Control apparatus with access monitoring unit configured to request interrupt process

In a control apparatus which uses a CPU which does not have hardware for memory protection, a function is realized to detect unauthorized writing from a non-safety-related unit program in units of bits, for a safety-related unit data area of a RAM, a safety-related unit register area of an external integrated circuit, and a built-in peripheral I/O register of the CPU. A memory access monitoring unit requests an interrupt process upon detection of a write access of the safety-related unit program permitted to access a safety-related unit region. The interrupt process realizes a function to detect write access from a non-safety-related unit program area by using a program counter of a write access origin retracted to a stack area to judge whether the write access origin is a safety-related unit program or the non-safety-related unit program area, and judge, in units of bits, whether or not there is a change to a safety-related unit region.

CROSS REFERENCE TO RELATED APPLICATION

The present invention claims priority under 35 U.S.C. § 119 to Japanese Patent Application No. 2016-203657 filed on Oct. 17, 2016, the entire content of which is incorporated herein by reference.

TECHNICAL FIELD

The present disclosure relates to a control apparatus having a safety-related unit designed in accordance with a functional safety standard. In particular, the present disclosure relates to a control apparatus having a non-safety-related unit writing detection function, equipped with a function in which unexpected writing, to a RAM or a control register used by a safety-related unit program executed on a CPU in the safety-related unit, from a non-safety-related unit program executed on the same CPU, is detected in units of bits, and the system transitions to a safe state.

BACKGROUND

International standards related to functional safety, such as the IEC 61508 series or the like, require that a system is designed such that a safety-related unit which executes a safety function is not affected by failure of a non-safety-related unit which executes a normal function, or by design errors.

IEC 61508-3:2010 defines that, when software executes safety functions having different levels of safety, it must be proven either that independency is achieved in both time space regions, or that invasion of the independency is controlled. An attachment to the standard shows examples of methods for achieving non-interference between software elements on the same computer. Because of this, in general, in a control apparatus having a safety-related unit, a higher privilege level is assigned to safety-related software so that only the safety-related software can access and write in a RAM or a safety-related register which stores safety-related variables, and a memory administration unit or a memory protection unit specifies, for each privilege level, a space in which write access is allowed. Meanwhile, most types of installation-usage CPUs of recent years do not have the memory administration unit or the memory protection unit. Thus, the protection method using the privilege mode cannot be easily utilized.

JP 2013-148999 A (“Patent Document 1”) discloses a method of providing a function to prevent write access from a non-safety-related unit on a safety-related unit register in an external integrated circuit, even for a control apparatus which uses a CPU which does not have a privilege mode for system protection.

Further, JP 2000-76135 A (“Patent Document 2”) discloses a method of preventing execution of an unintended memory access instruction, by adding small-size hardware which judges a program counter and an access destination memory address, during decoding of the memory access instruction, in a CPU which does not have the privilege mode.

However, the protection method of Patent Document 2 cannot be used in a CPU which does not have the hardware which judges both the program counter and the access destination memory address during instruction decoding by the CPU.

On the other hand, for example, for an internal register of the CPU, there is a demand for preventing write access from the non-safety-related unit, in units of bits. However, with the privilege mode which designates an access region in units of addresses, the protection method of Patent Document 2, and the protection method of Patent Document 1 in which the safety-related unit register and the non-safety-related unit register are separated by an external integrated circuit and the safety-related unit register is then protected, the protection in units of bits cannot be executed. Because of this, for example, when both a safety-related I/O terminal and a non-safety-related I/O terminal exist as I/O terminals of the CPU, it is necessary to apply a particular measure such as, for example, designing CPU peripheral circuits so that the terminals can be set independently in different registers, or executing an output process for the non-safety-related I/O terminal with safety-related firmware. In the related art, such restriction on the design occurs in the hardware and the firmware.

An advantage of the present disclosure lies in provision, in a control apparatus having a safety-related unit designed in accordance with a functional safety standard, of a non-safety-related unit write detection function, equipped with a function in which the system transitions to a safe state even when there is an unexpected write to a RAM or a control register used by a safety-related unit program executed on a CPU in a safety-related unit, or an arbitrary bit in the RAM or the control register, by a non-safety-related unit program executed on the same CPU, using a CPU which does not have hardware for memory protection.

