A fault information saving system and method

Abstract

The application relates to the technical field of automobile electronic function safety, and discloses a fault information storage system and method. The system comprises an FCCU fault collection module, which is used for detecting SRAM ECC errors and determining error types; a non-key fault channel receives single-bit errors, and a key fault channel receives double-bit errors; a hierarchical response decision module is used for determining corresponding write modes according to the error types; a double-buffered flash memory write module and a state machine management module are used for cooperatively executing write operations corresponding to the write modes; if an emergency write mode is triggered, a blocking flash memory write operation is executed, a state code is updated from a first value to a second value in a decreasing manner, fault information of the double-bit errors is written into the tail part of a main storage sector and a backup storage sector, the state code is updated from the second value to a third value in a decreasing manner after the writing is completed, and a safety state conversion of an automobile electronic controller is triggered. The system has good reliability when storing fault information.

Description

Technical Field

[0001] This invention relates to the field of automotive electronic functional safety technology, specifically to a fault information storage system and method. Background Technology

[0002] With the development of automotive intelligence, fault tracing is becoming increasingly important. As a hardware fault monitoring module for automotive-grade chips, the FCCU (Fault Collection and Control Unit) can capture ECC (Error Correction Code) errors in SRAM (Static Random Access Memory) caused by environmental interference in real time. To meet the safety closed-loop requirements, the fault information of this ECC error must be persistently stored.

[0003] In related technologies, fault information captured by the FCCU is typically temporarily stored in registers or RAM (Random Access Memory), or directly written to Flash memory. However, this approach has the following drawbacks: 1. Volatility: Information temporarily stored in registers or RAM will be lost after a severe fault triggers a system reset, failing to meet traceability requirements; 2. Low write reliability: Direct writing to Flash requires millisecond-level erase operations, which may not be completed before a system reset. Power loss caused by a reset can easily lead to data corruption, and the lack of backup poses a single point of loss risk; 3. Uniform response strategy: It does not distinguish between correctable single-bit errors (SBE) and uncorrectable double-bit errors (DBE). Uniform handling may lead to over-responding to single-bit errors, affecting system availability, or under-responding to double-bit errors, resulting in high security risks. Summary of the Invention

[0004] This invention provides a fault information storage system and method to solve the problem of low reliability in fault information storage schemes in related technologies.

[0005] In a first aspect, the present invention provides a fault information storage system applied to an automotive electronic controller, the system comprising: The FCCU fault collection module is configured with a non-critical fault channel and a critical fault channel for detecting SRAM ECC errors and determining the error type; wherein, the non-critical fault channel receives single-bit errors, and the critical fault channel receives double-bit errors. A graded response decision module, connected to the FCCU fault collection module, is used to determine the corresponding write mode according to the error type; wherein, a double-bit error triggers an emergency write mode, and a single-bit error triggers a buffer write mode. The dual-buffered flash write module includes physically independent primary storage sectors and backup storage sectors; The state machine management module is used to mark the lifecycle of fault information entries by using the physical characteristic of flash memory bits changing from 1 to 0 and employing decrementing state encoding. The dual-buffered flash memory writing module and the state machine management module are also used to collaboratively execute the write operation corresponding to the write mode; wherein, if the emergency write mode is triggered, the dual-buffered flash memory writing module performs a blocking flash memory write operation, the state machine management module updates the status code from a first value to a second value to mark that writing is in progress, the dual-buffered flash memory writing module appends the fault information corresponding to the double-bit error to the end of the main storage sector without erasure, and appends it to the backup storage sector without erasure, and after the writing is completed, the state machine management module updates the status code from a third value to mark it as valid, so as to trigger the safety state transition of the automotive electronic controller.

[0006] Secondly, the present invention provides a fault information storage method, applied to an automotive electronic controller, the method comprising: SRAM ECC errors are detected and error types are determined by the FCCU fault collection module; the FCCU fault collection module is configured with a non-critical fault channel and a critical fault channel; the non-critical fault channel receives single-bit errors and the critical fault channel receives double-bit errors. The hierarchical response decision module determines the corresponding write mode based on the error type; wherein, a double-bit error triggers an emergency write mode, and a single-bit error triggers a buffer write mode. The write operation corresponding to the write mode is executed by a dual-buffered flash memory write module and a state machine management module; the dual-buffered flash memory write module includes physically independent main storage sectors and backup storage sectors; the state machine management module uses the physical characteristic of flash memory bits changing from 1 to 0 to mark the life cycle of fault information entries with a decrementing state code. If the emergency write mode is triggered, a blocking flash write operation is performed through the dual-buffered flash write module, and the state code is updated from the first value to the second value through the state machine management module to mark that writing is in progress. The fault information corresponding to the double-bit error is appended to the end of the main storage sector without erasure and appended to the backup storage sector without erasure. After the writing is completed, the state code is updated from the first value to the third value through the state machine management module to mark it as valid, thereby triggering the safety state transition of the automotive electronic controller.

[0007] In one optional implementation, if the buffer write mode is triggered, the fault information corresponding to the single-bit error is saved to the SRAM buffer, and the fault information is asynchronously appended to the end of the currently active storage sector by a low-priority task without erasure.

