A multi-chip communication security function system and method

Abstract

A multi-chip communication safety function system and method, relating to the field of chip communication technology, includes M hosts and a multi-chip bridge, the multi-chip bridge includes N communication translation modules, a bus, a storage module, a bus monitoring module, a safety comparison module, a watchdog module and an error handling module: the safety comparison module is used to determine whether the current system is running normally by comparing the error value between the host calculation results with the standard value; it is used to compare the difference between the two host calculation results with the standard value range through a register to determine whether the system is running normally, and generate an error flag to notify the error handling module when the difference exceeds the specified range. The invention communicates with the peripherals with the chip and the multi-chip bridge, exchanges data in the multi-chip bridge, achieves the purpose of multi-chip collaboration, and resets and protects the external functions at the receiving multi-chip core data when the data verification between the master and slave cores fails, so as to avoid erroneous signal transmission.

Description

Technical Field

[0001] The present invention relates to the field of chip communication technology, and in particular to a multi-chip communication security function system and method. Background Art

[0002] With the rapid development of science and technology, the application scope of chips is constantly expanding, and the demand is rising sharply. The performance of single-core processors can no longer meet the needs of complex computing tasks. For this reason, multi-chip collaborative processing technology has emerged. It greatly improves computing power through the joint work of multiple chips and solves the problem of insufficient processing power of a single chip.

[0003] However, existing multi-core communications are integrated on a single chip, which results in slow iterations, high design costs, and difficulty in quickly following the market.

[0004] Communication issues between multiple chips have become a new challenge, especially the potential security risks during signal transmission. This is particularly prominent in fields with high safety requirements such as automobiles, and the importance of communication security has become even more important. Summary of the invention

[0005] In order to overcome the deficiencies in the background technology, the present invention discloses a multi-chip communication security function system and method.

[0006] In order to achieve the above-mentioned object of the invention, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention discloses a multi-chip communication safety function system, comprising M hosts and a multi-chip bridge, wherein the multi-chip bridge comprises N communication translation modules, a bus, a storage module, a bus monitoring module, a safety comparison module, a watchdog module and an error handling module:

[0008] A communication translation module is used to receive data sent by the host and parse it into a bus command of the multi-chip bridge; the host and the communication translation module are connected one by one; M, N are positive integers greater than or equal to 3, and M=N;

[0009] The bus is used to receive bus commands and arbitrate the bus commands and then output them to the storage module, the safety comparison module or the watchdog module;

[0010] The storage module is used for data exchange between hosts. The bus writes the data sent by the host into the storage module, and other hosts can read the data in the storage module to complete the data exchange between hosts.

[0011] The bus monitoring module is used to record the bus behavior. The bus monitoring module records various behavior operations implemented in the bus so as to trace the source of the error when an error occurs later.

[0012] A safety comparison module, used to determine whether the current system is running normally by comparing the error value between the host calculation results with the standard value, and to generate an error flag to notify the error handling module when the error value exceeds the standard value; the safety comparison module includes a first register, a second register and a standard value register;

[0013] The host first writes the standard value into the standard value register, and the standard value includes an upper limit value and a lower limit value; when the two hosts respectively control the bus bus to write the values ​​to be compared into the first register and the second register, the safety comparison module immediately and automatically performs the subtraction between the first register regA and the second register regB, and the difference after the subtraction is completed is compared with the standard value;

[0014] When the error value is greater than or equal to the lower limit and less than or equal to the upper limit, the safety comparison module does not generate an error flag to the error handling module, indicating that the current system is running normally;

[0015] When the error value is less than the lower limit or greater than the upper limit, the safety comparison module generates an error flag and sends it to the error processing module, which then transmits it to the host to notify the host of the comparison result error;

[0016] Watchdog module, used to monitor whether the host is running normally by feeding the dog;

[0017] The error handling module is used to receive error flags from the storage module, the safety comparison module, the watchdog module and the bus, and generate a corresponding error handling state according to the error level of the error flag.