SUMMARY

In a functional safety standard, it is sufficient for the system to be able to transition to a safe state when an abnormality of the system is detected. Thus, it is not necessary to prevent changing of the memory or the register by an unauthorized access, and it is sufficient that a function is provided to detect the unauthorized access and transition the system to the safe state. On the other hand, some installation-usage CPUs have an access monitoring unit which monitors a state of an address bus, which judges, for an access to an arbitrary address, whether or not at least an address range and the type of read/write match preset values, and which requests an interrupt process to the CPU. For example, for the purpose of program debugging which does not use an in-circuit emulator, there exist commercially available, installation-usage CPUs having the access monitoring unit. When a CPU having the access monitoring unit is used, an interrupt process occurs for write access to the RAM or the control register used by the safety-related unit program. An address range of a ROM region storing the safety-related unit program and an address range of a ROM region storing the non-safety-related unit program are separated. An interrupt process uses a program counter retracted to a stack area, to judge whether the write access is by the safety-related unit program or by the non-safety-related unit. For the write access by the non-safety-related unit, the interrupt process compares with backup data to judge whether or not there is a data change for the bit used by the safety-related unit. The backup data is set during write access by the safety-related unit, or during initialization.

In the present disclosure, an interrupt process is generated for write access to an arbitrary bit of a RAM or a control register used by the safety-related unit program. In the interrupt process, it is judged, based on a program counter retracted to a stack, whether the origin of the write access is a safety-related unit program or a non-safety-related unit program. In the case of the write access by the non-safety-related program, in the interrupt process, the data is compared with the backup data, and it is judged whether or not there is a data change in a safety-related bit. When there is a change in the safety-related bit, in the interrupt process, an error process is executed and the system transitions to a safe state.

DESCRIPTION OF EMBODIMENTS

An embodiment of the present disclosure will now be described for a control apparatus having a function to detect writing by a non-safety-related unit. First, an embodiment in which write detection is executed in units of bits for a built-in peripheral I/O register8of a CPU will be described with reference to a block diagram ofFIG. 2and a flowchart ofFIG. 1. As a data area related to a safety function, a safety-related unit data area52is provided in a built-in RAM5. In addition, as a control register related to the safety function, a safety-related unit register area72is provided in an external integrated circuit7. Further, in the built-in peripheral I/O register8which sets the operation of the CPU1, a non-separated register81which is used by both the safety function and a non-safety function is provided. The non-separated register81includes a safety-related bit812related to the safety function and a non-safety-related bit811which is not related to the safety function. InFIG. 2, as the non-separated register81, a case is exemplified which uses a register which sets an output of the I/O port9. In the I/O port9, output levels of a safety output terminal92related to the safety function and a non-safety output terminal91which is not related to the safety function vary respectively by settings of the safety-related bit812and the non-safety-related bit811. It is necessary to prevent a non-safety-related processing routine operated on the CPU from erroneously write-accesses these memories, registers, and particular bits in the registers related to the safety function, more specifically, the safety-related unit data area52, the safety-related unit register area72, and the non-separated register area81(hereinafter referred to as “safety-related unit region”). In the present embodiment, the “safety-related processing routine” refers to a particular program which is designed for safety, and is a routine which is permitted to access the safety-related unit region. On the other hand, a “non-safety-related processing routine” refers to a program other than the safety-related processing routine, and is a routine which is not permitted to access the safety-related unit region.

FIG. 2is a block diagram related to memory access of a microcomputer equipped with a memory access monitoring unit10. A CPU core2reads a program from a built-in ROM4through an internal bus3, and executes processes such as a calculation process, an access process to the built-in RAM5, an access process to the external integrated circuit7, and an access process to the built-in peripheral I/O register8. The accesses to the built-in RAM5and the built-in peripheral I/O register8are executed through the internal bus3, and the access to the external integrated circuit7is executed through the internal bus3and a BSC (bus state controller)6. The memory access monitoring unit10monitors a bus cycle of the internal bus3, and can issue, through an INTC (interrupt controller)11, an interrupt signal to the CPU core2in response to a read/write access or the like to a particular address.