[0008] In one optional implementation, the step of saving the fault information corresponding to the single-bit error to an SRAM buffer, and then having a low-priority task asynchronously append the fault information to the end of the currently active memory sector without erasure, includes: The fault information corresponding to the single-bit error is quickly saved to the SRAM buffer, and a background write request is marked. The background write request is responded to by a low-priority task, and the state machine management module updates the state code from the first value to the second value to mark that writing is in progress. The fault information in the SRAM buffer is appended to the end of the currently active storage sector without erasure. After the write is completed, the state code is decremented and updated to the third value through the state machine management module to mark it as valid.

[0009] In one optional implementation, the step of using the physical characteristic of flash memory bits changing from 1 to 0 to mark the lifecycle of fault information entries with a decrementing state code includes: When the fault information entry is empty, the status code remains the first value of all 1s; When the fault information entry is started to be written, the highest bit is set from 1 to 0 to obtain the second value of the marker being written; Once the write operation is complete and the verification is successful, the second highest bit is set from 1 to 0 to obtain the third value that marks the data as valid. After the fault information entry is read and processed, the third bit is set from 1 to 0 to obtain the fourth value that marks it as read.

[0010] In an optional implementation, the double-buffered flash write module is further configured to perform dual-sector cyclic management, and the method further includes: When the primary storage sector is in a write state, the backup storage sector is in a standby state or a background erase state. When it is detected that the currently written storage sector is full, the atomic switch to another storage sector that is in a waiting state. After the switch is complete, initiate a background erase operation on the already filled storage sectors.

[0011] In an optional implementation, after appending the fault information corresponding to the double-bit error to the primary storage sector / the backup storage sector without erasure, the method further includes: Write a magic number identifier at the beginning of the fault information entry, where a first specific identifier is used to identify a double-bit error and a second specific identifier is used to identify a single-bit error; Assign a globally incrementing sequence number to each fault information entry; The check code for a 32-bit cyclic redundancy check is calculated and written based on the data content of the fault information entry.

[0012] Thirdly, the present invention provides a fault information storage device applied to an automotive electronic controller, the device comprising: An error detection module is used to detect SRAM ECC errors and determine the error type through the FCCU fault collection module; the FCCU fault collection module is configured with a non-critical fault channel and a critical fault channel; the non-critical fault channel receives single-bit errors, and the critical fault channel receives double-bit errors. The mode determination module is used to determine the corresponding write mode based on the error type through the hierarchical response decision module; wherein, a double-bit error triggers an emergency write mode, and a single-bit error triggers a buffer write mode. The mode execution module is used to execute the write operation corresponding to the write mode through the double-buffered flash write module and the state machine management module; the double-buffered flash write module includes physically independent main storage sectors and backup storage sectors; the state machine management module uses the physical characteristic of flash bits changing from 1 to 0 to mark the life cycle of fault information entries with decrementing state codes. If the emergency write mode is triggered, a blocking flash write operation is performed through the dual-buffered flash write module, and the state code is updated from the first value to the second value through the state machine management module to mark that writing is in progress. The fault information corresponding to the double-bit error is appended to the end of the main storage sector without erasure and appended to the backup storage sector without erasure. After the writing is completed, the state code is updated from the first value to the third value through the state machine management module to mark it as valid, thereby triggering the safety state transition of the automotive electronic controller.

[0013] Fourthly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the fault information storage method of the first aspect or any corresponding embodiment described above.

[0014] Fifthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the fault information saving method of the first aspect or any corresponding embodiment thereof.

[0015] In a sixth aspect, the present invention provides a computer program product, including computer instructions for causing a computer to execute the fault information storage method described in the first aspect or any corresponding embodiment thereof.

[0016] The technical solution provided by this invention may include the following beneficial effects: The fault information storage system provided by this invention, through the configuration of non-critical and critical dual channels of the FCCU fault collection module, combined with the hierarchical response decision module to distinguish between single-bit and double-bit errors, triggers buffered and emergency write modes respectively. This overcomes the shortcomings of related technologies, such as over-response for single-bit errors or insufficient response for double-bit errors caused by the unified processing strategy, and achieves hierarchical and precise response, balancing system availability and security. By setting up a dual-buffered flash memory write module, using physically independent primary and backup sectors, dual backup writing is performed synchronously in emergency mode. This physically avoids the risk of loss of critical information due to damage to a single sector, realizing a dual-buffered redundancy mechanism and eliminating the risk of single-point failure. In emergency write mode, the state machine management module and the dual-buffered flash memory write module work together, utilizing the physical characteristic of flash memory bits changing from "1" to "0", using a decrementing state encoding combined with non-erasing append writing to the end of the sector. This eliminates time-consuming erasure operations and can complete primary and backup dual writing and status confirmation within a very short blocking window, ensuring that fault information is safely and completely saved before triggering the safe state transition of the automotive electronic controller, meeting functional safety traceability requirements. Attached Figure Description

