Fault processing system and method, storage medium and electronic device

Abstract

The embodiment of the invention provides a fault processing system and method, a storage medium and an electronic device. The system comprises a fault management unit which is connected with a security domain system and is used for carrying out first fault processing on a fault of the security domain system when the security domain system has the fault and carrying out second fault processing on the fault of the security domain system when the accumulated execution frequency of the first fault processing exceeds a preset threshold value and the fault is not successfully processed. Fault information of the fault which is not successfully processed is sent to a central fault management unit; and the central fault management unit is respectively connected with the fault management unit and the system reset management unit and is used for carrying out second fault processing on the fault according to the fault information. According to the system, the problem that faults cannot be detected and processed in time is solved, and the system achieves the effect of detecting and processing the faults in time.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of automotive electronic functional safety, and in particular, to a fault handling system and method, a storage medium, and an electronic device. Background Art

[0002] In order to meet the increasingly complex application scenarios, the design of on-board chips in the current automotive E / E (Electrical / Electronic Architecture) system tends to be large-scale integrated, which brings great challenges to the design of functional safety architecture in on-board chips. At present, the commonly used fault management method in on-board chips is a centralized fault management architecture. The fault management signals of all subsystems in the chip need to be centrally processed by the system, which brings great difficulties to the hardware architecture design and physical implementation of the chip, and also brings a large processing load to the chip's running software, which makes it impossible to detect and handle faults in a timely manner.

[0003] With regard to the problem in the related technologies that faults cannot be detected and processed in a timely manner, no effective solution has been proposed. Summary of the invention

[0004] The embodiments of the present application provide a fault handling system and method, and a storage medium electronic device, so as to at least solve the problem in the related art that faults cannot be detected and handled in a timely manner.

[0005] According to an embodiment of the embodiments of the present application, a fault handling system is provided, including: a fault management unit, connected to a security domain system, for performing a first fault handling on the fault occurring in the security domain system when a fault occurs in the security domain system, and sending fault information of the unhandled fault to a central fault management unit when the cumulative number of executions of the first fault handling exceeds a preset threshold and the fault is not handled successfully; the central fault management unit is respectively connected to the fault management unit and a system reset management unit, for performing a second fault handling on the fault according to the fault information.

[0006] In an exemplary embodiment, the fault management unit includes: multiple fault management sub-units, and the security domain system includes: multiple security domain subsystems; wherein the number of the multiple fault management sub-units is the same as the number of the multiple security domain subsystems, and the security domain subsystems are connected to the fault management sub-units in a one-to-one correspondence.

[0007] In an exemplary embodiment, the fault management unit is used to determine the level of fault information of the fault that has occurred and / or the type of the fault information when a fault occurs in the security domain system; and perform the first fault processing according to the level of the fault information and / or the type of the fault information.

[0008] In an exemplary embodiment, the fault management unit is used to determine that if the first fault handling is not successful, perform the first fault management on the fault again, obtain the cumulative number of executions of the first fault management and determine whether the cumulative number of executions exceeds the preset threshold.

[0009] In an exemplary embodiment, the central fault management unit is used to determine that the fault of the target security domain subsystem has not been successfully handled based on the fault information, and send a reset instruction to the system reset management unit; the system reset management unit is used to reset the target security domain subsystem according to the reset instruction, obtain the reset result of the target security domain subsystem, and send the reset result to the central fault management unit.

[0010] In an exemplary embodiment, the central fault management unit is used to control the fault processing system to power off when the reset result indicates that the target security domain subsystem is not reset successfully.

[0011] In an exemplary embodiment, the central fault management unit is used to determine the type of the fault information based on the fault information, and when it is determined that the type of the fault information is a shared safety mechanism fault type, perform the second fault processing on the fault according to the processing method corresponding to the shared safety mechanism fault type.

[0012] According to another embodiment of the embodiments of the present application, a fault handling method is also provided, including: in the event that a fault occurs in the security domain system, performing a first fault handling on the fault occurring in the security domain system by the fault handling unit; in the event that the cumulative number of executions of the first fault handling exceeds a preset threshold and the fault is not handled successfully, obtaining fault information of the unhandled fault by the central fault handling unit; and performing a second fault handling on the fault according to the fault information by the central fault handling unit.

[0013] According to another aspect of the embodiment of the present application, a computer-readable storage medium is further provided, the computer-readable storage medium comprising a stored program, wherein the fault handling method described in the above claims is executed when the program is run.

