Functional safety system, safety control method for the functional safety system, and functional safety program

A safety control method of a functional safety system,

• the system comprising:
• a first semiconductor chip configured to perform functional control for controlling a circuit to be controlled and functional safety control for safety control on the functional control;
• and
• a second semiconductor chip configured to perform at least the functional safety control on the functional control,
• the first semiconductor chip and the second semiconductor chip each including:
• an arithmetic section that executes pieces of software in a timesharing manner;
• a plurality of hardware resources used by the software executed in the arithmetic section;
• space domain separation hardware that limits access to the hardware resources accessible by each piece of the software;
• and
• a timer that counts an execution time for each piece of the software in the arithmetic section,
• the method comprising the steps of:
• intermittently executing safety unit software for performing the functional safety control in the arithmetic section of each of the first semiconductor chip and the second semiconductor chip;
• performing separation such that setting correctness diagnosis is made to diagnose correctness of an access limit set value that is a set value of an access limit imposed by the space domain separation hardware at switching of the software executed in the arithmetic section, the access limit set value is rewritten, and a separation signature value indicating operation history information on the setting correctness diagnosis and the rewriting is generated;
• making self-diagnosis such that whether the safety unit software has normally run is diagnosed based on a safety unit signature value that describes operation history information on the safety unit software, the information being generated by the safety unit software;
• and
• making mutual diagnosis such that mutual diagnosis signature values including the separation signature value and the safety unit signature value of the semiconductor chip are generated, the first semiconductor chip and the second semiconductor chip transmit and receive the mutual diagnosis signature values to and from each other, and correctness of the mutual diagnosis signature value received from the other is diagnosed.

A functional safety program in a functional safety system,

• the functional safety system comprising:
• a first semiconductor chip configured to perform functional control for controlling a circuit to be controlled and functional safety control for safety control on the functional control;
• and
• a second semiconductor chip configured to perform at least the functional safety control on the functional control,
• the first semiconductor chip and the second semiconductor chip each including:
• an arithmetic section that executes pieces of software in a timesharing manner;
• a plurality of hardware resources used by the software executed in the arithmetic section;
• space domain separation hardware that limits access to the hardware resources accessible by each piece of the software;
• and
• a timer that counts an execution time for each piece of the software in the arithmetic section,
• wherein a safety control program is executed in the arithmetic section of the first semiconductor chip and the arithmetic section of the second semiconductor chip,
• wherein the safety control program includes a first safety control program executed on the first semiconductor chip and a second safety control program executed on the second semiconductor chip,
• wherein the first safety control program and the second safety control program intermittently execute safety unit software for the functional safety program in a predetermined cycle, in the respective arithmetic sections of the first and second semiconductor chips,
• wherein separation is performed such that setting correctness diagnosis is made to diagnose correctness of an access limit set value that is a set value of an access limit imposed by the space domain separation hardware at switching of the software executed in the arithmetic section, the access limit set value is rewritten, and a separation signature value indicating operation history information on the setting correctness diagnosis and the rewriting is generated,
• wherein self-diagnosis is made such that whether the safety unit software has normally run is diagnosed based on a safety unit signature value that describes operation history information on the safety unit software, the information being generated by the safety unit software, and
• wherein mutual diagnosis is made such that mutual diagnosis signature values including the separation signature value and the safety unit signature value of the semiconductor chip are generated, the first semiconductor chip and the second semiconductor chip transmit and receive the mutual diagnosis signature values to and from each other, and correctness of the mutual diagnosis signature value received from the other is diagnosed.