[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the structure for storing fault information according to an embodiment of the present invention; Figure 2 This is a schematic flowchart of a first method for saving fault information according to an embodiment of the present invention; Figure 3 This is a schematic diagram of a second process for a fault information storage method according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the item lifecycle state machine according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the third process of the fault information storage method according to an embodiment of the present invention; Figure 6This is a structural block diagram of a fault information storage device according to an embodiment of the present invention; Figure 7 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0021] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0022] With the development of automotive intelligence, the computational tasks undertaken by microcontrollers (MCUs) in automotive electronic control units (ECUs) are becoming increasingly heavy, and their operational complexity and safety criticality are rising sharply. To meet increasingly stringent automotive-grade safety requirements, the ISO 26262 functional safety standard places extremely high demands on the fault diagnosis, safety mechanism response, and fault tracing capabilities of vehicle control systems. The FCCU (Fault Collection and Control Unit), as a module specifically designed for hardware-level fault monitoring within automotive-grade chips, is widely used. When an anomaly occurs during chip operation, the FCCU can capture and report the fault in real time. SRAM (Static Random Access Memory) is highly susceptible to bit flips due to environmental factors such as high-energy particle impacts, electromagnetic interference, or voltage fluctuations, resulting in ECC (Error Correction Code) errors. To achieve a functional safety closed loop in the system, the fault information corresponding to SRAM ECC errors detected by the FCCU must be persistently saved for fault tracing and root cause analysis after power-down and restart.

[0023] In related technologies, fault information captured by the FCCU is typically temporarily stored in volatile memory, such as registers or RAM (Random Access Memory), or directly written to non-volatile memory, such as Flash memory, to solve the problem of fault information storage and traceability. However, this approach has the following drawbacks: 1. Volatility of fault information. Since SRAM ECC errors, especially double-bit errors (DBE), usually indicate serious hardware failures, they can easily trigger an emergency system reset. Once the system is reset, the data in the volatile memory will be cleared, resulting in the permanent loss of critical fault context information, which completely fails to meet the ISO 26262 functional safety standard's strict requirements for fault traceability. 2. Low write reliability. Some related technologies recognize the shortcomings of volatile storage and attempt to write fault information directly to Flash memory. However, due to the physical characteristics of Flash memory, direct writing faces significant reliability risks: First, Flash memory must undergo an erase operation before new data can be written, a process that takes a considerable amount of time (typically in the milliseconds). Severe system failures leave very little window for software to respond, often resulting in a system reset before the Flash erase and write operations are complete, leading to write failure. Second, a sudden power outage during writing or erasing can severely damage the data structures in the Flash memory. Finally, the technology lacks a redundancy backup mechanism; if the Flash sector being written to has physical bad blocks or a single point of failure, the fault information will be completely lost. 3. Single response strategy. The uniform processing strategy used in handling SRAM ECC errors fails to distinguish between correctable single-bit errors (SBE) and uncorrectable double-bit errors (DBE). This can lead to over-responding to single-bit errors, affecting system real-time performance and availability, or under-responding to double-bit errors, resulting in the failure to reliably and timely save critical fault information, posing a significant security risk.

[0024] Figure 1 This is a schematic diagram of a fault information storage system according to an embodiment of the present invention. This fault information storage system is applied to an automotive electronic controller, such as... Figure 1 As shown, the system includes an FCCU fault collection module, a hierarchical response decision module, a dual-buffered flash memory writing module, and a state machine management module.

[0025] The FCCU fault collection module is configured with a non-critical fault channel and a critical fault channel to detect SRAMECC errors and determine the error type; the non-critical fault channel receives single-bit errors, and the critical fault channel receives double-bit errors. The graded response decision module is connected to the FCCU fault collection module and is used to determine the corresponding write mode according to the error type; wherein, a double-bit error triggers the emergency write mode and a single-bit error triggers the buffer write mode.

[0026] This dual-buffered flash write module includes physically independent primary storage sectors and backup storage sectors.

[0027] This state machine management module utilizes the physical characteristic of flash memory bits changing from 1 to 0 to mark the lifecycle of fault information entries using a decrementing state code.

[0028] The dual-buffered flash memory writing module and the state machine management module are also used to collaboratively execute the write operation corresponding to the write mode. If the emergency write mode is triggered, the dual-buffered flash memory writing module performs a blocking flash memory write operation, and the state machine management module updates the status code from a first value to a second value to mark the write as in progress. The dual-buffered flash memory writing module appends the fault information corresponding to the double-bit error to the end of the main storage sector without erasure and appends it to the backup storage sector without erasure. After the write is completed, the state machine management module updates the status code from a third value to mark it as valid, thereby triggering the safety state transition of the automotive electronic controller.

