Electronic control device

Abstract

To secure functional safety at an early stage while executing secure boot of a control application.SOLUTION: Before executing the secure boot for verifying the integrity of the control application, the electronic control device 10 starts execution of a functional safety ensuring application for realizing a limited function for the control application. As a result, the secure boot of the control application can be executed in a state where the functional safety is ensured by the execution of the functional safety ensuring application.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an electronic control device that can ensure functional safety early while executing secure boot of a control application. [Background technology]

[0002] For example, Patent Document 1 discloses an in-vehicle ECU that executes fail-safe processing as a substitute for an application that could not be started due to the verification result of secure boot. More specifically, the in-vehicle ECU described in Patent Document 1 executes verification of each of a plurality of applications in secure boot. Then, it executes applications that have been verified positively, does not execute applications that have been verified negatively, and executes fail-safe processing to substitute for applications that have been verified negatively. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-74461 Summary of the Invention [Problem to be solved by the invention]

[0004] As described above, the in-vehicle ECU of Patent Document 1 is configured to initiate fail-safe processing to substitute for an application that has been negatively verified if the secure boot verification returns a negative result. Secure boot is a relatively time-consuming process within the startup sequence of an in-vehicle ECU. Therefore, it may take a long time from the start of secure boot until a substitution signal is output by the fail-safe processing. During this time, neither a control signal from the application nor a substitution signal from the fail-safe processing is output. Therefore, there is a risk that the application's function and the substitution function provided by the fail-safe processing will not be performed, and the safety of the application's function will not be ensured for a long period of time.

[0005] The present disclosure has been made in consideration of the above-mentioned points, and aims to provide an electronic control device that can perform secure boot of a control application while ensuring functional safety early on. [Means for solving the problem]

[0006] In order to achieve the above object, an electronic control device (10) according to the present disclosure includes: a storage unit (16) that stores a control application for realizing a desired function and a functional safety application for realizing a function restricted to the control application; a functional safety application execution starting unit (30) that starts execution of a functional safety application at startup; a secure boot processing unit (32) that performs a secure boot to verify the integrity of the control application when the functional safety ensuring application is being executed; and a control application execution start unit (34) that starts execution of a control application instead of the functional safety ensuring application when the verification result by the secure boot processing unit is normal.

[0007] In this way, in the electronic control device according to the present disclosure, before executing a secure boot that verifies the integrity of the control application, execution of a functional safety application that enables restricted functions for the control application is started. This allows the secure boot of the control application to be executed in a state in which functional safety is ensured by the execution of the functional safety application. Therefore, with the electronic control device according to the present disclosure, functional safety can be ensured early by the functional safety application while executing the secure boot of the control application.

[0008] The reference numbers in parentheses above merely indicate an example of a correspondence with specific configurations in the embodiments described below, in order to facilitate understanding of the present disclosure, and are not intended to limit the scope of the present disclosure in any way.

[0009] Furthermore, the technical features of the present disclosure other than those described above will become apparent from the following description of the embodiments and the accompanying drawings. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a configuration diagram illustrating an example of a configuration of an electronic control device according to an embodiment. [Figure 2] 2 is a diagram showing a plurality of functional units configured in the electronic control device and the timing at which each functional unit operates; FIG. [Figure 3] FIG. 1A is a diagram for explaining the timing at which functional safety is ensured by the execution of a functional safety assurance application in an electronic control device according to an embodiment, and FIG. 1B is a diagram showing the timing at which functional safety is ensured by the execution of a fail-safe application in a conventional in-vehicle ECU. [Figure 4] FIG. 2 is a configuration diagram showing an example of a specific configuration of a communication interface and an input / output interface. [Figure 5] 4 is a flowchart showing an example of a series of processes executed in the electronic control unit when the electronic control unit is started by turning on the power or when the electronic control unit is restarted by resetting. [Figure 6] 6 is a flowchart showing an example of the details of the functional safety assurance process in the flowchart of FIG. 5. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, embodiments of an electronic control device according to the present disclosure will be described with reference to the drawings. However, the present disclosure is not limited to the following embodiments, and various modifications described below are also included within the technical scope of the present disclosure. Furthermore, in addition to the following, various modifications can be implemented without departing from the spirit of the present disclosure. The embodiments and various modifications can be implemented in appropriate combinations as long as no technical contradictions arise. In the following description, identical or similar components may be assigned the same reference numerals across multiple drawings, and their description may be omitted. Furthermore, when only a portion of a component is mentioned, the description provided elsewhere may apply to the other components.

