Security analysis method and device of car-grade chip, equipment and storage medium

Abstract

The application relates to the technical field of chip security, and discloses a safety analysis method, device and equipment for a vehicle-grade chip and a storage medium. The method comprises the following steps: acquiring safety attribute data and circuit netlist data of the vehicle-grade chip, wherein the safety attribute data comprises a safety target; determining a first fault event and a second fault event for the vehicle-grade chip from the circuit netlist data, wherein the first fault event is an event deviating from the safety target, and the second fault event is an event triggering a transient fault of the chip; generating a circuit failure fault tree based on a logical relationship between the first fault event and the second fault event; and determining safety measurement data of the vehicle-grade chip based on the circuit failure fault tree. Through implementation of the technical scheme, the logical structure of the chip circuit can be comprehensively considered, the safety measurement data of the safety target affected by the transient fault can be accurately calculated, and effective safety analysis for the vehicle-grade chip can be realized.

Description

Technical Field

[0001] This invention relates to the field of chip security technology, specifically to a security analysis method, apparatus, device, and storage medium for automotive-grade chips. Background Technology

[0002] With the gradual implementation of intelligent driving, more and more automotive components are demanding functional safety. The basic rules for the functional safety of intelligent driving automotive components and automotive chips have been gradually standardized to ensure that chips function normally without sudden problems and can provide normal alarms and safe implementation.

[0003] Currently, there are few functional safety analysis methods for automotive-grade chips, and safety failure analysis for automotive-grade chips is still in its infancy. Although existing safety analysis tools can detect some faults, these tools are difficult to measure and analyze transient faults in automotive-grade chips, making it difficult to effectively perform safety analysis on automotive-grade chips. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method, apparatus, device and storage medium for security analysis of automotive-grade chips, in order to solve the problem of difficulty in effectively performing security analysis on automotive-grade chips.

[0005] In a first aspect, embodiments of the present invention provide a safety analysis method for automotive-grade chips. The method includes: acquiring safety attribute data and circuit netlist data of the automotive-grade chip, the safety attribute data including safety targets; determining a first fault event and a second fault event for the automotive-grade chip from the circuit netlist data, wherein the first fault event is an event deviating from the safety targets, and the second fault event is an event causing transient chip failure; generating a circuit failure fault tree based on the logical relationship between the first fault event and the second fault event; and determining safety metric data for the automotive-grade chip based on the circuit failure fault tree, the safety metric data being used for safety analysis of the automotive-grade chip.

[0006] The safety analysis method for automotive-grade chips provided in this invention acquires the circuit netlist data and safety attribute data of the automotive-grade chip. By combining the circuit netlist data and safety attribute data, a first fault event and a second fault event are determined to construct a circuit failure fault tree. This allows for the screening of logic units in the circuit that are prone to transient faults and may cause deviations from safety targets. Subsequently, safety metric data is determined through the circuit failure fault tree. This allows for a comprehensive consideration of the chip's circuit logic structure, enabling accurate calculation of the safety metric data affecting safety targets due to transient faults. This safety metric data is then used for effective safety analysis of the automotive-grade chip.

[0007] In conjunction with the first aspect, in one implementation, generating a circuit failure fault tree based on the logical relationship between the first fault event and the second fault event includes: determining the hierarchical structure between the first fault event and the second fault event based on the logical relationship between the first fault event and the second fault event; determining the event logical expression at each level in sequence according to the hierarchical structure; and generating a circuit failure fault tree based on the event logical expression corresponding to each level.

[0008] The safety analysis method for automotive-grade chips provided in this invention constructs event logic expressions for each level sequentially based on the hierarchical structure between the first and second fault events, ensuring that the event logic expressions at each level are interdependent, thereby generating a corresponding circuit failure fault tree. This circuit failure fault tree clarifies the propagation path of transient faults, facilitating the effective identification of safety issues caused by transient faults.

[0009] In conjunction with the first aspect or its corresponding implementation, in one implementation, the event logic expression at each level is determined sequentially according to the hierarchical structure, including: taking the first fault event as the top event and the second fault time as the bottom event, determining the circuit logic relationship between adjacent levels from top to bottom according to the hierarchical structure; based on the circuit logic relationship, the events at each level are logically represented by the events at the next lower level to obtain the event logic expression at each level.

[0010] The safety analysis method for automotive-grade chips provided in this invention constructs event logic representations at each level from top to bottom. By representing events at each level logically using events at the next lower level, the impact of transient faults at the next lower level on the level above can be clearly identified. By analogy, the topological relationship from the bottom logic unit to the top safety target can be obtained. This establishes the relationship between the top event and the bottom event, thereby accurately identifying the bottom event that causes the unexpected occurrence of the top event, so as to carry out safety hardening during chip circuit design.