[0029] The FCCU fault collection module detects SRAM errors and classifies their severity. It uses a non-critical fault channel to receive minor single-bit errors and a critical fault channel to receive severe double-bit errors. The write mode indicates the strategy level for saving faulty data to non-volatile memory. The urgent write mode indicates the highest priority strategy, requiring immediate cessation of the current task's execution, while the buffered write mode indicates a low-priority strategy, temporarily storing the data and delaying execution. The hierarchical response decision module receives the error type from the FCCU fault collection module and determines how to save the data based on the error's severity. If a severe double-bit error is received, the urgent write mode is triggered; if a minor single-bit error is received, the buffered write mode is triggered. Flash memory is a type of non-volatile memory where data is retained even after power loss. A sector is the smallest physical unit for erasing data in flash memory. Physical independence refers to the existence of two physically separate, non-interfering storage areas, one working while the other is in standby mode, used alternately. This dual-buffered flash memory write module avoids data loss due to single-point failures by setting physically independent primary and backup storage sectors. The physical characteristic of flash memory bits changing from 1 to 0 means that during writing, data bits can only be changed from "1" to "0". Changing "0" back to "1" requires a time-consuming block erase operation. Decreasing status coding utilizes this physical characteristic, using specific status bits to sequentially change from "1" to "0" (e.g., decreasing values) to represent different stages of data. The lifecycle of a fault information entry refers to the entire state evolution of a fault record from the start of writing, to completion, and finally to being read. By setting up this state machine management module, each written fault record can be labeled with a status tag. Utilizing the characteristic that flash memory can only write "1" to "0", the decrementing value marks the current stage of the fault record's lifecycle. When a severe double-bit error occurs, the dual-buffered flash memory write module and the state machine management module work together to perform the following operations: First, the dual-buffered flash memory write module performs a blocking flash memory write operation, suspending other system tasks and prioritizing data writing. Simultaneously, the state machine management module decrements the status code from the initial first value to the second value, labeling it "Writing in Progress." Next, the dual-buffered flash memory write module employs an erase-free append-only write technique, eliminating the time-consuming erase step and directly writing the fault information to the end of the current primary storage sector. It then similarly writes it to the end of the current backup sector, achieving dual backup. After writing, the state machine management module decrements the status code again to the third value, labeling it "Valid." Finally, only after confirming that the critical fault information has been safely saved will the system trigger the automotive electronic controller's safety state transition, notifying the controller that the data has been preserved and it can safely enter a reset or degradation protection state.

[0030] The fault information storage system provided in this embodiment, through the non-critical channel and critical dual-channel configuration of the FCCU fault collection module, combined with the hierarchical response decision module to distinguish between single-bit and double-bit errors, triggers buffered and emergency write modes respectively. This overcomes the shortcomings of related technologies where the unified processing strategy leads to over-response for single-bit errors or insufficient response for double-bit errors, achieving hierarchical and precise response and balancing system availability and security. By setting up the dual-buffered flash memory write module, using physically independent primary and backup sectors, dual backup writing is performed synchronously in emergency mode. This physically avoids the risk of losing critical information due to damage to a single sector, realizing a dual-buffered redundancy mechanism and eliminating the risk of single-point failure. In emergency write mode, the state machine management module and the dual-buffered flash memory write module work together, utilizing the physical characteristic of flash memory bits changing from "1" to "0", using a decrementing state encoding combined with non-erasing append writing to the end of the sector. This eliminates time-consuming erasing operations and can complete primary and backup dual writing and status confirmation within a very short blocking window, ensuring that fault information is safely and completely saved before triggering the safe state transition of the automotive electronic controller, meeting functional safety traceability requirements.

[0031] According to an embodiment of the present invention, a method for saving fault information is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0032] This embodiment provides a method for storing fault information, applied to automotive electronic controllers. Figure 2 This is a flowchart of a fault information saving method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps: Step S201: Detect SRAM ECC errors and determine the error type using the FCCU fault collection module.

[0033] The FCCU fault collection module is configured with a non-critical fault channel and a critical fault channel; the non-critical fault channel receives single-bit errors, and the critical fault channel receives double-bit errors.

[0034] Please see details Figure 1 The embodiments shown are not described in detail here.

[0035] Step S202: The hierarchical response decision module determines the corresponding write mode based on the error type.

[0036] Among them, a two-bit error triggers an emergency write mode, while a single-bit error triggers a buffered write mode.

[0037] Please see details Figure 1 The embodiments shown are not described in detail here.

[0038] Step S203: The write operation corresponding to the write mode is executed through the double-buffered flash memory write module and the state machine management module.

[0039] The dual-buffered flash memory write module includes physically independent main storage sectors and backup storage sectors; the state machine management module utilizes the physical characteristic of flash memory bits changing from 1 to 0 to mark the lifecycle of fault information entries using decrementing state encoding.

[0040] If the emergency write mode is triggered, a blocking flash write operation is performed through the dual-buffered flash write module, and the state code is updated from the first value to the second value through the state machine management module to mark that the write is in progress. The fault information corresponding to the double-bit error is appended to the end of the main storage sector without erasure and also appended to the backup storage sector without erasure. After the write is completed, the state code is updated from the first value to the third value through the state machine management module to mark that it is valid, thereby triggering the safety state transition of the automotive electronic controller.

[0041] Please see details Figure 1 The embodiments shown are not described in detail here.

[0042] This embodiment provides a method for storing fault information, applied to automotive electronic controllers. Figure 3 This is a flowchart of a fault information saving method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps: Step S301: Detect SRAM ECC errors and determine the error type using the FCCU fault collection module.