[0012] (First embodiment) The electronic control device according to this embodiment can be applied to, for example, a mobile body. Mobile bodies include vehicles such as engine-driven vehicles, hybrid vehicles, and motor-driven vehicles, as well as aircraft such as drones, ships, construction machinery, and agricultural machinery. For example, when the electronic control device according to this embodiment is applied to a vehicle, it controls devices mounted on the vehicle. The electronic control device may also be referred to as an ECU. The electronic control device may be, for example, an engine ECU, a motor ECU, a battery ECU, a brake ECU, a shift-by-wire ECU, a transmission ECU, a steering ECU, an HVECU, a BEVECU, or an autonomous driving ECU, which performs control related to vehicle running (movement of the mobile body). Note that the electronic control device according to this embodiment may also be used as an electronic control device that performs control related to the movement of the mobile body, for example, an air conditioning device provided in the mobile body. Below, an example of the configuration of the electronic control device is described with reference to FIG. 1.

[0013] 1, the electronic control device 10 includes a microcomputer 12, a communication interface 20, and an input / output interface 22. The microcomputer 12 includes a processor 14, a ROM 16, and a RAM 18. The electronic control device 10 may include various circuits in addition to the elements described above. For example, the electronic control device 10 may include a power supply circuit that supplies power to each element.

[0014] The processor 14 is an arithmetic core for performing arithmetic processing. The processor may be configured with a CPU or the like. The processor 14 reads out a control application, a functional safety application, a boot program, a secure boot program, and the like stored in the ROM 16, expands them into the RAM 18, and starts executing them. This allows the execution of processing corresponding to various applications and programs to begin. Furthermore, the processor 14 can configure multiple functional units, which will be described later, by executing multiple instructions included in the boot program and the secure boot program.

[0015] ROM 16 is a rewritable nonvolatile memory that stores applications, programs, data, and the like. ROM 16 may be configured, for example, by a flash memory. ROM 16 has a rewritable area 16a that can be rewritten and a non-rewritable area 16b that cannot be rewritten. For example, a memory controller that manages the reading and writing of data in ROM 16 is set to permit both reading and writing to the rewritable area 16a and permit only reading to the non-rewritable area 16b. This allows the rewritable area 16a and the non-rewritable area 16b to be set in ROM 16. ROM 16 corresponds to the storage unit of the present disclosure.

[0016] The rewritable area 16a of the ROM 16 stores control applications that communicate with other ECUs via an in-vehicle LAN and output drive signals to actuators in order to realize desired functions such as control of vehicle driving. The control applications may be rewritten by an external tool connectable to the electronic control device 10 or by update data transmitted over the air (OTA).

[0017] The non-rewritable area 16b of the ROM 16 includes an area for storing a functional safety application. The functional safety application is an alternative function of the control application and is configured to realize a function that is limited with respect to the function of the control application. For example, if the desired function realized by the control application is to execute control related to vehicle driving, the functional safety application is configured to enable the vehicle to drive to safety using a limited function.

[0018] To give some specific examples, if the control application has a function of controlling a motor as a drive source for the vehicle, the functional safety application may be configured to control the motor when the vehicle speed is within a range equal to or lower than a predetermined speed. Also, if the control application has a function of controlling the vehicle transmission in accordance with the vehicle speed and accelerator pedal position, the functional safety application may be configured to control the vehicle transmission within a range of low-speed gears equal to or lower than a predetermined gear.

[0019] Furthermore, in order to restrict the functions of the control application, the functional safety application may turn off an output relay provided in an output line of a drive signal so that a drive signal is not output to an actuator involved in vehicle running while the vehicle is stopped, or may turn off a power supply relay provided in a power supply line that supplies power to the actuator.Furthermore, in order to restrict the functions of the control application, the functional safety application may stop communication with other ECUs installed in the vehicle via the in-vehicle LAN while the vehicle is stopped.

[0020] As in the above example, the functionality of the functional safety application is limited to the minimum functionality, such as enabling the vehicle to evacuate, etc. This reduces the size of the functional safety application and minimizes the time it takes for the functional safety application to be read from ROM 16 and start to run.

