Method for controlling separate running of linked program blocks, and controller

• US 20150268974A1
• Filed: 10/04/2013
• Published: 09/24/2015
• Est. Priority Date: 10/09/2012
• Status: Abandoned Application

• Current Assignee: Continental Automotive GmbH (Continental AG)
• Original Assignee: Continental Automotive GmbH (Continental AG)
• Inventors: Goebel, Andre, Petkov, Thomas
• Application Number:
  US14/434,175
• Publication Number:
  US 20150268974A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 9/44552 Conflict resolution, i.e. enabling coexistence of conflicting executables

Abstract

A method controls separated running of linked program blocks which are configured for implementing functions of safety-relevant systems. A first program block is executed on a processor, the first program block being present in a first portion of a memory. A second program block is called during the execution of the first program block. The second program block is present in a second portion of the memory, which is different from the first portion. Access to the memory is monitored by a memory protection device, which initiates an exception if it is determined that the second program block is called during the execution of the first program block. An exception handler locks the first portion upon occurrence of the exception and releases the second portion for execution. The access to data is controlled by the memory protection device by use of exceptions and of the locks and releases resulting therefrom.

Claims

1-10. -10. (canceled)

11. A method for controlling separate running of linked program blocks configured for implementing functions of safety-relevant systems, which comprises the steps of:

executing a first program block of the linked program blocks on a processor, the first program block being stored in a first section of a memory accessed by the processor;

calling up a second program block of the linked program blocks during an execution of the first program block, the second program block being stored in a second section of the memory being different than the first section of the memory;

monitoring accesses to the memory by a memory protection device, the memory protection device triggering an exception if the monitoring of the accesses by the memory protection device prompts ascertainment that during the execution of the first program block the second program block is called; and

prompting an exception handler to disable the first section and to enable the second section for execution upon an occurrence of the exception.

12. The method according to claim 11, which further comprises executing the second program block after an enablement of the second section and at an end of the execution of the second program block a return takes place causing the second section to be disabled by the exception handler and the first section to be enabled by the exception handler for further execution, and the return triggers a further exception.

13. The method according to claim 11, which further comprises:

during the execution of the first or the second program block, calling at least one further program block stored in a section of the memory, which is different than the first and second sections for the first and second program blocks; and

triggering, via the memory protection device, an additional exception when the further program block is called, an occurrence of the additional exception prompts the exception handler to disable the section of the memory that contains a calling program block and to enable the section of the memory that contains a called program block, and the called program block is executed by the processor following enablement.

14. The method according to claim 11, which further comprises:

continuously disabling access to the second section while the first program block is executed; and

continuously disabling access to the first section while the second program block is executed.

15. The method according to claim 11, wherein the first program block has an associated first data section for data that are stored by the first program block and also read, and the second program block has an associated second data section, which is different than the first data section, for data that are stored by the second program block and also read, wherein the exception handler disables the first data section when calling of the second program block by the first program block triggers an exception, and the exception handler disables the second data section when calling of the first program block by the second program block triggers an exception.

16. The method according to claim 11, which further comprises:

providing the first program block with a different associated safety level than the second program block; and

forming the program blocks on a basis of ISO standard 26262 and are classified in accordance with an ASIL categorizations A-D or QM, the first and second program blocks being classified differently.

17. The method according to claim 11, wherein:

the exception is an interrupt;

the interrupt is at least one of triggered or processed inside or outside the processor; and

the interrupt is maskable or unmaskable, or the interrupt corresponds to a trap exception or to a fault exception.

18. The method according to claim 11, wherein an exception that is triggered when a program block calls a program block with a different safety level is executed by the exception handler with a different priority than an exception that is triggered when the program block calls the program block with the different safety level.

19. The method according to claim 11, wherein an exception that is triggered when a program block calls a program block with a higher safety level is executed by the exception handler with a higher priority than an exception that is triggered when the program block calls the program block with a lower safety level.

20. The method according to claim 12, which further comprises prompting the exception handler to disable the second section and to enable the first section for execution after an occurrence of the further exception.

21. The method according to claim 17, which further comprises selecting the interrupt from the group consisting of a hardware interrupt and a software interrupt.

22. A controller, comprising:

a data processing apparatus having a memory, a processor and a memory protection device;

said memory being connected to said processor and having a first and also at least one second program block being stored in first and second sections of said memory, said first section and said second section being different from one another;

the first and the at least one second program block are linked to one another and said memory protection device embodied with programming or with a connection to said memory that prompts said memory protection device to trigger an exception when the first program block, being stored in said first section, calls the second program block, being stored in said second section;

said data processing apparatus further having an exception handler connected to said memory protection device for receiving the exception; and

said exception handler being connected to said memory protection device and thereby being set up to be prompted by a reception of the exception to disable a logical connection between said first section of said memory and said processor and to enable a further logical connection between said second section of said memory and said processor for executing the second program block on said processor.

23. The controller according to claim 22, wherein the first program block has a different safety level than the second program block, and the program blocks are formed on a basis of ISO standard 26262 and are classified in accordance with an ASIL categorizations A-D or QM, the first and second program blocks being classified differently.

24. The controller according to claim 22, wherein the controller is a vehicle controller.