Monitoring method, microcontroller, computer program and storage medium therefor

Abstract

The application provides a monitoring method, a microcontroller, a computer program and a storage medium thereof. In the monitoring state, the security core calls input data for monitoring in the memory, and inputs the input data into the register of the AMU computing engine to trigger the AMU computing engine to perform a monitoring operation. Then, whether the monitoring operation result is consistent with a preset standard value is compared. If yes, the current monitoring task is ended, and the next monitoring task is executed. If no, the fault number is accumulated, and whether the fault number reaches a threshold value is judged. If yes, a fault response instruction is triggered, and the monitoring is stopped. If no, the current monitoring task is ended, and the next monitoring task is executed. It can be seen that the application realizes real-time monitoring of the security of the AMU computing engine, ensures that the AMU computing engine can be responded in time when it is confirmed to be faulty, and thus enhances the security of the AMU module. Under the monitoring of the security core, the AMU module can be applied to an application scene with a higher security level, and the application scope is expanded.

Description

Technical Field

[0001] This invention relates to the field of intelligent vehicle technology, and in particular to a monitoring method, a microcontroller, a computer program, and a storage medium thereof. Background Technology

[0002] With the development of automotive intelligence, the integration and complexity of automotive controllers are increasing, and traditional hardware architectures and development models can no longer handle complex functional development and large amounts of calibration data. To address this, and to ensure the control accuracy of the controller, existing automotive controllers employ machine learning algorithms for mathematical modeling to solve these technical challenges. Among these, Gaussian Process Regression (GPR)-based modeling algorithms offer more convenient and efficient modeling while maintaining model accuracy. However, the security core (Central Processing Unit, CPU) of traditional microcontrollers (MCUs) struggles to process GPR formulas and cannot meet the real-time requirements of the controller. Therefore, current mainstream automotive microcontroller chips are equipped with an Advanced Modelling Unit (AMU). The AMU module is a high-performance hardware acceleration unit integrated within the MCU, specifically designed for fitting and calculating GPR expressions. Developers only need to configure the model parameters and inputs into the corresponding registers and trigger the calculation to obtain the output results, significantly improving computational speed and providing new possibilities for traditional controller development.

[0003] However, the AMU module was not designed with functional safety in mind and cannot be directly used in safety-critical systems. Therefore, during the AMU's computational engine operations, its safety status cannot be monitored in real time, posing a potential threat to the stability and safety of the controller.

[0004] Therefore, there is an urgent need for a monitoring method for AMU modules to achieve real-time monitoring of the security status of AMU modules and improve the overall security of the controller. Summary of the Invention

[0005] The purpose of this invention is to provide a monitoring method, a microcontroller, a computer program, and a storage medium thereof to solve at least one of the following problems: how to perform real-time security monitoring of an AMU module, how to expand the application scope of an AMU module, and how to improve the security of a microcontroller.

[0006] To address the aforementioned technical problems, this invention provides a monitoring method for security monitoring of an AMU module. The AMU module includes at least one AMU computing engine, which executes computational instructions and has both a working state and a monitoring state. The monitoring method includes:

[0007] The AMU computing engine enters the monitoring state;

[0008] Input data for monitoring is input into the register of the AMU computing engine to trigger the AMU computing engine to perform monitoring operations;

[0009] Obtain the monitoring and calculation results of the AMU computing engine, and compare the monitoring and calculation results with the preset standard value. If they are consistent, the current monitoring task ends and waits for the next monitoring task to be executed. If not, accumulate the number of faults and determine whether the number of faults has reached the threshold. If so, trigger the fault response command and stop monitoring. If not, the current monitoring task ends and waits for the next monitoring task to be executed.

[0010] Optionally, in the monitoring method, the monitoring task is executed at least once during the monitoring state.

[0011] Optionally, in the monitoring method, the working state and the monitoring state of the AMU computing engine are switched alternately.

[0012] Optionally, in the monitoring method, when the number of AMU computing engines is greater than or equal to 2, some of the AMU computing engines have the working state and the monitoring state, and the remaining AMU computing engines have the working state.

[0013] Each AMU computing engine with the monitoring state corresponds to several AMU computing engines without the monitoring state. In the working state, it executes the same computing instructions as each AMU computing engine without the monitoring state.

