Method and device for detecting functional safety mechanism failure of vehicle

Abstract

The present application relates to a method and apparatus for detecting functional safety mechanism failures in a vehicle, wherein the method comprises: detecting the current operating stage of a microprocessor; if the current operating stage is the initialization monitoring stage, performing a BIST check on the microprocessor; and when the check result indicates a microprocessor failure, verifying the check result using a preset failure reconfirmation strategy, and obtaining microprocessor fault information based on the check result; interrupting the current operating process of the microprocessor based on the fault information, identifying the current fault type of the microprocessor, and matching a corresponding fault handling strategy based on the current fault type to execute the fault handling strategy on the microprocessor. The embodiments of the present application can differentially monitor the operating stage of the microprocessor and match the corresponding fault handling strategy to reduce the risk of power interruption during vehicle operation and improve vehicle driving safety.

Description

Technical Field

[0001] The present application relates to the field of vehicle technology, and in particular to a method and device for detecting functional safety mechanism failures in a vehicle. Background Art

[0002] Functional safety fault diagnosis for controllers can be broadly categorized into two types: first, controller-level fault diagnosis, and second, microprocessor-level fault diagnosis. Controller-level fault diagnosis can be summarized as functional-level diagnosis. The detection and management of this type of fault are relatively mature, and the DEM module in the AUTOSAR model provides detailed and specific definitions for these operations. The second type of microprocessor-level fault diagnosis primarily involves detecting potential faults in microprocessor hardware, including common CPU (Central Processing Unit) core lockstep monitoring, BIST (Built-in Self Test) self-tests, ECC (Error Checking and Correcting) checks, and clock monitoring.

[0003] In related technologies, such as CN113043969A "A Vehicle Functional Safety Monitoring Method and System", the vehicle function operation status can be monitored, and a fault notification can be reported to the fault de-bouncing module when a fault occurs; the fault de-bouncing module confirms the fault type; the fault management module starts the timeout timer to track the fault processing flow, and notifies the corresponding application software layer to perform fault pre-processing based on the corresponding information in the fault table; after the pre-processing is completed, the fault management module turns off the timeout timer, and triggers the fault status notification module to notify the corresponding module of the fault processing to perform the functional safety processing process.

[0004] However, the related technology only involves controller-level fault diagnosis, but less about microprocessor-level fault diagnosis and processing, and there are certain safety hazards in fault processing, such as the risk of interruption when the microprocessor is reset, which urgently needs to be improved. Summary of the Invention

[0005] The present application provides a method and device for detecting functional safety mechanism failures in a vehicle to solve the technical problems in related technologies, such as the lack of involvement in microprocessor-level fault diagnosis and processing, and the existence of certain safety hazards during fault processing, which is not conducive to ensuring vehicle driving safety.

[0006] The first aspect of the present application provides a method for detecting a functional safety mechanism failure of a vehicle, comprising the following steps: detecting a current operating stage of a microprocessor; if the current operating stage is an initialization monitoring stage, performing a built-in self-test (BIST) on the microprocessor, and when the verification result indicates a microprocessor failure, verifying the verification result using a preset failure reconfirmation strategy, and obtaining fault information of the microprocessor based on the verification result; interrupting the current operating process of the microprocessor based on the fault information, identifying the current fault type of the microprocessor, and matching a corresponding fault handling strategy based on the current fault type to execute the fault handling strategy on the microprocessor.

[0007] According to the above technical means, the embodiment of the present application can perform differential monitoring on the initialization monitoring phase of the microprocessor and match the corresponding fault handling strategy to reduce the risk of power interruption during vehicle operation and improve vehicle driving safety.

[0008] Optionally, in one embodiment of the present application, the verification result is verified using a preset failure reconfirmation strategy, including: determining the failure type of the microprocessor based on the verification result; when the failure type is a logic self-test failure type, injecting a preset fault into the microprocessor, and obtaining the injection result of the preset fault based on the post-injection state of the register; when the failure type is a memory self-test failure type, reading the failed memory block corresponding to the built-in self-test BIST, and determining whether the fault of the failed memory block is a permanent fault, and when the fault of the failed memory block is a permanent fault, recording the fault data of the failed memory block.

[0009] According to the above technical means, the embodiment of the present application can ensure the accuracy of the verification result through failure reconfirmation.

[0010] Optionally, in one embodiment of the present application, after obtaining the current operating stage of the microprocessor, it also includes: if the current operating stage is the execution monitoring stage, detecting whether the microprocessor meets the preset random hardware failure condition and / or the preset systematic software failure condition; if the microprocessor meets the preset random hardware failure condition and / or the preset systematic software failure condition, generating fault information corresponding to the microprocessor to interrupt the current operating process of the microprocessor based on the fault information.

[0011] According to the above technical means, the embodiment of the present application can perform differential monitoring on the execution monitoring stage of the microprocessor and match the corresponding fault handling strategy to reduce the risk of power interruption during vehicle operation and improve vehicle driving safety.

