A SoC system and SoC functional safety control method

Abstract

The present invention provides a SoC system and a SoC functional safety control method, comprising: a SoC chip and an external device, the external device is used to power the SoC chip and provide an external reference frequency; the SoC chip comprises a SoC functional module, the SoC functional module comprises a plurality of SoC functional units, each SoC functional unit is used to cooperate in realizing a vehicle control function, each SoC functional unit is respectively configured with a local safety mechanism unit, the local safety mechanism unit is used to collect fault information of the corresponding SoC functional unit; the SoC chip also comprises a safety island module, the safety island module comprises a safety bus, a monitoring and decision logic unit and a plurality of fault management modules, the fault management module is also connected to the monitoring and decision logic unit via the safety bus, the fault management module is used to receive the fault information of the corresponding local safety mechanism unit, and transmit it to the monitoring and decision logic unit via the safety bus, the monitoring and decision logic unit is used to cooperate with the external device to process the fault event.

Description

Technical Field

[0001] The present invention relates to the technical field of chip design, and in particular to a SoC system and a SoC functional safety control method. Background Art

[0002] At present, with the continuous advancement of electrification in the automotive industry, traditional mechanical components installed on road vehicles are gradually being replaced by sensors, controllers and actuators based on semiconductor components. The system-on-chip (SoC) that constitutes the above semiconductor components is widely used in domain control architecture and regional control architecture in vehicles, and is also widely used in the control of vehicle domains such as body, chassis, power, cockpit, and autonomous driving.

[0003] For the electronic / electrical systems (E / E systems) of road vehicles, the concept of functional safety was introduced, and the ISO 26262 standard was introduced in the automotive industry to evaluate the possible hazards caused by abnormal functional performance and system interactions of safety-related E / E systems. In the second edition (2018 edition) of the ISO 26262 standard, Part 11 was added as a guide for the application of ISO 26262 to semiconductor products.

[0004] ISO 26262 defines the classification of functional safety requirements, namely "Automotive Safety Integrity Level" (ASIL), which is divided into four levels: A, B, C, and D, where ASIL D represents the highest level of stringency and ASIL A represents the lowest level of stringency. ISO 26262 defines safety mechanisms, which are technical solutions implemented by the functions, elements or other technologies of the E / E system to detect and mitigate / tolerate faults, or control / avoid failures in order to maintain the intended function or achieve / maintain a certain safe state. Safety mechanisms should prevent the risks of single-point failures (SPF) or residual faults (RF), as well as the risks of latent faults (LF) as effectively as possible. In order to measure the effectiveness of the safety mechanism applied in the entire system, ISO 26262 specifies the numerical requirements for single-point failure measure (SPFM), latent fault measure (LFM) and probabilistic metric for random hardware failures (PMHF) at different ASIL levels, as shown in the following table.

[0005] Table 1: Requirements for SPFM, LFM, and PMHF at different ASIL levels

[0006]

[0007] At the same time, the ISO 26262 standard also puts forward requirements for avoiding correlated failures. Correlated failures may cause single-point failures in a single module to spread to other components of the system in a cascading, common-cause or other manner, and prevent the safety architecture and safety mechanism from achieving the expected effect. Therefore, it is necessary to conduct correlated failure analysis and optimize the design based on the analysis results to avoid the above situation.

[0008] As the single-chip scale of automotive SoCs continues to expand, the silicon wafer area and the number of gates have greatly increased, and the expected calculation results of the total failure rate under the same process have also increased, making the PMHF target more difficult to achieve under a given ASIL level. At the same time, with the increase in the number and types of IPs, the design of safety mechanisms on different IPs has become more diverse. Different safety mechanisms need to be combined to meet the coverage indicators of failures at the SoC level to ensure that SPFM and LFM can still meet the requirements of a given ASIL level. The relationship between safety mechanisms, expected functions and safety mechanisms is more complex, and the risk of common cause failures and cascading failures has also increased. Products have higher requirements for safety status, from fail-safe to fail-operable. When a chip fails, the fault must be classified and the fault response must be performed as much as possible while ensuring basic functions.

[0009] In the development and integration of SoC products, IP reuse has become a common approach taken by design companies. Through the above model, companies can quickly integrate and iterate products using modular design. However, in the field of automotive products, automotive-grade IPs that have obtained ISO 26262 certification are expensive, and require additional design considerations compared to similar consumer / industrial products. For automotive products, the lack of a common safety architecture makes this process more difficult when integrating and implementing functional safety design at the SoC level. It may potentially be necessary to customize the purchased IP for automotive use, or to add appropriate safety mechanisms during integration, so that the product can ultimately meet the requirements of a given ASIL level.

[0010] In terms of safety architecture, for high-safety level control systems that meet ASIL D requirements, traditional solutions often use redundant control channels and voters to make decisions. When multiple redundant copies output different results, the control logic output is determined by voting. For a two-channel architecture, when the results of the two channels are different, the system alarms and enters a safe state; for a three-channel architecture, when the result of one channel is different from the other two channels, the results of the other two channels are selected for execution. In SoC design, such an architecture will bring 2 or even 3 times more additional area, increase the power consumption of the product, and require an additional clock coordination mechanism, which increases the complexity of the product and has a negative impact on the cost optimization of the product.