[0014] Optionally, in the monitoring method, the monitoring method further includes:

[0015] When an AMU computing engine with the monitored state is in the working state, the corresponding operation instruction of an AMU computing engine without the monitored state is executed. The operation results of the two AMU computing engines are compared and it is determined whether they are consistent. If they are consistent, the current comparison task ends and waits for the next comparison task to be executed. If not, the number of abnormalities of the corresponding AMU computing engine without the monitored state is accumulated, and it is determined whether the number of abnormalities has reached a set value. If so, the fault response instruction is triggered and monitoring is stopped. If not, the current comparison task ends and waits for the next comparison task to be executed.

[0016] Optionally, in the monitoring method, during the working state of the AMU computing engine in the monitoring state, the AMU computing engine in the monitoring state and several corresponding AMU computing engines not in the monitoring state perform the comparison task at least once.

[0017] Based on the same inventive concept, the present invention also provides a computer program, including a monitoring method for executing the computer program when it is executed on a suitable computer device.

[0018] Based on the same inventive concept, the present invention also provides a microcontroller, comprising: an AMU module, a memory, and a security core; wherein,

[0019] The memory is used to store the computer program;

[0020] The security core is used to run the computer program to perform security monitoring on the AMU module.

[0021] Optionally, in the microcontroller, the memory is further used to store multiple sets of the input data for monitoring and the corresponding preset standard values, so that when the monitoring task is executed, the security core calls a set of the input data for monitoring and inputs it into the register of the AMU computing engine; and the memory is further used to store at least the calculation results of the AMU computing engine in the working state, the monitoring calculation results, the comparison results of the monitoring calculation results and the preset standard values, and the number of failures.

[0022] Based on the same inventive concept, the present invention also provides a computer program encoded on the computer-readable storage medium.

[0023] In summary, this invention provides a monitoring method, a microcontroller, a computer program, and a storage medium thereof. The microcontroller includes a security core for performing security monitoring on the AMU computing engine. Specifically, when the AMU computing engine enters the monitoring state, the security core retrieves the monitoring input data stored in the memory and inputs it into the AMU computing engine's register to trigger monitoring operations. Then, the monitoring operation result is compared with a preset standard value. If consistent, the current monitoring task ends, and the system waits for the next monitoring task. If not, the number of failures is accumulated, and it is determined whether the number of failures reaches a threshold. If so, a fault response command is triggered, and monitoring stops; otherwise, the current monitoring task ends, and the system waits for the next monitoring task. Therefore, this invention achieves real-time security monitoring of the AMU computing engine, ensuring timely response when the AMU computing engine is confirmed to be faulty, thus improving the overall security performance of the microcontroller. Furthermore, by monitoring the AMU computing engine, the failure status of the common supporting hardware within the AMU module can be identified, thereby achieving security monitoring of the AMU module.

[0024] Therefore, this invention solves the problem that functional safety was not considered in the design of the AMU module. Under the safety monitoring of the safety core, the AMU module can be directly applied to safety-critical systems or other application scenarios with higher safety levels, thus expanding its scope of application. Attached Figure Description

[0025] Figure 1 This is a flowchart of the monitoring method in an embodiment of the present invention.

[0026] Figure 2 This is a schematic diagram of the internal structure of the AMU module in an embodiment of the present invention.

[0027] Figure 3 This is a schematic diagram illustrating the alternation between the working state and the monitoring state in an embodiment of the present invention.

[0028] Figure 4 This is a schematic diagram of the microcontroller in an embodiment of the present invention.

[0029] Figure 5 This is a flowchart of executing a monitoring task in an embodiment of the present invention.

[0030] Figure 6 This is a schematic diagram of the internal structure of an AMU module in an embodiment of the present invention.

[0031] Figure 7 This is a schematic diagram of the state of AMU0 and a schematic diagram of the time period division in an embodiment of the present invention.

[0032] Figure 8This is a schematic diagram of the state of AMU1 and a schematic diagram of time period division in an embodiment of the present invention.

[0033] Figure 9 This is a schematic diagram illustrating the relationship between the two AMU computing engines and the security core in an embodiment of the present invention.

[0034] Figure 10 This is a flowchart of performing a comparison task in an embodiment of the present invention.

[0035] Figure 11 This is a schematic diagram of the state and time period division of the second AMU computing engine in an embodiment of the present invention.

