How the computing unit operates in safe operation mode

Abstract

The present invention relates to a method for operating an arithmetic unit in a safe operation mode, comprising the steps of: reading a startup instruction (208) for starting the safe operation mode and starting the safe operation mode based on the read startup instruction; reading an instruction in the safe operation mode and calculating the current check value from the instruction currently to be executed and a previous check value; and checking the current check value at least once in the safe operation mode.

Description

Technical Field

[0001] The present invention relates to an operation method of an arithmetic unit in a safe operation mode, an arithmetic unit for implementing the same, and a computer program.

Background Art

[0002] An arithmetic unit such as a microcontroller or a system-on-chip (SoC) can implement a functionally safe execution platform (for example, called "Safe Island", "Vital Modules", "Safe Backbone" or "Safe Execution Platform" in English), and enables the execution of software at the highest safety level with respect to operation safety or functional safety (referred to as "safety" in English). For example, this safety level may be ASIL-D, which is the highest safety requirement level for automotive safety-related systems based on the safety standard of ISO26262 or ASIL (Automotive Safety Integrity Level) defined by the same standard, in the automotive field.

[0003] Such a functionally safe execution platform can be realized, for example, by providing two identical processor cores and operating in a so-called lockstep mode. In this mode, the two cores execute the same process, verify the validity of the results with each other, and can output an error signal when a difference is detected. The cores are usually arranged in separate clock trees and separate regions on each chip. The program code can be stored, for example, in an embedded NOR flash memory, and the data can be stored in an embedded static ROM memory.

[0004] The lockstep concept with such additional redundant processor cores involves high energy consumption and large space requirements. Furthermore, the lockstep concept does not work equally well across all processor types. For example, the lockstep concept works well for medium-performance cores used, for instance, in vehicle engine control or brake system control. However, at higher performance levels, the lockstep method often scales poorly. High-performance cores often operate only to a limited extent in parallel lockstep operation. Also, NOR flash memory often cannot scale to nodes below 28nm and requires more area than NAND flash. Embedded static RAM typically cannot accommodate capacities greater than 10 MiB (mebibytes).

[0005] Therefore, functionally safe execution platforms based on the lockstep principle are often only partially suitable for systems with large amounts of program code and data, such as autonomous driving systems. [Overview of the project] [Means for solving the problem]

[0006] The present invention proposes a method for operating a computing unit in a safe operating mode having the features of the independent claims, and a computing unit and computer program for carrying out the same. Advantageous embodiments are the subject of the cited claims and the following description.

[0007] The present invention enables the operation of a computing unit in a safe operating mode with respect to operational safety or functional safety (in English, "safety"). In this specification, the terms safe or secure can be understood in particular as operational safety or functional safety, expressed as "safety" in English, and distinct from information technology safety or information security, expressed as "security" in English.

[0008] The arithmetic unit comprises, in particular, a processor unit having one or more processor cores, a non-volatile storage unit such as (NAND) flash memory, and a volatile storage unit such as (LPDDR) RAM memory. The non-volatile storage unit may preferably store software or program code. The software includes, in particular, individual instructions or machine instructions or directives generated by a compiler during the compilation process. During execution, individual instructions are read from the volatile storage unit by the processor unit and executed. In the normal operation or normal operating mode of the arithmetic unit, this reading or retrieval ("fetch") of instructions is performed in a conventional manner. In contrast, in safe operation mode, reading is performed in a special manner to enable the safe operation of the arithmetic unit.

[0009] For this purpose, in this method, a startup instruction for activating the safe operating mode is read and executed by the processor unit, particularly during the normal operating mode of the arithmetic unit. Based on this read startup instruction, the processor unit's safe operating mode is activated. For example, this startup instruction can be implemented by a compiler instruction or a pragma directive.

[0010] In safe operation mode, instructions are read by the processor unit, particularly from the volatile memory unit, especially during instruction fetching (English: "fetch," "instruction fetch"), and the processor unit calculates the currently executed instruction and previous check values, particularly using the check value calculation method pw n =f(o n ,pw n-1 The current test value is calculated according to the following, and the test value pw n This is the previous test value pw n-1 and the current command o n This is the function f.

[0011] Then, each of the instructions that were loaded o nThis can be executed by the processor unit. If no previous check value pw0 exists at the time of the first acquisition (n=1), a predetermined value (e.g., zero) can be used, or the initial check value pw0 can be read along with the invocation instruction. Therefore, the initial check value may be added to the invocation instruction, for example, as an instruction argument.