[0012] Optionally, in one embodiment of the present application, after obtaining the current operating stage of the microprocessor, it also includes: if the current operating stage is the power-off monitoring stage, turning off the timer of the microprocessor to prohibit interrupting the data storage action of the microprocessor in the power-off monitoring stage.

[0013] According to the above technical means, the embodiment of the present application can turn off the timer during the power-off monitoring phase to avoid unexpected timer failures caused by data storage and ensure the normal execution of the program.

[0014] Optionally, in one embodiment of the present application, while interrupting the current running process of the microprocessor based on the fault information, the current fault type of the microprocessor is obtained, including: based on the interruption time of the microprocessor and the fault information, obtaining the freeze frame and the corresponding fault code when the microprocessor is interrupted, and storing the freeze frame and the fault code to generate a fault record table.

[0015] According to the above technical means, the embodiment of the present application can store freeze frames and fault codes to generate a fault record table so that technicians can quickly locate the cause of the fault.

[0016] Optionally, in one embodiment of the present application, the fault handling strategy corresponding to the matching of the current fault type includes: when the current fault type meets the preset reminder conditions, pushing a risk warning signal to the driver; when the current fault type does not meet the preset reminder conditions, sending a takeover signal to the auxiliary microprocessor, so as to use the auxiliary microprocessor instead of the microprocessor to control the vehicle to execute the preset safety strategy.

[0017] According to the above technical means, the embodiments of the present application can determine different fault handling strategies based on different fault risks to reduce the probability of power interruption and ensure the normal driving of the vehicle.

[0018] The second aspect of the present application provides a device for detecting functional safety mechanism failures of a vehicle, including: a detection module for detecting the current operating stage of a microprocessor; a verification module for performing a built-in self-test (BIST) verification on the microprocessor when the current operating stage is the initialization monitoring stage, and when the verification result is a microprocessor failure, verifying the verification result using a preset failure reconfirmation strategy, and obtaining fault information of the microprocessor based on the verification result; a processing module for interrupting the current operating process of the microprocessor based on the fault information, identifying the current fault type of the microprocessor, and matching the corresponding fault handling strategy based on the current fault type to execute the fault handling strategy on the microprocessor.

[0019] Optionally, in one embodiment of the present application, the verification module includes: a determination unit, used to determine the failure type of the microprocessor based on the verification result; an injection unit, used to inject a preset fault into the microprocessor when the failure type is a logic self-test failure type, and obtain the injection result of the preset fault based on the post-injection state of the register; a recording unit, used to read the failed memory block corresponding to the built-in self-test BIST when the failure type is a memory self-test failure type, and determine whether the fault of the failed memory block is a permanent fault, and record the fault data of the failed memory block when the fault of the failed memory block is a permanent fault.

[0020] Optionally, in one embodiment of the present application, it also includes: a second detection module, which is used to detect whether the microprocessor meets the preset random hardware failure condition and / or the preset systematic software failure condition when the current operation stage is the execution monitoring stage; and a generation module, which is used to generate fault information corresponding to the microprocessor when the microprocessor meets the preset random hardware failure condition and / or the preset systematic software failure condition, so as to interrupt the current operation process of the microprocessor based on the fault information.

[0021] Optionally, in one embodiment of the present application, it also includes: a shutdown module, which is used to shut down the timer of the microprocessor when the current operating stage is the power-off monitoring stage, so as to prohibit interruption of the data storage action of the microprocessor in the power-off monitoring stage.

[0022] Optionally, in one embodiment of the present application, the processing module includes: a storage unit, which is used to obtain a freeze frame and a corresponding fault code when the microprocessor is interrupted based on the interrupt time of the microprocessor and the fault information, and store the freeze frame and the fault code to generate a fault record table.

[0023] Optionally, in one embodiment of the present application, the processing module includes: a reminder unit, used to push a risk warning signal to the driver when the current fault type meets the preset reminder conditions; an auxiliary unit, used to send a takeover signal to an auxiliary microprocessor when the current fault type does not meet the preset reminder conditions, so as to use the auxiliary microprocessor instead of the microprocessor to control the vehicle to execute a preset safety strategy.

[0024] A third aspect of the present application provides a vehicle, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a method for detecting a functional safety mechanism failure of the vehicle as described in the above embodiment.

[0025] A fourth aspect of the present application provides a computer-readable storage medium, which stores a computer program that, when executed by a processor, implements the above-mentioned method for detecting functional safety mechanism failures of a vehicle.

[0026] Beneficial effects of the embodiments of the present application:

[0027] (1) The embodiments of the present application can perform differential monitoring on the operation phase of the microprocessor, ensuring the monitoring range while not affecting the normal operation of the program.

[0028] (2) The embodiment of the present application can use freeze frames and fault codes to generate a fault record table so that technicians can quickly locate the cause of the fault.