[0011] In conjunction with the first aspect, in one implementation, determining the safety metric information of an automotive-grade chip based on a circuit failure fault tree includes: determining a set of transient fault events that trigger a first fault event based on the circuit failure fault tree, the set of transient fault events including one or more second fault events; determining the fault probability corresponding to each transient fault event in the set of transient fault events; and obtaining the safety metric information based on each fault probability.

[0012] The safety analysis method for automotive-grade chips provided in this invention analyzes the set of transient fault events that trigger the first fault event to determine the fault probability of each transient fault event. The fault probability of each transient fault event is then combined and passed to the top layer of the circuit failure fault tree to obtain safety measurement information. This method realizes the measurement of transient faults on violations of chip safety objectives and provides data support for subsequent chip optimization iteration and safety assessment.

[0013] In conjunction with the first aspect or its corresponding implementation, in one implementation, determining the transient fault event set that triggers the first fault event based on the circuit failure fault tree includes: identifying multiple second fault events corresponding to the first fault event based on the circuit failure fault tree; sequentially detecting the occurrence signal value of the first fault event when each second fault event occurs; when the occurrence signal value of the first fault event is a preset value, determining the minimum second fault event set that triggers the occurrence of the first fault event, and determining the minimum second fault event set as the transient fault event set.

[0014] The safety analysis method for automotive-grade chips provided in this invention combines the relationship between the occurrence signal value of the first fault event and the occurrence of the second fault event to screen out the minimum set of second fault events that can trigger the first fault event. This achieves qualitative analysis of the quantitative analysis of transient faults on chip safety and can identify the most direct transient fault that triggers the first fault event.

[0015] In conjunction with the first aspect or its corresponding implementation, in one implementation, safety measurement information is obtained based on each fault probability, including: when the first fault event is equal to the logical AND of each transient fault event, the fault probabilities are accumulated to obtain safety measurement information.

[0016] In conjunction with the first aspect or its corresponding implementation, in one implementation, safety measurement information is obtained based on each fault probability, including: when the first fault event is equal to the logical OR of each transient fault event, determining the opposing probability corresponding to each transient fault event, wherein the opposing probability is the difference between 1 and the fault probability; and obtaining safety measurement information based on the cumulative result of each opposing probability.

[0017] The safety analysis method for automotive-grade chips provided in this invention determines safety measurement information based on the logical relationship between the first fault event and the transient fault event, thereby realizing the quantitative analysis of the impact of transient faults on chip safety and facilitating the accurate calculation of the probability metric value of transient faults on chip safety.

[0018] Secondly, embodiments of the present invention provide a safety analysis device for automotive-grade chips. The device includes: a data acquisition module for acquiring safety attribute data and circuit netlist data of the automotive-grade chip, wherein the safety attribute data includes safety targets; a fault event determination module for determining a first fault event and a second fault event for the automotive-grade chip from the circuit netlist data, wherein the first fault event is an event deviating from the safety targets, and the second fault event is an event causing a transient fault in the chip; a fault tree generation module for generating a circuit failure fault tree based on the logical relationship between the first fault event and the second fault event; and a safety measurement module for determining safety measurement data for the automotive-grade chip based on the circuit failure fault tree, wherein the safety measurement data is used for safety analysis of the automotive-grade chip.

[0019] Thirdly, embodiments of the present invention provide a computer device, including: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the security analysis method for automotive-grade chips described in the first aspect or any corresponding embodiment.

[0020] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer instructions, which are used to cause a computer to execute the security analysis method for automotive-grade chips described in the first aspect or any corresponding embodiment. Attached Figure Description

[0021] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating the safety analysis method for automotive-grade chips according to some embodiments of the present invention;

[0023] Figure 2 This is a schematic diagram illustrating the safety analysis of transient faults in automotive-grade chips according to some embodiments of the present invention;

[0024] Figure 3 This is a flowchart illustrating a security analysis method for another automotive-grade chip according to some embodiments of the present invention;

[0025] Figure 4 This is a schematic diagram of the circuit failure fault tree of the CPU-ALU branch in some embodiments of the present invention;

[0026] Figure 5 This is a branch diagram of the fault tree of ALU circuit failure in some embodiments of the present invention;

[0027] Figure 6 This is a structural block diagram of a safety analysis device for automotive-grade chips according to an embodiment of the present invention;

[0028] Figure 7 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] To ensure the safety of vehicle electronic systems, the International Standardization Organization (ISO) developed international standards for functional safety. These standards primarily apply to specific electrical components, electronic devices, and programmable electronic devices in the automotive industry, aiming to improve the functional safety of automotive electronic and electrical products. With the gradual implementation of intelligent driving, more and more automotive components are facing increased demands for functional safety.