[0021] In addition, the functional safety application is stored in the non-rewritable area 16b of the ROM 16. Therefore, unlike the control application, the functional safety application can be considered safe without verifying its integrity by secure boot. Therefore, the functional safety application can start execution without verifying its integrity by secure boot. This also contributes to shortening the time until the functional safety application starts execution.

[0022] The non-rewritable area 16b also includes an area for storing encryption data such as keys. The encryption data is used to decrypt encrypted update data for rewriting the control application. The encryption data can also be used to verify the integrity of the control application.

[0023] Furthermore, the non-rewritable area 16b also includes an area for storing a boot program and a secure boot program. The boot program runs when the electronic control unit 10 is powered on and when the electronic control unit 10 is restarted by resetting. Below, with reference to Figures 2 and 3, the timing at which the boot program and the secure boot program run, the multiple functional units constructed in the electronic control unit 10 by the boot program and the secure boot program, and the roles of each of the multiple functional units will be described.

[0024] For example, when the electronic control unit 10 is powered on, it executes a boot process to start a boot program, as shown in Fig. 3(a). When the boot program starts to operate as a result of this boot process, the electronic control unit 10 enters a boot state, as shown in Figs. 2 and 3(a). In this boot state, the electronic control unit 10 first executes an execution start process for a functional safety assurance application. In other words, as a result of the operation of the boot program, a functional safety assurance application execution start unit 30 is established as a functional unit in the electronic control unit 10, as shown in Fig. 2.

[0025] As shown in Fig. 3(a), when the functional safety-ensuring application execution starting unit 30 reads the functional safety-ensuring application from the ROM 16, expands it into the RAM 18, and starts its execution, the electronic control unit 10 enters an execution state in which the functional safety-ensuring application is executed. The functional safety-ensuring application can substitute for the functions of the control application with limited functions. Therefore, when the functional safety-ensuring application starts to operate, the safety of the function provided by the control application is ensured.

[0026] In parallel with the execution of the functional safety ensuring application, the electronic control unit 10 executes a secure boot process for securely booting the control application using a secure boot program, as shown in Fig. 3(a). In other words, the operation of the secure boot program configures a secure boot processing unit 32 as a functional unit in the electronic control unit 10, as shown in Fig. 2. The secure boot processing unit 32 verifies the integrity of the control application before the processor 14 executes (starts) the control application.

[0027] For example, the secure boot processing unit 32 generates a hash value from the data of the control application. The secure boot processing unit 32 also obtains the hash value of the data of the legitimate control application by decrypting the digital signature attached to the control application with a key. If the two hash values ​​match, the secure boot processing unit 32 considers the control application to be legitimate and satisfies integrity, and determines that the verification is OK. On the other hand, if the two hash values ​​do not match, the secure boot processing unit 32 determines that the verification is NG. This is an example of secure boot processing, and the secure boot processing unit 32 may verify the integrity of the control application using other methods.

[0028] As a result of the operation of the boot program, a control application execution start unit 34 is constructed as a functional unit in the electronic control unit 10, as shown in FIG. 2. The secure boot processing unit 32 provides the verification result to the control application execution start unit 34, as shown in FIG. 2. When the control application execution start unit 34 receives a result of verification OK from the secure boot processing unit 32, the control application execution start unit 34 performs an execution start process for the control application, as shown in FIG. 3(a). That is, the control application execution start unit 34 reads the control application from the ROM 16, expands it in the RAM 18, and starts execution. As a result, as shown in FIGS. 2 and 3(a), the electronic control unit 10 enters an execution state in which the control application is executed. On the other hand, when the control application execution start unit 34 receives a result of verification NG from the secure boot processing unit 32, it does not start execution of the control application. In this case, the electronic control unit 10 continues to execute the functional safety application, as shown in FIGS. 2 and 3(a).

[0029] 1 shows an example in which the non-rewritable area 16b has three areas, but this is not limiting. For example, the storage area for encryption data and the storage areas for the boot program and secure boot program may be a common (single) area. Furthermore, the three areas of the non-rewritable area 16b may be a common (single) area.

[0030] 1 shows an example in which the electronic control device 10 includes one processor 14 and one ROM 16. However, the electronic control device 10 may include a plurality of processors 14 and / or a plurality of ROMs 16.