[0029] (3) The embodiments of the present application can determine different fault handling strategies based on different fault risks to reduce the probability of power interruption, ensure the normal driving of the vehicle, and avoid dangerous situations such as power interruption caused by reset by adding an auxiliary microprocessor.

[0030] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0032] Figure 1 This is a flowchart of a method for detecting a functional safety mechanism failure of a vehicle provided in accordance with an embodiment of the present application;

[0033] Figure 2 1 is a schematic diagram showing the principle of a method for detecting a functional safety mechanism failure of a vehicle according to one embodiment of the present application;

[0034] Figure 3 1 is a schematic diagram showing a method for detecting a failure of a functional safety mechanism of a vehicle according to another embodiment of the present application;

[0035] Figure 4 1 is a schematic diagram showing the principle of a method for detecting a functional safety mechanism failure of a vehicle according to yet another embodiment of the present application;

[0036] Figure 5 This is a schematic structural diagram of a device for detecting a functional safety mechanism failure in a vehicle according to an embodiment of the present application;

[0037] Figure 6 A schematic structural diagram of a vehicle provided according to an embodiment of the present application.

[0038] Among them, 10 is a detection device for functional safety mechanism failure of a vehicle, 100 is a detection module, 200 is a verification module and 300 is a processing module; 601 is a memory, 602 is a processor and 603 is a communication interface. DETAILED DESCRIPTION

[0039] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0040] The following describes a method and apparatus for detecting a functional safety mechanism failure of a vehicle according to an embodiment of the present application with reference to the accompanying drawings. In response to the technical problems that the related technologies mentioned in the background technology mentioned above involve little in microprocessor-level fault diagnosis and processing, and there are certain safety hazards during fault processing, which is not conducive to ensuring vehicle driving safety, the present application provides a method for detecting a functional safety mechanism failure of a vehicle. In this method, corresponding functional safety mechanism monitoring can be performed according to the current operating stage of the microprocessor. When the current operating stage of the microprocessor is the initialization monitoring stage, the microprocessor is subjected to a BIST check, and the check result is verified by a preset failure reconfirmation strategy, thereby obtaining microprocessor fault information. Then, the current operating process of the microprocessor is interrupted according to the fault information, and a corresponding fault processing strategy is matched according to the current fault type of the microprocessor, so as to perform more targeted fault processing, avoid the microprocessor interrupting the vehicle power during fault processing, and perform differential monitoring according to the operating stage of the microprocessor and match the corresponding fault processing strategy, thereby improving vehicle driving safety. Thus, the technical problems that the related technologies involve little in microprocessor-level fault diagnosis and processing, and there are certain safety hazards during fault processing, which are not conducive to ensuring vehicle driving safety are solved.

[0041] Specifically, Figure 1 A flowchart of a method for detecting a functional safety mechanism failure in a vehicle provided in an embodiment of the present application.

[0042] like Figure 1 As shown, the method for detecting functional safety mechanism failure of the vehicle is applied in the model building stage, wherein the method includes the following steps:

[0043] In step S101 , the current operating stage of the microprocessor is detected.

[0044] During the actual execution process, the embodiment of the present application can detect the current operating stage of the microprocessor, and thus perform different monitoring according to different operating stages, which ensures the scope of monitoring and does not affect the normal operation of the program. Among them, the current operating stage of the microprocessor can include the initialization monitoring stage, the execution monitoring stage and the power-off monitoring stage.

[0045] In step S102, if the current operation phase is the initialization monitoring phase, a built-in self-test (BIST) is performed on the microprocessor. When the verification result indicates that the microprocessor has failed, the verification result is verified using a preset failure reconfirmation strategy, and fault information of the microprocessor is obtained based on the verification result.

[0046] As a possible implementation method, when the current operating stage of the microprocessor is the initialization monitoring stage, the embodiment of the present application can use the BIST module of the microprocessor to complete the preliminary monitoring and diagnosis of the microprocessor. After the verification is completed, the verification result can be judged through the BIST register. If the verification result is normal, the failure reconfirmation step is skipped. Otherwise, it is necessary to enter the failure reconfirmation step to reconfirm the corresponding functional safety mechanism and memory accuracy and reliability.

[0047] It should be noted that since some functions of the microprocessor may affect program execution during testing, at this stage, the embodiment of the present application can first test the functional modules of this part, such as the watchdog monitoring test, and the test of some flash, Ram and other memory storage areas, so as to avoid potential failures.

[0048] Optionally, in one embodiment of the present application, a preset failure reconfirmation strategy is used to verify the verification result, including: determining the failure type of the microprocessor based on the verification result; when the failure type is a logic self-test failure type, injecting a preset fault into the microprocessor, and obtaining the injection result of the preset fault based on the post-injection state of the register; when the failure type is a memory self-test failure type, reading the failed memory block corresponding to the built-in self-test BIST, and determining whether the fault of the failed memory block is a permanent fault, and when the fault of the failed memory block is a permanent fault, recording the fault data of the failed memory block.