[0031] Currently, China lacks a deep understanding of international standards for automotive-grade functional safety, and few domestically produced automotive chips have passed functional safety process certification. Furthermore, China is still in the early stages of functional safety failure analysis for automotive-grade semiconductor components, and has not yet developed standardized or commercially available functional safety analysis technologies and tools. Although commercial functional safety analysis tools based on current safety standards exist abroad, these existing tools do not support qualitative and quantitative analysis of transient failures.

[0032] From a microscopic circuit perspective, not all transient faults at circuit nodes will cause chip failure, nor are all failed chip electronic components related to vehicle safety. Chip safety analysis requires analyzing and screening different logic units of the chip according to safety requirements, identifying those relevant to safety. The safety of automotive-grade chips is closely related to the circuit implementation of the logic algorithm, manifested in three aspects: First, whether the circuit unit itself has fault-tolerant functionality; generally, fault-tolerant designs employ spatial or temporal redundancy. Second, whether transient faults generated by circuit nodes are affected by circuit shielding effects such as logic shielding, time window shielding, and electrical shielding, and whether they are shielded during transmission; only those faults that are not shielded can cause circuit failure. Third, whether the circuit failure caused by the transient fault is related to safety, i.e., whether it violates safety objectives.

[0033] The technical solution of this invention adopts the fault tree analysis method to establish the topological relationship between the bottom logic unit and the top safety target, generate the circuit failure fault tree, and combine factors such as safety target, circuit implementation, and shielding effect. The fault tree analysis method is used to study the propagation path of transient faults, screen out the weak logic units in the circuit that are prone to transient faults and will lead to violations of safety targets, so as to achieve safety analysis of automotive-grade chips.

[0034] According to an embodiment of the present invention, a security analysis method for automotive-grade chips is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0035] This embodiment provides a security analysis method for automotive-grade chips, which can be used in computer devices such as servers and computers. Figure 1 This is a flowchart of a security analysis method for automotive-grade chips according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps:

[0036] Step S101: Obtain the safety attribute data and circuit netlist data of the automotive-grade chip, wherein the safety attribute data includes safety objectives.

[0037] Automotive-grade chips are semiconductor components used in vehicles. Each automotive-grade chip contains multiple circuit components with interconnections. The circuit netlist data describes these interconnections. Specifically, the circuit netlist data can be determined by analyzing the interconnections of the circuit components within the automotive-grade chip. For example... Figure 2As shown, the functions of automotive-grade chips need to be described through multiple levels. Circuit netlist data can be described in the form of gate-level netlist, that is, the circuit components described are gates or components of the same level.

[0038] Safety attribute data is used to characterize the safety performance of automotive-grade chips. This data includes safety objectives and safety levels. Safety objectives represent the chip's safety requirements, and the safety level corresponds to the safety objectives. Specifically, safety objectives can be derived step-by-step based on specific application requirements, or they can be obtained based on safety elements out of context (SEooC). Of course, other methods can also be used; no specific limitations are made here, and those skilled in the art can determine the appropriate method based on actual needs.

[0039] Step S102: Identify the first fault event and the second fault event for the automotive-grade chip from the circuit netlist data.

[0040] The first fault event is an event that deviates from the safety target, and the second fault event is an event that causes a transient fault in the chip.

[0041] The interconnections between various circuit components can be determined based on the circuit netlist data, and each component is susceptible to transient faults. Transient faults are soft faults, meaning they disappear after a single occurrence, and their occurrence may cause chips to deviate from safety objectives, thus affecting the overall vehicle safety.

[0042] Circuit netlist data represents the connections between various circuit components in the form of logic gates, meaning that a chip circuit contains multiple logic units. Computer equipment needs to analyze different logic units in the chip circuit according to safety objectives, identifying the logic units related to those objectives. The event of a failure in a top-level logic unit that deviates from the safety objective is designated as the first fault event; the occurrence of the first fault event will definitely affect the overall vehicle safety. Simultaneously, the event of a transient failure in a bottom-level logic unit is designated as the second fault event; the occurrence of the second fault event will trigger the first fault event.

[0043] Step S103: Based on the logical relationship between the first fault event and the second fault event, generate a circuit failure fault tree.

