b. CPU is short for Central Processing Unit. In this third embodiment, the CPU system execution environment 1100b is implemented on one CPU hardware, and the CPU verification execution environment 1200b is implemented on other CPU hardware as a secure verification execution environment that is substantially isolated from the CPU system execution environment 1100b.

[0124] Even with the information processing apparatus 1000 described in Embodiment 3, the high-reliability functional unit 1130 can be continuously verified in the same way as in Embodiment 1. Furthermore, the hardware implementing the execution environment is not limited to a CPU; it can be any hardware capable of processing programs, such as an FPGA (Field Programmable Gate Array), a GPU (Graphics Processing Unit), or dedicated hardware.

[0125] <Variation Example>

[0126] The following will be the above Figure 1 The high reliability function unit 1130, the general function unit 1120, the high reliability function verification function unit 1210, and the time management function unit 1230 are referred to as "high reliability function unit 1130, etc." The high reliability function unit 1130, etc., is developed through... Figure 13The processing circuit 81 shown is implemented in this way. Specifically, the processing circuit 81 includes: multiple high-reliability function units 1130, each having an input unit 1131 and an output unit 1132; a normal function unit 1120, capable of performing processing in the system execution environment 1100, during which the high-reliability function unit 1130 corresponding to the processing can be recalled, and data used in the execution of the high-reliability function unit 1130 is injected into the input unit 1131; a high-reliability function verification function unit 1210, which, in the safe execution environment 1200, injects verification data into the input unit 1131 to execute the high-reliability function unit 1130, and performs operation verification of the high-reliability function unit 1130 based on the output from the output unit 1132 when the high-reliability function unit 1130 is executed; and a time management function unit 1230, which manages the timing of the operation verification and the maximum execution time of the operation verification. In the processing circuit 81, either dedicated hardware or a processor that executes a program stored in memory can be used. Processors, for example, correspond to central processing units, processing units, arithmetic units, microprocessors, microcomputers, DSPs (Digital Signal Processors), etc.

[0127] When the processing circuit 81 is dedicated hardware, the processing circuit 81 may correspond to, for example, a single circuit, a composite circuit, a programmable processor, a parallel programmable processor, an ASIC (Application Specific Integrated Circuit), an FPGA, or a combination thereof. The functions of each part in the high-reliability functional unit 1130, etc., can be implemented separately by circuits that distribute the processing circuit, or the functions of each part can be integrated into a single processing circuit.

[0128] When the processing circuit 81 is a processor, the functions in the high-reliability functional unit 1130, etc., are implemented through a combination with software, etc. Furthermore, "software, etc." refers to, for example, software, firmware, or both software and firmware. Software, etc., is described as a program and stored in memory. Figure 14As shown, the processor 82 applied to the processing circuit 81 reads and executes the program stored in the memory 83 to realize the functions of each part. That is, the information processing device 1000 includes a memory 83 for storing a program that performs the following steps on the result of execution by the processing circuit 81: a normal function unit 1120 that can perform processing in the system execution environment 1100, during the execution of processing, recalls a high reliability function unit 1130 corresponding to the processing from a plurality of high reliability function units 1130, and injects the data used in the execution of the high reliability function unit 1130 into the input unit 1131; a high reliability function verification function unit 1210, in the safe execution environment 1200, injects the injected verification data into the input unit 1131 and executes the high reliability function unit 1130, and performs operation verification of the high reliability function unit 1130 based on the output from the output unit 1132 when the high reliability function unit 1130 is executed; and a time management function unit 1230 manages the timing of the execution of the operation verification and the maximum execution time of the operation verification. In other words, this program can also be described as a process or method that enables the computer to execute the high-reliability function unit 1130, etc. Here, the memory 83 may be, for example, a non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable Read Only Memory), EEPROM (Electrically Erasable Programmable Read Only Memory), HDD (Hard Disk Drive), magnetic disk, floppy disk, optical disk, compact disk, mini disk, DVD (Digital Versatile Disc), its drive device, or any storage medium used in the future.