[0049] It is understandable that BIST includes LBIST (Logic BIST) and MBIST (Memory BIST), which can perform systematic and relatively complete verification of the functional safety mechanism module in the microprocessor.

[0050] like Figure 2As shown, the embodiment of the present application can confirm whether it is LBIST or MBIST that fails based on the BIST check result register. If LBIST fails, it means that a fault has been detected in the safety mechanism and it is necessary to perform fault injection (usually including watchdog fault injection, etc.). Then, it is determined whether the fault injection result is successful based on the register status after the fault injection. If all safety mechanisms pass the test, it means that the safety mechanism is reliable and the next step can be entered.

[0051] If the MBIST fails, it means there is a memory block detection error. Read the failed memory block corresponding to the BIST to confirm whether the failed memory block has a temporary fault or a permanent fault. If it is confirmed that a permanent fault has occurred, record the fault.

[0052] Optionally, in one embodiment of the present application, after obtaining the current operating stage of the microprocessor, it also includes: if the current operating stage is the execution monitoring stage, detecting whether the microprocessor meets the preset random hardware failure condition and / or the preset systematic software failure condition; if the microprocessor meets the preset random hardware failure condition and / or the preset systematic software failure condition, generating fault information corresponding to the microprocessor to interrupt the current operating process of the microprocessor based on the fault information.

[0053] In some embodiments, when executing the monitoring phase, the microprocessor is mainly monitored for random hardware failures and systematic software failures. In implementation, the embodiments of the present application can perform real-time monitoring by enabling lock-step core verification, clock verification, power supply monitoring, memory ECC verification, interrupt protection, software and hardware watchdog mechanisms, and associate the monitoring results with the ECM module (fault control module). For some modules that are not associated with the ECM, periodic readback monitoring is used to ensure the real-time nature of the monitoring.

[0054] Furthermore, the embodiments of the present application can detect whether the microprocessor meets preset random hardware failure conditions and / or preset systematic software failure conditions during monitoring, and determine whether random hardware failure and systematic software failure have occurred, thereby generating corresponding fault information when it is determined that random hardware failure and systematic software failure have occurred, and interrupting the current running process of the microprocessor after confirming the fault.

[0055] Among them, the preset random hardware failure conditions and / or the preset systematic software failure conditions can be set accordingly by those skilled in the art according to actual conditions and are not specifically limited here.

[0056] Optionally, in one embodiment of the present application, after obtaining the current operating stage of the microprocessor, it also includes: if the current operating stage is the power-off monitoring stage, turning off the timer of the microprocessor to prohibit interrupting the data storage action of the microprocessor in the power-off monitoring stage.

[0057] In other embodiments, during the power-off monitoring phase, in order to avoid unexpected timer generation during data storage, such as software or hardware watchdog failure, the timer is turned off during data storage to ensure normal execution of the program.

[0058] In step S103, the current running process of the microprocessor is interrupted based on the fault information, and the current fault type of the microprocessor is identified. A corresponding fault handling strategy is matched based on the current fault type to execute the fault handling strategy on the microprocessor.

[0059] During the actual execution process, the embodiment of the present application can interrupt the current running process of the microprocessor based on the fault information, thereby triggering the recording of the fault through the interruption. Some faults can be assisted by periodic judgment. For all modules that can be associated with ECM (fault control module), that is, after the fault occurs, the interrupt processing is uniformly entered, and the fault is confirmed and recorded in the interruption; for some modules that are not associated with ECM, periodic judgment confirmation and recording are used.

[0060] The embodiment of the present application can also identify the current fault type and determine the severity of the fault, thereby matching the corresponding fault handling strategy based on the current fault type.

[0061] Optionally, in one embodiment of the present application, while the current running process of the microprocessor is interrupted based on the fault information, the current fault type of the microprocessor is obtained, including: based on the interruption time and fault information of the microprocessor, obtaining the freeze frame and corresponding fault code when the microprocessor is interrupted, and storing the freeze frame and fault code to generate a fault record table.

[0062] For example, the design of the fault code in the embodiment of the present application refers to the 14229-1 format, and the storage and clearing of faults comply with the relevant specifications of UDS and OBD (On-Board Diagnostics).

[0063] In the design of the freeze frame, the embodiments of the present application can be designed according to different fault classifications. For example, for memory ECC-related faults, the freeze frame must include the specific error address when the ECC error occurs; for task timeout faults, the freeze frame must include the task name of the timed-out task, etc. Designing the freeze frame according to different fault classifications can help personnel quickly locate the cause of the problem when an error occurs.

[0064] In addition, to facilitate the location of the cause of the problem, in addition to the storage of the above fault codes and freeze frames, an additional fault code appendix is ​​added. The faults in the appendix are recorded in the order of occurrence, and the system time when each fault occurs is recorded.