[0043] The FCCU fault collection module is configured with a non-critical fault channel and a critical fault channel; the non-critical fault channel receives single-bit errors, and the critical fault channel receives double-bit errors.

[0044] Optionally, when the FCCU fault collection module detects an SRAM ECC error, it reads the fault information by reading the Error Address Register (EAR) and the Error Status Register (ESR).

[0045] Step S302: The hierarchical response decision module determines the corresponding write mode based on the error type.

[0046] Among them, a two-bit error triggers an emergency write mode, while a single-bit error triggers a buffered write mode.

[0047] Please see details Figure 1 The embodiments shown are not described in detail here.

[0048] Step S303: The write operation corresponding to the write mode is executed through the dual-buffered flash memory write module and the state machine management module.

[0049] The dual-buffered flash memory write module includes physically independent main storage sectors and backup storage sectors; the state machine management module utilizes the physical characteristic of flash memory bits changing from 1 to 0 to mark the lifecycle of fault information entries using decrementing state encoding.

[0050] If the emergency write mode is triggered, a blocking flash write operation is performed through the dual-buffered flash write module, and the state code is updated from the first value to the second value through the state machine management module to mark that the write is in progress. The fault information corresponding to the double-bit error is appended to the end of the main storage sector without erasure and also appended to the backup storage sector without erasure. After the write is completed, the state code is updated from the first value to the third value through the state machine management module to mark that it is valid, thereby triggering the safety state transition of the automotive electronic controller.

[0051] If this buffered write mode is triggered, the fault information corresponding to the single-bit error is saved to the SRAM buffer, and a low-priority task asynchronously appends this fault information to the end of the currently active memory sector without erasure. When the buffered write mode is triggered, the system does not immediately perform a time-consuming flash memory erase operation. Instead, it quickly stores the fault information in the SRAM buffer (a high-speed but power-loss volatile memory), and then a low-priority task asynchronously performs the write operation in the background. During the write operation, a non-erasure append write is used, directly writing the data to the end of the currently active sector (the memory area being used). This resolves the conflict between single-bit error handling and system real-time performance, avoids blocking other tasks and causing system lag in order to record minor faults, and ensures the continuous and stable operation of the automotive electronic controller.

[0052] Optionally, when the fault information corresponding to the single-bit error is saved to the SRAM buffer and the low-priority task asynchronously appends the fault information to the end of the currently active storage sector without erasure, specifically, the fault information corresponding to the single-bit error is quickly saved to the SRAM buffer and a background write request is marked. The background low-priority task captures and responds to the background write request, and the state machine management module updates the status code from the first value to the second value to mark that writing is in progress, declaring that data is being written. Then, the fault information in the SRAM buffer is appended to the end of the currently active storage sector without erasure. After the writing is completed, the state machine management module updates the status code from the third value to mark that it is valid, declaring that the data is valid. This establishes a state machine error prevention mechanism for background asynchronous writing. Even if a power failure or anomaly occurs during asynchronous writing, the data status can be accurately identified by reading the status code, ensuring the consistency and traceability of the data status in the asynchronous storage process.

[0053] Optionally, specific numerical mapping rules for the decrementing status code can be set. When using the physical characteristic of flash memory bits changing from 1 to 0 to mark the lifecycle of fault information entries with decrementing status codes, specifically, when the fault information entry is empty, the status code remains a first value of all 1s; when writing the fault information entry begins, the highest bit is set from 1 to 0 to obtain the second value marking writing; after the writing is completed and the verification is passed, the second highest bit is set from 1 to 0 to obtain the third value marking the data as valid; when the fault information entry is read and processed, the third bit is set from 1 to 0 to obtain the fourth value marking it as read. By setting this rule, the default state after flash memory erasure is all "1s", denoted as the first value (empty); when writing data begins, the highest bit "1" is set to "0", becoming the second value (writing in progress); after writing and verification, the second highest bit is set to "0", becoming the third value (valid); when the data is read, the third bit is set to "0", becoming the fourth value (read). This utilizes the physical characteristics of flash memory—that it "can only change 1s to 0s" and "does not require erasure"—to implement a complete, irreversible, and interference-resistant data lifecycle state machine by changing only a few bits, greatly improving the efficiency of underlying state management. For example, the first value is 0xFF, the second value is 0x7F, the third value is 0x3F, and the fourth value is 0x1F. Figure 4 This is a schematic diagram of the entry lifecycle state machine according to an embodiment of the present invention.

[0054] Optionally, the dual-buffered flash memory write module is also used to perform dual-sector cyclic management. Specifically, when the primary storage sector is in a write state, the backup storage sector is in a standby state or a background erase state. When it is detected that the currently written storage sector is full, the write pointer is atomically switched to another storage sector in a standby state. After the switch is completed, the background erase operation on the full storage sector is initiated. By setting this dual-sector cyclic management, the primary storage sector and the backup storage sector are always in different stages. One is responsible for receiving data, while the other is in standby or silently performing time-consuming erase operations in the background. When the currently active storage sector is full, the system performs an atomic switch (an uninterrupted instantaneous jump) to point to another ready storage sector, and then starts erasing the originally full sector. This resolves the deadlock between the slow flash erase (millisecond level) and the fast fault recording requirement (microsecond level). By using dual-sector alternation to cover the field, the time-consuming erase operation is moved to the background, ensuring that there are always sectors that can be written directly without erasure when a fault occurs. Optionally, before atomically switching the write pointer, it is also necessary to determine whether another storage sector in the standby state has completed the background erase operation; if not, the process is blocked and waited for or another redundant sector that has been erased is selected to ensure that the storage sector to be switched is in a writable state during the switch, further ensuring that fault information is written in a timely manner.