[0018] Specifically, the multi-chip communication safety function system also includes a first ECC error correction module, which is connected to the bus bus, performs ECC encoding on the data when the data is input to the bus, and performs ECC decoding on the encoded data when the data is output from the bus bus. When the ECC decoding finds a 1-bit data error, it normally controls the peripherals in the multi-chip bridge and sends the error flag to the error handling module; it is directly transmitted to the host through the error handling module, and the host can decide the operation after finding the error; when the ECC decoding finds a 2-bit or more data error, the error flag is transmitted to the error handling module. After the error handling module detects a multi-bit bus error, it directly resets the multi-chip bridge and transmits the error to the host, notifying the host that the multi-chip bridge has an error and has completed the reset.

[0019] Specifically, the multi-chip communication safety function system also includes a second ECC error correction module, which is connected to the storage module. Before writing data into the storage module, the data is first encoded through ECC, and then the encoded data is stored in the storage module; when the data is read out from the storage module, the data with ECC information is ECC decoded; when the ECC decoding finds that an error has occurred, the error flag is transmitted to the error handling module; the error handling module transmits the generated error flag to the host and notifies the host that the data read out is erroneous data.

[0020] Specifically, the bus monitoring module is a dual-port SRAM memory.

[0021] Specifically, the watchdog module monitors whether the host is operating normally by feeding the dog, which specifically includes: when the watchdog receives the dog feeding, it indicates that the host is operating normally. If the dog is not fed within a preset time, it indicates that the host is operating incorrectly, and an error will be generated and an error flag will be transmitted to the error handling module.

[0022] Specifically, the watchdog module further includes: when the host runs incorrectly, the system will reset the multi-chip bridge;

[0023] Specifically, the host sends a signal through the communication interface to communicate with the communication translation module.

[0024] Specifically, the communication interfaces that can be expanded by the communication translation module include: sci, spi, iic, fsi, and hic; each communication translation module will have a fixed ID number when communicating with the bus bus, telling the bus bus which host sent the command.

[0025] Specifically, if multiple hosts conflict in bus communication at the same time, the bus will communicate in ascending priority order according to the ID numbers sent by the communication translation module.

[0026] Specifically, the multi-chip bridge is connected to each host by a unique error status signal line. When no error information is generated, the error status signal line level is low; when there is an error information status that needs to be notified to the host, the error status signal line level is pulled high.

[0027] In a second aspect, the present invention further discloses a multi-chip communication security function method, based on any of the multi-chip communication security function systems described above, characterized in that the method comprises:

[0028] S1, the first host sends a configuration standard value command;

[0029] S2, the first communication translation module receives the configuration standard value command and parses it into the first bus data; the first communication translation module is connected to the first host;

[0030] S3, the bus bus parses the first bus data to obtain a standard value and writes it into a standard value register;

[0031] S4, the second host sends a first data to be compared command, and the third host sends a second data to be compared command;

[0032] S5, the second communication translation module receives the first data command to be compared and parses it into the second bus data, and the third communication translation module receives the second data command to be compared and parses it into the third bus data; the second communication translation module is connected to the second host; the third communication translation module is connected to the third host;

[0033] S6, the bus bus parses the second bus data to obtain first data to be compared and writes it into the first register, and the bus bus parses the third bus data to obtain second data to be compared and writes it into the second register;

[0034] S7, after the security comparison module detects that the data in the first register and the second register are updated, the security comparison module subtracts the first register from the second register to obtain an error value;

[0035] S8, the error value is compared with the standard value, if the error value is less than or equal to the standard value indicates that the second host and the third host are currently calculated correctly, continue to work; otherwise, an error signal is generated to the error handling module and proceeds to step S9;

[0036] S9. The error processing module generates an error notification according to the error signal and transmits it to the second host and the third host.

[0037] A multi-chip communication security function system provided by the present invention can enable peripherals with chips to communicate with a multi-chip bridge, exchange data in the multi-chip bridge, and achieve the purpose of multi-chip collaboration.