[0036] The attached figures are labeled as follows:

[0037] 10 - AMU module; 101 - AMU computing engine; 1011 - First AMU computing engine; 1012 - Second AMU computing engine; 20 - Security core; 30 - Memory; a - Operating status; b - Monitoring status. Detailed Implementation

[0038] To make the objectives, advantages, and features of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the drawings are all in a very simplified form and are not drawn to scale, and are only used to facilitate and clearly illustrate the objectives of the embodiments of the present invention. Furthermore, the structures shown in the drawings are often part of the actual structures. In particular, different figures may emphasize different aspects and sometimes use different scales. It should also be understood that, unless specifically stated or indicated, the terms "first," "second," "third," etc., in the specification are only used to distinguish the various components, elements, steps, etc., in the specification, and are not used to indicate the logical or sequential relationships between the various components, elements, steps, etc.

[0039] Please see Figure 1 This embodiment provides a monitoring method, including:

[0040] Step 1 S11: The AMU computing engine enters the monitoring state;

[0041] Step 2 S12: Input the monitoring data into the register of the AMU computing engine to trigger the AMU computing engine to perform monitoring operations;

[0042] Step 3 S13: Obtain the monitoring and calculation results of the AMU computing engine, and compare whether the monitoring and calculation results are consistent with the preset standard value. If yes, the current monitoring task ends and waits for the next monitoring task to be executed; if no, accumulate the number of faults and determine whether the number of faults has reached the threshold. If yes, trigger the fault response command and stop monitoring; if no, the current monitoring task ends and waits for the next monitoring task to be executed.

[0043] As can be seen, the monitoring method provided in this embodiment achieves real-time monitoring of the security of the AMU computing engine, ensuring timely response when the AMU computing engine is confirmed to be faulty, improving the overall security performance of the microcontroller. Furthermore, by monitoring the security of the AMU computing engine, it covers the security monitoring of failures of common supporting hardware within the AMU module, thereby solving the problem of the AMU module not considering functional safety in its design. Under the security monitoring of the security core, the AMU module can be directly applied to safety-critical systems or other application scenarios with higher security levels, expanding its applicability.

[0044] The following is in conjunction with the appendix Figure 1-11 This embodiment provides a detailed description of the monitoring method.

[0045] Please see Figure 2 The AMU module 10 is a high-performance hardware acceleration unit, comprising several AMU computing engines 101 and supporting hardware such as a static RAM module and a memory access module (DMA). The AMU computing engine 101 is a hardware-implemented kernel specifically for RBF kernel function calculations, the SRAM is used for storing machine learning models, and the DMA module is used to load model parameters from Flash memory into the SRAM. Therefore, the monitoring method provided in this embodiment monitors the AMU computing engines 101, thereby covering failures of shared supporting hardware such as DMA and SRAM, thus achieving overall security monitoring of the AMU module 10.

[0046] Please see Figure 3-4 The AMU computing engine 101 is used to execute calculation instructions and has a working state a and a monitoring state b. During the time period of working state a, the AMU computing engine 101 performs work task calculations according to the calculation instructions. During the time period of monitoring state b, the AMU computing engine 101 performs monitoring task calculations according to the calculation instructions. Furthermore, after power-on, the working state a and the monitoring state b of the AMU computing engine alternately switch. Figure 3As shown, the time periods T1, T2, T3...Tx corresponding to working state a are all interspersed with the time period Tm of monitoring state b. Here, x is a positive integer. This embodiment does not limit the number of times the working state a and the monitoring state b switch; it can switch only once or multiple times. For example, after power-on, the AMU computing engine 101 remains in working state a. After time T1, the AMU computing engine 101 remains in monitoring state b, i.e., in time period Tm until power-off or hibernation. Of course, the AMU computing engine 101 can also first be in monitoring state b and then switch to working state a. This embodiment does not limit the order of working state a and monitoring state b. Furthermore, by adjusting the time periods T1, T2, T3...Tx corresponding to working state a, and adjusting the duration of the time period Tm of monitoring state b, different frequencies of security monitoring can be performed on the AMU computing engine 101. The timing and frequency of the time period Tm of the monitoring state b can be adjusted according to the actual usage load and functional safety diagnostic coverage requirements of the AMU computing engine 101. This embodiment does not make specific limitations on this.