[0044] The circuit failure fault tree is used to characterize the logical causality between the first and second failure events. That is, it describes the causal relationship of failure of each logic unit contained in the automotive-grade chip through fault event symbols, logic gate symbols and transfer symbols.

[0045] Specifically, the circuit failure fault tree uses an inverted tree structure, taking the first fault event as the root (i.e., the top event) of the inverted tree, searching for possible events that could cause the first fault event, and taking them as branches (i.e., intermediate events) of the circuit failure fault tree, and so on, level by level until the second fault event (i.e., the bottom event) at the bottom level is found.

[0046] By analyzing circuit netlist data, computer equipment can identify multiple logical units between the first and second fault events. Based on the logical relationships between these units, the system recursively traces back to the logical unit corresponding to the first fault event, thereby determining the logical relationship between transient faults of all logical units and the second fault event. Based on this logical relationship, a circuit failure fault tree can be constructed with the first fault event as the top event and the second fault event as the bottom event.

[0047] Step S104: Based on the circuit failure fault tree, determine the safety measurement data of the automotive-grade chip. This safety measurement data is used to perform safety analysis on the automotive-grade chip.

[0048] Safety metrics represent the probability of transient failures violating chip safety objectives. These metrics enable safety analysis of automotive-grade chips, allowing for targeted hardening of weak logic units within these chips. Furthermore, they provide a basis for safety testing and safety level assessment of automotive-grade chips.

[0049] The computer equipment identifies multiple second fault events that trigger the first fault event based on a constructed circuit failure fault tree. It then performs qualitative analysis on these second fault events to filter out the simplest combination of each event. Next, the computer equipment performs quantitative analysis on each second fault event in the simplest combination to determine the corresponding fault probability value. This fault probability value is passed from bottom to top until it reaches the top level of the circuit failure fault tree. Combining this with the logical relationship between the first and second fault events, the final fault probability value is determined. This top-level fault probability value is the final safety measurement data.

[0050] The safety analysis method for automotive-grade chips provided in this embodiment acquires the circuit netlist data and safety attribute data of the automotive-grade chip. Combining these data, it identifies the first and second fault events to construct a circuit failure fault tree. This allows for the screening of logic units in the circuit that are prone to transient faults and may cause deviations from safety objectives. Subsequently, the circuit failure fault tree is used to determine safety metric data. This allows for a comprehensive consideration of the chip's circuit logic structure, enabling accurate calculation of safety metric data that affects safety objectives due to transient faults. This safety metric data then facilitates effective safety analysis of the automotive-grade chip.

[0051] This embodiment provides a security analysis method for automotive-grade chips, which can be used in computer devices such as servers and computers. Figure 3 This is a flowchart of a security analysis method for automotive-grade chips according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps:

[0052] Step S201: Obtain the safety attribute data and circuit netlist data of the automotive-grade chip. The safety attribute data includes safety objectives. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0053] Step S202: Identify a first fault event and a second fault event for the automotive-grade chip from the circuit netlist data. The first fault event is an event that deviates from the safety target, and the second fault event is an event that causes a transient fault in the chip. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0054] Step S203: Based on the logical relationship between the first fault event and the second fault event, generate a circuit failure fault tree.

[0055] Specifically, step S203 above may include:

[0056] Step S2031: Based on the logical relationship between the first fault event and the second fault event, determine the hierarchical structure between the first fault event and the second fault event.

[0057] A hierarchical structure is a multi-level structure of logical units existing between the first fault event and the second fault event. For example... Figure 2 As shown, there are three levels between the first and second fault events, and each level corresponds to a specific logic unit. A transient fault in a logic unit at any level may affect the normal operation of the logic unit at the next higher level.

[0058] Step S2032: Determine the event logic expression at each level in sequence according to the hierarchical structure.

[0059] Starting with the logic unit corresponding to the first fault event, the logic units at each level are represented sequentially according to the hierarchical structure, down to the next lower-level logic unit. When a transient fault event occurs in the logic unit at the current level, it propagates to the current level. Therefore, the transient fault event at the current level can be represented using the transient fault of the next lower-level logic unit, thus obtaining the event logic expression for the current level. Similarly, by representing the transient fault event of the upper-level logic unit using the transient fault event of the lower-level logic unit, the event logic expression for each level can be obtained.

[0060] In some alternative embodiments, step S2032 includes:

[0061] Step a1: Using the first fault event as the top event and the second fault time as the bottom event, determine the circuit logic relationship between adjacent levels from top to bottom according to the hierarchical structure.