FIG. 3is a diagram showing an example address map in the present embodiment. An address assignment range of the built-in ROM4(built-in ROM region), an address assignment range of the built-in RAM5(built-in RAM region), an address assignment range of the external integrated circuit7(external memory region), and an address assignment range of the built-in peripheral I/O register8(built-in peripheral I/O region) are determined by the type of the CPU. The address assignment range of the built-in ROM4includes a non-safety-related unit program area41in which the non-safety-related processing routine is stored, and a safety-related unit program area42in which the safety-related processing routine is stored. The addresses thereof are respectively designated during compiling, so that each of the address ranges is a consecutive address range. The address assignment range of the built-in RAM5includes a non-safety-related unit data area51in which data of the non-safety-related function is stored, a safety-related unit data area52in which data of the safety-related function is stored, and a stack area53. The addresses thereof are respectively designated during compiling, so that each of the address ranges is a consecutive address range. The address assignment range of the external integrated circuit7includes a non-safety-related unit register area71in which a register of the non-safety-related function is stored, and a safety-related unit register area72in which a register of the safety-related function is stored. The external integrated circuit7is designed so that each of the address ranges is a consecutive address range. In the built-in peripheral I/O register8, a bit pattern of 1 is set in advance for the safety-related bit812in the non-separated register81, and a bit pattern of 0 is set in advance for the non-safety-related bit811in the non-separated register81. These bit patterns are stored as safety-related bit pattern data421in the safety-related unit program area42.FIG. 3shows the non-safety-related bit811and the safety-related bit812as consecutive bits, but alternatively, the non-safety-related bit811and the safety-related bit812may be non-consecutive within the register. The data of the safety-related bit which is set by the program of the safety-related unit is stored as safety-related bit backup data521in the safety-related unit data area52.

FIG. 1is a flowchart showing execution content of the detection process of writing to the safety-related unit data area52and the operations of each unit inFIG. 1in the present embodiment. In the flowchart ofFIG. 1, a routine on the left side is a non-safety-related unit processing routine or a safety-related unit processing routine, and, for example, a processing routine having the highest priority is executed by an interrupt process. When the processing routine write-accesses the safety-related unit region, the memory access monitoring unit10detects the write access, and outputs an interrupt signal through the INTC11to the CPU core2.

When the CPU core2receives the interrupt signal, the CPU core2executes retraction of the status register and the program counter to the stack area53by a hardware process, and then executes an interrupt processing routine. In the interrupt processing routine, a program counter which is retracted to the stack area53is read, and it is judged whether or not the program counter retracted to the stack region is included in the address range of the safety-related unit data area52. When the program counter is not included in the address range, the interrupt processing routine judges that the access is a write access from the non-safety-related unit data area51. On the other hand, when the program counter is included in the address range, the interrupt processing routine judges that the access is a write access from the safety-related unit data area52.

In the case of the write access from the safety-related unit data area52, for the write access to the non-separated register81, a logical product of the non-separated register81and the safety-related bit pattern data421is determined, and is stored in the safety-related bit backup data521. In the event that the value of the safety-related bit812of the non-separated register81is not changed after the initial setting, the present step may be omitted.

In the case of the write access from the non-safety-related unit data area51, if the write access is to the safety-related unit data area52or the safety-related unit register area72, an error process is executed. For the write access to the non-separated register81, it is judged whether or not the logical product between the non-separated register81and the safety-related bit pattern data421matches the safety-related bit backup data521, and, when the values do not match, a change in the safety-related bit812is judged, and an error process is executed.

The detection process of writing to the safety-related unit region by the interrupt is executed for all write accesses to the safety-related unit region, regardless of whether the access is a write access from the non-safety-related processing routine or a write access from the safety-related processing routine. With the writing detection process, a process time is increased, but because normally, in the non-safety-related processing routine, only the write access to the non-separated register81is executed and the write access frequency to the non-separated register is low, the increase in the process time does not cause a problem. Moreover, in the safety-related processing routine, normally the routine is executed with a low priority level, and thus the increase in the process time by the writing detection process does not cause a problem.

As described, by executing the write detection process of the flowchart ofFIG. 1using the CPU shown inFIG. 2, it becomes possible to realize a function in which unexpected writing of the RAM or the register used by a safety-related program, or a particular bit of the RAM and the register, is detected, and the system transitions to a safe state.

REFERENCE SIGNS LIST