[0012] Subsequently, in safe operation mode, the current check value is verified at least once by the processor unit. For this purpose, for example, the current check value can be compared with a pre-calculated corresponding reference check value. Furthermore, for each instruction in the software, the corresponding reference check value may be stored in a non-volatile memory unit. Since the instruction chain or order is known in advance, the order of the check values ​​can also be predetermined. For example, each current check value can be verified at regular time intervals or when a specific event occurs.

[0013] The safe operation mode enables the implementation of a functionally safe execution platform ("Safe Island," "Vital Modules," "Safe Backbone," or "Safe Execution Platform") in a low-cost, energy-saving, and space-saving manner. In safe operation mode, software can be executed at a high or even the highest level of safety, for example, at the highest safety requirement level ASIL-D, compliant with the ISO 26262 safety standard in the automotive sector. Check values ​​can be used to appropriately verify the accuracy and completeness of individual instructions read in safe operation mode, and to determine whether individual instructions have been read correctly. If an error is detected during the check value verification, predetermined measures can be taken, such as outputting an error message, creating a record in error memory, potentially stopping the system, or transitioning to a safe state. In safe operation mode, it is possible to safely read instructions from insecure storage units, such as conventional (NAND) flash memory or (LPDDR) RAM memory, via insecure communication systems, such as an internal processor bus system.

[0014] Ideally, each instruction should have its own reference check value added outside the arithmetic unit, for example during the compilation process, and then, when a predetermined confirmation event occurs, for example, it can be checked by the processor core based on this reference check value and the calculated check value during reading within the arithmetic unit. In this way, the integrity of the instruction can be ensured from the compiler to the processor core.

[0015] This method is suitable for all processor and logic units that execute programs and read instructions from memory for that purpose. In particular, this method is suitable for high-performance cores and systems with large program code and large amounts of data, such as those used in autonomous driving. No special hardware units are required to implement the safe operating mode. For example, conventional memory units and buses can be used. Furthermore, the implementation of error detection code (EDC) or error correction code (ECC) in the hardware is not required. For example, a large-capacity external RAM memory can be used and connected to the processor unit via a conventional standard interface such as the JEDEC-LPDDR interface. Alternatively, program code and initialization data may be written to RAM memory using conventional external NAND flash memory, for example. It is appropriate that the safe operating mode can be started and stopped at any time as needed.

[0016] While additional reference check values ​​may require more memory space for the program code, safe operation mode does not require embedded NOR flash memory or embedded static ROM memory. Additional logic circuits, additional instructions, and a Control and Status Register (CSR) can be provided for the processor core for safe operation mode, which may slightly increase the space requirements on the chip, but still significantly reduce them compared to using separate safe memory.

[0017] For example, each check value can be calculated according to a Cyclic Redundancy Check (CRC). The length of each check value can be selected so that, for example, such check values ​​can be incorporated into the invocation instruction as direct values. Since the calculation of check values ​​is performed when acquiring each instruction executed at the full core clock, the calculation is performed within a single clock cycle, especially for 16-bit and 32-bit instructions. It is appropriate that the check values ​​are applicable to 64-bit instructions and longer instructions as well. The check values ​​cover at least 128 32-bit instructions (4096 program memory bits) in particular, so as not to overuse program space or execution time. In particular, although the check values ​​can be calculated continuously, there is one pre-calculated comparison value for every 128 instructions. It is appropriate that the calculation method for the check values ​​can be set to keep the hardware cost and power consumption for calculation as low as possible. It is also appropriate that the calculation method can be set so that different sequences of the same instruction appropriately generate different check values. For example, to meet the ASIL-D safety level, it is appropriate that the check values ​​detect at least 99% of all possible combinations of bit errors. The so-called Hamming weight, or the number of undetected errors, is typically less than 1% of the total number of possible errors for any given number of bit errors.

[0018] According to one embodiment, when a predetermined confirmation event occurs, the current inspection value (at that time) is checked in safe operation mode. Ideally, this method allows setting the frequency or specific events for checking the current inspection value during safe operation mode.