[0011] Therefore, it is necessary to provide a SoC system and a SoC functional safety control method to effectively solve the above problems. Summary of the invention

[0012] The present invention provides a SoC system and a SoC functional safety control method.

[0013] An embodiment of the present invention provides a SoC system, comprising: a SoC chip and an external device, wherein the SoC chip is connected to the external device, and the external device is used to power the SoC chip and provide an external reference frequency; wherein:

[0014] The SoC chip includes a SoC functional module, and the SoC functional module includes a plurality of SoC functional units, each of which is used to cooperate in realizing a vehicle control function, and each of the SoC functional units is respectively configured with a local safety mechanism unit, and the local safety mechanism unit is used to collect fault information corresponding to the SoC functional unit;

[0015] The SoC chip also includes a safety island module, which includes a safety bus, a monitoring and decision-making logic unit and multiple fault management modules. The number of the fault management modules is the same as the number of the SoC functional units and is connected one-to-one. The fault management module is also connected to the monitoring and decision-making logic unit through the safety bus. The fault management module is used to receive fault information of the corresponding local safety mechanism unit and transmit it to the monitoring and decision-making logic unit through the safety bus. The monitoring and decision-making logic unit is used to cooperate with the external device to handle fault events.

[0016] Preferably, the plurality of SoC functional units respectively include:

[0017] Processing unit, used to process and execute various instructions and algorithms;

[0018] Storage unit, used to store programs and data, providing fast read and write access;

[0019] The interface unit is used to provide high-speed and low-speed I / O interfaces for communicating with the outside world;

[0020] A bus unit, used for transmitting data signals, control signals, interrupt and exception handling signals;

[0021] Clock unit, used to provide the frequency required by each IP;

[0022] Power supply unit, used to manage the power supply and power consumption of each IP;

[0023] The digital-to-analog conversion unit is used for conversion between digital and analog signals.

[0024] Preferably, the safety bus is configured as an independent data channel and is only used to transmit the fault information.

[0025] Preferably, the SoC chip further comprises a detection unit, and the detection unit is used to detect whether common cause failure and cascading failure occur in the SoC functional module and the safety island module.

[0026] Preferably, the SoC chip includes a first physical isolation area and a second physical isolation area, the first physical isolation area and the second physical isolation area comply with preset isolation constraint rules, the SoC functional module is located in the first physical isolation area, and the safety island module is located in the second physical isolation area.

[0027] Preferably, the safety bus further classifies the fault information; the classification includes:

[0028] The first category is a recoverable fault at the subsystem level. When the monitoring and decision logic unit receives the fault information belonging to the first category, it outputs fault prompt information;

[0029] The second category is an unrecoverable fault at the subsystem level. When the monitoring and decision logic unit receives the fault information belonging to the second category, it outputs fault prompt information and controls the corresponding SoC functional unit to reset through the safety bus and the fault management module;

[0030] The third category is a recoverable fault at the SoC system level. When the monitoring and decision logic unit receives the fault information belonging to the third category, it outputs fault prompt information and controls the corresponding SoC functional unit to enter interruption and handle the fault through the safety bus and the fault management module;

[0031] The fourth category is an unrecoverable fault at the SoC system level. When the monitoring and decision logic unit receives the fault information belonging to the fourth category, it outputs a fault prompt message and controls the SoC chip reset through an external device.

[0032] Preferably, the external device includes:

[0033] A power management chip, comprising a first power supply module and a second power supply module, wherein the first power supply module is connected to the SoC functional module to supply power thereto, and the second power supply module is connected to the safety island module to supply power thereto;

[0034] a safety MCU module, connected to the monitoring and decision logic unit, configured to receive the fault information and control the power management chip to disconnect the power supply to the SoC functional module when the fault information includes preset fault information; and

[0035] An external oscillator is connected to the SoC functional module and the safety island module, and is used to provide an external reference clock for the SoC functional module and the safety island module.

[0036] An embodiment of the present invention further provides a SoC functional safety control method, which is applied to the SoC system as described in any one of the above items, and the method includes:

[0037] The local safety mechanism unit performs internal fault diagnosis on the corresponding SoC functional unit at a preset period, and outputs first fault information if a fault occurs in the corresponding SoC functional unit;

[0038] The fault management module converts the first fault information into a standardized data format and transmits the format to the safety bus;

[0039] The safety bus classifies the first fault information based on preset rules and outputs it to the monitoring and decision logic unit;

[0040] The monitoring and decision logic unit performs fault processing based on the classification of the first fault information.