[0014] According to another aspect of the embodiments of the present application, there is further provided an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned fault handling method through the computer program.

[0015] In the embodiment of the present application, the fault management unit performs a first fault processing on the fault occurring in the security domain system, and when the cumulative number of executions of the first fault processing exceeds a preset threshold and the fault is not processed successfully, the fault information of the unprocessed fault is sent to the central fault management unit; when the central fault management unit receives the fault information of the unprocessed fault, the central fault management unit performs a second fault processing on the fault according to the fault information. To solve the problem that the prior art cannot detect and process faults in a timely manner, the embodiment of the present application achieves timely detection and processing of faults by setting a fault management unit and a central fault management unit. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0017] Figure 1 is a structural diagram of a fault handling system according to an embodiment of the present application;

[0018] Figure 2 is a schematic diagram of a fault handling system according to an optional embodiment of the present application;

[0019] Figure 3 is a structural diagram of a fault management unit according to an embodiment of the present application;

[0020] Figure 4 is a schematic diagram of a hardware environment of a chip according to a fault handling method of an embodiment of the present application;

[0021] Figure 5 is a flowchart of a fault handling method according to an embodiment of the present application;

[0022] Figure 6 is a flowchart of a fault handling method according to an optional embodiment of the present application;

[0023] Figure 7 is a schematic diagram of a fault handling device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] Automotive functions are particularly important for the safety of electrical / electronic architecture (E / E) systems related to safety in the automotive field. In the development of automotive E / E systems, including software and controller hardware, automotive development engineers inevitably make human negligence or errors, which cause system function failures, and then lead to failures and hazards. This part of the failure caused by human negligence is a systematic failure; the controller hardware fails due to its own aging, external environmental factors, etc., resulting in corresponding failures and hazards; hardware failures are random and conform to a certain probability distribution, so they are called random hardware failures.

[0027] In order to avoid the above two failures in the automotive E / E system, the concept of functional safety is derived. At present, automotive functional safety design generally follows the ISO26262 standard, which is derived from the IEC61508 standard and is mainly positioned in the automotive industry's specific electrical devices, electronic devices, programmable electronic devices, integrated circuit chips and other components specifically used in the automotive field, aiming to improve the international standards for the functional safety of automotive electronic and electrical products.

[0028] ISO 26262 is based on the V model. The automotive functional safety development activities begin at the concept stage, which mainly includes the definition of related items, hazard analysis and risk assessment, and functional safety solution development; the required automotive safety integrity level (ASIL) is divided for the system or system components according to the hazard risk assessment, so that the functional safety of the system product meets the automotive safety requirements. ASIL is usually divided into four levels, namely A, B, C, and D, where D is the highest safety level and A is the lowest safety level. Then similar hazard events are combined and classified, and then safety goals are derived; if the derived safety goals are similar, they can be merged to inherit the highest ASIL level. The safety requirements of the automotive E / E system determine the ASIL level. The higher the ASIL level, the greater the corresponding safety measures implementation cost (such as R&D cost, R&D cycle, R&D technical requirements), and the higher its diagnostic coverage. In the ISO26262 standard, achieving the ASIL-D level requires the single-point fault metric index and the multi-point fault metric index to be greater than or equal to 99% and 90% respectively. Therefore, it is very complex and difficult to implement functional safety in automotive E / E systems.

[0029] In order to meet the requirements of functional safety, the on-board chips in the automotive E / E system will be designed with corresponding software and hardware safety mechanisms to prevent systematic failures or random hardware failures. Safety mechanisms are very important technical means to ensure the functional safety of on-board chip systems, such as hardware redundancy, memory signatures, error detection and correction codes (ECC), parity checks (Parity), cyclic redundancy checks (CRC), clock monitoring, voltage monitoring, and safe state import. The safety mechanism needs to detect the fault in time when the system fails and report it to the system, so that the system can perform corresponding fault processing responses according to the fault type and the degree of fault hazard, thereby avoiding the occurrence of latent faults or the harmful effects directly caused by the fault.

[0030] In the related technology, in order to meet the increasingly complex application scenarios, the design of on-board chips in the current automotive E / E (Electrical / Electronic Architecture) system tends to be large-scale integrated, which brings great challenges to the design of functional safety architecture in on-board chips. At present, the commonly used fault management method in on-board chips is a centralized fault management architecture. The fault management signals of all subsystems in the chip need to be centrally processed by the system, which brings great difficulties to the hardware architecture design and physical implementation of the chip, and also brings a large processing load to the chip's operating software, which makes it impossible to detect and handle faults in a timely manner. To this end, the present application provides a fault handling system and method, a storage medium, and an electronic device.