[0047] Please see Figure 2 and 4 Based on the same inventive concept, this embodiment also provides a computer program and a microcontroller. The computer program is used to execute the monitoring method when executed on a suitable computer device. The microcontroller includes an AMU module 10, a security core 20, and a memory 30. The memory 30 stores the computer program; the security core 20 runs the computer program to perform security monitoring on the AMU module 10, ensuring the functional safety of the AMU module 10.

[0048] The AMU module 10 may contain a plurality of AMU computing engines 101. This embodiment does not limit the specific number; it can be one, two, or three or more. Further, in one embodiment, the AMU module 10 contains only one AMU computing engine 101. The monitoring process for the AMU computing engine 101 is as follows:

[0049] Please see Figures 1-5 ,in, Figure 5 A flowchart for performing a monitoring task.

[0050] Step 1 S11: The AMU computing engine 101 enters the monitoring state b.

[0051] Since the AMU computing engine 101 has alternating working state a and monitoring state b, when the state of the AMU computing engine 101 switches from working state a to monitoring state b, or directly enters the monitoring state b, the security core 20 starts monitoring the AMU computing engine 101.

[0052] Step 2 S12: Input the monitoring data into the register of the AMU computing engine 101 to trigger the AMU computing engine 101 to perform monitoring operations.

[0053] It should be noted that the memory 30 stores multiple sets of the input data for monitoring. When the monitoring task is executed, the security core 20 calls one set of the input data for monitoring and inputs it into the register of the AMU computing engine 101 to trigger the AMU computing engine 101 to perform monitoring operations.

[0054] For example, Figure 3 The three monitoring states b are shown in the diagram. During each time period Tm, a monitoring task is executed once. When executing the monitoring task corresponding to the first time period Tm, the security core 20 retrieves the first set of monitoring input data from the memory 30 and inputs it into the register of the AMU computing engine 101. When executing the monitoring task corresponding to the second time period Tm, the security core 20 retrieves the second set of monitoring input data from the memory 30 and inputs it into the register of the AMU computing engine 101. And when executing the monitoring task corresponding to the third time period Tm, the security core 20 retrieves the third set of monitoring input data from the memory 30 and inputs it into the register of the AMU computing engine 101. In subsequent monitoring tasks, a new set of monitoring input data can be used, or the aforementioned sets of monitoring input data can be reused.

[0055] Alternatively, two monitoring tasks can be performed within each time period Tm. When performing the first monitoring task within the first time period Tm, the security core 20 retrieves the first set of monitoring input data from the memory 30; and when performing the second monitoring task within the first time period Tm, the security core 20 retrieves the second set of monitoring input data from the memory 30. Based on this, the monitoring limitations caused by a single set of monitoring input data and its corresponding preset standard value can be avoided, thereby improving diagnostic coverage and obtaining more accurate security monitoring results. In this embodiment, the number of monitoring tasks performed within the corresponding time period Tm after switching to monitoring state b is not limited; it can be one, two, or three times, etc. Furthermore, the specific order and frequency of use of each set of monitoring input data and its corresponding preset standard value are not limited; they can be set to be used randomly.

[0056] Step 3 S13: Obtain the monitoring and calculation results of the AMU computing engine 101, and compare the monitoring and calculation results with the preset standard value. If they are consistent, the current monitoring task ends and waits for the next monitoring task to be executed. If not, accumulate the number of faults and determine whether the number of faults has reached the threshold. If they are consistent, trigger the fault response command and stop monitoring. If not, the current monitoring task ends and waits for the next monitoring task to be executed.

[0057] During the monitoring calculations performed by the AMU computing engine 101, the security core 20 remains in a waiting state. After the AMU computing engine 101 completes the monitoring calculations, the security core 20 obtains the corresponding monitoring calculation results and compares them with a preset standard value. If the two data points match, it indicates that the AMU computing engine 101 performed the calculations correctly and without faults in this monitoring task. Accordingly, this monitoring task ends, and the system waits for the next monitoring task. If the two data points do not match, it indicates that the AMU computing engine 101 performed the calculations incorrectly in this monitoring task, and a fault may exist. Based on this, further judgment is required. The fault counter in the security core 20 is incremented by 1, that is, the number of faults is accumulated, and it is determined whether the number of faults has reached a threshold. If yes, the security core 20 triggers a fault response command and stops monitoring; otherwise, this monitoring task ends, and the system waits for the next monitoring task.