[0019] According to one embodiment, a predetermined acknowledgment event includes the reading of a predetermined acknowledgment instruction. Such an acknowledgment instruction may be a special machine instruction that instructs a processor unit to check the current check value. It is preferable that such an acknowledgment instruction can be generated at any time as needed, or based on a special trigger event, such as after a predetermined number of instructions have been read. This method allows for, for example, adherence to a predetermined error detection time and prevents a reduction in the error detection range, i.e., the probability of detecting any combination of errors, due to, for example, an excessive number of unchecked instructions being read. It is preferable that such an acknowledgment instruction be generated during the compilation process and placed at an appropriate location in the instruction flow. Reference values ​​may be added to the acknowledgment instruction.

[0020] Alternatively or additionally, according to one embodiment, a predetermined confirmation event includes reading a jump instruction to execute a jump during program execution. Such a jump instruction instructs the processor unit to jump to a specific instruction or corresponding memory address in the program code and execute that instruction or the instruction therein. Such jumps can, in principle, go anywhere, including to potentially dangerous targets. To prevent this, it is appropriate that a confirmation of the current check value can be performed for each jump, and that the check value itself, particularly calculated from the jump instruction, can be confirmed in the jump.

[0021] Alternatively or additionally, according to one embodiment, a predetermined verification event includes reading a subroutine instruction to execute a subroutine. Such a subroutine instruction, like a jump instruction, may instruct the processor unit to execute a specific instruction in a particular program code module. Verification can be performed particularly if the subroutine is large or compiled from a different source file than the rest of the instructions. For this purpose, the current check value can be verified, in particular, by reading each subroutine instruction.

[0022] Alternatively or additionally, a given acknowledgment event may include reading a branch instruction to execute multiple instruction branches. Such branch instructions can instruct the processor unit to divide the normal linear program progression. It is appropriate that a check of the current check value at the start of each instruction branch be performed.

[0023] According to one embodiment, if the current check value is not verified after a predetermined maximum number of read instructions and / or a predetermined maximum period of time has elapsed, a predetermined measure is taken. For example, if verification is not performed after 100 instructions have been read and / or after a microsecond has elapsed, an error message such as a timeout error can be output as a measure.

[0024] According to one embodiment, a stop instruction is read to terminate the safe operation mode, particularly at its termination. The current check value is calculated from this stop instruction and the previous check value, and this current check value is verified. This allows for a final determination that there were no errors in the safe operation mode. Based on the reading of this stop instruction, the processor unit can terminate the safe operation mode, and the arithmetic unit can resume operation in normal operation mode. For example, this stop instruction can be implemented by a compiler instruction or a pragma directive, similar to an initiation instruction.

[0025] According to one embodiment, after a startup instruction is loaded, a first instruction that is currently the execution target and a first check value consisting of a predetermined initial check value or a loaded initial check value are calculated as previous check values. In the safe operation mode, then, each current check value is confirmed based on this first check value. For example, the calculation of the check value can be initialized with this start value such that the check value confirmed at the time of stop corresponds to a predetermined expected value, for example, a value of zero, in the case of no error. Alternatively, the calculation of the check value may be initialized with a predetermined start value such as zero, and in the case of no error, the final value may correspond to a value that can be calculated in advance based on the knowledge of the instruction chain.

[0026] According to one embodiment, reference check values are respectively assigned to, for example, one, a plurality, or all of the instructions that are pre-loaded before starting the safe operation mode. It is particularly appropriate that these reference check values are generated into executable machine code in the compilation process of the program code. At the time of execution, it is appropriate that the instructions to be loaded are loaded together with their respective reference check values into a volatile memory unit in which individual instructions are loaded together with the reference check values in the safe operation mode. Each current check value calculated from each loaded instruction in the safe operation mode can then be confirmed according to the respective reference check value of each instruction, and in particular, can be implemented by comparing the corresponding current check value with each reference check value.

[0027] According to one embodiment, in the safe operation mode, when a certain number of instructions are skipped and not executed, and / or when a certain number of instructions already executed are re-executed, for example, by executing a corresponding jump instruction or branch instruction, the current check value is changed. In such a case, even if individual instructions are set to be omitted or repeated, there is a possibility that the verification of the check value fails with an error, although all instructions are correctly read and executed as set. To prevent this, the current check value is changed using a change instruction. When multiple instructions are not executed in a jump, a first change instruction is read and executed by the processor unit. For example, through the argument of the first change instruction, the current check value is changed as if the individual skipped instructions were executed by this first change instruction. When a certain number of instructions already executed during a loop are re-executed, a second change instruction is read. By this second change instruction or its argument, the current check value is changed as if each re-executed instruction was executed only once. For example, each change instruction is generated during the compilation process and can be inserted into the instruction flow at an appropriate position.