[0031] This embodiment provides a fault handling system, which can be applied to chips, such as vehicle-mounted chips, including but not limited to vehicle-mounted central gateway chips, vehicle-mounted smart cockpit chips, etc. Figure 1 As shown, the system includes: a fault management unit 120 and a central fault management unit 140, wherein:

[0032] The fault management unit 120 is connected to the security domain system 160 and is used to perform a first fault processing on the fault occurring in the security domain system 160 when a fault occurs in the security domain system 160, and send fault information of the unsuccessfully processed fault to the central fault management unit 140 when the cumulative number of executions of the first fault processing exceeds a preset threshold and the fault is not successfully processed;

[0033] The central fault management unit 140 is connected to the fault management unit 120 and the system reset management unit 180 respectively, and is used to perform a second fault processing on the fault according to the fault information.

[0034] According to the fault handling system of the embodiment of the present application, the fault management unit performs the first fault handling on the fault occurring in the security domain system, and when the cumulative number of executions of the first fault handling exceeds the preset threshold and the fault is not handled successfully, the fault information of the unhandled fault is sent to the central fault management unit, and when the central fault management unit receives the fault information of the unhandled fault, the second fault handling is performed on the fault information. The system achieves the effect of timely detection and handling of faults by setting up the fault management unit and the central fault management unit.

[0035] In order to avoid the load of fault management unit detection caused by centralized fault management, such as Figure 2 As shown, in an embodiment of the present application, the fault management unit 120 includes: a plurality of fault management subunits, and the security domain system 160 includes: a plurality of security domain subsystems; wherein, the number of the plurality of fault management subunits is the same as the number of the plurality of security domain subsystems, and the security domain subsystems are connected to the fault management subunits in a one-to-one correspondence. Furthermore, through the one-to-one connection between the security domain subsystem and the fault management subunit, it is realized to configure an independent fault management subunit for each security domain subsystem, so as to perform fault detection and fault processing on each security domain subsystem in real time. And based on the configuration of an independent fault management subunit for each security domain subsystem, it is possible to accurately locate and respond to the faults occurring in each security domain subsystem within the chip, avoiding the hardware architecture design and physical implementation of the chip due to the centralized management of the faults of all security domain subsystems in the chip, which brings great difficulties, and at the same time causes a large processing load on the running software of the chip, which is not conducive to the design and implementation of functional safety chips with high efficiency, high coverage, and timely fault processing response.

[0036] Among them, the security domain system 160 is used for processing and controlling functional data. For example, N security domain subsystems with different functions are designed inside the chip according to different application function requirements. For example, the N security domain subsystems with different functions include the security domain subsystem of the low-latency CAN / LIN communication engine, the security domain subsystem of the network switching hardware engine, the security domain subsystem of the functional safety peripheral interface, the security domain subsystem of the on-chip storage controller, the security domain subsystem of the Peripheral Component Interconnect Express (PCIE), the security domain subsystem of the double data rate (DDR), etc.

[0037] In an embodiment of the present application, the fault management unit 120 is used to determine the level of fault information and / or the type of fault information of the fault that has occurred when a fault occurs in the security domain system; and perform a first fault processing according to the level of the fault information and / or the type of the fault information.

[0038] Among them, the level of fault information can be determined based on a preset database, wherein the preset database includes data information and the level corresponding to the data information. For example, when it is determined that a fault occurs in the security domain system, the security domain subsystem in the security domain system where the fault occurs can be determined, and then the data information corresponding to the security domain subsystem where the fault occurs can be determined, so that the level corresponding to the data information of the fault can be obtained from the preset database; the level of fault information can also be determined based on the scope of fault impact. For example, when the fault affects fewer users, the level of fault information is determined to be a low level, and when the fault affects more users, the level of fault information is determined to be a high level; the level of fault information can also be determined based on the display value of the fault information. For example, when the display value is 1, the level of fault information is determined to be a high level.