[0062] Step a2: Based on the circuit logic relationship, the events at each level are logically represented using the events at the next lower level to obtain the logical expression of the events at each level.

[0063] Using the first fault event as the top event and the second fault time as the bottom event, the circuit logic relationship between adjacent levels is determined sequentially from top to bottom, starting with the first fault event. Based on the circuit logic relationship between adjacent levels, the transient fault events of the previous level are represented by the transient fault events of the next level. This process is repeated layer by layer until all levels are replaced by bottom events, meaning that the final top event can be entirely expressed using bottom events for event logic.

[0064] For example, the hierarchy between the first and second fault events is level 1. The level of the second fault event corresponds to two logic units, and the transient fault events of these two logic units are represented as events A and B, respectively. If the circuit netlist data determines that the first and second fault events have a logical AND relationship, then the logical representation of the first fault event using the second fault event is AB. If the circuit netlist data determines that the first and second fault events have a logical OR relationship, then the logical representation of the first fault event using the second fault event is A+B.

[0065] By constructing event logic representations at each level from top to bottom, and representing events at each level logically using events at the next lower level, the impact of transient faults at the next lower level on the level above can be clearly defined. By analogy, the topological relationship from the bottom logic unit to the top security target can be obtained. This establishes the relationship between the top event and the bottom event, thereby accurately identifying the bottom event that causes the top event to occur unexpectedly, so as to carry out security hardening during chip circuit design.

[0066] Step S2033: Generate a circuit failure fault tree based on the event logic expression corresponding to each level.

[0067] By expressing the event logic at each level, the logical dependencies between adjacent levels can be determined. Based on these dependencies, the connections between adjacent levels can be constructed. Therefore, by combining these connections, a circuit failure fault tree can be generated.

[0068] Step S204: Based on the circuit failure fault tree, determine the safety measurement data of the automotive-grade chip. This safety measurement data is used to perform safety analysis on the automotive-grade chip.

[0069] Specifically, step S204 above may include:

[0070] Step S2041: Based on the circuit failure fault tree, determine the set of transient fault events that triggered the first fault event, the set of transient fault events including one or more second fault events.

[0071] Based on the above, since each event in the circuit failure fault tree has been replaced with an event logic expression using a second fault event, the first fault event can be expressed by multiple second fault events, which together constitute the fault event set of the first fault event.

[0072] Furthermore, the second fault event in the fault event set is a transient fault event that may cause the first fault event to occur, but it is not certain that it will cause the first fault event to occur. At this time, the computer device can use Boolean operations to simplify the fault event set until removing any transient fault event would cause the first fault event to not necessarily occur. The second fault event set obtained at this time is the simplest combination of transient faults, that is, the transient fault event set.

[0073] In some alternative embodiments, step S2041 includes:

[0074] Step b1: Based on the circuit failure fault tree, identify multiple second fault events corresponding to the first fault event.

[0075] Step b2: Sequentially detect the occurrence signal value of the first fault event when each second fault event occurs.

[0076] Step b3: When the occurrence signal value of the first fault event is a preset value, determine the minimum second fault event set that caused the occurrence of the first fault event, and determine the minimum second fault event set as the transient fault event set.

[0077] Since the first fault event can be fully represented by the second fault event, and the second fault event is a transient fault event, which is a single point of failure, the logic of the first fault event represented by the second fault event is either an AND gate or an OR gate.

[0078] Based on the circuit failure fault tree, all second fault events representing the first fault event can be identified. Then, each second fault event can be detected sequentially to determine the occurrence signal value corresponding to the first fault event when a second fault event occurs. This occurrence signal value is the logic value of the first fault event, and includes 0 and 1.

[0079] The preset value is a pre-defined value used to indicate that the occurrence of a first fault event will cause the chip to fail. The computer device can compare the generated signal value with the preset value to determine whether the generated signal value matches the preset value. When it is determined that the generated signal value is the preset value, it means that the occurrence of a second fault event will trigger the occurrence of the first fault event. By sequentially traversing each second fault event, the combination of events in which the occurrence of a second fault event leads to the occurrence of a first fault event is found. The second fault events contained in this combination of events constitute the minimal set of second fault events, i.e., the transient fault event set.

[0080] For example, based on a certain safety objective, when the occurrence signal value of the first fault event is 0, it is considered that the occurrence of the first fault event has caused the chip to fail. Then, through the event logic expression, it can be known which second fault events will cause the occurrence signal value of the first fault event to be 0. The combination of these second fault events that cause the first fault event to occur is the transient fault event set.