[0041] An embodiment of the present invention further provides a SoC functional safety control method, which is applied to the SoC system as described in any one of the above items, and the method includes:

[0042] The local safety mechanism unit performs internal fault diagnosis on the corresponding SoC functional unit at a preset period, and outputs safety response information if the corresponding SoC functional unit does not fail;

[0043] The fault management module transmits the safety response information to the safety bus;

[0044] If the monitoring and decision logic unit does not receive the security response information within the specified time, it is determined that the corresponding SoC functional unit fails and the fault processing is performed.

[0045] Preferably, it also includes if the monitoring and decision logic unit receives the security response information within a specified time, determining that the corresponding SoC functional unit has not failed and continuing to collect information sent by the fault management module through the security bus.

[0046] Compared with the prior art, the technical solution of the embodiment of the present invention has the following beneficial effects:

[0047] An embodiment of the present invention provides a SoC system and a SoC functional safety control method, including a SoC chip and external devices. The safety function is integrated into a safety island module in the SoC chip. There is no need to use a redundant voting architecture, thus avoiding the shortcomings of the voting architecture, such as a large number of devices, the need for clock coordination, being unfavorable for cost control, and complex control and diagnostic logic. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are some embodiments of the present invention, not all embodiments. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor.

[0049] Figure 1 A schematic diagram of the SoC system structure provided for one embodiment of the present invention;

[0050] Figure 2 A schematic diagram of the SoC system structure provided for another embodiment of the present invention;

[0051] Figure 3 A schematic flow chart of a SoC functional safety control method provided by an embodiment of the present invention;

[0052] Figure 4 A schematic flow chart of a SoC functional safety control method provided in accordance with another embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0055] Based on the problems existing in the prior art, an embodiment of the present invention provides a SoC system.

[0056] Figure 1 A schematic diagram of the SoC system structure provided by an embodiment of the present invention. Figure 1 The embodiment of the present invention provides a SoC system, including: a SoC chip 100 and an external device 200, the SoC chip 100 is connected to the external device 200, the external device 200 is used to power the SoC chip 100 and provide an external reference frequency; wherein: the SoC chip 100 includes a SoC functional module 110, the SoC functional module 110 includes a plurality of SoC functional units, each SoC functional unit is used to cooperate to realize a vehicle control function, each SoC functional unit is respectively configured with a local safety mechanism unit, and the local safety mechanism unit is used to collect fault information of the corresponding SoC functional unit; ... 00 also includes a safety island module 120, the safety island module 120 includes a safety bus 122, a monitoring and decision logic unit 123 and multiple fault management modules 121. The number of fault management modules 121 is the same as the number of SoC functional units and they are connected one-to-one. The fault management module 121 is also connected to the monitoring and decision logic unit 123 through the safety bus 122. The fault management module 121 is used to receive fault information of the corresponding local safety mechanism unit and transmit it to the monitoring and decision logic unit 123 through the safety bus 122. The monitoring and decision logic unit 123 is used to cooperate with the external device 200 to handle fault events.

[0057] In a specific implementation, the SoC chip 100 includes a SoC functional module 110 and a safety island module 120. The SoC functional module 110 includes a plurality of SoC functional units, each of which is used to cooperate in executing the intended functionality (Intended Functionality) of the SoC system. In this embodiment, the intended functions are the functions of the automotive SoC chip 100, such as: domain control function, regional control function, body control, chassis control, power control, cockpit control, automatic driving control, etc. These functions can be achieved by setting one or more subsystems (SoC functional units) containing corresponding functions in the SoC functional module 110.

[0058] In some embodiments, Figure 2 As shown, multiple SoC functional units include: a processing unit 111, a storage unit 112, an interface unit 113, a bus unit 114, a clock unit 115, a power supply unit 116, and a digital-to-analog conversion unit 117. Among them, the processing unit 111 is used to process and execute various instructions and algorithms. The storage unit 112 is used to store programs and data, and provide fast read and write access. The interface unit 113 is used to provide high-speed and low-speed I / O interfaces to communicate with the outside world. The bus unit 114 is used to transmit data signals, control signals, interrupts and exception handling signals. The clock unit 115 is used to provide the frequency required by each IP. The power supply unit 116 is used to manage the power supply and power consumption of each IP. The digital-to-analog conversion unit 117 is used for conversion between digital and analog signals. The specific way in which each SoC functional unit cooperates to implement the vehicle control function can adopt any well-known method in the field of vehicle control, which will not be repeated here.

[0059] Each SoC functional unit is deployed with a local safety mechanism unit (not shown in the figure), which is used to diagnose internal faults of the corresponding SoC functional unit to collect fault information of the corresponding SoC functional unit.

[0060] In some embodiments, the local safety mechanism unit provided by the processing unit 111 adopts a lockstep diagnostic mechanism. The local safety mechanism unit provided by the storage unit 112 adopts a fault correction code (ECC) diagnostic mechanism. The local safety mechanism unit provided by the interface unit 113 adopts a test pattern diagnostic mechanism. The local safety mechanism unit provided by the bus unit 114 adopts information redundancy, frame counter and timeout monitoring diagnostic mechanisms. The local safety mechanism unit provided by the clock unit 115 adopts a frequency check (FRC Check) diagnostic mechanism. The local safety mechanism unit provided by the power supply unit 116 adopts an over / under voltage detection (Over / UnderVoltage Check) diagnostic mechanism. The local safety mechanism unit provided by the digital-to-analog conversion unit 117 adopts a self-test (SelfTest) diagnostic mechanism. The specific diagnostic mechanism is a diagnostic method well known in the art and will not be repeated here.