[0039] The type of fault information can be determined based on the attribute information of the fault information; the type of fault information can also be determined based on the fault manifestation of the fault information; and the type of fault information can also be determined based on the fault signal reported by the security domain system. For example, when the type of fault information is determined based on the attribute information of the fault information or the fault manifestation of the fault information, the type of fault information includes but is not limited to mechanical fault, electrical fault, brake fault, steering fault, tire fault, etc. For another example, when the type of fault information is determined based on the fault signal reported by the security domain system, the type of fault information includes a shared safety mechanism fault type and a non-shared safety mechanism fault type. The shared safety mechanism fault can be understood as a fault in data communication between security domain subsystems in the security domain system; the non-shared safety mechanism fault type can be understood as a fault in the safety mechanism of each security domain subsystem in the security domain subsystem.

[0040] Among them, the faults with high-level fault information can be processed first, and after the high-level faults are processed, the faults with low-level fault information can be processed. For example, the faults of safety performance can be regarded as high-level faults, and the faults of non-safety performance can be regarded as low-level faults. It should be noted that when processing the faults of low-level fault information, when the faults of high-level fault information are detected, the faults of high-level fault information are processed first.

[0041] In the embodiment of the present application, the first fault processing includes but is not limited to resetting, restarting the power supply or shutting down the power supply, replacing a light bulb, etc. Among them, the first fault processing method for a fault with a high-level fault information is resetting, and the first fault processing method for a fault with a low-level fault information is not resetting, that is, by determining the type of the low-level fault information, for example, when the type of the fault information is determined to be a tire fault, the sensor is used to determine that the tire pressure of the tire is insufficient, and then the tire is inflated.

[0042] In an embodiment of the present application, the fault management unit 120 is used to perform the first fault management on the fault again if it is determined that the first fault processing has not been successfully processed, and obtain the cumulative number of executions of the first fault management and determine whether the cumulative number of executions exceeds a preset threshold.

[0043] That is, when the fault management unit 120 performs the first fault processing on the occurred fault, it can determine whether the first fault processing is successful. When it is determined that the first fault processing is not successful, the first fault processing can be performed again on the fault.

[0044] Among them, it can be determined whether the first fault handling is successful based on running the test within a preset time. For example, after the first fault handling is performed on the occurred fault, the security domain subsystem corresponding to the fault can be restarted, and the security domain subsystem can be detected whether the last fault that occurred occurs within the preset time. If the last fault occurs, it is determined that the first fault handling is not successful. If the last fault does not occur, it is determined that the first fault handling is successful. It can also be determined whether the first fault handling is successful based on the restart function. For example, if it is determined that the fault type of the fault that has occurred is the headlights, the headlights can be restarted. After restarting, if the headlights are normal, it is determined that the first fault handling is successful. If the headlights are abnormal, it is determined that the first fault handling is not successful.

[0045] In order to make it easier for those skilled in the art to understand the detection of the security domain system by the fault management unit in the present application, that is, the real-time detection of the security domain subsystem by the fault management subunit, the optional embodiments of the present application are explained in the following way.

[0046] For example, take a fault management subunit detecting the corresponding security domain subsystem as an example. Figure 3 As shown, the fault management subunit includes an online hardware self-test module 302, a communication interface module 304, a fault injection module 306, a fault recording module 308, a fault collection and control module 310, a fault processing interface module 312, a fault processing monitoring module 314, and a security domain subsystem 316. Among them, the online self-test module 302 is connected to the corresponding security domain subsystem 316, and is responsible for the logic built-in self-test (LBIST) and storage built-in self-test (MBIST) of the security domain subsystem 316; the communication interface module 304 is connected to the fault management communication bus 1110, and is responsible for the transmission of configuration information and fault information of the fault management subunit; the fault injection module 306 is connected to the corresponding security domain subsystem 316, and is responsible for the fault injection test of the internal memory security mechanism, hardware redundant security mechanism, and custom security mechanism of the corresponding security domain subsystem 316; the fault recording module 308 is connected to the corresponding security domain subsystem 316, and is responsible for the fault information recording of the internal memory security mechanism, hardware redundant security mechanism, and custom security mechanism of the corresponding security domain subsystem 316; the fault collection and control module 310 The fault handling interface module 312 is connected to the corresponding security domain subsystem 316, the fault handling interface module 312, and the fault handling monitoring module 314, and is responsible for collecting all faults in the corresponding security domain subsystem 316 and performing system management according to the fault type; the fault handling interface module 312 is connected to the corresponding security domain subsystem 316, the fault collection and control module 310, and the fault handling monitoring module 314, and is responsible for receiving the fault handling signal of the fault collection and control module 310, and then outputting it to the corresponding security domain subsystem 316 and the fault handling monitoring module 314; the fault handling monitoring module 314 is connected to the corresponding security domain subsystem 316, the fault collection and control module 310, and the fault handling interface module 312, and as a safety mechanism of the fault collection and control module 310, monitors the fault handling of the fault collection and control module 310. Thus, the fault management subunit can detect, record, and handle the faults in the connected security domain subsystem in real time.