[0081] Here, by combining the relationship between the occurrence signal value of the first fault event and the occurrence of the second fault event, the minimum set of second fault events that can trigger the first fault event is selected. This achieves qualitative analysis of the quantitative analysis of transient faults on chip safety and can identify the most direct transient fault that triggers the first fault event.

[0082] Step S2042: Determine the fault probability corresponding to each transient fault event in the transient fault event set.

[0083] Computer devices store fault probability calculation models. These models are used to analyze whether transient fault events will be shielded by circuit shielding effects, such as logic shielding, time window shielding, and electrical shielding.

[0084] Once the transient fault events that cannot be shielded are identified, each transient fault event is input into the fault calculation model to calculate the fault probability, thus obtaining the fault probability corresponding to each transient fault event. This fault probability model is pre-trained based on circuit shielding effect experiments and a Boolean calculation model.

[0085] Step S2043: Based on each failure probability, obtain safety measurement information.

[0086] Safety metrics are represented by the probability of the first failure event occurring. Based on the failure probabilities corresponding to each transient failure event and the event logic expression between each transient failure event and the first failure event, the probability of the first failure event occurring due to the occurrence of a transient failure event can be calculated.

[0087] In some alternative embodiments, when the first fault event is equal to the logical AND of all transient fault events, step S2043 may include: accumulating the probabilities of each fault to obtain safety measurement information.

[0088] The circuit failure fault tree includes n secondary failure events (x1, x2, ... x). n If the circuit failure fault tree is defined as follows:

[0089] Φ(X)=Φ(x1,x2,...,x n )

[0090] With F S (t) represents the probability of the first failure event occurring, and its functional expression is:

[0091] F S (t)=E[Φ(x)]

[0092] When the first fault event equals the logical AND of all transient fault events, i.e., when the first fault event is an AND gate structure, its occurrence probability can be expressed as:

[0093]

[0094] Among them, F i (t) represents the unavailability of the i-th transient fault, where i equals {1,2,3…}, F i (t) is the probability of a transient fault occurring in logic unit i within the time interval [0, t].

[0095] In some alternative embodiments, when the first fault event is equal to the logical OR of each transient fault event, step S2043 may include:

[0096] Step c1: Determine the opposite probability corresponding to each transient fault event. The opposite probability is the difference between 1 and the fault probability.

[0097] Step c2: Based on the cumulative results of each opposing probability, security measurement information is obtained.

[0098] F i (t) represents the probability of a transient failure in the i-th logic unit. The opposite probability of a transient failure in the i-th logic unit is 1 - F. i (t).

[0099] When the first fault event equals the logical OR of all transient fault events, i.e., when the first fault event is an OR gate structure, the probability of the occurrence of the first fault event under the OR gate structure is obtained by accumulating the various contradictory probabilities and subtracting the accumulated result from 1. This probability can be specifically expressed as:

[0100]

[0101] Among them, F S () indicates the probability of the first failure event occurring.

[0102] Here, based on the logical relationship between the first fault event and the transient fault event, the safety measurement information is determined, realizing the quantitative analysis of the impact of transient faults on chip safety, which facilitates the accurate calculation of the probability measurement value of the impact of transient faults on chip safety.

[0103] The safety analysis method for automotive-grade chips provided in this embodiment constructs a circuit failure fault tree that clearly defines the propagation path of transient faults, facilitating the effective identification of safety issues caused by transient faults. By analyzing the set of transient fault events that trigger the first fault event, and combining the fault probability of each transient fault event to propagate to the top level of the circuit failure fault tree, safety measurement information is obtained. This realizes the measurement of transient faults against chip safety objectives, providing data support for subsequent chip optimization iterations and safety assessments.

[0104] This invention uses an MCU chip as an example to test and verify the above method. First, the top-level security objective of the chip is obtained based on the SEooC method; second, under this top-level security objective, a circuit failure fault tree is established for the ALU module in the MCU, such as... Figure 4 As shown; then, by combining the circuit failure fault tree, the weak logic unit (i.e., security weakness) is located, and the event in which the weak logic unit experiences a transient failure is the second fault event; subsequently, the VCS simulation tool is used to simulate injecting faults into these security weakness units to verify whether the security objectives are violated, such as... Figure 5 As shown in the figure. Experimental results show that injecting transient faults into security vulnerabilities located using the above method during the simulation phase does indeed lead to a deviation from the chip security target, and the experiment proves the feasibility of the method.