[0028] According to one embodiment, the arithmetic unit has a processor unit based on the RISC-V instruction set architecture (ISA). An instruction set generally refers to the entire set of machine instructions that a processor unit can execute. The RISC-V instruction set architecture is based on the so-called RISC principle (Reduced Instruction Set Computer, RISC), in which an instruction set typically consists of a small number of instructions, usually less than 100. Each instruction can be processed simply and quickly by the processor unit, thus achieving a simplified processor design, high processor clock speed, and fast execution speed. This is in contrast to the so-called CISC architecture (Complex Instruction Set Computing, CISC), where the instruction set contains a large number of instructions (more than 100), allowing each processor to perform complex processing, but resulting in a complex processor design. The RISC-V instruction set architecture is an open standard or "open source," making it easy to modify and extend the instruction set. RISC-V processors, or processors in general with modifiable instruction set architectures, are particularly suitable for implementing safe operating modes. This is because it allows for the easy incorporation of instructions necessary for executing safe operating modes, such as start instructions, stop instructions, confirmation instructions, and modification instructions, into the instruction set.

[0029] Particularly preferred, this method is suitable for applications in the automotive sector. The computing unit can be configured as a microcontroller or control device for a (motorized) vehicle in particular. The processes performed by the computing unit may include safety-critical functions performed for the safe operation and control of the vehicle, such as engine control, driver assistance functions, or functions in autonomous driving. This method improves the safety, fail-safe, and integrity of the control device. In particular, this method can meet safety requirements in the (motorized) vehicle sector, such as those set by the ISO 26262 standard and, in particular, the so-called "Automotive Safety Integrity Level" (ASIL), which is the safety requirement level for automotive safety-related systems specified in ISO 26262.

[0030] For example, the arithmetic unit according to the present invention, which is a control device for an automobile, is configured to implement the method according to the present invention, particularly in terms of programming technology. It is also advantageous for the method according to the invention to be implemented in the form of a computer program or computer program product, which carries out all method steps, as this can be implemented at a particularly low cost, especially when an executable control device is already in existence and used for other tasks. Finally, a machine-readable storage medium storing the computer program as described above is provided. Suitable storage media or data carriers for providing computer programs include, for example, hard disks, flash memory, EEPROMs, DVDs, and especially magnetic, optical, and electrical storage units. It is also possible to download the program via a computer network (Internet, intranet, etc.). Such downloads can be performed by wired or wireless (e.g., WLAN network, 3G, 4G, 5G, 6G connection, etc.).

[0031] Further advantages and configurations of the present invention will become apparent from the description and accompanying drawings. The present invention will be schematically shown based on the embodiments in the drawings and will be described below with reference to the drawings. [Brief explanation of the drawing]

[0032] [Figure 1] A schematic diagram of the configuration of a computing unit according to the present invention, configured to carry out an embodiment of the method according to the present invention. [Figure 2] A schematic diagram showing an embodiment of the method according to the present invention in block diagram form. [Figure 3] A schematic diagram showing an embodiment of the method according to the present invention in block diagram form. [Figure 4] A schematic diagram showing an embodiment of the method according to the present invention in block diagram form. [Figure 5] A schematic diagram showing an embodiment of the method according to the present invention in block diagram form. [Figure 6] A schematic diagram showing an embodiment of the method according to the present invention in block diagram form. [Figure 7] A schematic diagram showing an embodiment of the method according to the present invention in block diagram form. [Figure 8] A schematic diagram showing an embodiment of the method according to the present invention in block diagram form. [Modes for carrying out the invention]

[0033] Figure 1 schematically shows a computing unit that can be configured as a system-on-a-chip (SoC), labeled 100. For example, SoC 100 can be installed in an automobile and incorporated into the vehicle's control system, and used to perform safety-critical functions for the safe operation of the vehicle, such as engine control, driver assistance functions, and autonomous driving.

[0034] To ensure the safety and integrity of the control device, to execute the software at the highest safety level, and to meet the safety requirements of the (motorized) vehicle sector, particularly in accordance with the ASIL-D safety requirement level of the ISO 26262 standard, the SoC100 is configured, particularly in terms of programming technology, to implement embodiments of the method according to the present invention. In this method, the SoC100 can operate in a safe operating mode in which safe instruction retrieval is possible. This method realizes a functionally safe execution platform 110 ("Safe Island", "Vital Modules", "Safe Backbone", or "Safe Execution Platform") within the SoC100.