[0047] Among them, since the security domain subsystem 316 has two parts, the logic part and the storage part, each security domain subsystem 316 corresponds to a security mechanism, so the online hardware self-test module 302 detects the potential faults of the security mechanism. After the security domain subsystem 316 is powered on, the chip hardware is detected based on the online hardware self-test module 302 to detect whether there is a fault, wherein the logic of the chip is tested, that is, a test vector is automatically generated, the test vector is output, and the output is compared with the expected output; the storage of the chip is tested, that is, the embedded memory in the chip is self-tested, because the embedded memory in the chip is deeply buried in the logic of the chip, and there is no way to directly test it by adding external stimulation. A part of the circuit must be designed in the chip to automatically self-test the embedded memory.

[0048] Among them, the fault injection module 306 is a fault injection test for the internal security mechanism of the security domain subsystem 316. The security mechanism is to detect certain faults, and the security mechanism itself may also have problems, so the fault injection module 306 is to detect the security mechanism. For example, the detection of the fault of the internal memory security mechanism of the security domain subsystem 316 can be achieved in the following way: obtain a one-bit signal and a multi-bit signal in the internal memory of the security domain subsystem 316, and simulate the two-bit error based on the one-bit signal and the multi-bit signal to determine whether the internal memory security mechanism of the security domain subsystem 316 reports the two-bit error. If it is reported, it means that the internal memory security mechanism of the security domain subsystem 316 itself is normal, that is, the internal memory security mechanism of the security domain subsystem 316 has no fault. If it is not reported, it means that the internal memory security mechanism of the security domain subsystem 316 itself has a problem, that is, the internal memory security mechanism of the security domain subsystem 316 has a fault.

[0049] In an embodiment of the present application, the central fault management unit 140 is used to determine that the fault of the target security domain subsystem has not been successfully handled based on the fault information, and send a reset instruction to the system reset management unit 180; the system reset management unit 280 is used to reset the target security domain subsystem according to the reset instruction, obtain the reset result of the target security domain subsystem, and send the reset result to the central fault management unit.

[0050] Among them, reset can be understood as restoring factory settings.

[0051] The central fault management unit 140 is used to control the fault handling system to power off when the reset result indicates that the target security domain subsystem is not successfully reset. For example, after the fault system is powered off, the fault can be reported for repair based on the type of fault.

[0052] Among them, when the reset result indicates that the target security domain subsystem is reset successfully, fault detection is performed on the security domain system in real time.

[0053] The central fault management unit 140 is used to determine the type of fault information according to the fault information, and when it is determined that the type of fault information is a shared security mechanism fault type, perform a second fault processing on the fault according to the processing method corresponding to the shared security mechanism fault type. That is to say, when a fault occurs in the security domain system, the type of fault that has occurred can be determined. When it is determined that the fault type is a shared security mechanism fault type, it indicates that the fault management unit does not have the authority to process the fault of the shared security mechanism fault type, and therefore a higher-level central fault management unit is required to perform fault processing. For example, when it is determined that the shared storage between the first security domain subsystem and the second security domain subsystem fails, the central fault management unit can accurately determine that the failed shared storage is set in the first security domain subsystem, and therefore the storage path can be replaced, that is, the data of the shared storage is stored in the second security domain subsystem.

[0054] In order to make the fault handling system more perfect, such as Figure 2 As shown, the fault handling system also includes a fault management communication bus 1110, an application domain processor system 1112, a system storage unit 1114, a system bus 1116, and a security domain processor system 1118, wherein: the application domain processor system 1112 is connected to the system bus 1116, the system storage unit 1114 is connected to the system bus 1116, the security domain system 160 is connected to the system bus 1116 and the fault management unit 120, the fault management unit 120 is connected to the security domain system 160 and the fault management communication bus 1110, the security domain processor system 1118 is connected to the fault management communication bus 1110, the central fault management unit 140 is connected to the fault management communication bus 1110 and the system reset management unit 180, and the system reset management unit 180 is connected to the central fault management unit 140.

[0055] Among them, the application domain processor system 1112 is responsible for non-functional safety data processing and control, and can be implemented using a high-performance CPU system. For example, high-performance CPU models include ARM Cortex-A53, ARM Cortex-A57, ARMCortex-A72, etc.