[0038] In addition, the safety comparison module provided by the present invention can verify the data between the master and slave cores used for calculating the same signal, and reset and protect the external functions at the receiving multi-chip core data when the verification fails, so as to avoid erroneous signal transmission;

[0039] In addition, the multi-chip bridge of the present invention integrates ECC security monitoring, and performs corresponding encryption and decryption during data transmission and access to ensure the security of data during transmission;

[0040] In addition, since the present invention can expand the connection of low-speed peripherals through the communication translation module, processing the transmission data of these low-speed peripherals through a multi-chip bridge can reduce the load of the main chip and improve the overall performance of the system, thereby freeing up the resources on the main chip to process more complex tasks and achieve better resource optimization; and the multi-chip bridge can easily add or remove low-speed peripherals, thereby improving the flexibility and scalability of the system.

[0041] A multi-chip communication safety function method provided by the present invention can verify the data between the master and slave cores used for calculating the same signal, and reset and protect the external function at the receiving multi-chip core data when the verification fails, so as to avoid erroneous signal transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 is a schematic diagram of a multi-chip communication security function system provided according to an embodiment of the present invention;

[0044] Figure 2 It is a schematic diagram of the ECC error correction structure of the bus module provided according to an embodiment of the present invention;

[0045] Figure 3 is a schematic diagram of an ECC error correction structure of a storage module provided according to an embodiment of the present invention;

[0046] Figure 4 is a schematic diagram of a bus monitoring module monitor provided according to an embodiment of the present invention;

[0047] Figure 5 is a schematic diagram of a security comparison module provided according to an embodiment of the present invention;

[0048] Figure 6 1. is a schematic diagram of a watchdog feeding process according to an embodiment of the present invention;

[0049] Figure 7 is a schematic diagram of a watchdog counting process according to an embodiment of the present invention;

[0050] Figure 8 It is a schematic diagram of a multi-chip communication security function method provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The present invention can be explained in detail through the following embodiments. The purpose of disclosing the present invention is to protect all technical improvements within the scope of the present invention. In the description of the present invention, it should be understood that if there are terms such as "upper", "lower", "front", "back", "left", "right", etc. indicating directions or positional relationships, they only correspond to the drawings of the present application for the convenience of describing the present invention, and do not indicate or imply that the device or element referred to must have a specific direction.

[0052] Embodiment 1.

[0053] refer to Figure 1 This embodiment provides a multi-chip communication security function system, including M hosts and a multi-chip bridge, wherein the multi-chip bridge includes N communication translation modules, a bus, a storage module, a bus monitoring module, a security comparison module, a watchdog module and an error handling module:

[0054] A communication translation module, for receiving external host communication interface signals and parsing the signals into bus commands for the multi-chip bridge;

[0055] Specifically, the multi-chip bridge bus command includes a read command and a write command;

[0056] This embodiment provides a specific data format of a bus command:

[0057] The bus command contains 32 bits;

[0058] The first bit is used to distinguish whether the bus command is a write command or a read command; if it is 0, data is read; if the first bit is 1, data is written.

[0059] The 2nd to 8th bits are the read or write data length, which is used to indicate how much data will be written or how much data will be read;

[0060] The 9th to 16th bits are check bits, which are used to check whether the first 16 data are correct. If they are correct, the communication translation will operate normally. If they are incorrect, an error will be reported and the signal will not be processed.

[0061] Bits 17 to 32 are the starting address, which is used to indicate the starting address of the data to be written or read.

[0062] In a computer system, different hardware modules are assigned different address ranges, which are defined when the system is designed.

[0063] When the host sends a bus command, it includes the address of the target module in the starting address bit. The system will use this address to determine which module the command should be distributed to.

[0064] By specifying different addresses in the bus command, the system can ensure that the data is correctly sent to the target module, whether it is used for storage, data exchange between hosts or security comparison. This is a prior art and will not be repeated here.

[0065] The communication translation module can be extended to any common communication interface such as SCI, SPI, IIC, FSI, HIC, etc., which can communicate with the corresponding interface of the host; and each communication translation module will have a fixed ID number when communicating with the bus, telling the bus which host sent the command; the number of hosts corresponds to the number of communication translation modules one by one;

[0066] The M and N are positive integers greater than or equal to 3. The numbers of M and N are determined according to actual needs. In this embodiment, the values ​​of M and N are 3.