[0031] 3(b) shows the operation and state of the ECU in the in-vehicle ECU of Patent Document 1. In the in-vehicle ECU of Patent Document 1, first, in a boot state by boot processing, secure boot processing of the control application is performed. In this secure boot processing, if the secure boot verification result is verification NG, failsafe application execution start processing is performed to start failsafe processing that replaces the application that has failed verification. When this failsafe application execution start processing puts the ECU in an execution state in which the failsafe application is executed, functional safety by the control application is ensured from that point on.

[0032] 3(a) and 3(b), the electronic control unit 10 according to this embodiment starts executing a functional safety ensuring application for realizing restricted functions for the control application before executing a secure boot that verifies the integrity of the control application. Therefore, functional safety by the control application can be ensured earlier than in the in-vehicle ECU of Patent Document 1. Furthermore, the electronic control unit 10 according to this embodiment can execute a secure boot of the control application in a state in which functional safety is ensured by executing the functional safety ensuring application.

[0033] For example, suppose that while a vehicle is traveling, the electronic control unit 10 malfunctions for some reason and is reset. In this case, if it takes a long time for the electronic control unit 10 to perform the function of the control application, the safety of the function controlled by the control application cannot be ensured during that time, which may make it difficult to properly execute control related to vehicle traveling. In this regard, according to the electronic control unit 10 of this embodiment, the functional safety assurance application quickly executes control that replaces the control by the control application. Therefore, the safety of the function controlled by the control application can be quickly ensured, and control related to vehicle traveling can be executed.

[0034] However, the functionality of the functional safety application is limited relative to the functionality of the control application. Therefore, when the secure boot process results in a successful verification of the control application, the electronic control unit 10 promptly switches from the functional safety application to the control application. This switching is performed, for example, by terminating the execution of the functional safety application in response to the start of execution of the control application. At this time, if the control application executes multiple functions, the switching from the functional safety application to the control application may be performed for each of the multiple functions. This makes it possible to minimize the occurrence of blank periods in which no control is performed for multiple functions when switching from the functional safety application to the control application.

[0035] Returning to FIG. 1, the description of the configuration of the electronic control unit 10 will continue. The communication interface 20 of the electronic control unit 10 is for communicating with other ECUs mounted in the vehicle via an in-vehicle LAN. For communication via the in-vehicle LAN, communication protocols such as CAN (registered trademark), LIN, FlexRay (registered trademark), and Ethernet (registered trademark) can be used. The input / output interface 22 is for acquiring sensor signals from outside the electronic control unit 10 and outputting drive signals to actuators that are to be controlled by the electronic control unit 10.

[0036] 4 shows an example of a specific configuration of the communication interface 20 and the input / output interface 22. As shown in FIG. 4, the communication interface 20 includes a communication IC 40, an OR circuit 42, and a switch circuit 44. The communication IC 40 transmits and receives communication signals to and from the other ECUs 70, 72, and 74. The OR circuit 42 receives a communication signal from the functional safety ensuring application execution unit 36 ​​and a communication signal from the control application execution unit 38, and outputs either of the communication signals to the communication IC 40. The switch circuit 44 is provided between the functional safety ensuring application execution unit 36 ​​and the OR circuit 42. The switch circuit 44 is configured to be turned on when an execution signal is not output from the control application execution unit 38, and to be turned off while an execution signal is output from the control application execution unit 38.

[0037] 4 only shows a configuration for transmitting communication signals to the other ECUs 70, 72, and 74, but the same configuration may also be used for receiving communication signals from the other ECUs 70, 72, and 74. That is, a switch circuit similar to the switch circuit 44 may be provided in the wiring for transmitting communication signals received from the other ECUs 70, 72, and 74 to the functional safety assurance application execution unit 36.

[0038] 4, the input / output interface 22 includes driver ICs 50, 60, OR circuits 52, 62, and switch circuits 54, 64. The driver ICs 50, 60 output drive signals corresponding to drive command signals to the respective actuators 80, 84. Furthermore, when the vehicle is stopped and a drive command signal is being output from the functional safety assurance application execution unit 36, the driver ICs 50, 60 operate to turn off the switch circuits 82, 86 provided between the driver ICs 50, 60 and the respective actuators 80, 84.