[0056] The system storage unit 1114 is responsible for providing a cache for system data, which is implemented using an on-chip SRAM (Static Random-Access Memory, SRAM) memory.

[0057] Among them, the system bus 1116 is responsible for providing a data transmission path between the application domain processor system 1112, the system storage unit 1114 and the security domain system 160, and can be implemented using a high-performance NIC and NOC bus topology. For example, the high-performance NIC bus is ARM CoreLink NIC-400, and the high-performance NOC bus is Arteris FlexNoC. The communication protocol can adopt a high-performance bus protocol, such as AXI, AHB, etc.

[0058] Among them, the fault management communication bus 1110 is responsible for providing fault management configuration information and data transmission paths between the security domain processor system 1118, the fault management unit 120 and the central fault management unit 140. It can be implemented using high-performance NIC and NOC bus topology structures. For example, the high-performance NIC bus is ARM CoreLink NIC-400, and the high-performance NOC bus is Arteris FlexNoC, etc. The communication protocol can adopt AXI-lite, AHB-lite, APB, etc.

[0059] Among them, the security domain processor system 1118 is responsible for functional safety data processing and control, and is implemented using a CPU system that can provide real-time functional safety performance. For example, full-performance CPU models include ARM Cortex-M0, ARM Cortex-M7, ARM Cortex-R5, ARM Cortex-R52, etc.

[0060] According to the fault handling system of the embodiment of the present application, the functional safety architecture composed of a distributed fault management unit, a central fault management unit, a safety domain system, a system reset management unit, a fault management communication bus, an application domain processor system, a system storage unit, a system bus, and a safety domain processor system is used to perform hierarchical and graded processing of internal faults of the vehicle chip, thereby reducing the transmission path of the fault signal in the chip, reducing the complexity of the chip hardware architecture design and physical implementation, and thus improving the speed and energy efficiency of the chip. And based on equipping each safety domain subsystem with an independent fault management unit, it is possible to perform fault detection in real time and perform fault processing and fault information reporting according to the level of the fault information of the fault that has occurred, thereby ensuring accurate positioning and response to the faults occurring in each safety domain subsystem inside the chip, effectively reducing the load of centralized fault detection, and being able to efficiently and timely detect and process faults, and adopting reasonable fault processing measures for the detected faults, and improving the availability of the chip system when a fault occurs, thereby improving the safety of the system.

[0061] According to one aspect of an embodiment of the present application, a fault handling method is provided. The fault handling method can be executed in a chip. For example, the method runs on a chip. Figure 4FIG. 1 is a hardware structure block diagram of a chip of a fault handling method according to an embodiment of the present invention. Figure 4 As shown, the chip may include one or more ( Figure 4 Only one is shown in the figure) processor 402 (processor 402 may include but is not limited to a microprocessor (Microprocessor Unit, referred to as MPU) or a programmable logic device (Programmable logic device, referred to as PLD)) and a memory 404 for storing data. In an exemplary embodiment, the above chip may also include a transmission device 406 and an input and output device 408 for communication functions. It can be understood by those skilled in the art that Figure 4 The structure shown is only for illustration and does not limit the structure of the above chip. Figure 4 More or fewer components as shown, or with Figure 4 Equivalent functions or comparisons shown Figure 4 A different configuration with more features is shown.

[0062] The memory 404 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the fault handling system in the embodiment of the present invention. The processor 402 executes various functional applications and data processing by running the computer program stored in the memory 404, that is, to implement the above method. The memory 404 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 404 may further include a memory remotely arranged relative to the processor 402, and these remote memories can be connected to the chip via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0063] The transmission device 406 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the switching device. In one example, the transmission device 406 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 406 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0064] Figure 5 is a flowchart of a fault handling method according to an embodiment of the present application, which is applied to the above-mentioned chip, such as Figure 5 As shown, the troubleshooting methods include:

[0065] Step 520: When a fault occurs in the security domain system, a fault processing unit performs a first fault processing on the fault occurring in the security domain system.

[0066] Among them, the fault management unit includes: multiple fault management sub-units, and the security domain system includes: multiple security domain subsystems; wherein the number of the multiple fault management sub-units is the same as the number of the multiple security domain subsystems, and the security domain subsystems are connected to the fault management sub-units in a one-to-one correspondence.

[0067] In an embodiment of the present application, multiple fault management subunits can detect the corresponding multiple security domain subsystems in real time. When a security domain subsystem fails, the fault management subunit can perform a first fault processing on the fault occurring in the security domain subsystem.