[0067] Since the communication translation module can be expanded to any communication interface, this embodiment can connect low-speed peripherals through a multi-chip bridge expansion, and send data to the low-speed peripherals of the multi-chip bridge to allow them to communicate with the same external low-speed communication interface.

[0068] Because the data transmission of low-speed peripherals usually does not require very high bandwidth, processing this data through a multi-chip bridge can reduce the load on the main chip and improve the overall performance of the system, thereby freeing up resources on the main chip to handle more complex tasks and achieving better resource optimization; because the data processing and communication of low-speed peripherals can be undertaken by a multi-chip bridge, and low-speed peripherals can be easily added or removed through a multi-chip bridge, the flexibility and scalability of the system are improved.

[0069] The bus bus is used to receive the bus commands translated by the communication translation module and arbitrate each bus command and then output it to the multi-chip bridge peripheral; the multi-chip bridge peripheral is a storage module, a security comparison module or a watchdog module;

[0070] refer to Figure 2 The bus bus also adds a first ECC error correction module. The input bus signal, i.e., the bus command translated by the communication translation module, is input to the bus bus through ECC encoding. When the bus is output, the ECC error is corrected by the ECC decoding module. When a 1-bit data error is found, the peripherals in the multi-chip bridge can be controlled normally, but the error flag err_flag will be given to the error handling module, which is directly transmitted to the host through the error handling module. The host can decide the operation by itself after finding the error; when a 2-bit or more ECC error is found, the error flag err_flag will be transmitted to the error handling module. After the error handling module detects a multi-bit bus error, it will directly reset the multi-chip bridge and transmit the error to the host, telling the host that the multi-chip bridge has an error and has completed the reset. This reset function cannot be masked. The data error is an error that occurs during ECC decoding;

[0071] The multi-chip bridge has a built-in reset function. After the reset is executed, each module in the multi-chip bridge is restored to the initial state.

[0072] After reset, the multi-chip bridge will not execute the previous erroneous instructions and inform the host. The host will resend the execution command after receiving the error. This can effectively protect the correctness of the data and prevent the erroneous data from flowing to other hosts or peripherals.

[0073] If multiple hosts conflict in the bus communication at the same time, the bus will communicate according to the priority from small to large according to the ID number sent by the communication translation module;

[0074] Storage module, used for host data exchange; the host writes data into the storage module, and other hosts can read the data in the storage module to complete data exchange between hosts;

[0075] The function of the multi-chip bridge is to connect the hosts for communication. After the hosts process their own transactions, they need to exchange the processed information to give full play to the multi-core processing capabilities. The storage in the multi-chip bridge plays a vital role in data caching for the communication between the hosts. However, the storage unit will fail during multiple uses. Therefore, in order to improve the security of data communication and the functional safety of multi-chip communication, it is very important to use ECC in the storage unit.

[0076] refer to Figure 3 The system also adds a second ECC error correction module, which is used to encode the data before writing it into the storage module, and then store the encoded data into the storage module. When the data is read out from the storage module, the data with ECC information first enters the ECC decoding module for ECC error checking. When an error occurs, the error flag err_flag is transmitted to the error handling module. The error handling module transmits the generated error flag to the host and notifies the host that the data read out is erroneous data.

[0077] The multi-chip bridge integrates security functions and performs corresponding encryption and decryption during data transmission and access to ensure the security of data during transmission.

[0078] The bus monitoring module is used to record the bus behavior. The bus monitoring module records various behavior operations implemented in the bus so as to trace the source of the error when an error occurs later.

[0079] refer to Figure 4 The bus monitoring module monitor records the bus behavior data in real time and stores it in its own storage. Each bus operation will be stored in the monitor. When the host detects a multi-chip bridge error or detects that the received data does not meet its expectations, it can read all bus operation processes stored in the monitor through the bus, that is, all bus behavior data, and check whether the data or bus behavior is correct by reading the bus operation process.