[0061] The safety island module 120 is used to perform functional safety fault management of the SoC system. It applies a general safety architecture that is decoupled from other functional modules. It can unify and centralize the reporting and processing path of the safety mechanism, and centralize the collection, classification, reporting of fault information, and the decision-making and execution of fault handling, so as to facilitate rapid porting in the form of IP applications and adaptability to different products.

[0062] Specifically, the safety island module 120 includes a fault management module 121, a safety bus 122, and a monitoring and decision logic unit 123. Among them, the fault management module 121 is designed as a part of the safety island module 120 (safety island IP) to facilitate standardized design and application, and its physical deployment location can be close to the SoC functional module 110 to facilitate the reading of fault information. Each SoC functional unit corresponds to a fault management module 121, and the fault management module 121 receives the fault information fed back by the corresponding local security mechanism unit from the SoC functional unit. Then, the fault management module 121 converts the fault information into a standardized data format suitable for the safety bus 122. When no fault information is received, the fault management module 121 of the corresponding SoC functional unit periodically sends a security response to the monitoring and decision logic unit 123 through the safety bus 122 to indicate that the current state of the corresponding SoC functional unit is safe.

[0063] The purpose of the fault management module 121 converting the fault information into a standardized data format is to structure the information contained in the fault information data and ensure the efficiency and reliability of data transmission through this format. Regarding the structure of the standardized data format, for example, the data bits of the fault information can be allocated to facilitate the standardized processing of a large number of fault information fed back by safety mechanisms of different locations and types, unify the fault reporting rules and logic, and facilitate the reuse of the design on other products.

[0064] Exemplarily, the standardized data format may include a target address, a source address, a channel ID, a priority, data, and a checksum in sequence.

[0065] The safety bus 122 is used to provide a protected data channel to transmit fault information to the safety island module 120 through the fault management module 121. On the safety bus 122, fault information can be classified based on the impact of the fault, the way to handle the fault, and the time priority of handling the fault.

[0066] In some embodiments, the safety bus 122 is designed as an independent data channel, which is only used to transmit fault information. The fault information referred to here is a generalized fault information, which not only includes information when each SoC functional unit fails, but also includes the safety response information output when each SoC functional unit does not fail. Any other type of data on the SoC chip 100 does not use the safety bus 122 channel. Other data is transmitted in the form of a conventional data bus or on-chip network. By using an independent safety bus 122, it is possible to avoid sharing bandwidth with other system buses that perform the expected functions of the SoC system. As a result, on the one hand, it is avoided that fault data occupies system bus resources, and on the other hand, it is also avoided that fault data and any other type of data are prioritized, which in turn causes the system to be unable to effectively respond to faults within a given time.

[0067] The monitoring and decision logic unit 123 is used to monitor the fault information related to functional safety, make fault handling decisions, and execute fault responses with the support of the SoC functional module 110 and / or the external device 200 to ensure that the system enters a predefined safe state. Decisions on fault handling can be made based on a specific classification scheme, taking different fault responses for different classification methods and making the system enter a corresponding safe state.

[0068] In some embodiments, classification can be performed based on the scope of the fault and the recoverability of the system after the fault. For example, fault information (the fault information here is fault information in a narrow sense, referring to the information when the SoC functional unit fails) includes four categories. The first category is recoverable faults at the subsystem level. The faults that can be recovered at the subsystem level refer to recoverable faults of the SoC functional unit. When the monitoring and decision logic unit 123 receives fault information belonging to the first category, the fault information is recorded and the fault prompt information is output (fault alarms can be performed at the vehicle level through screen display, sound prompts, etc.). The second category is unrecoverable faults at the subsystem level, that is, unrecoverable faults at the SoC functional unit level. When the monitoring and decision logic unit 123 receives fault information belonging to the second category, the fault information is recorded and the fault prompt information is output (fault alarms can be performed at the vehicle level through screen display, sound prompts, etc.), and the corresponding SoC functional unit is reset through the safety bus 122 and the fault management module 121. The third classification is a recoverable fault at the SoC system level. When the monitoring and decision logic unit 123 receives the fault information belonging to the third classification, it records the fault information and outputs the fault prompt information (it can be displayed on the screen, sound prompts, etc. at the vehicle level to give a fault alarm), and also controls the corresponding SoC functional unit to enter an interrupt and handle the fault through the safety bus 122 and the fault management module 121. The fourth classification is an unrecoverable fault at the SoC system level. When the monitoring and decision logic unit 123 receives the fault information belonging to the fourth classification, it records the fault information and outputs the fault prompt information (it can be displayed on the screen, sound prompts, etc. at the vehicle level to give a fault alarm), and also controls the SoC chip 100 to reset through the external device 200. In this embodiment, the classification can be used as a basis for the classification and sorting of the severity of the fault, or it can be classified and sorted based on other schemes. The classification method described in this embodiment is only an example. In actual applications, it is not necessary to limit the specific level number and classification method of the type, severity, etc. based on this embodiment. In other embodiments, the monitoring and decision logic unit 123 may not record or output the fault prompt information, and directly handle the fault problem by itself.