[0035] To implement a functionally safe execution platform 110 or safe operating mode, the illustrated example includes a processor unit 111, a cache logic unit 112, and a timer 113. The processor unit 111 may appropriately be a processor core based on the RISC-V instruction set architecture (but is not limited to this). This RISC-V processor 111 and cache logic unit 113 are connected to the interconnect unit 120 of the SoC 100 as other elements of the functionally safe execution platform 110, for example, via RAM and cache memory 121. For example, a flash storage unit 140, such as NAND flash memory, can be connected to the interconnect unit 120 via interface 141, and a RAM storage unit 150, such as LPDDR-RAM, can be connected via RAM controller 151. The SoC 100 may also have one or more additional processor cores 130, each with associated RAM and cache memory 131 connected to the interconnect unit 120. Furthermore, as additional elements of the functionally secure execution platform 110, a storage unit 122 for the startup process (boot flash memory) and a peripheral bus 160 may be connected to the connection unit 120. Numerous peripheral units are connected to the peripheral bus 160, such as an analog-to-digital converter 161, a serial bus system 162 ("Serial Peripheral Interface," SPI), a direct memory access unit 163 ("Direct Memory Access," DMA), a timer 164, and a further fieldbus system 165, such as a Flexlay fieldbus. Naturally, fewer or more peripheral units may be provided, indicated by reference numeral 166. An external monitoring unit 180 ("Watchdog") for detecting and managing errors and failures of the SoC 100 may be connected via the serial bus system 162.Furthermore, the SoC100 may have an error management unit 170 (Error Management Module, EMM) for managing the outputted error messages.

[0036] In safe operation mode, as explained below with reference to Figures 2 to 8, the processor 111 calculates and verifies the check values ​​of the loaded instructions in order to ensure the integrity of the instructions from the compiler to the processor core 111.

[0037] Figures 2 to 8 schematically show embodiments of the method according to the present invention as block diagrams. Each of Figures 2 to 8 shows a series of instructions that can be read and executed by the processor 111.

[0038] These individual instructions are generated by a compiler, for example, during the program code compilation process, and a reference check value is calculated for each generated instruction. These instructions, along with their respective reference check values, can be stored, for example, in a flash memory unit 140, and from there they can be copied to a RAM memory unit 150 during the operation of the SoC 100. In particular, of the instructions that need to be executed reliably, at least one, preferably the first instruction or the last instruction, is stored along with its reference check value, for example, as an instruction argument. However, preferably, multiple instructions or all instructions are stored along with their respective reference check values. Each instruction, along with its respective reference check value, can be read from the RAM memory 150 by the processor 111 during instruction fetching ("fetch", "instruction fetch") and executed.

[0039] As shown in Figure 2, in normal operation mode, the processor 111 reads and executes instructions 202, 204, and 206 in the usual manner. During this normal operation mode, the check values ​​for the read instructions are not calculated. When the startup instruction 208 is read, the processor 111 activates safe operation mode. From then on, until the safe operation mode is terminated by the processor 111, the current check value is calculated from each read instruction and the previous check value.

[0040] After the start instruction 208 is read, a first check value is calculated, in particular, using the first instruction currently being executed and a predetermined initial check value or the read initial check value as previous check values. For example, the calculation of the check value can be initialized using the read initial check value so that, if there are no errors, the final value to be calculated later matches a predetermined value, such as zero.

[0041] After the safe operation mode is activated, the processor 111 reads instruction 210 and calculates the current check value from this instruction 210 and the initial check value. Then, the processor 111 reads the next instruction 212 and calculates the current check value from this instruction 212 and the previous check value.

[0042] Instruction 212 is, for example, a subroutine instruction for executing a subroutine. Processor 111 executes the corresponding subroutine or the corresponding program code module. In this process, processor 111 reads instructions 218, 220, 222, 224, 226, 228, 230, and 232, and calculates the current check value from the read instruction and the previous check value. Instruction 232 may be, for example, a return instruction that characterizes the end of a subroutine and instructs processor 111 to return to the previous instruction flow.