[0080] The bus behavior includes: data, address and read / write flag;

[0081] The bus behavior recorded in the bus monitoring module mainly includes the address corresponding to the data and whether the data is to be read or written.

[0082] For example, if the host detects data inconsistency, it can check the bus behavior data recorded by the bus monitoring module to see if the data was incorrectly written in a write operation or the data was incorrectly read in a read operation.

[0083] In summary, by analyzing the read and write flags, data, and addresses in the bus behavior data, it is possible to determine whether the behavior of the bus operation is correct, and to perform error diagnosis and repair accordingly.

[0084] The bus monitoring module monitor uses a dual-port SRAM memory, one port is responsible for writing bus behavior, and the other port is responsible for the bus reading data from the monitor. The use of dual-port SRAM can avoid conflicts between the monitor recording bus behavior and the bus reading monitor data.

[0085] The bus behavior data is recorded in the memory of the bus monitoring module, which is similar to the log of various bus behavior operations. The memory starts to store again after each power-on, and starts to store again from the starting address when the memory is full.

[0086] A safety comparison module is used to compare the results of individual operations of each host; the safety comparison module includes a first register, a second register and a standard value register;

[0087] refer to Figure 5 , the host first writes the standard value, where the standard value includes an upper limit value and a lower limit value. When the two hosts control the bus bus to write the values ​​to be compared to the first register regA and the second register regB respectively, the safety comparison module immediately and automatically performs the subtraction between the first register regA and the second register regB. The error value after the subtraction is compared with the standard value. When the difference is between the standard value or equal to the standard value, no error flag is generated to the error handling module. When the difference is outside the standard value, an error flag is generated and given to the error handling module, which is then transmitted to the host by the error handling module to notify the host that the comparison result is wrong.

[0088] Specifically, when the error value is greater than or equal to the lower limit value and less than or equal to the upper limit value, the safety comparison module does not generate an error flag to the error handling module, indicating that the current system is running normally;

[0089] When the error value is less than the lower limit or greater than the upper limit, the safety comparison module generates an error flag and sends it to the error processing module, which then transmits it to the host to notify the host of the comparison result error;

[0090] This function is used to store the results of each calculation in the multi-chip bridge for comparison when multiple chips jointly process events. It can be used for functional safety data comparison between the main core and the secondary core. When the comparison is successful, it means that the main core is working normally. When the comparison fails, it means that the calculation results of the main core and the secondary core are different. The system should immediately find the cause and stop working to enter the protection mode.

[0091] In a possible embodiment, for example, host 1 is the main control core of a system, and host 2 is the follower core of the main control core of the system, which is used for verification. When the system receives a signal, it is processed by the main control core and the follower core respectively. Since the signal is easily interfered by the outside during the transmission process, it is necessary to confirm the correctness of the received signal and the correctness of the calculation of the main control core through security comparison, so a security comparison module can be used. The main control core and the follower core write the calculation results after receiving the signal into the security comparison module of the multi-chip bridge respectively, and judge the correctness of the calculation of the main control core receiving the signal core by whether an error occurs after the security comparison.

[0092] Before using the safety comparison module, you need to configure the standard value first, and then different external hosts write the data to be compared to RegA and RegB respectively. When the safety comparison module detects that the data in both registers have been updated, it will automatically calculate the difference, and then compare the calculated difference with the standard value. If the difference is greater than the standard value, the error handling module will generate an error to inform the host, and the host will determine whether to use the data to be compared as the correct value.

[0093] Watchdog module, used to monitor whether the host is running normally by feeding the dog;

[0094] refer to Figure 6 ,7. Generally, there is a watchdog in the chip as a check mode to see if the program is running correctly. Since the multi-chip bridge does not have a core, it is impossible to use a normal program to feed the watchdog. In this case, any external host is used in the multi-chip bridge to feed the watchdog. When the watchdog receives the feeding signal, it indicates that the external host is working normally. If the dog is not fed within the preset time, it indicates that the external host program is running incorrectly and cannot communicate normally with the multi-chip bridge. At this time, the multi-chip bridge cannot work in normal mode. The system should immediately reset the protection of the external function at the receiving multi-chip core data to avoid erroneous signal transmission.