[0105] This embodiment also provides a security analysis device for automotive-grade chips, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0106] This embodiment provides a security analysis device for automotive-grade chips, such as... Figure 6 As shown, it includes:

[0107] The data acquisition module 301 is used to acquire safety attribute data and circuit netlist data of automotive-grade chips, wherein the safety attribute data includes safety targets.

[0108] The fault event determination module 302 is used to determine a first fault event and a second fault event for the automotive-grade chip from the circuit netlist data. The first fault event is an event that deviates from the safety target, and the second fault event is an event that causes a transient fault in the chip.

[0109] The fault tree generation module 303 is used to generate a circuit failure fault tree based on the logical relationship between the first fault event and the second fault event.

[0110] The safety measurement module 304 is used to determine the safety measurement data of automotive-grade chips based on the circuit failure fault tree. This safety measurement data is used to perform safety analysis on automotive-grade chips.

[0111] In some alternative embodiments, the fault tree generation module 303 may include:

[0112] The hierarchy determination unit is used to determine the hierarchical structure between the first fault event and the second fault event based on the logical relationship between the first fault event and the second fault event.

[0113] A logical expression unit is used to determine the logical expression of events at each level in a hierarchical structure.

[0114] The fault tree generation unit is used to generate a circuit failure fault tree based on the event logic expression corresponding to each level.

[0115] In some alternative embodiments, the logical expression unit may include:

[0116] The logic relationship determination sub-unit is used to determine the circuit logic relationship between adjacent levels from top to bottom according to the hierarchical structure, with the first fault event as the top event and the second fault time as the bottom event.

[0117] The logic representation subunit is used to logically represent events at each level using events at the next lower level, based on circuit logic relationships, to obtain the logical expression of events at each level.

[0118] In some alternative embodiments, the security measurement module 304 may include:

[0119] The fault event set determination unit is used to determine the transient fault event set that triggers the first fault event based on the circuit failure fault tree. The transient fault event set includes one or more second fault events.

[0120] The fault probability determination unit is used to determine the fault probability corresponding to each transient fault event in the transient fault event set.

[0121] The measurement unit is used to obtain safety measurement information based on each failure probability.

[0122] In some alternative embodiments, the fault event set determination unit may include:

[0123] The identification subunit is used to identify multiple second fault events corresponding to the first fault event based on the circuit failure fault tree.

[0124] The detection subunit is used to sequentially detect the occurrence signal value of the first fault event when each second fault event occurs.

[0125] The determination subunit is used to determine the minimum second fault event set that triggers the occurrence of the first fault event when the occurrence signal value of the first fault event is a preset value, and to determine the minimum second fault event set as the transient fault event set.

[0126] In some alternative embodiments, when the first fault event equals the logical AND of all transient fault events, the aforementioned measurement unit may include:

[0127] The first accumulation subunit is used to accumulate the probabilities of each fault to obtain safety measurement information.

[0128] In some alternative embodiments, when the first fault event is equal to the logical OR of all transient fault events, the measurement unit may further include:

[0129] The opposition probability determination sub-unit is used to determine the opposition probability corresponding to each transient fault event. The opposition probability is the difference between 1 and the fault probability.

[0130] The second accumulation subunit is used to obtain security measurement information based on the accumulation results of each opposing probability.

[0131] The further functional descriptions of each module, unit, and subunit are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0132] In this embodiment, the safety analysis device for automotive-grade chips is presented in the form of functional units. Here, a unit refers to an ASIC circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0133] The safety analysis device for automotive-grade chips provided in this embodiment acquires circuit netlist data and safety attribute data of the automotive-grade chip. Combining these data, it identifies a first fault event and a second fault event to construct a circuit failure fault tree. This allows for the screening of logic units in the circuit that are prone to transient faults and may cause deviations from safety targets. Subsequently, the circuit failure fault tree is used to determine safety metric data. This allows for a comprehensive consideration of the chip's circuit logic structure, enabling accurate calculation of safety metric data that affects safety targets due to transient faults. This safety metric data then facilitates effective safety analysis of the automotive-grade chip.

[0134] This invention also provides a computer device having the above-described features. Figure 7 The safety analysis device shown is for automotive-grade chips.

[0135] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 7 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 7 Take a processor 10 as an example.