[0058] For example, in the monitoring state, the AMU computing engine 101 acquires the first input data (x1, x2, x3, x4, x5, x6) for monitoring, and the preset standard value corresponding to the first input data for monitoring is 1. If the output result w of the AMU computing engine 101 is 1, it indicates that the AMU computing engine 101 has performed the calculation correctly in this monitoring task, and enters the state of waiting to execute the next monitoring task. If the output result w of the AMU computing engine 101 is not equal to 1, it indicates that the AMU computing engine 101 has performed the calculation incorrectly in this monitoring task, and the fault counter is incremented by 1 based on the previous count. That is, if the fault counter has accumulated 2 fault counts before, the fault count is updated to 3. Then, the security core 20 continues to execute the judgment program, that is, to determine whether the updated fault count has reached the threshold q. If the threshold q = 5 and 3 < 5, it indicates that the updated fault count has not reached the threshold, and the current monitoring task ends, waiting to execute the next monitoring task. If the threshold q = 3, it indicates that the number of faults after the update has reached the threshold. The security core 20 confirms the fault of the AMU computing engine 101 and issues the fault response command, while stopping monitoring.

[0059] Furthermore, the memory 30 is also used to store: the calculation results of the AMU calculation engine 101 in the working state, the monitoring calculation results, the comparison results of the monitoring calculation results with the preset standard value, and the number of failures.

[0060] In other embodiments, the AMU module 10 includes multiple AMU computing engines 101. Some of the AMU computing engines 101 have both a working state a and a monitoring state b, while the remaining AMU computing engines 101 only have working state a. Each AMU computing engine 101 having monitoring state b corresponds to several AMU computing engines 101 that do not have monitoring state b, and in the working state, it executes the same computational instructions as the AMU computing engines that do not have monitoring state b. In other words, an AMU computing engine 101 having monitoring state b executes the same computational instructions as its corresponding AMU computing engine 101 that does not have monitoring state b in any one or more of its own working states a. Optionally, only one AMU computing engine 101 without monitoring state b may execute the same computational instructions in the same working state a; or, two or more AMU computing engines 101 without monitoring state b may execute the same computational instructions in the same working state a. Specifically, the same computational instructions for each AMU computing engine 101 that does not have the monitoring state b can be executed once or multiple times.

[0061] For example, Figure 6-8 As shown, the AMU module 10 contains 10 AMU computing engines 101, numbered AMU0 to AMU9. AMU0 and AMU1 have both operating state a and monitoring state b, while AMU2 to AMU9 only have operating state a. AMU0 corresponds to AMU2 to AMU6, and AMU1 corresponds to AMU7 to AMU9. In one embodiment, under any operating state a of AMU0, one or more of the same computational instructions from AMU2 to AMU6 can be executed. For example, under the first operating state a of AMU0, the same computational instructions of AMU2 are executed multiple times; under the second operating state a of AMU0, the same computational instructions of AMU3 to AMU4 are executed sequentially; and under the third operating state a of AMU0, the same computational instructions of AMU5 and AMU6 are executed multiple times. This embodiment does not limit the object or the number of times the same computational instructions are executed under each operating state a of AMU0. Similarly, it does not limit the object or the number of times the same computational instructions are executed under each operating state a of AMU1.

[0062] In other embodiments, the time periods of the operating states of AMU0 and AMU1 can be divided to execute the same computational instructions of the corresponding AMU computing engine 101 that does not have the monitoring state in different time periods. For example, the operating time period of AMU0 can be divided into five or more segments, and each time period has a working state a and a monitoring state b. Assuming that the operating time period of AMU0 is divided into five segments, in the first time period T-AMU2, the state of AMU0 alternates between working state a and monitoring state b. In working state a within the first time period T-AMU2, AMU0 executes the same computational instructions as AMU2. In monitoring state b within the first time period T-AMU2, the security check AMU0 performs the monitoring task. Similarly, during the second time period T-AMU3, AMU0 executes the same arithmetic instructions as AMU3 in its operating state a; during the third time period T-AMU4, AMU0 executes the same arithmetic instructions as AMU4 in its operating state a; during the fourth time period T-AMU5, AMU0 executes the same arithmetic instructions as AMU5 in its operating state a; and during the fifth time period T-AMU6, AMU0 executes the same arithmetic instructions as AMU6 in its operating state a.