[0095] The preset time is determined according to specific requirements.

[0096] The process of feeding the watchdog is as follows Figure 5As shown, any host sends a dog feeding command, which is received and parsed into a bus command by the corresponding communication translation module, and the bus bus arbitrates the bus command and feeds the dog to the watchdog module;

[0097] This embodiment also provides a specific implementation method for the watchdog to determine whether the host is operating normally. Figure 7 As shown,

[0098] Any host sends a command to enable the watchdog;

[0099] The watchdog enable command is received by a corresponding communication translation module and parsed into a bus command;

[0100] The bus arbitrates the bus command and turns on the watchdog enable;

[0101] The watchdog counter is 0 and starts counting up.

[0102] Check whether the watchdog is fed before the watchdog counter overflows. If the watchdog is fed before the watchdog counter overflows, the count of the watchdog counter is reset to 0. Otherwise, an error flag is generated to the error handling module. The error handling module notifies the external host according to the error flag to notify its operation that an error has occurred.

[0103] The error processing module is used to receive the error flag and process the error flag; the error information is generated by the storage module, the bus monitoring module, the safety comparison module and the watchdog module.

[0104] The error processing module receives error information from the storage module, the safety comparison module, the watchdog module and the bus, and generates a corresponding error processing state according to the error level of the error information.

[0105] Each of the above modules will have an error flag signal sent to the error handling module. The error flag signal of each module is different. The signal that is pulled high indicates which module has an error, thereby making a distinction. Each host can receive the error flag of the error handling module.

[0106] If an error occurs on the bus and an error flag is generated, the multi-chip bridge needs to be reset and all hosts need to be notified;

[0107] If other error flags are generated, it is only necessary to notify the corresponding host; when the error handling module receives error information and needs to notify the host, the multi-chip bridge and each host are connected by a unique error status signal line. When no error information is generated, the signal line level is low; when there is an error information status that needs to be informed to the host, the error status signal line level is pulled high; after receiving the high level, the host knows that an error has occurred in the multi-chip bridge and the host performs corresponding processing.

[0108] The host sends the command to be executed to the communication translation module through the communication interface. The communication translation module parses the command and sends it to the bus. The bus has its own arbitration function. After the bus arbitration, the host command is executed and data communication is carried out with other hosts. Since the multi-chip bridge has no core, it is unable to identify and process errors on the bus. Therefore, a safety comparison module and an error handling module are added to the multi-chip bridge to achieve the identification and processing of error states.

[0109] A multi-chip communication security function system provided in this embodiment can enable peripherals with chips to communicate with a multi-chip bridge, exchange data in the multi-chip bridge, and achieve the purpose of multi-chip collaboration.

[0110] In addition, the security comparison module provided in this embodiment can verify the data between the master and slave cores used to calculate the same signal, and reset and protect the external functions at the receiving multi-chip core data when a verification error occurs to avoid erroneous signal transmission.

[0111] In addition, the multi-chip bridge of this embodiment integrates ECC security monitoring, and performs corresponding encryption and decryption during data transmission and access, thereby ensuring the security of data during transmission.

[0112] In addition, since the multi-chip bridge of this embodiment can expand the connection of low-speed peripherals through the communication translation module, processing the transmission data of these low-speed peripherals through the multi-chip bridge can reduce the load of the main chip and improve the overall performance of the system, thereby freeing up the resources on the main chip to process more complex tasks and achieve better resource optimization; and the multi-chip bridge can easily add or remove low-speed peripherals, thereby improving the flexibility and scalability of the system.

[0113] Embodiment 2.