[0069] The external device 200 is used to supply power to the SoC chip 100 , provide an external reference frequency, and cooperate with the SoC chip 100 to perform fault response operations when a fault occurs in the SoC functional module 110 .

[0070] The SoC system provided in this embodiment includes a SoC chip 100 and an external device 200. In the SoC chip 100, the security function is integrated into the safety island module 120. There is no need to use a redundant voting architecture, thus avoiding the shortcomings of the voting architecture, such as the large number of devices, the need for clock coordination, the difficulty in controlling costs, and the complexity of control and diagnostic logic.

[0071] In addition to the local safety mechanism in the safety island module 120, the activities involved in functional safety, including: collection of fault information, classification of fault information, reporting of faults, decision-making on fault handling, and execution of fault handling are concentrated in a single IP, namely the safety island IP (safety island module 120), which facilitates the establishment of a common functional safety architecture at the SoC level, and is applicable to different products in the form of IP applications, facilitating rapid deployment and upgrade iterations.

[0072] For the fault information fed back by the safety mechanism, the fault management module 121 can standardize the data format of the fault information, simplify the fault reporting rules and logic, and facilitate the design reuse using the fault management module 121.

[0073] The dedicated safety bus 122 is used to transmit fault information, which does not occupy system bus resources, avoids the impact on system operating efficiency and system performance, and also avoids the priority preemption of fault data and other types of data, which may cause the system to be unable to effectively respond to faults within a given time.

[0074] In some embodiments, the fault management module 121 may be embedded with a periodically triggered safety response logic, which can send a safety response when the working parameters of the corresponding subsystem (SoC functional unit) are normal and no fault information is received, and send it to the monitoring and decision logic unit 123 through the safety bus 122. The monitoring and decision logic unit 123 can monitor whether the safety response is sent normally through timeout monitoring, window monitoring, question-and-answer monitoring, etc., and judge whether the corresponding subsystem is in a normal working state. If the normal working parameters of the corresponding subsystem change due to an unknown fault, the safety response will be lost. Even if the failure mode corresponding to the unknown fault cannot be detected by the safety mechanism, the monitoring and decision logic unit 123 can still judge that the subsystem is in an abnormal working state, and cooperate with the SoC functional module 110 and the external device 200 to make the system enter a safe state.

[0075] In some embodiments, the SoC chip 100 includes a first physical isolation area and a second physical isolation area, the first physical isolation area and the second physical isolation area are compounded with preset isolation constraint rules, the SoC functional module 110 is located in the first physical isolation area, and the safety island module 120 is located in the second physical isolation area. For the two physical isolation areas, when performing layout planning, layout, and routing in the back-end design of the SoC chip 100, line spacing, area, and restriction constraint rules can be set to isolate the modules to which the safety island module 120 and the SoC functional module 110 belong and the corresponding signals, power supplies, and clock networks.

[0076] Exemplarily, the following exemplary layout rules can be applied to achieve isolation partitioning: define the layout areas (Placement Region) of the SoC functional module 110 and the safety island unit respectively. The logic corresponding to different layout areas should belong to different, mutually isolated physical regions (Physical Region). For the defined layout areas, boundaries (Boundary) should be reserved, and boundary parameters should be set to ensure the effectiveness of isolation. The internal connection of the layout area should use the internal network (Internal-nets), which should not be allowed to leave the boundary of the area. The connection from the inside to the outside of the layout area should use the interface network (Interface-nets), one end of which should be located within the layout area and the other end outside the layout area, and should not be allowed to enter the boundary of another layout area. The secondary network that is connected to the interface network and does not belong to the layout area should not be allowed to pass through any layout area. The connection lines that do not belong to the layout area are defined as external connection lines (External Wires) and should not be allowed to pass through any layout area.

[0077] Exemplarily, the SoC functional module 110 and the safety island module 120 are independent of each other in terms of power supply and reference clock, are independently powered by an external device 200, use independent internal and external reference clock resources, and apply measures that can mitigate or avoid related failures, thereby ensuring the independence of different isolation partitions and avoiding mutual interference.

[0078] In some embodiments, Figure 2 As shown, the external device 200 includes a power management chip 220, a security MCU module 210 and an external oscillator 230. The power management chip 220 includes a first power supply module (not shown) and a second power supply module (not shown). The first power supply module is connected to the SoC function module 110 to supply power thereto, and the second power supply module is connected to the safety island module 120 to supply power thereto, so that the safety island module 120 and the SoC function module 110 are independently powered and do not affect each other.