[0055] Optionally, a lifespan monitoring mechanism can be set up. Specifically, the number of erases of the main storage sector and the backup storage sector can be counted. When the number of erases exceeds the preset lifespan warning threshold, a lifespan warning signal can be output to the upper-layer system to indicate the risk of storage media aging.

[0056] Step S304: Perform data integrity assurance operations on the fault information corresponding to the written SRAM ECC error.

[0057] Specifically, after the fault information corresponding to the double-bit error is appended to the main storage sector / backup storage sector without erasure—that is, after the fault information corresponding to the double-bit error is appended to the main storage sector without erasure, or after the fault information corresponding to the double-bit error is appended to the backup storage sector without erasure—that is, after each time the fault information corresponding to the SRAM ECC error is written to the storage sector, data integrity protection operations are performed on the fault information, including a triple protection mechanism of magic number, globally incrementing sequence number, and 32-bit cyclic redundancy check (CRC) check code. Specifically, firstly, a magic number identifier is written to the header of the fault information entry, where a first specific identifier is used to identify double-bit errors and a second specific identifier is used to identify single-bit errors, thereby distinguishing single-bit errors from double-bit errors using a specific byte sequence; secondly, a globally incrementing sequence number is assigned to each fault information entry to issue monotonically increasing numbers in chronological order to prevent data out-of-order or loss; finally, a 32-bit cyclic redundancy check code is calculated and written based on the data content of the fault information entry to set the check fingerprint generated by calculating the data content. This triple protection mechanism constructs a data integrity protection network. When the system restarts and reads fault records, it can accurately remove garbled or partially written data caused by extreme environments, ensuring that the fault information used for security analysis is absolutely true and reliable.

[0058] For example, the first specific identifier is 0x46415441 and the second specific identifier is 0x53464154.

[0059] Furthermore, if a power outage occurs while the system is saving fault information, half-stored data may remain in the flash memory. Upon power-up, the system needs to read the fault log to filter out useful and complete fault information. Therefore, a power-down recovery mechanism is implemented. When the system restarts and reads the fault log, the following steps are performed: The management block (the area in flash memory used to record system global metadata) is read to obtain the location of the last written storage sector, determining the location of the active storage sector before the last power outage; the status codes of fault information entries within that storage sector are scanned, identifying damaged entries with the second status code. This indicates that the entry was not fully written to the system before the power outage, resulting in incomplete or damaged entries, which need to be marked as discarded to prevent subsequent readings from mistakenly identifying damaged entries as fault information; valid entries with the third status code are identified by comparing the 32-bit cyclic redundancy check (CRC) checksum. The third value represents valid data. The 32-bit CRC checksum is calculated using a complex algorithm. Data fingerprinting is crucial because even a single bit flipped or erroneous in the data will result in a different fingerprint. For example, while the status code of some entries may have changed to a third value, it could be a false alarm. This could be due to a power outage just after the status bit was written, before the specific fault information was written, or data corruption caused by electromagnetic interference. Therefore, cyclic redundancy check (CRC) must be used to recalculate the fingerprint. Only entries that match the fingerprint are considered truly valid. By comparing valid entries in the primary and backup storage sectors, the latest valid data is selected for recovery based on the globally incrementing sequence number. Since the system is configured to write to both primary and backup sectors simultaneously, in extreme power outages, the primary storage sector might have just finished writing the data along with the sequence number, while the backup storage sector might have only written the previous sequence number before the power outage. In this case, both the primary and backup sectors contain valid data, but the content may differ. By comparing the globally incrementing sequence number, the system can determine that the updated sequence number reflects the final fault condition, thus achieving better data recovery.

[0060] As one or more specific application embodiments of the present invention, the optimal implementation scheme or the scheme that the inventors most want to embody is described in combination with the specific application scenario.

[0061] Figure 5 This is a flowchart of a fault information saving method according to an embodiment of the present invention, such as... Figure 5As shown, when an SRAM ECC error is detected, the error address register / error status register is read to distinguish between single-bit and double-bit errors. If it's a single-bit error, the corresponding fault information is saved to the SRAM buffer, the background request is marked, and the process ends. If it's a double-bit error, the corresponding fault information is prepared to be filled into the write buffer, and a 32-bit cyclic redundancy check (CRC) checksum is calculated. When filling the write buffer, the status of the currently active master sector is first checked. If the current active master sector is full, the backup sector is switched to the new current master sector. The old, full master sector is erased, and the fault information is written to the new current master sector in a blocking manner. Then, the 32-bit CRC checksum is verified. If verification fails, a retry is performed or an alarm is triggered indicating a corrupted marker. If verification succeeds, the fault information is written to the backup sector, and the 32-bit CRC checksum is verified again. If verification fails, a retry is performed or an alarm is triggered indicating a corrupted marker. If verification succeeds, a system safety state is triggered, and the process ends.