[0136] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0137] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0138] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0139] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0140] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0141] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0142] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A security analysis method for automotive-grade chips, characterized in that, The method includes: The safety attribute data and circuit netlist data of automotive-grade chips are obtained. The safety attribute data includes safety targets, and the circuit netlist data is used to describe the interconnection relationships between the circuit components contained in the automotive-grade chip. The circuit netlist data represents the interconnection relationships of each circuit component in the form of logic gates, that is, the chip circuit contains multiple logic units. The circuit netlist data determines a first fault event and a second fault event for the automotive-grade chip. The first fault event is an event in which a logic unit at the top level of the logic fails and deviates from the safety target. The second fault event is an event in which a logic unit at the bottom level of the logic causes a transient fault in the chip. The occurrence of the second fault event triggers the occurrence of the first fault event. Based on the logical relationship between the first fault event and the second fault event, a circuit failure fault tree is generated. Based on the circuit failure fault tree, the safety measurement data of the automotive-grade chip is determined, and the safety measurement data is used to perform safety analysis on the automotive-grade chip. Specifically, determining the safety metric information of the automotive-grade chip based on the circuit failure fault tree includes: determining a set of transient fault events that trigger the first fault event based on the circuit failure fault tree, wherein the set of transient fault events includes one or more second fault events; determining the fault probability corresponding to each transient fault event in the set of transient fault events; and obtaining the safety metric information based on each fault probability.

2. The method according to claim 1, characterized in that, The step of generating a circuit failure fault tree based on the logical relationship between the first fault event and the second fault event includes: Based on the logical relationship between the first fault event and the second fault event, the hierarchical structure between the first fault event and the second fault event is determined; According to the hierarchical structure, the event logic expression at each level is determined sequentially; Based on the event logic expression corresponding to each level, the circuit failure fault tree is generated.

3. The method according to claim 2, characterized in that, The step of determining the event logic expression at each level according to the hierarchical structure includes: Using the first fault event as the top event and the second fault event as the bottom event, the circuit logic relationship between adjacent levels is determined from top to bottom according to the hierarchical structure. Based on the circuit logic relationship, events at each level are logically represented using events at the next lower level, resulting in logical expressions for events at each level.

4. The method according to claim 1, characterized in that, Based on the circuit failure fault tree, a set of transient fault events that triggered the first fault event is determined, including: Based on the circuit failure fault tree, identify multiple second fault events corresponding to the first fault event; The occurrence signal value of the first fault event is detected sequentially when each of the second fault events occurs. When the occurrence signal value of the first fault event is a preset value, the minimum second fault event set that caused the occurrence of the first fault event is determined, and the minimum second fault event set is determined as the transient fault event set.

5. The method according to claim 1 or 4, characterized in that, The process of obtaining the safety measurement information based on each of the aforementioned failure probabilities includes: When the first fault event equals the logical AND of each of the transient fault events, the probabilities of each fault are accumulated to obtain the safety measurement information.

6. The method according to claim 1 or 4, characterized in that, The process of obtaining the safety measurement information based on each of the aforementioned failure probabilities includes: When the first fault event is equal to the logical OR of each of the transient fault events, the opposition probability corresponding to each of the transient fault events is determined, and the opposition probability is the difference between 1 and the fault probability. The security measurement information is obtained based on the cumulative result of each of the aforementioned opposing probabilities.

7. A security analysis device for automotive-grade chips, characterized in that, The device includes: The data acquisition module is used to acquire safety attribute data and circuit netlist data of automotive-grade chips. The safety attribute data includes safety targets, and the circuit netlist data is used to describe the interconnection relationships between the circuit components contained in the automotive-grade chip. The circuit netlist data represents the interconnection relationships of each circuit component in the form of logic gates, that is, the chip circuit contains multiple logic units. The fault event determination module is used to determine a first fault event and a second fault event for the automotive-grade chip from the circuit netlist data. The first fault event is an event in which a logic unit at the top level of the logic fails and deviates from the safety target. The second fault event is an event in which a logic unit at the bottom level of the logic causes a transient fault in the chip. The occurrence of the second fault event triggers the occurrence of the first fault event. The fault tree generation module is used to generate a circuit failure fault tree based on the logical relationship between the first fault event and the second fault event; The safety measurement module is used to determine the safety measurement data of the automotive-grade chip based on the circuit failure fault tree, and the safety measurement data is used to perform safety analysis on the automotive-grade chip. The safety measurement module includes: a fault event set determination unit, used to determine a transient fault event set that causes the first fault event based on the circuit failure fault tree, wherein the transient fault event set includes one or more second fault events; a fault probability determination unit, used to determine the fault probability corresponding to each transient fault event in the transient fault event set; and a measurement unit, used to obtain the safety measurement information based on each fault probability.

8. A computer device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the security analysis method for automotive-grade chips as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the security analysis method for automotive-grade chips according to any one of claims 1 to 6.

Images