[0079] The safety MCU module 210 is connected to the monitoring and decision logic unit 123, and is used to receive fault information and control the power management chip 220 to disconnect the power supply to the SoC functional module 110 when the fault information includes preset fault information. That is, under some fault classifications, the monitoring and decision logic unit 123 can control the power management chip 220 to disconnect the power supply to the SoC functional module 110 through the safety MCU module 210.

[0080] The external oscillator 230 is connected to the SoC functional module 110 and the safety island module 120 to provide an external reference clock for the SoC functional module 110 and the safety island module 120. The external reference clock source uses the external oscillator 230 and applies measures that can mitigate or avoid related failures to ensure independence between different isolation partitions and avoid mutual interference.

[0081] In some embodiments, the SoC chip 100 further includes a detection unit. The detection unit is used to detect whether common cause failures and cascading failures occur in the SoC functional module 110 and the safety island module 120, that is, the SoC chip 100 applies detection or control measures for related failures to avoid the occurrence of related failures or reduce their impact.

[0082] Specifically, by applying dedicated independent monitoring, performing selective reinforcement, adding self-checks during startup or operation, and adding indirect detection methods, possible related failures, including common cause failures and cascading failures, can be avoided or detected.

[0083] Exemplarily, when applying dedicated independent monitoring, independent monitoring circuits and the like may be added to the clock and power resources used by the safety island module 120. When performing selective reinforcement, for the circuits in the safety island module 120, the robustness of the safety island module 120 may be enhanced by using over-design methods, such as applying higher electrical or thermal stress levels, to avoid related failures caused by changes in electrical or environmental parameters. When adding self-tests during startup or runtime, for the safety island module 120, additional self-test logic is added to cover more possible failure modes that may occur and cause related failures. When adding indirect detection methods, for the safety island module 120, a functional loop self-test that will fail in the event of a shared resource failure is used, or a delay line used as a common cause failure sensor is set.

[0084] In some embodiments, multiple local safety mechanisms may be applied in the SoC functional unit on the same SoC functional module 110, such as: the bus unit 114 simultaneously applies the fault detection code (EDC) and the parity check (Parity). In the above manner, the total diagnostic coverage for a single fault mode of the SoC functional unit can be improved by synthesizing multiple safety mechanisms; or more fault modes can be covered by using different safety mechanisms, and the total diagnostic coverage for a single SoC functional unit can be improved. This embodiment can further improve the single point fault metric (SPFM), the latent fault metric (LFM), and reduce the hardware failure probability metric (PMHF). Exemplarily, information redundancy, frame counter and timeout monitoring are simultaneously applied to the bus unit 114. In this way, the safety mechanism of the SoC functional unit can be supplemented. In this embodiment, by combining multiple safety mechanisms and applying them to the same SoC functional unit, the total diagnostic coverage for a single failure mode of the SoC functional unit is improved. By using different safety mechanisms, more failure modes are covered on the same SoC functional unit, and the total diagnostic coverage for a single subsystem is improved.

[0085] The present application also provides a SoC functional safety control method, which is applied to the SoC system in any of the above embodiments, such as Figure 3 As shown, the method includes:

[0086] Step S110 : the local safety mechanism unit performs internal fault diagnosis on the corresponding SoC functional unit at a preset period.

[0087] Step S111, determining whether a corresponding SoC functional unit fails.

[0088] Step S112: If a corresponding SoC functional unit fails, the local safety mechanism unit outputs first failure information.

[0089] Step S113: the fault management module converts the first fault information into a standardized data format and transmits it to the safety bus.

[0090] In step S114, the safety bus classifies the first fault information based on preset rules and outputs the classification to the monitoring and decision logic unit.

[0091] Step S115: the monitoring and decision logic unit performs fault processing based on the classification of the first fault information.

[0092] Specifically, the local safety mechanism unit performs internal fault diagnosis on the corresponding SoC functional unit at a time interval lower than the fault tolerance time interval (FTTI, Fault Tolerance Time Interval), and the specific interval time can be set based on actual needs. The local safety mechanism unit determines whether the corresponding SoC functional unit fails. If so, step S112 is executed and the local safety mechanism unit outputs the first fault information. The first fault information here refers to the fault information in a narrow sense, which is the information that the corresponding SoC functional unit fails. It should be noted that some or all of the SoC functional units may perform periodic fault diagnosis on the corresponding SoC functional unit and send the fault information to the corresponding fault management module 121 when a fault occurs. If the local safety mechanism unit determines that the corresponding SoC functional unit has not failed, it can return to step S110 to continue to perform periodic fault diagnosis on the corresponding SoC functional unit.