[0039] OR circuits 52, 62 receive a drive command signal from the functional safety ensuring application execution unit 36 ​​and a drive command signal from the control application execution unit 38, and output either of the drive command signals to driver ICs 50, 60. Switch circuits 54, 64 are provided between the functional safety ensuring application execution unit 36 ​​and the OR circuit 52, and between the functional safety ensuring application execution unit 36 ​​and the OR circuit 62, respectively. Switch circuits 54, 64 are configured to be turned on when an execution signal is not output from the control application execution unit 38, and to be turned off while an execution signal is output from the control application execution unit 38.

[0040] 4, the microcomputer 12 of the electronic control device 10 has, as functional units, a functional safety assurance application execution unit 36 ​​that executes a functional safety assurance application and a control application execution unit 38 that executes a control application. The functional safety assurance application execution unit 36 ​​executes the functional safety assurance application to generate and output communication signals for communicating with the other ECUs 70, 72, and 74 and drive command signals for driving the actuators 80 and 84. The control application execution unit 38 also executes the control application to generate and output communication signals for communicating with the other ECUs 70, 72, and 74 and drive command signals for driving the actuators 80 and 84.

[0041] Furthermore, when the control application execution unit 38 starts executing the control application, it generates and outputs an execution signal while the control application is being executed. While the execution signal is being output from the control application execution unit 38, each of the switch circuits 44, 54, 64 is turned off. Therefore, even if the functional safety ensuring application execution unit 36 ​​outputs a communication signal or a drive command signal, while the control application execution unit 38 is executing the control application, the communication signal and the drive command signal from the functional safety ensuring application execution unit 36 ​​are prevented from being output to the communication IC 40 and the driver ICs 50, 60.

[0042] In this embodiment, as will be described later, the electronic control unit 10 switches from the functional safety application to the control application by software processing. In addition, the electronic control unit 10 uses the above-mentioned hardware circuit to prevent conflict between the communication signal and drive command signal from the functional safety application execution unit 36 ​​and the communication signal and drive command signal from the control application execution unit 38. Therefore, after the control application execution unit 38 starts executing the control application, it is possible to more reliably output the communication signal and drive command signal generated by the control application, rather than the functional safety application, to the communication IC 40 and the driver ICs 50, 60.

[0043] Next, an example of a series of processes executed by the electronic control unit 10 when the electronic control unit 10 is started by powering on or restarted by resetting will be described with reference to the flowcharts of FIGS.

[0044] In step S100, after startup, the electronic control unit 10 executes processing to start execution of the functional safety assurance application. Specifically, the electronic control unit 10 reads the functional safety assurance application from the ROM 16, expands it in the RAM 18, and starts execution. This puts the functional safety assurance application into an execution state. In the following step S110, the electronic control unit 10 determines whether execution of the functional safety assurance application has started. For example, the electronic control unit 10 can determine that execution of the functional safety assurance application has started based on the output of a communication signal and / or a drive command signal from the functional safety assurance application execution unit 36.

[0045] If the electronic control unit 10 determines in step S110 that the execution of the functional safety assurance application has not started even after the predetermined time has elapsed, the electronic control unit 10 proceeds to the processing of step S120. In step S120, the electronic control unit 10 resets itself and then executes the processing of step S100. On the other hand, if the electronic control unit 10 determines in step S110 that the execution of the functional safety assurance application has started, the electronic control unit 10 proceeds to the processing of step S130.

[0046] In step S130, the electronic control unit 10 executes functional safety assurance processing by the functional safety assurance application. Details of this functional safety assurance processing will be described with reference to the flowchart in Fig. 6. Note that the functional safety assurance processing shown in the flowchart in Fig. 6 is an example of a case where the desired function realized by the control application is the execution of control related to vehicle driving, and the functional safety assurance application enables the vehicle to drive to safety with limited functions.

[0047] First, in step S210, the electronic control unit 10 determines whether the vehicle is traveling. If it is determined that the vehicle is not traveling, that is, that the vehicle is stopped, the electronic control unit 10 proceeds to the processing of step S220. On the other hand, if it is determined that the vehicle is traveling, the electronic control unit 10 proceeds to the processing of step S240.

[0048] In step S220, the electronic control unit 10 stops communication with the other ECUs 70, 72, and 74 mounted on the vehicle using the communication IC 40. Furthermore, in step S230, the electronic control unit 10 turns off the switch circuits 82 and 86 provided in the drive signal output lines so that drive signals are not output to the actuators 80 and 84. At this time, the electronic control unit 10 may also turn off the switch circuits provided in the power supply lines that supply power to the actuators 80 and 84. This is because when the vehicle is stopped, there is no need for the functional safety assurance application that enables the vehicle to evacuate and run.