[0043] Based on the return instruction 232, the processor 111 reads instructions 214 and 216 and calculates the current check value for each. Instruction 216 may be, for example, a jump instruction to jump to a specific instruction 234 or its memory address in RAM 150. The processor 111 then reads this instruction 234 and calculates the current check value. The next instruction read, 236, may again be, for example, a subroutine instruction. Based on this subroutine instruction 236, the processor 111 rereads the individual instructions 218, 220, 222, 224, 226, 228, 230, and 232 of this module and calculates the current check value for each.

[0044] Based on the fact that the return instruction 232 has been reread, the processor 111 returns to the previous instruction flow and reads instructions 238 and 240, and calculates the current check value, respectively.

[0045] Instruction 240 is, for example, a stop instruction to stop the safe driving mode. Based on this read stop instruction 240, the processor 111 stops the safe driving mode. The processor 111 also checks the current check value based on the reading of the stop instruction 240. In this process, it is checked whether the current check value calculated from the stop instruction 240 corresponds to a predetermined value, such as zero, as the final value.

[0046] If this final value does not correspond to a value of zero, it indicates that an error has occurred, and predetermined measures are taken, such as outputting an error message, shutting down the system, or transitioning to a safe state. On the other hand, if the final value corresponds to a value of zero, it indicates that there is no error. The processor 111 then returns to its normal operating mode. In this process, the processor 111 reads instructions 242 and 244 without calculating the check value.

[0047] According to one embodiment, as described below with reference to Figure 3, the current test values ​​may be checked during safe operation mode. For example, if a subroutine is large or compiled from a different source file than the rest of the instructions, it may be appropriate to check the test values ​​when starting this subroutine during safe operation mode.

[0048] As shown in Figure 3, in normal operating mode, the processor 111 reads instructions 302, 304, and 306 without calculating the test values. The next instruction read, 308, is, for example, a startup instruction, which triggers the safe operating mode. As explained above, the processor 111 then calculates the current test value from each instruction read and initializes the calculation of the test values ​​with the initial test values ​​based on the startup instruction 306.

[0049] In safe operation mode, the processor 111 first reads instruction 310, then reads subroutine instruction 312, and the subroutine is executed. In this subroutine, the processor 111 first reads verification instruction 320, and in response, the processor 111 verifies the current check value at that point. In this way, the read subroutine instruction 312 can be verified, especially immediately after its execution. In this verification, the processor 111 compares the check value calculated from the subroutine instruction 312 with, for example, a predetermined value of zero.

[0050] After this confirmation, the processor 111 reads the next instruction 322 and calculates the current check value from this instruction 322 and the previous check value (in this case, zero). Subsequently, the processor 111 reads the subroutine instructions 324, 326, 328, 330, 332, and 334, and calculates the current check value for each. Instruction 334 is, for example, a return instruction, and in response, the processor 111 returns to the previous instruction flow and executes instruction 314. This instruction 314 is also, for example, a confirmation instruction, and in response, the processor 111 reconfirms the current check value. In this way, the subroutine or its individual instructions can be confirmed, especially immediately after execution. Based on this confirmation, the processor reads the next instruction 316 and reinitializes the calculation of the check value with a new initial check value.

[0051] Next, processor 111 reads instruction 318. This instruction 318 is, for example, a jump instruction, and upon receiving it, processor 111 jumps to instruction 336 and reads it. Then, processor 111 reads instruction 338, which is, for example, another subroutine instruction. Processor 111 reads instruction 320 again to verify the current check value and reinitializes the calculation of the check value with instruction 322. Then, processor 111 rereads further subroutine instructions 324, 326, 328, 330, 332, and 334, returns to the previous instruction flow in response to return instruction 334, and reads instruction 340. This instruction 340 is also a confirmation instruction, and based on this, processor 111 verifies the current check value.

[0052] The processor 111 reads instructions 342, 344, and 346, with instruction 346 being a stop instruction, which disables the safe operation mode. In response to the stop instruction 346, the processor 111 checks the current test value. After that, the processor 111 returns to normal operation mode and reads instructions 348 and 350 without calculating the test value.

[0053] According to one embodiment, as described below with reference to Figure 4, the current test value may be verified based on a jump command. Since jump commands may, in principle, lead to potentially dangerous targets, it may be appropriate to perform verification at the time of the jump.

[0054] In the example in Figure 4, the processor 111 is already in safe operation mode, and in the process reads instructions 402, 404, 406, and 408, and calculates the current check value for each. Instruction 408 is a jump instruction for performing an indirect jump to multiple addresses or multiple further instructions 410, 416, and 424, for example.