[0093] After the fault management module 121 collects the first fault information from the local safety mechanism unit of the corresponding SoC functional unit, it converts the first fault information into a standardized data format and outputs it to the safety bus 122. The safety bus 122 uses a protected channel to transmit the first fault information to the monitoring and logic decision unit 123. The monitoring and logic decision unit 123 can classify the fault information based on the impact of the fault, the way to handle the fault, and the time priority of handling the fault, such as the classification method from the first classification to the fourth classification mentioned in the above embodiment, and of course its classification method is not limited to this. The monitoring and logic decision unit 123 sets the processing method for each fault based on the classified first fault information, and can cooperate with the safety island module 120 and the external device 200 during the processing. For example, the corresponding SoC functional unit is directly controlled to reset through the fault management module 121, and the SoC functional module 110 is powered off through the external device 200. After the fault is handled, the SoC system re-enters the safe state.

[0094] The present application also provides another SoC functional safety control method, which is applied to the SoC system of any of the above embodiments, such as Figure 4 As shown, the method includes:

[0095] Step S120 : the local safety mechanism unit performs internal fault diagnosis on the corresponding SoC functional unit at a preset period.

[0096] Step S121, determining whether a corresponding SoC functional unit fails.

[0097] Step S122: If the corresponding SoC functional unit does not fail, the local security mechanism unit outputs security response information.

[0098] Step S123: The fault management module transmits the safety response information to the safety bus.

[0099] Step S124, determining whether the monitoring and decision logic unit receives the security response information within a specified time.

[0100] Step S125: If the monitoring and decision logic unit does not receive the security response information within the specified time, it is determined that the corresponding SoC functional unit fails and the fault processing is performed.

[0101] In some embodiments, if the monitoring and decision logic unit receives security response information within the specified time, that is, the security response is not lost, it is determined that the corresponding SoC functional unit has not failed and switches to the continue modeling mode, and continues to collect information sent by the fault management module through the security bus.

[0102] Specifically, the local safety mechanism unit performs internal fault diagnosis on the corresponding SoC functional unit at a time interval lower than the fault tolerance time interval, and the specific interval time can be set based on actual needs. The local safety mechanism unit determines whether the corresponding SoC functional unit fails. If not, step S122 is executed and the local safety mechanism unit outputs a safety response message. The interval between the output of two safety response messages can be set to a period T based on actual needs. The time can be consistent with the time for the local safety mechanism unit to diagnose the fault, or it can be slightly longer. It should be noted that some or all of the SoC functional units can perform periodic fault diagnosis on the corresponding SoC functional unit and send the safety response information to the corresponding fault management module 121 when no fault occurs.

[0103] The fault management module 121 collects the security response information from the local security mechanism unit of the corresponding SoC functional unit and outputs it to the security bus 122. The security bus 122 uses a protected channel to transmit the security response information to the monitoring and logic decision unit 123. If the monitoring and logic decision unit 123 does not receive the security response information of the corresponding SoC functional unit within the specified time, it is determined that the SoC functional unit has a fault and performs fault processing. If the monitoring and logic decision unit 123 receives the security response information of the corresponding SoC functional unit within the specified time, it is determined that the SoC functional unit has not failed and returns to step S120. The local security mechanism unit continues to perform fault diagnosis. The specified time can be the same as the period T, or it can be slightly longer.

[0104] When the monitoring and logic decision unit 123 does not receive the security response information of the corresponding SoC functional unit within the specified time, that is, the security response is lost, it is judged as a timeout, and the SoC functional unit is considered to have a fault and enters the fault response mode for fault processing. The fault information can be classified based on the impact of the fault, the way to handle the fault, and the time priority of handling the fault, such as the classification method of the first classification to the fourth classification mentioned in the above embodiment, of course, its classification method is not limited to this. The monitoring and logic decision unit 123 sets the processing method for each fault based on the classified first fault information, and can cooperate with the safety island module 120 and the external device 200 during processing. For example, the corresponding SoC functional unit is directly controlled to reset through the fault management module 121, and the SoC functional module 110 is powered off through the external device 200. After the fault is handled, the SoC system re-enters the safe state.

[0105] In some implementations, the fault may be handled in the following manner, for example, by placing the SoC chip 100 in a reset state (the SoC chip 100 enters a reset mode) to recover from a single subsystem (SoC functional unit) or SoC-level fault.

[0106] For example, the power supply of the SoC chip 100 is completely cut off by the external device 200 (the SoC chip 100 enters the power-off mode), and the SoC functional module 110 stops outputting all expected functions. Figure 2 , the power supply of the SoC chip 100 can be completely cut off by the power management chip 220 in the external device 200 (entering the Power-off mode), the SoC functional module 110 stops the output of all expected functions, and the security MCU module 210 in the external device 200 takes over the expected functions.