[0114] refer to Figure 8 This embodiment discloses a multi-chip communication security function method, which is used in a multi-chip communication security function system of the above embodiment, and includes the following steps:

[0115] S1, the first host sends a configuration standard value command;

[0116] Specifically, the first host is any host connected to the multi-chip bridge;

[0117] S2, the first communication translation module receives the configuration standard value command and parses it into the first bus data; the first communication translation module is connected to the first host;

[0118] S3, the bus bus parses the first bus data to obtain a standard value and writes it into a standard value register;

[0119] The standard value includes an upper limit value and a lower limit value;

[0120] S4, the second host sends a first data to be compared command, and the third host sends a second data to be compared command;

[0121] S5, the second communication translation module receives the first data command to be compared and parses it into the second bus data, and the third communication translation module receives the second data command to be compared and parses it into the third bus data; the second communication translation module is connected to the second host; the third communication translation module is connected to the third host;

[0122] S6, the bus bus parses the second bus data to obtain the first data to be compared and writes it into the first register, and the bus bus parses the third bus data to obtain the second data to be compared and writes it into the second register;

[0123] S7, after the security comparison module detects that the data in the first register and the second register are updated, the security comparison module subtracts the first register from the second register to obtain an error value;

[0124] S8, the error value is compared with the standard value, if the error value is less than or equal to the standard value indicates that the second host and the third host are currently calculated correctly, continue to work; otherwise, an error signal is generated to the error handling module and proceeds to step S9;

[0125] When the error value is greater than or equal to the lower limit and less than or equal to the upper limit, the safety comparison module does not generate an error flag to the error handling module, indicating that the current system is running normally;

[0126] When the error value is less than the lower limit or greater than the upper limit, the safety comparison module generates an error flag and sends it to the error processing module, which then transmits it to the host to notify the host of the comparison result error;

[0127] S9. The error processing module generates an error notification according to the error signal and transmits it to the second host and the third host.

[0128] A multi-chip communication security function method provided in this embodiment can verify the data between the master and slave cores used for calculating the same signal, and reset and protect the external function receiving the multi-chip core data when the verification fails to prevent erroneous signal transmission.

[0129] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 Processes Multiple processes and / or boxes Figure 1 A device that has the functions specified in one or more boxes.

[0130] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0131] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0132] The parts of the present invention that are not described in detail are prior art. It is obvious to those skilled in the art that the present invention is not limited to the details of the above-mentioned exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic characteristics of the present invention; therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive, and it is intended that all changes that fall within the meaning and scope of equivalent elements are included in the present invention.

Claims

1. A multi-chip communication security function system, comprising M hosts and a multi-chip bridge, characterized in that: The multi-chip bridge includes N communication translation modules, a bus, a storage module, a bus monitoring module, a security comparison module, a watchdog module and an error handling module: A communication translation module, used to receive data sent by the host and parse it into bus commands of the multi-chip bridge; The host is connected to the communication translation module in a one-to-one correspondence; M, N are positive integers greater than or equal to 3, and M=N; The bus is used to receive bus commands and arbitrate the bus commands and then output them to the storage module, the safety comparison module or the watchdog module; The multi-chip communication safety function system also includes a first ECC error correction module, which is connected to the bus bus, performs ECC encoding on the data when the data is input to the bus, and performs ECC decoding on the encoded data when it is output from the bus bus. When the ECC decoding finds a 1-bit data error, the peripherals in the multi-chip bridge are normally controlled, and the error flag is sent to the error handling module; it is directly transmitted to the host through the error handling module, and the host can decide the operation after finding the error; when the ECC decoding finds a 2-bit or more data error, the error flag is transmitted to the error handling module, and the error handling module directly resets the multi-chip bridge after detecting a multi-bit bus error, and transmits the error to the host, notifying the host that the multi-chip bridge has an error and has completed the reset; Storage module, used for data exchange between hosts; The bus writes the data sent by the host into the storage module, and other hosts can read the data in the storage module to complete the data exchange between hosts; Bus monitoring module, used to record bus behavior; The bus monitoring module records various behavior operations implemented in the bus; A safety comparison module, used to determine whether the current system is running normally by comparing the error value between the host calculation results with the standard value, and to generate an error flag to notify the error handling module when the error value exceeds the standard value; the safety comparison module includes a first register, a second register and a standard value register; The host first writes the standard value into the standard value register, and the standard value includes an upper limit value and a lower limit value; when the two hosts respectively control the bus bus to write the values ​​to be compared into the first register and the second register, the safety comparison module immediately and automatically performs the subtraction between the first register regA and the second register regB, and the error value after the subtraction is completed is compared with the standard value; When the error value is greater than or equal to the lower limit and less than or equal to the upper limit, the safety comparison module does not generate an error flag to the error handling module, indicating that the current system is running normally; When the error value is less than the lower limit or greater than the upper limit, the safety comparison module generates an error flag and sends it to the error processing module, which then transmits it to the host to notify the host of the comparison result error; Watchdog module, used to monitor whether the host is running normally by feeding the dog; The error handling module is used to receive error flags from the storage module, the safety comparison module, the watchdog module and the bus, and generate a corresponding error handling state according to the error level of the error flag.