[0055] Subsequently, the processor 111 reads these instructions 410, 416, and 424, respectively, and calculates the current check value for each. In particular, these instructions 410, 416, and 424 are confirmation instructions, and in response, the processor 111 checks the current check value for each. In this way, the read jump instruction 408 can be checked immediately after its execution. After each check, the processor 111 reads the individual instructions 412, 414, 418, 420, 422, 426, 428, and 430, and calculates the current check value for each.

[0056] For example, instruction 408 may be a subroutine instruction for executing multiple subroutines in indirect function acquisition. In this case, instructions 410, 412, and 414 characterize the first subroutine, instructions 416, 418, 420, and 422 characterize the second subroutine, and instructions 424, 426, 428, and 430 characterize the third subroutine. In this case, the last instruction 414, 422, and 430 of each subroutine may be a return instruction.

[0057] According to one embodiment, as described below with reference to Figure 5, the verification of the current check value may be performed based on a branch instruction for executing a branch of multiple instructions. In the example in Figure 5, the processor 111 is already in safe operation mode and reads instructions 502, 504, and 506, and calculates the current check value for each. Instruction 506 is, for example, a branch instruction (e.g., If-then), and as the first branch, it reads and executes instructions 508, 510, 512, 514, and 516, and as the second branch, it reads and executes instructions 520, 522, 524, 526, 528, 530, and 532.

[0058] Subsequently, the processor 111 reads the first instruction 508 or 518 of each of these two branches, which are acknowledgment instructions, and in response, the processor 111 performs an acknowledgment of the current check value. The processor 111 then reads the remaining instructions of each of the two branches.

[0059] The last instruction 516 or 532 of each of the two branches is a jump instruction, for example, to jump to instruction 534. This recombines the two branches, and the processor 111 reads this instruction 534 and the subsequent instructions 536, 538.

[0060] Furthermore, as described below with reference to Figures 6a and 6b, jump instructions or branch instructions may be used to skip instructions in the auxiliary flow or to re-execute them within a loop. In the example in Figure 6a, the processor 111 is already in safe operation mode and reads instructions 602, 604, and 606, calculating the current check value for each. Instruction 606 is a jump instruction that skips instructions 608, 610, and 612 and jumps to instruction 614. For example, the skipped instruction 608 may be a confirmation instruction.

[0061] Based on the fact that jump instruction 606 has been read, processor 111 reads instruction 614, for example, which is a confirmation instruction, and performs the corresponding confirmation. The processor then continues the instruction flow and reads instruction 616.

[0062] In the example in Figure 6b, the processor 111 is in safe operation mode and reads instructions 650, 652, 654, 656, 658, 660, 662, 664, and 666, calculating the current check value for each. Instructions 652 and 660 are, for example, confirmation instructions. Instruction 666 is a jump instruction to return to confirmation instruction 660 and reread instructions 660, 662, and 664. After this reread, the processor 111 reads instructions 668, 670, 672, 674, and 676. Instruction 668 is, for example, a confirmation instruction. Instruction 676 is a jump instruction to return to confirmation instruction 652 and reread instructions 652 through 674. The processor 111 then continues with instructions 678, 680, and 682, with instruction 678 also being a confirmation instruction.

[0063] According to one embodiment, as described below with reference to Figures 7a and 7b, the current check value may be changed using a change instruction when individual instructions are omitted or repeated. In the example in Figure 7a, the processor 111 is in safe operation mode and reads instructions 702, 704, 706, 708, and 710, each calculating the current check value. Instruction 710 is a jump instruction to jump to instruction 718 without executing instructions 712, 714, and 716. Instruction 704 is a first modify instruction that changes the current check value as if the individual instructions 712, 714, and 716 that were not executed had been executed.

[0064] In the example in Figure 7b, the processor 111 is in safe operation mode and reads instructions 750, 752, 754, 756, 758, 760, 762, 764, and 766, calculating the current check value for each. Instruction 766 is a jump instruction to return to instruction 760 and reread instructions 760, 762, and 764. Instruction 758 is a second modify instruction that changes the current check value as if instructions 760, 762, and 764 had each been executed only once.

[0065] After reloading instructions 760, 762, and 764, processor 111 loads instructions 768, 770, 772, 774, and 776. Instruction 776 is also a jump instruction that returns to instruction 752 and reloads instructions 752 through 774. Instruction 770 is a second modify instruction that changes the current check value as if each of the re-executed instructions 752 through 774 had been executed only once.