[0107] For example, the SoC chip 100 is in a normal working state (the SoC chip 100 enters the Normal operation mode), the SoC functional module 110 has an erroneous expected functional output, and the safety island module 120 outputs a fault signal to the external device 200 for providing warning information to the vehicle driver.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A SoC system, characterized in that: include: A SoC chip and an external device, wherein the SoC chip is connected to the external device, and the external device is used to power the SoC chip and provide an external reference frequency; wherein: The SoC chip includes a SoC functional module, and the SoC functional module includes a plurality of SoC functional units, each of which is used to cooperate in realizing a vehicle control function, and each of the SoC functional units is respectively configured with a local safety mechanism unit, and the local safety mechanism unit is used to perform internal fault diagnosis on the corresponding SoC functional unit at a time interval lower than the fault tolerance time interval, and collect fault information of the corresponding SoC functional unit; The SoC chip also includes a safety island module, which includes a safety bus, a monitoring and decision logic unit and a plurality of fault management modules. The number of the fault management modules is the same as the number of the SoC functional units and they are connected one-to-one. The fault management module is also connected to the monitoring and decision logic unit through the safety bus. The fault management module is used to receive fault information of the corresponding local safety mechanism unit, and convert the fault information into a standardized data format suitable for the safety bus and transmit it to the safety bus, and transmit it to the monitoring and decision logic unit through the safety bus. The safety bus is configured as an independent data channel and is only used to transmit the fault information. The monitoring and decision logic unit is used to monitor the fault information, make fault handling decisions, and cooperate with the external device to execute fault response and handle fault events; The SoC chip includes a first physical isolation area and a second physical isolation area, the first physical isolation area and the second physical isolation area comply with preset isolation constraint rules, the SoC functional module is located in the first physical isolation area, and the safety island module is located in the second physical isolation area.

2. The SoC system according to claim 1, characterized in that: The plurality of SoC functional units respectively include: Processing unit, used to process and execute various instructions and algorithms; Storage unit, used to store programs and data, providing fast read and write access; The interface unit is used to provide high-speed and low-speed I / O interfaces for communicating with the outside world; A bus unit, used for transmitting data signals, control signals, interrupt and exception handling signals; Clock unit, used to provide the frequency required by each IP; Power supply unit, used to manage the power supply and power consumption of each IP; The digital-to-analog conversion unit is used for conversion between digital and analog signals.

3. The SoC system according to claim 1, characterized in that: The SoC chip also includes a detection unit, which is used to detect whether common cause failure and cascading failure occur in the SoC functional module and the safety island module.

4. The SoC system according to claim 1, characterized in that: The safety bus also classifies the fault information; the classification includes: The first category is a recoverable fault at the subsystem level. When the monitoring and decision logic unit receives the fault information belonging to the first category, it outputs fault prompt information; The second category is an unrecoverable fault at the subsystem level. When the monitoring and decision logic unit receives the fault information belonging to the second category, it outputs fault prompt information and controls the corresponding SoC functional unit to reset through the safety bus and the fault management module; The third category is a recoverable fault at the SoC system level. When the monitoring and decision logic unit receives the fault information belonging to the third category, it outputs fault prompt information and controls the corresponding SoC functional unit to enter interruption and handle the fault through the safety bus and the fault management module; The fourth category is an unrecoverable fault at the SoC system level. When the monitoring and decision logic unit receives the fault information belonging to the fourth category, it outputs a fault prompt message and controls the SoC chip reset through an external device.

5. The SoC system according to claim 1, characterized in that: The external device includes: A power management chip, comprising a first power supply module and a second power supply module, wherein the first power supply module is connected to the SoC functional module to supply power thereto, and the second power supply module is connected to the safety island module to supply power thereto; a safety MCU module, connected to the monitoring and decision logic unit, configured to receive the fault information and control the power management chip to disconnect the power supply to the SoC functional module when the fault information includes preset fault information; and An external oscillator is connected to the SoC functional module and the safety island module, and is used to provide an external reference clock for the SoC functional module and the safety island module.

6. A SoC functional safety control method, characterized in that: Applied to the SoC system according to any one of claims 1 to 5, the method comprises: The local safety mechanism unit performs internal fault diagnosis on the corresponding SoC functional unit at a time interval shorter than the fault tolerance time interval, and outputs first fault information if a fault occurs in the corresponding SoC functional unit; The fault management module converts the first fault information into a standardized data format suitable for a safety bus and transmits the data to the safety bus; The safety bus classifies the first fault information based on preset rules and outputs it to the monitoring and decision logic unit; The monitoring and decision logic unit performs fault processing based on the classification of the first fault information.

7. A SoC functional safety control method, characterized in that: Applied to the SoC system according to any one of claims 1 to 5, the method comprises: The local safety mechanism unit performs internal fault diagnosis on the corresponding SoC functional unit at a time interval shorter than the fault tolerance time interval, and if the corresponding SoC functional unit does not fail, the local safety mechanism unit outputs safety response information; The fault management module converts the safety response information into a standardized data format suitable for a safety bus and transmits the data to the safety bus; If the monitoring and decision logic unit does not receive the security response information within the specified time, it is determined that the corresponding SoC functional unit fails and the fault processing is performed.

8. The SoC functional safety control method according to claim 7, characterized in that: It also includes if the monitoring and decision logic unit receives the security response information within a specified time, determining that the corresponding SoC functional unit has not failed and continuing to collect information sent by the fault management module through the security bus.

Images