[0129] The above describes the structure for implementing the functions of the high-reliability functional unit 1130, etc., using either hardware or software. However, it is not limited to this; it is also possible to implement a part of the high-reliability functional unit 1130, etc., using dedicated hardware and the other part using software. For example, regarding the high-reliability functional unit 1130, its functions can be implemented using a dedicated hardware processing circuit 81, an interface, and a receiver, etc. In addition, its functions can be implemented by the processing circuit 81, which is a processor 82, reading and executing a program stored in the memory 83.

[0130] As described above, the processing circuit 81 can implement the above functions through hardware, software, or a combination thereof.

[0131] Furthermore, the motion mode management function unit 1110 and the steps performed by the motion mode management function unit 1110 can also be implemented in the same way as described above. In addition, the normal function unit 1120, the high reliability function verification function unit 1210, the time management function unit 1230, and the motion mode management function unit 1110 can also correspond to the normal procedure, the high reliability function verification procedure, the time management procedure, and the motion mode management procedure, respectively.

[0132] Furthermore, it is possible to freely combine the various embodiments and their variations, or to appropriately modify or omit the various embodiments and their variations.

[0133] The above description is illustrative in all respects only and is not limiting. It should be understood that countless variations not illustrated can be conceived.

Claims

1. An information processing device, which is an information processing device for an autonomous driving system, comprising: Multiple highly reliable functional units, each with input and output sections; The normal function unit is capable of performing processing in the system execution environment. During the execution of the processing, it can call up the high reliability function unit corresponding to the processing and inject the data used in the execution of the high reliability function unit into the input unit. The verification table retains the injected verification data used in the operation verification of the highly reliable functional unit. The verification function unit injects the injected verification data into the input unit and executes the high reliability function unit in a verification execution environment that is a safe execution environment relative to the system execution environment. Based on the output from the output unit when the high reliability function unit is executed, the operation verification of the high reliability function unit is performed. as well as The time management function manages the timing of the action verification and the maximum execution time of the action verification. The verification form also retains: Verification action timing indicates the timing at which the verification of the action begins; The expected output data represents the expected output from the output unit when the verification function unit has executed the high reliability function unit. Expected action log, which represents the expected action log of the high reliability function unit when the verification function unit executes the high reliability function unit; Output control flags indicate whether execution should be transferred to the normal function unit after the verification function unit executes the high-reliability function unit; and Maximum verification time refers to the maximum allowable time for verifying the action.

2. The information processing apparatus according to claim 1, wherein, The verification function unit includes: The verification planning unit determines the high reliability function of the verification target from the plurality of high reliability function units based on the verification action timing, and plans the timing for executing the action verification of the high reliability function of the verification target. The verification data injection unit injects the injected verification data into the input unit of the high reliability function unit of the verification object; The verification execution unit executes the high reliability function of the verification object, which is injected with the injected verification data, at a time scheduled by the verification planning unit. The output management unit, when the verification execution unit executes the high reliability function unit of the verification object, obtains the output of the output unit of the high reliability function unit of the verification object, and executes the high reliability function unit of the verification object using the normal function unit according to the output unit control flag; The action log acquisition unit acquires the action log of the high reliability function of the verification object when the verification execution unit executes it; and The integrity determination unit determines the integrity of the high reliability function unit of the verification object by comparing the output obtained by the output management unit with the expected output data and by comparing the action log obtained by the action log acquisition unit with the expected action log.