[0063] Similarly, the operating time of AMU1 can be divided into three or more segments. During the first time segment T-AMU7, in operating state a, AMU1 executes the same computational instructions as AMU7; during the second time segment T-AMU8, in operating state a, AMU1 executes the same computational instructions as AMU8; and during the third time segment T-AMU9, in operating state a, AMU1 executes the same computational instructions as AMU9. Of course, when the operating time segments of AMU0 and AMU1 are further divided into many segments, the computations within each time segment can be executed cyclically. This embodiment does not limit the order in which AMU0 and AMU1 execute the computational instructions from AMU2 to AMU9.

[0064] Based on this, when two or more AMU computing engines 101 are set in the AMU module 10, the monitoring method further includes: when an AMU computing engine 101 with the monitoring state b is in the working state a, executing the corresponding operation instruction of an AMU computing engine 101 that does not have the monitoring state, comparing the operation results of the two AMU computing engines 101, and determining whether they are consistent. If they are, the current comparison task ends, and the next comparison task is awaited; if not, the number of abnormalities of the corresponding AMU computing engine 101 that does not have the monitoring state b is accumulated, and it is determined whether the number of abnormalities reaches a set value. If so, the fault response instruction is triggered, and monitoring is stopped; if not, the current comparison task ends, and the next comparison task is awaited. It should be noted that executing the same operation instruction means that the executed operation program is the same, and the received input data is the same.

[0065] For example, Figure 9-10 As shown, the AMU module 10 includes two AMU computing engines, which are named the first AMU computing engine 1011 and the second AMU computing engine 1012 in this embodiment. The first AMU computing engine 1011 only has the working state; the second AMU computing engine 1012 has both the working state and the monitoring state; and in the working state, both AMU computing engines execute the same computational instructions. It can be understood that the first AMU computing engine 1011 is used to execute normal working computational instructions. The second AMU computing engine 1012 not only executes the same computational instructions as the first AMU computing engine 101, but also cooperates with the security core 20 to perform security monitoring. Therefore, during the monitoring of the second AMU computing engine 1012, the monitoring method further includes:

[0066] Step S21: The second AMU computing engine 1012 enters the working state. That is, the second AMU computing engine 1012 switches to the working state, or directly enters the working state.

[0067] Step S22: The first AMU computing engine 1011 and the second AMU computing engine 1012 perform the same operation.

[0068] Step S23: The security core 20 obtains the calculation results of the first AMU computing engine 1011 and the second AMU computing engine 1012 respectively, and determines whether they are consistent. If they are consistent, it means that there is no abnormality in this comparison, and the current comparison task ends, waiting to execute the next comparison task. If they are inconsistent, it means that there is an abnormality in this comparison result, that is, at least one of the first AMU computing engine 1011 and the second AMU computing engine 1012 has failed. In this case, the number of abnormalities corresponding to the first AMU computing engine 1011 needs to be incremented by 1, and it is determined whether the number of abnormalities has reached a set value. If yes, the security core 20 triggers the fault response command and stops monitoring; if no, it means that there is an abnormality in this comparison, but it does not necessarily indicate that the first AMU computing engine 1011 and the second AMU computing engine 1012 have failed, so the current comparison task ends, waiting to execute the next comparison task. It should be noted that when the calculation results of the first AMU computing engine 1011 and the second AMU computing engine 1012 are consistent, there is also the possibility that the two may have the same fault. Therefore, further security monitoring of the second AMU computing engine 1012 can identify the situation of the same fault and further improve the diagnostic coverage.

[0069] The waiting for the next comparison task includes, but is not limited to, the following three situations: First, if the microcontroller is set to execute the comparison task once after power-on, then after the current comparison task ends, it waits for the next power-on before executing the comparison task again. Second, if the comparison task is set to execute once each time the working state is entered, then after the current comparison task ends, the working state switches to the monitoring state to execute the monitoring task, and then executes the comparison task again after switching back from the monitoring state to the working state. Third, if the comparison task is set to execute more than two comparison tasks within each working state, then after the current comparison task ends, it directly enters the next comparison task, or waits for a set interval before executing the comparison task again. Furthermore, stopping monitoring means stopping the execution of both the comparison task and the monitoring task. Further, in this embodiment... Figure 10 This is a flowchart illustrating the comparison of calculation results in a single operating state. This embodiment does not limit the number of times the comparison task is executed; it can be performed once or multiple times during the first operating state after power-on, or it can be performed once or multiple times each time the microcontroller switches to the operating state after power-on.