2. The multi-chip communication safety function system according to claim 1, characterized in that: The multi-chip communication safety function system also includes a second ECC error correction module, which is connected to the storage module, and is firstly ECC-encoded before writing data into the storage module, and then the encoded data is stored in the storage module; when the data is read out from the storage module, the data with ECC information is ECC-decoded; When an error is found during ECC decoding, the error flag is transmitted to the error handling module; The error handling module transmits the generated error flag to the host and notifies the host that the read data is erroneous data.

3. The multi-chip communication safety function system according to claim 1, characterized in that: The bus monitoring module is a dual-port SRAM.

4. The multi-chip communication safety function system according to claim 1, characterized in that: The watchdog module monitors whether the host is operating normally by feeding the dog, specifically including: when the watchdog receives the dog feeding, it indicates that the host is operating normally. If the dog is not fed within a preset time, it indicates that an error occurs in the operation of the host, and an error will be generated and an error flag will be transmitted to the error handling module.

5. The multi-chip communication safety function system according to claim 4, characterized in that: The watchdog module also includes: when the host runs incorrectly, the system will reset the multi-chip bridge.

6. The multi-chip communication safety function system according to claim 1, characterized in that: The host sends signals to communicate with the communication translation module through the communication interface; the communication translation module can expand the communication interface including: sci, spi, iic, fsi, hic; each communication translation module will have a fixed ID number when communicating with the bus bus.

7. The multi-chip communication safety function system according to claim 6, characterized in that: If multiple hosts conflict in bus communication at the same time, the bus will communicate in ascending priority according to the ID number sent by the communication translation module.

8. The multi-chip communication safety function system according to claim 1, characterized in that: The multi-chip bridge is connected to each host by a unique error status signal line, and when no error information is generated, the level of the error status signal line is low; When there is an error information status that needs to be notified to the host, the error status signal line level is pulled high.

9. A multi-chip communication safety function method, based on the multi-chip communication safety function system according to any one of claims 1 to 8, characterized in that: The method comprises: S1, the first host sends a configuration standard value command; S2, the first communication translation module receives the configuration standard value command and parses it into the first bus data; the first communication translation module is connected to the first host; S3, the bus bus parses the first bus data to obtain a standard value and writes it into a standard value register; S4, the second host sends a first data to be compared command, and the third host sends a second data to be compared command; S5, the second communication translation module receives the first data command to be compared and parses it into the second bus data, and the third communication translation module receives the second data command to be compared and parses it into the third bus data; the second communication translation module is connected to the second host; the third communication translation module is connected to the third host; S6, the bus bus parses the second bus data to obtain first data to be compared and writes it into the first register, and the bus bus parses the third bus data to obtain second data to be compared and writes it into the second register; S7, after the security comparison module detects that the data in the first register and the second register are updated, the security comparison module subtracts the first register from the second register to obtain an error value; S8, the error value is compared with the standard value, if the error value is less than or equal to the standard value indicates that the second host and the third host are currently calculated correctly, continue to work; otherwise, an error signal is generated to the error handling module and proceeds to step S9; S9. The error processing module generates an error notification according to the error signal and transmits it to the second host and the third host.

Images