3. An information processing device, which is an information processing device for an autonomous driving system, comprising: Multiple highly reliable functional units, each with input and output sections; The normal function unit is capable of performing processing in the system execution environment. During the execution of the processing, it can call up the high reliability function unit corresponding to the processing and inject the data used in the execution of the high reliability function unit into the input unit. The verification table retains the injected verification data used in the operation verification of the highly reliable functional unit. The verification function unit injects the injected verification data into the input unit and executes the high reliability function unit in a verification execution environment that is a safe execution environment relative to the system execution environment. Based on the output from the output unit when the high reliability function unit is executed, the operation verification of the high reliability function unit is performed. The time management function manages the timing of the action verification and the maximum execution time of the action verification; A status table, as a result of the action verification, maintains status data indicating whether the high-reliability functional unit is functioning normally; as well as The action mode management function manages the action modes of system actions within the system execution environment. In the status table, each action mode includes at least one of the following data: Can data be used to indicate whether the high reliability function unit is a target for use? Normal status data indicates that the high reliability function being used is not functioning properly; Abnormal status data indicates that the high reliability function being used is malfunctioning; as well as The "Action Mode Enable / Disable Data" indicates whether the operation of the high-reliability function unit used in the aforementioned action mode is enabled.

4. The information processing apparatus according to claim 3, wherein, The verification function updates the status data stored in the status table whenever the action verification is performed.

5. The information processing apparatus according to claim 3, wherein, The action mode management function unit includes a fault-on-failure action function unit, which switches the action mode operated by the system when the abnormal state data is contained in the status table, in relation to the high reliability function unit used in the action mode managed by the action mode management function unit.

6. The information processing apparatus according to claim 3, wherein, It also includes a display unit that displays an anomaly when the abnormal status data is contained in the status table for the high reliability function unit used in the operation mode managed by the operation mode management function unit.

7. An information processing method, which is an information processing method in an autonomous driving system, wherein, During the execution of the process, a general-purpose functional unit capable of performing processing in the system execution environment calls out the high-reliability functional unit corresponding to the process from multiple high-reliability functional units, each having an input unit and an output unit, and injects the data used in the execution of the high-reliability functional unit into the input unit. The verification table retains the injected verification data used in the operation verification of the highly reliable functional unit. In a verification execution environment that is a safe execution environment relative to the system execution environment, the verification function unit injects the injected verification data into the input unit and executes the high reliability function unit. Based on the output from the output unit when the high reliability function unit has been executed, the operation verification of the high reliability function unit is performed. The time management function manages the timing of the action verification and the maximum execution time of the action verification. The verification form also retains: Verification action timing indicates the timing at which the verification of the action begins; The expected output data represents the expected output from the output unit when the verification function unit has executed the high reliability function unit. Expected action log, which represents the expected action log of the high reliability function unit when the verification function unit executes the high reliability function unit; Output control flags indicate whether execution should be transferred to the normal function unit after the verification function unit executes the high-reliability function unit; and Maximum verification time refers to the maximum allowable time for verifying the action.

8. An information processing method, which is an information processing method in an autonomous driving system, wherein, During the execution of the process, a general-purpose functional unit capable of performing processing in the system execution environment calls out the high-reliability functional unit corresponding to the process from multiple high-reliability functional units, each having an input unit and an output unit, and injects the data used in the execution of the high-reliability functional unit into the input unit. The verification table retains the injected verification data used in the operation verification of the highly reliable functional unit. In a verification execution environment that is a safe execution environment relative to the system execution environment, the verification function unit injects the injected verification data into the input unit and executes the high reliability function unit. Based on the output from the output unit when the high reliability function unit has been executed, the operation verification of the high reliability function unit is performed. The time management function manages the timing of the action verification and the maximum execution time of the action verification. The status table, as the result of the action verification, maintains status data indicating whether the high-reliability functional unit is functioning correctly. The action mode management function manages the action modes of system actions within the system's execution environment. In the status table, each action mode includes at least one of the following data: Can data be used to indicate whether the high reliability function unit is a target for use? Normal status data indicates that the high reliability function being used is not functioning properly; Abnormal status data indicates that the high reliability function being used is malfunctioning; as well as The "Action Mode Enable / Disable Data" indicates whether the operation of the high-reliability function unit used in the aforementioned action mode is enabled.

Images