[0066] After reloading these instructions 752 through 774, the processor 111 continues loading the next instructions 778, 780, and 782. For example, instruction 780 is a second modify instruction that changes the current check value for the subsequent jump instruction.

[0067] By using these first and second modification instructions, the number of confirmation instructions can be reduced compared to Figures 6a and 6b. Furthermore, as explained below with reference to Figure 8, it is also possible to use a combination of modification and confirmation instructions.

[0068] In the example in Figure 8a, the processor 111 is in safe operation mode and reads instructions 802, 804, 806, 808, and 810, calculating the current check value for each. Instruction 810 is a jump instruction that skips instructions 812, 814, and 816 and jumps to instruction 818. Instruction 804 is a modification instruction, but the current check value is not changed for the subsequent jump instruction 810. Instructions 812 and 818 may also be confirmation instructions.

[0069] In the example in Figure 8b, the processor 111 is in safe operation mode and reads instructions 850, 852, 854, 856, 858, 860, 862, 864, and 866, calculating the current check value for each. Instruction 866 is a jump instruction to return to instruction 860 and reread instructions 860, 862, and 864. Instruction 852 is, for example, a confirmation instruction. Instruction 858 is a second modify instruction that changes the current check value as if instructions 860, 862, and 864 had been executed only once.

[0070] Processor 111 reloads instructions 860, 862, and 864, then loads instructions 868, 870, 872, 874, and 876, with instruction 876 being a jump instruction to return to acknowledgment instruction 852. Processor 111 reloads instructions 852 through 874, followed by instructions 878, 880, and 882.

Claims

1. A method for operating the calculation unit (100) in safe operation mode, The steps include reading activation commands (208, 308) for activating the safe operating mode, and activating the safe operating mode based on the read activation commands, In the aforementioned safe operation mode, the steps include: reading the instruction and calculating the current check value for the instruction currently to be executed and the previous check value, respectively; In the aforementioned safety operation mode, the step of checking the current test value at least once, Methods that include...

2. The method according to claim 1, further comprising the step of checking the current inspection value when a predetermined confirmation event occurs in the safety operation mode.

3. The aforementioned predetermined confirmation event is: Reading of the prescribed confirmation commands (314, 320, 340), Reading the jump instruction (318) to execute the jump, Loading of subroutine instructions (312, 338) for executing the subroutine, and Reading a branch instruction (408) to execute multiple instruction branches, The method according to claim 2, comprising one or more confirmation events.

4. The method according to any one of claims 1 to 3, wherein if the current check value is not checked after a predetermined maximum number of read commands and / or a predetermined maximum period has elapsed, a predetermined measure is taken.

5. In the aforementioned safe operation mode, the step of reading a stop command (240, 346) to stop the safe operation mode, The steps include: the stop command, the previous inspection value, and the current inspection value; The step of confirming the current test value, The method according to any one of claims 1 to 4, further comprising:

6. The method according to any one of claims 1 to 5, further comprising the step of reading the startup instruction, and then calculating the first instruction currently to be executed and a first check value which is a predetermined initial check value or a read initial check value as the previous check value.

7. The method according to any one of claims 1 to 6, further comprising the step of assigning a reference check value to each instruction to be read before activating the safe operation mode.

8. In the safe operation mode, if a certain number of instructions (712, 714, 716) are not executed, the first change instruction (704) is read, and the current check values ​​are changed as if each of the individual unexecuted instructions (712, 714, 716) had been executed, and / or In the aforementioned safe operation mode, if a certain number of already executed instructions (752, 754, 756, 758, 760, 762, 764, 766, 768, 770, 772, 774, 776) are re-executed, the second change instruction (758, 770, 780) is read, and the current check value of each of the re-executed instructions (752, 754, 756, 758, 760, 762, 764, 766, 768, 770, 772, 774, 776) is changed as if it had been executed only once. The method according to any one of claims 1 to 7, further comprising:

9. A computing unit (100) configured to carry out all method steps of the method described in any one of claims 1 to 8.

10. The arithmetic unit (100) according to claim 9, having a processor unit (111) based on the RISC-V instruction set architecture.

11. A computer program, when executed on the arithmetic unit (100), that causes the arithmetic unit (100) to perform all method steps of the method according to any one of claims 1 to 8.

12. A machine-readable storage medium storing the computer program described in claim 11.

Images