[0049] In step S240, the electronic control unit 10 starts communication with the other ECUs 70, 72, 74 mounted on the vehicle using the communication IC 40. Furthermore, in step S250, the electronic control unit 10 turns on the switch circuits 82, 86 provided on the drive signal output lines to enable output of drive signals from the driver ICs 50, 60 to the actuators 80, 84. Then, in step S260, the electronic control unit 10 generates drive command signals to drive the actuators 80, 84 within the limited range of function and outputs the signals to the driver ICs 50, 60.

[0050] For example, in an electric vehicle (such as a hybrid vehicle, an electric vehicle, or a fuel cell vehicle) that uses a motor as a drive source, if the control application controls a power supply relay that switches on and off the supply of drive voltage to the motor, the electronic control device 10 may use the functional safety assurance application to control the power supply relay so as to limit the drive voltage supplied to the motor via the power supply relay when the electric vehicle is running. The power supply relay may be turned off when the electric vehicle is stopped.

[0051] Furthermore, if the control application is one that realizes shift position switching by shift-by-wire in response to a switching instruction from the shift lever, the electronic control unit 10 may be configured to use a functional safety assurance application to turn off a relay in the wiring that outputs a drive signal to a motor that switches the shift position when the vehicle is stopped, and turn on the relay when the vehicle is running, thereby enabling the shift position to be switched.

[0052] Furthermore, if the control application controls the gear position of the vehicle transmission by energizing a solenoid, the electronic control unit 10 may be configured, using a functional safety application, to turn off the relay in the wiring that outputs a drive signal to the solenoid when the vehicle is stopped, and to turn on the relay when the vehicle is running, while allowing only low gear to be used.

[0053] In step S140 of the flowchart in Fig. 5, the electronic control unit 10 executes a secure boot process to verify the integrity of the control application. While this secure boot process is being performed, the electronic control unit 10 is concurrently executing a functional safety application. In step S150, the electronic control unit 10 acquires the verification result of the secure boot process. If the integrity of the control application is verified in the secure boot process, the verification result will be "verification OK." On the other hand, if the integrity of the control application cannot be verified, the verification result will be "verification NG."

[0054] In step S160, the electronic control unit 10 determines whether the verification result of the secure boot process acquired in step S150 was verification OK or verification NG. If it is determined that the verification is OK, the electronic control unit 10 proceeds to processing of step S170. On the other hand, if it is determined that the verification is NG, the electronic control unit 10 proceeds to processing of step S190.

[0055] In step S170, the electronic control unit 10 performs processing to start the execution of the control application. That is, the electronic control unit 10 reads the control application from the ROM 16, expands it in the RAM 18, and starts execution. As a result, the electronic control unit 10 enters an execution state in which the control application is executed. Then, in step S180, the electronic control unit 10 ends the functional safety ensuring application. In this way, in this embodiment, the electronic control unit 10 is configured to switch from the functional safety ensuring application to the control application by software processing.

[0056] In step S190, since the verification result of the control application is NG, the electronic control unit 10 does not start the execution of the control application and continues the execution state of the functional safety ensuring application. Then, in step S200, the electronic control unit 10 notifies the user that the functional safety ensuring application will continue to be executed. This allows the user of the vehicle to recognize that the function of controlling the vehicle's driving is limited and that the vehicle can only be driven to an extent that allows for evacuation driving.

[0057] (Variation) The above describes preferred embodiments of the present disclosure, but the present disclosure is not limited to the above-described embodiments and can be implemented in various modified forms within the scope of the gist of the present disclosure.

[0058] For example, in the above-described embodiment, an example has been described in which the functional safety application is stored in a non-rewritable area of ​​the ROM 16. However, the functional safety application may be stored in another storage medium. For example, if the electronic control device 10 includes a hardware security module, the functional safety application may be stored in the memory of the hardware security module.