[0065] Optionally, in one embodiment of the present application, a corresponding fault handling strategy is matched based on the current fault type, including: when the current fault type meets the preset reminder conditions, pushing a risk warning signal to the driver; when the current fault type does not meet the preset reminder conditions, sending a takeover signal to the auxiliary microprocessor, so as to use the auxiliary microprocessor instead of the microprocessor to control the vehicle to execute the preset safety strategy.

[0066] As a possible implementation method, the embodiment of the present application can determine the current fault type, wherein the current fault type can be divided into a serious fault type, a general fault type and a minor fault type according to the severity. A serious fault means that the microprocessor is in a state where it cannot work normally and may cause a reset, etc.; a general fault means that the fault prompted has a certain risk, but the microprocessor can still maintain basic operation; a minor fault means that the microprocessor can work normally, but the fault prompted has a certain risk.

[0067] When the current fault type is a general fault type or a minor fault type, the embodiment of the present application can determine that the current fault type meets the preset reminder conditions, thereby pushing a risk warning signal to the driver to remind the driver to handle the risk.

[0068] When the current fault type is a serious fault type, the embodiment of the present application can determine that the current fault type does not meet the preset reminder conditions, so as to enhance the credibility and robustness of the reported fault, and adhere to the principle of cross-processing of important faults between cores, that is, if core 0 (CPU0) fails, then core 1 (CPU1) will handle the fault, and if core 1 (CPU1) fails, then core 0 (CPU0) will handle the fault. The embodiment of the present application can be as follows Figure 3 As shown in the figure, in the hardware design, a microprocessor redundancy design is made. In addition to the main microprocessor, a low-cost auxiliary microprocessor is added. The auxiliary microprocessor and the main microprocessor communicate through CAN (Controller Area Network) bus to exchange real-time information, and the functional safety output pin of the main microprocessor is connected to the auxiliary microprocessor.

[0069] Therefore, when a serious fault occurs, in order to avoid unexpected conditions in the controller, the auxiliary microprocessor takes over the main work of the main microprocessor to ensure basic functions. When general faults and minor faults occur, they are reported to the application layer, which then performs unified fault power reduction control.

[0070] Combine Figures 2 to 4 As shown, the working principle of the method for detecting functional safety mechanism failure of a vehicle according to an embodiment of the present application is described in detail using an embodiment.

[0071] During the actual implementation process, the embodiment of the present application may include two parts: microprocessor monitoring and fault handling.

[0072] 1. In the microprocessor monitoring part, the embodiment of the present application can monitor faults differently according to different stages:

[0073] 1. The initialization monitoring phase mainly monitors whether the microprocessor has random hardware failures and whether the functional safety mechanism is reliable. In terms of implementation, on the one hand, the BIST (built-in self-test) module of the microprocessor is used to complete the preliminary monitoring and diagnosis of the microprocessor. On the other hand, some modules that may affect program execution during testing are tested at this stage to avoid potential failures. For example, the monitoring test of the watchdog and the test of some memory storage areas such as flash and RAM are all completed in the initialization monitoring phase.

[0074] like Figure 2 As shown, the following steps may be included:

[0075] Step S201: After the microprocessor is powered on and reset, a BIST (built-in self-test) check is performed. The BIST includes LBIST (logic BIST) and MBIST (memory BIST), which can perform a systematic and relatively complete check on the functional safety mechanism module in the microprocessor.

[0076] Step S202: After the verification is completed, the verification result can be judged through the BIST register. If the verification result is normal, the failure reconfirmation step is skipped; otherwise, the failure reconfirmation step needs to be entered.

[0077] Step S203: The failure reconfirmation step is mainly to reconfirm the functional safety corresponding mechanism and memory correctness and reliability.

[0078] Step S204: According to the BIST check result register, it is determined whether the failure is LBIST (Logic BIST) or MBIST (Memory BIST).

[0079] Step S205: If the LBIST fails, it means that a fault is detected in the safety mechanism and fault injection (usually including watchdog fault injection, etc.) is required.

[0080] Step S206: Determine whether the fault injection result is successful based on the register status after the fault injection. If all safety mechanisms pass the test, it means that the safety mechanism is reliable and the next step can be entered.

[0081] Step S207: If the MBIST fails, it indicates that a memory block detection error exists.

[0082] Step S208: reading the failed memory block corresponding to the BIST, and confirming whether the failed memory block has a temporary fault or a permanent fault. If it is confirmed that a permanent fault has occurred, recording the fault.

[0083] Step S209: Fault recording and processing.

[0084] 2. During the execution monitoring phase, the microprocessor is mainly monitored for random hardware failures and systematic software faults. In terms of implementation, real-time monitoring is performed by enabling lockstep core verification, clock verification, power supply monitoring, memory ECC verification, interrupt protection, and software and hardware watchdog mechanisms. The monitoring results are then associated with the ECM module (fault control module). For some modules that are not associated with the ECM, periodic readback monitoring is used to ensure real-time monitoring.