[0068] Wherein, when a fault occurs in the security domain subsystem, the level of fault information and / or the type of fault information of the fault is determined, and then the first fault processing is performed according to the level of the fault information and / or the type of the fault information.

[0069] Step 540 , when the cumulative number of executions of the first fault processing exceeds a preset threshold and the fault is not processed successfully, the fault information of the fault that is not processed successfully is obtained through the central fault processing unit.

[0070] In an embodiment of the present application, when the first fault processing is performed according to the level of fault information and / or the type of fault information, it can be determined whether the first fault processing is successful. When it is determined that the first fault processing is not successful, the first fault processing is performed again on the fault, and the cumulative number of executions of the first fault processing is obtained and it is determined whether the cumulative number of executions exceeds a preset threshold. When the cumulative number of executions of the first fault processing exceeds the preset threshold and the fault is not processed successfully, the unprocessed fault is sent to the central fault processing unit so that the central fault processing unit obtains the unprocessed fault information.

[0071] In one embodiment of the present application, when it is determined that the type of fault information is a shared safety mechanism fault type, the shared safety mechanism fault type is sent to the central fault management unit so that the central fault management unit performs a second fault processing on the fault according to the processing method corresponding to the shared safety mechanism fault type.

[0072] Step 560: Perform a second fault processing on the fault according to the fault information by the central fault processing unit.

[0073] In an embodiment of the present application, when the central fault processing unit obtains unprocessed fault information, it determines the target security domain subsystem corresponding to the unprocessed fault information, and based on the connection between the central fault management unit and the system reset management unit, sends a reset instruction to the system reset management unit, so that the system reset management unit resets the target security domain subsystem according to the reset instruction, obtains the reset result of the target security domain subsystem, and sends the reset result to the central fault management unit.

[0074] Among them, the central fault management unit receives the reset result, and when the reset result indicates that the target security domain subsystem is not reset successfully, the fault processing system is controlled to be powered off.

[0075] In one embodiment of the present application, the type of the fault information is determined, and when it is determined that the type of the fault information is a shared safety mechanism fault type, the second fault processing is performed on the fault according to the processing method corresponding to the shared safety mechanism fault type.

[0076] In a specific embodiment of the present application, for example, taking the application scenario of the fault handling method as an on-board central gateway chip as an example, Figure 6 As shown:

[0077] Step 1: During chip operation, real-time fault detection is performed on the security mechanism within each security domain subsystem;

[0078] Step 2: The safety mechanism inside the safety domain subsystem detects that a fault has occurred in the safety domain subsystem, and the fault management subunit corresponding to the safety domain subsystem identifies the fault type;

[0079] Step 3: The fault management subunit corresponding to the security domain subsystem performs the first fault processing;

[0080] Step 4 determines whether the first fault processing is successful, and if successful, proceeds to step 1; if unsuccessful, proceeds to step 5;

[0081] Step 5: The fault management subunit corresponding to the security domain subsystem performs a fault processing retry, obtains the number of fault processing retries, and determines whether the number of retries exceeds the preset number of retries. If the number of retries exceeds the preset number of retries, the process proceeds to step 4. If the number of retries does not exceed the preset number of retries, the process proceeds to step 6.

[0082] Step 6: The fault management subunit corresponding to the security domain subsystem reports the unsuccessfully processed fault information to the central fault management unit, so that the central fault management unit performs a second fault processing on the unsuccessfully processed fault;

[0083] Step 7: Determine whether the second fault processing is successful. If it is determined that the second fault processing is successful, proceed to step 1. If it is determined that the second fault processing is not successful, otherwise proceed to step 8.

[0084] Step 8: The control system enters a safe state.

[0085] According to the fault handling method of the embodiment of the present application, the fault management unit performs a first fault handling on the fault occurring in the security domain system, and when the cumulative number of executions of the first fault handling exceeds a preset threshold and the fault is not handled successfully, the fault information of the unhandled fault is sent to the central fault management unit, and when the central fault management unit receives the fault information of the unhandled fault, the second fault handling is performed on the fault information. The system achieves the effect of timely detection and handling of faults by setting up the fault management unit and the central fault management unit.