[0059] Furthermore, for example, the electronic control unit 10 and the method described herein may be implemented by a dedicated computer including a processor programmed to execute one or more functions embodied in a computer program. The electronic control unit 10 and the method described herein may also be implemented using dedicated hardware logic circuits. The electronic control unit 10 and the method described herein may also be implemented by one or more dedicated computers configured by combining a processor that executes a computer program with one or more hardware logic circuits. The processor may be any computing core, such as a CPU, MPU, GPU, or DFP (Data Flow Processor). Some or all of the functions of the processor may be implemented by hardware. For example, some or all of the functions of the processor may be implemented using a system-on-chip (SoC), an integrated circuit (IC), or a field-programmable gate array (FPGA). [Explanation of symbols]

[0060] 10: Electronic control device, 12: Microcomputer, 14: Processor, 16: ROM, 16a: Rewritable area, 16b: Non-rewritable area, 18: RAM, 20: Communication interface, 22: Input / output interface, 30: Functional safety application execution start unit, 32: Secure boot processing unit, 34: Control application execution start unit, 36: Functional safety application execution unit, 38: Control application execution unit, 40: Communication IC, 42: OR circuit, 44: Switch circuit, 50: Driver IC, 52: OR circuit, 54: Switch circuit, 60: Driver IC, 62: OR circuit, 64: Switch circuit, 70, 72, 74: ECU, 80: Actuator, 82: Switch circuit, 84: Actuator, 86: Switch circuit

Claims

1. a storage unit (16) for storing a control application for realizing a desired function and a functional safety assurance application for realizing a function restricted to the control application; a functional safety application execution starting unit (30) that starts execution of the functional safety application at startup; a secure boot processing unit (32) that executes a secure boot to verify the integrity of the control application when the functional safety ensuring application is being executed; and a control application execution start unit (34) that starts execution of the control application instead of the functional safety assurance application when a verification result by the secure boot processing unit is normal.

2. The electronic control device according to claim 1 , wherein, when a result of the verification by the secure boot processing unit is abnormal, the control application execution starting unit does not start execution of the control application, and continues to execute the functional safety ensuring application.

3. The electronic control device according to claim 2 , further comprising a notification unit (S200) that notifies a user when the functional safety assurance application continues to be executed.

4. the storage unit is a nonvolatile memory and has a rewritable unprotected area and a non-rewritable protected area; The electronic control device according to claim 1 , wherein the functional safety assurance application is stored in a protected area of ​​the storage unit.

5. the storage unit includes a memory of a hardware security module; The electronic control device according to claim 1 , wherein the functional safety application is stored in a memory of the hardware security module.

6. the desired function realized by the control application is related to vehicle running, The electronic control device according to claim 1 , wherein the functional safety ensuring application enables the vehicle to run to an evacuation site by using the restricted functions.

7. 7. The electronic control device according to claim 6, wherein the functional safety assurance application turns off a relay provided in an output line of a drive signal to an actuator (80, 84) involved in the running of the vehicle while the vehicle is stopped.

8. The electronic control unit according to claim 6 , wherein the functional safety ensuring application stops communication with other electronic control units mounted on the vehicle via an in-vehicle LAN while the vehicle is stopped.

9. outputs from the control application and the functional safety assurance application are output to actuators involved in the running of the vehicle via hardware circuits (52, 54, 62, 64), respectively; The electronic control device according to claim 6 , wherein the hardware circuit functions to prevent an output from the functional safety application from being output to the actuator in response to the control application starting execution.

10. the control application controls a power supply relay that switches between supplying and not supplying a drive voltage to a motor in an electric vehicle using a motor as a drive source, 7. The electronic control device according to claim 6, wherein the functional safety ensuring application controls the power supply relay so as to turn off the power supply relay when the electric vehicle is stopped, and to limit the drive voltage supplied to the motor via the power supply relay when the electric vehicle is running.

11. The control application realizes shift position switching by shift-by-wire in response to a shift instruction from a shift lever, 7. The electronic control device according to claim 6, wherein the functional safety ensuring application turns off a relay in a wiring that outputs a drive signal to a motor that switches a shift position when the vehicle is stopped, and turns on the relay when the vehicle is running, thereby enabling the shift position to be switched.

12. the control application controls a gear position of a transmission of the vehicle through energization of a solenoid; 7. The electronic control device according to claim 6, wherein the functional safety ensuring application turns off a relay in a wiring that outputs a drive signal to the solenoid when the vehicle is stopped, and turns on the relay when the vehicle is running, and enables use of only a low gear.

Images