[0085] 3. During the power-off monitoring phase, in order to avoid unexpected timers generated during data storage, such as software and hardware watchdog failures, the software and hardware watchdogs are turned off during data storage to ensure normal execution of the program.

[0086] 2. In the troubleshooting section, you can Figure 4 As shown, the following steps are included:

[0087] Step S401: Is the fault associated with the ECM? Regarding the confirmation and recording of the fault, the embodiment of the present application can trigger the recording of the fault through an interrupt, and some faults can be assisted by periodic judgment.

[0088] Step S402: For all modules that can be associated with ECM (fault control module), after a fault occurs, interrupt processing is uniformly performed, and the fault is confirmed and recorded in the interrupt.

[0089] Step S403: For some modules that are not associated with the ECM, periodic determination is performed to confirm and record them.

[0090] Step S404: Fault logging. The freeze frame is designed based on different fault categories. For example, for memory ECC-related faults, the freeze frame must include the specific error address when the ECC error occurred. For task timeout faults, the freeze frame must include the name of the timed-out task. Designing freeze frames based on different fault categories can help personnel quickly locate the cause of the problem when it occurs.

[0091] In addition, to facilitate the location of the cause of the problem, in addition to the storage of the above fault codes and freeze frames, an additional fault code appendix is ​​added. The faults in the appendix are recorded in the order of occurrence, and the system time when each fault occurs is recorded.

[0092] Step S405: Determine the current fault type, i.e., confirm whether it is a serious fault. The embodiment of the present application can determine the current fault type, wherein the current fault type can be divided into a serious fault type, a general fault type, and a minor fault type according to the severity. A serious fault means that the microprocessor is in a state of not being able to work normally and may cause a reset, etc. A general fault means that the fault is prompted to have a certain risk, but the microprocessor can still maintain basic operation; a minor fault means that the microprocessor can work normally, but the fault is prompted to have a certain risk.

[0093] Step S406: When the current fault type is a serious fault type, the embodiment of the present application can determine that the current fault type does not meet the preset reminder conditions, so as to enhance the credibility and robustness of the reported fault, and adhere to the principle of cross-processing of important faults between cores, that is, if core 0 (CPU0) fails, then core 1 (CPU1) will handle the fault; if core 1 (CPU1) fails, then core 0 (CPU0) will handle the fault. The embodiment of the present application can be as follows: Figure 3 As shown in the figure, in the hardware design, a microprocessor redundancy design is performed. In addition to the main microprocessor, a low-cost auxiliary microprocessor is added. The auxiliary microprocessor and the main microprocessor exchange real-time information through CAN communication, and the functional safety output pin of the main microprocessor is connected to the auxiliary microprocessor.

[0094] Therefore, when a serious fault occurs, in order to avoid unexpected conditions in the controller, the auxiliary microprocessor takes over the main work of the main microprocessor to ensure basic functions. When general faults and minor faults occur, they are reported to the application layer, which then performs unified fault power reduction control.

[0095] Step S407: Push a prompt message to the driver, prompting him to pull over immediately.

[0096] Step S408: When the current fault type is a general fault type or a minor fault type, the embodiment of the present application can determine that the current fault type meets the preset reminder condition, thereby pushing a risk warning signal to the driver to remind the driver to handle the risk.

[0097] Step S409: Entering the power-reduced limp home mode.

[0098] According to the method for detecting functional safety mechanism failures in a vehicle proposed in an embodiment of the present application, corresponding functional safety mechanism monitoring can be performed based on the current operating stage of the microprocessor. When the current operating stage of the microprocessor is the initialization monitoring stage, a BIST check is performed on the microprocessor, and the check result is verified through a preset failure reconfirmation strategy, thereby obtaining fault information of the microprocessor. The current operating process of the microprocessor is then interrupted based on the fault information, and a corresponding fault handling strategy is matched according to the current fault type of the microprocessor. This allows for more targeted fault handling, avoiding the microprocessor interrupting the vehicle's power during fault handling. This allows for differential monitoring of the microprocessor's operating stage and matching of corresponding fault handling strategies, thereby improving vehicle driving safety. This solves the technical problem in related technologies that there is little involvement in microprocessor-level fault diagnosis and handling, and that there are certain safety hazards during fault handling, which is not conducive to ensuring vehicle driving safety.

[0099] Next, a device for detecting a failure in a functional safety mechanism of a vehicle proposed in an embodiment of the present application will be described with reference to the accompanying drawings.

[0100] Figure 5 It is a block diagram of a device for detecting a functional safety mechanism failure of a vehicle according to an embodiment of the present application.

[0101] like Figure 5 As shown, the device 10 for detecting a functional safety mechanism failure of a vehicle includes: a detection module 100 , a verification module 200 and a processing module 300 .