[0062] This embodiment also provides a fault information storage device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0063] This embodiment provides a fault information storage device, applied to automotive electronic controllers, such as... Figure 6 As shown, it includes: Error detection module 601 is used to detect SRAM ECC errors and determine the error type through FCCU fault collection module; the FCCU fault collection module is configured with non-critical fault channel and critical fault channel; the non-critical fault channel receives single-bit errors and the critical fault channel receives double-bit errors. The mode determination module 602 is used to determine the corresponding write mode based on the error type through the hierarchical response decision module; wherein, a double-bit error triggers an emergency write mode, and a single-bit error triggers a buffer write mode. The mode execution module 603 is used to execute the write operation corresponding to the write mode through the double-buffered flash memory write module and the state machine management module; the double-buffered flash memory write module includes physically independent main storage sectors and backup storage sectors; the state machine management module uses the physical characteristic of flash memory bits changing from 1 to 0 to mark the life cycle of fault information entries with decrementing state encoding. If the emergency write mode is triggered, a blocking flash write operation is performed through the dual-buffered flash write module, and the state code is updated from the first value to the second value through the state machine management module to mark that the write is in progress. The fault information corresponding to the double-bit error is appended to the end of the main storage sector without erasure and also appended to the backup storage sector without erasure. After the write is completed, the state code is updated from the first value to the third value through the state machine management module to mark that it is valid, thereby triggering the safety state transition of the automotive electronic controller.

[0064] In one alternative implementation, if the buffer write mode is triggered, the fault information corresponding to the single-bit error is saved to the SRAM buffer, and the fault information is asynchronously appended to the end of the currently active storage sector by a low-priority task without erasure.

[0065] In one optional implementation, the fault information corresponding to the single-bit error is saved to an SRAM buffer, and a low-priority task asynchronously appends the fault information without erasure to the end of the currently active memory sector, including: The fault information corresponding to the single-bit error is quickly saved to the SRAM buffer, and a background write request is marked. The low-priority task responds to the background write request and updates the status code from the first value to the second value through the state machine management module to mark the write process. The fault information in the SRAM buffer is appended to the end of the currently active storage sector without erasure. After the write is completed, the state code is decremented and updated to the third value through the state machine management module to mark it as valid.

[0066] In one optional implementation, the lifecycle of fault information entries is marked using a decrementing state encoding, taking advantage of the physical characteristic of flash memory bits changing from 1 to 0. When the fault information entry is empty, the status code remains the first value of all 1s; When the fault information entry is written, the highest bit is set from 1 to 0, thus obtaining the second value in the mark writing process; Once the write operation is complete and the verification is successful, the second highest bit is set from 1 to 0 to obtain the third value that marks the data as valid. After the fault information entry is read and processed, the third bit is set from 1 to 0, resulting in the fourth value that marks it as read.

[0067] In an alternative implementation, the device further includes a dual-sector loop management module for execution via the dual-buffered flash write module: When the primary storage sector is in a write state, the backup storage sector is in a standby state or a background erase state. When it is detected that the currently written storage sector is full, the atomic switch to another storage sector that is in a waiting state. After the switch is complete, initiate a background erase operation on the already filled storage sectors.

[0068] In one optional implementation, the device further includes a data integrity verification module, used for: Before the fault information corresponding to the double-bit error is appended to the main storage sector and the backup storage sector without erasure, a magic number identifier is written to the header of the fault information entry, wherein the first specific identifier is used to identify the double-bit error and the second specific identifier is used to identify the single-bit error. Assign a globally incrementing sequence number to each fault information entry; The data content of the fault information entry is used to calculate and write a 32-bit cyclic redundancy check code.

[0069] The fault information storage device provided in this embodiment of the invention can execute the fault information storage method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method. Further functional descriptions of the various modules and units described above are the same as in the corresponding embodiments described above, and will not be repeated here.

[0070] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0071] The following is a detailed reference. Figure 7 The diagram illustrates a structural schematic suitable for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 701, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 702 or a program loaded from memory 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device. The processor 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0072] Typically, the following devices can be connected to I / O interface 705: input devices 706 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 708 including, for example, magnetic tapes, hard disks, etc.; and communication devices 709. Communication device 709 allows electronic devices to exchange data via wireless or wired communication with other devices. Although Figure 7Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0073] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 709, or installed from a memory 708, or installed from a ROM 702. When the computer program is executed by the processor 701, it performs the functions defined in the fault information storage method of the embodiments of the present invention.

[0074] Figure 7 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0075] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the fault information saving method shown in the above embodiments is implemented.

[0076] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0077] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the invention.