[0070] Furthermore, when the second AMU computing engine 1012 also corresponds to other AMU computing engines, in the working state of the AMU computing engine with a monitoring state, the AMU computing engine with the monitoring state performs at least one comparison task with several corresponding AMU computing engines that do not have the monitoring state. For example, the second AMU computing engine 1012 also corresponds to the third AMU computing engine 1013 and the fourth AMU computing engine 1014. When the second AMU computing engine 1012 is in a certain working state, it can perform one or more comparison tasks with the first AMU computing engine 1011, the third AMU computing engine 1013, and the fourth AMU computing engine 1014 respectively, or the second AMU computing engine 1012 can perform one or more comparison tasks with any one or several of the corresponding three AMU computing engines. That is, in each working state of the second AMU computing engine 1012, the object, number of times, and order of execution of the comparison task are not limited.

[0071] Furthermore, in one embodiment, the state of the first AMU computing engine 1011 can also be divided into multiple time periods to perform different comparison tasks. For example... Figure 11As shown, within the time period T-1011 corresponding to the first AMU computing engine 1011, the second AMU computing engine 1012 performs a comparison task with the first AMU computing engine 1011; within the time period T-1013, the second AMU computing engine 1012 performs a comparison task with the third AMU computing engine 1013; and within the time period T-1014, the second AMU computing engine 1012 performs a comparison task with the fourth AMU computing engine 1014. The cumulative number of anomalies generated during the comparison process also corresponds to each AMU computing engine. For example, if within the time period T-1011, the second AMU computing engine 1012 performs at least one comparison task with the first AMU computing engine 1011, then the cumulative number of anomalies during the comparison process corresponds to the number of anomalies in the first AMU computing engine 1011. Suppose that after the first time period T-1011 of the second AMU computing engine 1012 ends, the number of exceptions in the first AMU computing engine 1011 is 3, which does not reach the set value. Then, the second AMU computing engine 1012 enters the time period T-1013. The second AMU computing engine 1012 will perform at least one comparison task with the third AMU computing engine 1013. If an exception also occurs during this period, it will be accumulated as the exception count of the third AMU computing engine 1013. This count is not added to the exception count of the first AMU computing engine 1011 (3), but rather added to the previously accumulated exception count of the third AMU computing engine 1013. This continues until the second AMU computing engine 1012 re-enters the time period T-1011, when it continues to perform comparison tasks with the first AMU computing engine 1011. If an exception occurs during this period, it will be added to the previous exception count of 3.

[0072] Furthermore, when the cumulative number of anomalies in one of the AMU computing engines reaches the set value, the corresponding AMU computing engine generates a fault response and executes a global response or a partitioned response depending on the scope of the fault. In a global response, all AMU computing engines stop running; in a partitioned response, other fault-free AMU computing engines can run normally or stop running based on functional dependencies.

[0073] Furthermore, the memory 30 is also used to store at least the comparison results of the AMU computing engine 101 in the working state and the number of anomalies corresponding to each of the AMU computing engines 101.

[0074] It should be noted that the monitoring method provided in this embodiment monitors the AMU computing engine 101, thereby covering the failure of common supporting hardware such as DMA and SRAM, and thus achieving overall security monitoring of the AMU module 10. Furthermore, the monitoring method is not limited to monitoring the AMU computing engine 10, but can also be used for other hardware acceleration units.

[0075] Based on the same inventive concept, this embodiment also provides a computer program encoded on the computer-readable storage medium.