[0102] Specifically, the detection module 100 is used to detect the current operation stage of the microprocessor.

[0103] The verification module 200 is used to perform a built-in self-test (BIST) on the microprocessor when the current operation stage is the initialization monitoring stage, and when the verification result shows that the microprocessor has failed, verify the verification result using a preset failure reconfirmation strategy, and obtain the fault information of the microprocessor based on the verification result.

[0104] The processing module 300 is used to interrupt the current running process of the microprocessor based on the fault information, identify the current fault type of the microprocessor, and match the corresponding fault processing strategy based on the current fault type to execute the fault processing strategy on the microprocessor.

[0105] Optionally, in one embodiment of the present application, the verification module 200 includes: a determination unit, an injection unit, and a recording unit.

[0106] The determination unit is used to determine the failure type of the microprocessor according to the verification result.

[0107] The injection unit is used to inject a preset fault into the microprocessor when the failure type is a logic self-test failure type, and obtain the injection result of the preset fault according to the post-injection state of the register.

[0108] The recording unit is used to read the failed memory block corresponding to the built-in self test (BIST) when the failure type is a memory self-test failure type, and determine whether the failure of the failed memory block is a permanent failure. If the failure of the failed memory block is a permanent failure, the recording unit is used to record the failure data of the failed memory block.

[0109] Optionally, in one embodiment of the present application, the device 10 for detecting a functional safety mechanism failure of a vehicle further includes: a second detection module and a generation module.

[0110] The second detection module is used to detect whether the microprocessor meets the preset random hardware failure condition and / or the preset systematic software failure condition when the current operation stage is the execution monitoring stage.

[0111] The generation module is used to generate fault information corresponding to the microprocessor when the microprocessor meets the preset random hardware failure condition and / or the preset systematic software fault condition, so as to interrupt the current running process of the microprocessor based on the fault information.

[0112] Optionally, in one embodiment of the present application, the device 10 for detecting a functional safety mechanism failure of a vehicle further includes: a shutdown module.

[0113] The shutdown module is used to shut down the timer of the microprocessor when the current operation stage is the power-off monitoring stage, so as to prohibit interruption of the data storage action of the microprocessor in the power-off monitoring stage.

[0114] Optionally, in one embodiment of the present application, the processing module 300 includes: a storage unit.

[0115] The storage unit is used to obtain a freeze frame and a corresponding fault code when the microprocessor is interrupted based on the interruption time and fault information of the microprocessor, and store the freeze frame and the fault code to generate a fault record table.

[0116] Optionally, in one embodiment of the present application, the processing module 300 includes: a reminder unit and an auxiliary unit.

[0117] Among them, the reminder unit is used to push a risk warning signal to the driver when the current fault type meets the preset reminder conditions.

[0118] The auxiliary unit is used to send a takeover signal to the auxiliary microprocessor when the current fault type does not meet the preset reminder conditions, so that the auxiliary microprocessor can replace the microprocessor to control the vehicle to execute the preset safety strategy.

[0119] It should be noted that the aforementioned explanation of the embodiment of the method for detecting a functional safety mechanism failure of a vehicle is also applicable to the device for detecting a functional safety mechanism failure of a vehicle of this embodiment, and will not be repeated here.

[0120] According to the detection device for functional safety mechanism failure of a vehicle proposed in the embodiment of the present application, the corresponding functional safety mechanism monitoring can be performed according to the current operating stage of the microprocessor. When the current operating stage of the microprocessor is the initialization monitoring stage, the microprocessor is subjected to BIST verification, and the verification result is verified by a preset failure reconfirmation strategy, thereby obtaining the fault information of the microprocessor. Then, the current operating process of the microprocessor is interrupted according to the fault information, and the corresponding fault handling strategy is matched according to the current fault type of the microprocessor. The fault handling is performed more specifically to avoid the microprocessor interrupting the vehicle power during the fault handling. Differential monitoring is performed according to the operating stage of the microprocessor, and the corresponding fault handling strategy is matched, thereby improving the driving safety of the vehicle. Thus, the technical problem in the related art that there is little involvement in microprocessor-level fault diagnosis and processing, and there are certain safety hazards during fault handling, which is not conducive to ensuring the driving safety of the vehicle is solved.

[0121] Figure 6 A schematic diagram of the structure of a vehicle provided in an embodiment of the present application. The vehicle may include:

[0122] A memory 601 , a processor 602 , and a computer program stored in the memory 601 and executable on the processor 602 .

[0123] When the processor 602 executes the program, the method for detecting a functional safety mechanism failure of a vehicle provided in the above embodiment is implemented.

[0124] Furthermore, the vehicle further comprises:

[0125] The communication interface 603 is used for communication between the memory 601 and the processor 602 .

[0126] The memory 601 is used to store computer programs that can be run on the processor 602 .