Claims

1. A fault information storage system, characterized in that, The system, used in automotive electronic controllers, includes: The FCCU fault collection module is configured with a non-critical fault channel and a critical fault channel for detecting SRAM ECC errors and determining the error type; wherein, the non-critical fault channel receives single-bit errors, and the critical fault channel receives double-bit errors; A graded response decision module, connected to the FCCU fault collection module, is used to determine the corresponding write mode according to the error type; wherein, a double-bit error triggers an emergency write mode, and a single-bit error triggers a buffer write mode. The dual-buffered flash write module includes physically independent primary storage sectors and backup storage sectors; The state machine management module is used to mark the lifecycle of fault information entries by using the physical characteristic of flash memory bits changing from 1 to 0 and employing decrementing state encoding. The dual-buffered flash memory writing module and the state machine management module are also used to collaboratively execute the write operation corresponding to the write mode; wherein, if the emergency write mode is triggered, the dual-buffered flash memory writing module performs a blocking flash memory write operation, the state machine management module updates the status code from a first value to a second value to mark that writing is in progress, the dual-buffered flash memory writing module appends the fault information corresponding to the double-bit error to the end of the main storage sector without erasure, and appends it to the backup storage sector without erasure, and after the writing is completed, the state machine management module updates the status code from a third value to mark it as valid, so as to trigger the safety state transition of the automotive electronic controller.

2. A method for storing fault information, characterized in that, Applied to automotive electronic controllers, the method includes: SRAM ECC errors are detected and error types are determined by the FCCU fault collection module; the FCCU fault collection module is configured with a non-critical fault channel and a critical fault channel; the non-critical fault channel receives single-bit errors and the critical fault channel receives double-bit errors. The hierarchical response decision module determines the corresponding write mode based on the error type; wherein, a two-bit error triggers an emergency write mode, and a single-bit error triggers a buffer write mode. The write operation corresponding to the write mode is executed by a dual-buffered flash memory write module and a state machine management module; the dual-buffered flash memory write module includes physically independent main storage sectors and backup storage sectors; the state machine management module uses the physical characteristic of flash memory bits changing from 1 to 0 to mark the life cycle of fault information entries with a decrementing state code. If the emergency write mode is triggered, a blocking flash write operation is performed through the dual-buffered flash write module, and the state code is updated from the first value to the second value through the state machine management module to mark that writing is in progress. The fault information corresponding to the double-bit error is appended to the end of the main storage sector without erasure and appended to the backup storage sector without erasure. After the writing is completed, the state code is updated from the first value to the third value through the state machine management module to mark it as valid, thereby triggering the safety state transition of the automotive electronic controller.

3. The fault information storage method according to claim 2, characterized in that, If the buffered write mode is triggered, the fault information corresponding to the single-bit error is saved to the SRAM buffer, and the fault information is asynchronously appended to the end of the currently active storage sector by a low-priority task without erasure.

4. The fault information storage method according to claim 3, characterized in that, The step of saving the fault information corresponding to the single-bit error to the SRAM buffer, and then having a low-priority task asynchronously append the fault information to the end of the currently active memory sector without erasure, includes: The fault information corresponding to the single-bit error is quickly saved to the SRAM buffer, and a background write request is marked. The background write request is responded to by a low-priority task, and the state machine management module updates the state code from the first value to the second value to mark that writing is in progress. The fault information in the SRAM buffer is appended to the end of the currently active storage sector without erasure. After the write is completed, the state code is decremented and updated to the third value through the state machine management module to mark it as valid.

5. The fault information storage method according to any one of claims 2 to 4, characterized in that, The method of utilizing the physical characteristic of flash memory bits changing from 1 to 0, and using decrementing state encoding to mark the lifecycle of fault information entries, includes: When the fault information entry is empty, the status code remains the first value of all 1s; When the fault information entry is started to be written, the highest bit is set from 1 to 0 to obtain the second value of the marker being written; Once the write operation is complete and the verification is successful, the second highest bit is set from 1 to 0 to obtain the third value that marks the data as valid. After the fault information entry is read and processed, the third bit is set from 1 to 0 to obtain the fourth value that marks it as read.

6. The fault information storage method according to any one of claims 2 to 4, characterized in that, The dual-buffered flash memory writing module is also used to perform dual-sector cyclic management, and the method further includes: When the primary storage sector is in a write state, the backup storage sector is in a standby state or a background erase state. When it is detected that the currently written storage sector is full, the atomic switch to another storage sector that is in a waiting state. After the switch is complete, initiate a background erase operation on the already filled storage sectors.

7. The fault information storage method according to any one of claims 2 to 4, characterized in that, After appending the fault information corresponding to the double-bit error to the primary storage sector / backup storage sector without erasure, the method further includes: Write a magic number identifier at the beginning of the fault information entry, where a first specific identifier is used to identify a double-bit error and a second specific identifier is used to identify a single-bit error; Assign a globally incrementing sequence number to each fault information entry; The check code for a 32-bit cyclic redundancy check is calculated and written based on the data content of the fault information entry.

8. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the fault information storage method according to any one of claims 2 to 7 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the fault information saving method according to any one of claims 2 to 7.

10. A computer program product, characterized in that, It includes computer instructions for causing a computer to execute the fault information saving method according to any one of claims 2 to 7.

Images