[0076] In summary, this embodiment provides a monitoring method, a microcontroller, a computer program, and a storage medium thereof. The microcontroller includes a security core 20 for performing security monitoring on the AMU computing engine 10. Specifically, when the AMU computing engine 10 enters the monitoring state, the security core 20 calls the monitoring input data stored in the memory 30 and inputs it into the register of the AMU computing engine 10 to trigger monitoring operations. Then, the monitoring operation result is compared with a preset standard value. If consistent, the current monitoring task ends, and the system waits for the next monitoring task. If not, the number of faults is accumulated, and it is determined whether the number of faults has reached a threshold. If so, a fault response command is triggered, and monitoring stops; otherwise, the current monitoring task ends, and the system waits for the next monitoring task. Therefore, this embodiment achieves real-time security monitoring of the AMU computing engine 10, ensuring timely response when the AMU computing engine 10 is confirmed to be faulty, thus improving the overall security performance of the microcontroller. Furthermore, this embodiment monitors the AMU computing engine 101 to understand the failure status of the common supporting hardware inside the AMU module 10, thereby achieving security monitoring of the AMU module 10. Therefore, this embodiment solves the problem that the AMU computing engine 10 was not designed with functional safety in mind. Under the security monitoring of the security core 20, the AMU computing engine 10 can be directly applied to safety-critical systems or other application scenarios with higher security levels, expanding its applicability.

[0077] Furthermore, it should be understood that although the present invention has been disclosed above with reference to preferred embodiments, these embodiments are not intended to limit the present invention. For any person skilled in the art, many possible variations and modifications can be made to the technical solutions of the present invention based on the disclosed technical content, or equivalent embodiments can be modified accordingly, without departing from the scope of the present invention. Therefore, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention, without departing from the content of the present invention, shall still fall within the scope of protection of the present invention.

Claims

1. A monitoring method for security monitoring of an AMU module, wherein, The AMU module is equipped with at least one AMU computing engine, characterized in that the AMU computing engine is used to execute computation instructions and has a working state and a monitoring state; the monitoring method includes: The AMU computing engine enters the monitoring state; Input data for monitoring is input into the register of the AMU computing engine to trigger the AMU computing engine to perform monitoring operations; Obtain the monitoring and calculation results of the AMU computing engine, and compare the monitoring and calculation results with the preset standard value. If they are consistent, the current monitoring task ends and waits for the next monitoring task to be executed. If not, accumulate the number of faults and determine whether the number of faults has reached the threshold. If so, trigger the fault response command and stop monitoring. If not, the current monitoring task ends and waits for the next monitoring task to be executed. Wherein, AMU refers to Advanced Modeling Unit, and when the number of AMU computing engines is greater than or equal to 2, some of the AMU computing engines have the working state and the monitoring state, and the remaining AMU computing engines have the working state; wherein, each AMU computing engine with the monitoring state corresponds to several AMU computing engines without the monitoring state, so that in the working state, it executes the same computing instructions as each AMU computing engine without the monitoring state; Furthermore, when an AMU computing engine with the monitored state is in the working state, the corresponding operation instruction of an AMU computing engine without the monitored state is executed, the operation results of the two AMU computing engines are compared, and it is determined whether they are consistent. If they are consistent, the current comparison task is ended, and the process waits for the next comparison task. If not, the number of abnormalities of the corresponding AMU computing engine without the monitored state is accumulated, and it is determined whether the number of abnormalities has reached a set value. If so, the fault response instruction is triggered, and monitoring is stopped. If not, the current comparison task is ended, and the process waits for the next comparison task.

2. The monitoring method according to claim 1, characterized in that, Under the monitoring state, the monitoring task is executed at least once.

3. The monitoring method according to claim 1, characterized in that, The AMU computing engine alternately switches between its working state and its monitoring state.

4. The monitoring method according to claim 1, characterized in that, In the working state of the AMU computing engine with a monitoring state, the AMU computing engine with the monitoring state and several corresponding AMU computing engines without the monitoring state perform the comparison task at least once.

5. A computer program product, characterized in that, This includes a monitoring method as described in any one of claims 1 to 4, used when the computer program product is executed on a computer device.

6. A microcontroller, characterized in that, Includes the AMU module, memory, and security core; among which, The memory is used to store the computer program product as described in claim 5; The security core is used to run the computer program product to perform security monitoring on the AMU module.

7. The microcontroller according to claim 6, characterized in that, The memory is also used to store multiple sets of the input data for monitoring and the corresponding preset standard values, so that when the monitoring task is executed, the security core calls a set of the input data for monitoring and inputs it into the register of the AMU computing engine; as well as, The memory is also used to store at least the calculation results of the AMU computing engine in the working state, the monitoring calculation results, the comparison results of the monitoring calculation results with the preset standard value, and the number of failures.

8. A computer-readable storage medium, characterized in that, The computer program product as described in claim 5 is encoded on the computer-readable storage medium.

Images