[0127] The memory 601 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0128] If the memory 601, processor 602, and communication interface 603 are implemented independently, the communication interface 603, memory 601, and processor 602 can be connected to each other via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0129] Optionally, in a specific implementation, if the memory 601, the processor 602 and the communication interface 603 are integrated on a chip, the memory 601, the processor 602 and the communication interface 603 can communicate with each other through an internal interface.

[0130] The processor 602 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0131] This embodiment also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned method for detecting a functional safety mechanism failure of a vehicle.

[0132] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0133] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of this application, "N" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0134] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or N executable instructions for implementing a custom logical function or process step, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed in a different order than shown or discussed, including performing functions in a substantially simultaneous manner or in a reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application pertain.

[0135] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or N wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program can be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or processing it in other suitable ways as necessary, and then storing it in a computer memory.

[0136] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0137] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0138] In addition, the functional units in the various embodiments of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into a module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0139] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present application. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

Claims

1. A method for detecting a functional safety mechanism failure in a vehicle, characterized in that: The following steps are involved: Detecting the current operating stage of the microprocessor; If the current operation phase is the initialization monitoring phase, performing a built-in self-test (BIST) check on the microprocessor, and when a check result indicates that the microprocessor has failed, verifying the check result using a preset failure reconfirmation strategy, and obtaining fault information of the microprocessor based on the check result; interrupting a current running process of the microprocessor based on the fault information, identifying a current fault type of the microprocessor, and matching a corresponding fault handling strategy based on the current fault type to execute the fault handling strategy on the microprocessor; After obtaining the current operating stage of the microprocessor, it also includes: If the current operation stage is the power-off monitoring stage, the timer of the microprocessor is turned off to prohibit interrupting the data storage action of the microprocessor in the power-off monitoring stage.

2. The method according to claim 1, characterized in that The verifying the verification result by using a preset failure reconfirmation strategy includes: determining a failure type of the microprocessor according to the verification result; In the case where the failure type is a logic self-test failure type, injecting a preset fault into the microprocessor, and obtaining an injection result of the preset fault according to a post-injection state of the register; In the case where the failure type is a memory self-test failure type, the failed memory block corresponding to the built-in self-test BIST is read, and it is determined whether the failure of the failed memory block is a permanent failure. If the failure of the failed memory block is a permanent failure, the failure data of the failed memory block is recorded.

3. The method according to claim 1, characterized in that After obtaining the current operating stage of the microprocessor, it also includes: If the current operation phase is the execution monitoring phase, detecting whether the microprocessor satisfies a preset random hardware failure condition and / or a preset systematic software failure condition; If the microprocessor meets the preset random hardware failure condition and / or the preset systematic software failure condition, fault information corresponding to the microprocessor is generated to interrupt the current running process of the microprocessor based on the fault information.

4. The method according to claim 1, wherein The interrupting of the current running process of the microprocessor based on the fault information and obtaining the current fault type of the microprocessor include: Based on the interruption time of the microprocessor and the fault information, a freeze frame and a corresponding fault code when the microprocessor is interrupted are obtained, and the freeze frame and the fault code are stored to generate a fault record table.

5. The method according to claim 1, wherein The matching of the corresponding fault handling strategy based on the current fault type includes: If the current fault type meets the preset warning conditions, a risk warning signal is pushed to the driver; In the case that the current fault type does not meet the preset reminder condition, a takeover signal is sent to the auxiliary microprocessor, so that the auxiliary microprocessor is used instead of the microprocessor to control the vehicle to execute a preset safety strategy.

6. A device for detecting a failure in a functional safety mechanism of a vehicle, characterized in that: The detection device is used to implement the method according to any one of claims 1 to 5, and the detection device includes: A detection module, used for detecting the current operation stage of the microprocessor; a verification module, configured to perform a built-in self-test (BIST) verification on the microprocessor when the current operation phase is an initialization monitoring phase, and, when a verification result indicates that the microprocessor has failed, verify the verification result using a preset failure reconfirmation strategy, and obtain fault information of the microprocessor based on the verification result; A processing module is used to interrupt the current running process of the microprocessor based on the fault information, identify the current fault type of the microprocessor, and match a corresponding fault handling strategy based on the current fault type to execute the fault handling strategy on the microprocessor.

7. The device according to claim 6, characterized in that The verification module includes: a determining unit, configured to determine a failure type of the microprocessor according to the verification result; an injection unit, configured to, when the failure type is a logic self-test failure type, inject a preset fault into the microprocessor and obtain an injection result of the preset fault according to a post-injection state of the register; A recording unit is used to read the failed memory block corresponding to the built-in self test BIST when the failure type is a memory self-test failure type, and determine whether the failure of the failed memory block is a permanent failure, and record the failure data of the failed memory block when the failure type is a permanent failure.

8. A vehicle, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for detecting a functional safety mechanism failure of a vehicle as described in any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method for detecting a functional safety mechanism failure of a vehicle as described in any one of claims 1 to 5.

Images