[0086] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0087] Figure 7 is a structural block diagram of a fault handling device according to an embodiment of the present application; Figure 7 As shown, including:

[0088] A first processing module 720 is used for performing a first fault processing on the fault occurring in the security domain system through the fault processing unit when a fault occurs in the security domain system;

[0089] An acquisition module 740 is configured to acquire, through the central fault processing unit, fault information of the unsuccessfully processed fault when the cumulative number of executions of the first fault processing exceeds a preset threshold and the fault is not successfully processed;

[0090] The second processing module 60 is used to perform a second fault processing on the fault according to the fault information through the central fault processing unit.

[0091] Through the above device, based on the first processing module, in the case of a fault in the security domain system, the fault processing unit performs a first fault processing on the fault in the security domain system, based on the acquisition module, in the case of the cumulative execution times of the first fault processing exceeding the preset threshold and the fault is not successfully processed, the central fault processing unit obtains the fault information of the unsuccessful processing fault, and based on the second processing module, the central fault processing unit performs a second fault processing on the fault according to the fault information. By setting up the fault management unit and the central fault management unit, the system effectively reduces the load of centralized fault detection and processing, and realizes the detection and processing of faults efficiently and timely.

[0092] In an exemplary embodiment, the fault management unit includes: multiple fault management sub-units, and the security domain system includes: multiple security domain subsystems; wherein the number of the multiple fault management sub-units is the same as the number of the multiple security domain subsystems, and the security domain subsystems are connected to the fault management sub-units in a one-to-one correspondence.

[0093] In an exemplary embodiment, the first processing module 720 is used to determine the level of fault information and / or the type of fault information that has occurred when a fault occurs in the security domain system; and perform the first fault processing according to the level of the fault information and / or the type of the fault information.

[0094] In an exemplary embodiment, the acquisition module 740 is used to determine that if the first fault handling is not successful, perform the first fault management on the fault again, obtain the cumulative number of executions of the first fault management and determine whether the cumulative number of executions exceeds the preset threshold.

[0095] In an exemplary embodiment, the second processing module 760 is used to determine that the fault of the target security domain subsystem has not been successfully handled based on the fault information, and send a reset instruction to the system reset management unit; the system reset management unit is used to reset the target security domain subsystem according to the reset instruction, obtain the reset result of the target security domain subsystem, and send the reset result to the central fault management unit.

[0096] In an exemplary embodiment, the second processing module 760 is used to control the fault processing system to power off when the reset result indicates that the target security domain subsystem is not reset successfully.

[0097] In an exemplary embodiment, the second processing module 760 is used to determine the type of the fault information according to the fault information, and when it is determined that the type of the fault information is a shared safety mechanism fault type, perform the second fault processing on the fault according to the processing method corresponding to the shared safety mechanism fault type. An embodiment of the present application also provides a storage medium, the storage medium includes a stored program, wherein the program executes any of the above methods when it is run.

[0098] Optionally, in this embodiment, the storage medium may be configured to store program codes for executing the following steps:

[0099] S1, when a fault occurs in the security domain system, performing a first fault processing on the fault occurring in the security domain system by the fault processing unit;

[0100] S2, when the cumulative number of executions of the first fault processing exceeds a preset threshold and the fault is not successfully processed, obtaining fault information of the fault that is not successfully processed through the central fault processing unit;

[0101] S3, performing a second fault processing on the fault according to the fault information by the central fault processing unit.

[0102] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0103] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0104] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0105] S1, when a fault occurs in the security domain system, performing a first fault processing on the fault occurring in the security domain system by the fault processing unit;

[0106] S2, when the cumulative number of executions of the first fault processing exceeds a preset threshold and the fault is not successfully processed, obtaining fault information of the fault that is not successfully processed through the central fault processing unit;

[0107] S3, performing a second fault processing on the fault according to the fault information by the central fault processing unit.

[0108] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.

[0109] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0110] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0111] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A fault handling system, characterized in that: include: a fault management unit connected to the security domain system, and configured to, in the event that a fault occurs in the security domain system, perform a first fault processing on the fault occurring in the security domain system, and, in the event that the cumulative number of executions of the first fault processing exceeds a preset threshold and the fault is not successfully processed, send fault information of the unsuccessfully processed fault to the central fault management unit; The central fault management unit is connected to the fault management unit and the system reset management unit respectively, and is used to perform a second fault processing on the fault according to the fault information.

2. The fault handling system according to claim 1, characterized in that: The fault management unit includes: a plurality of fault management sub-units, and the security domain system includes: a plurality of security domain sub-systems; wherein, The number of the multiple fault management subunits is the same as the number of the multiple security domain subsystems, and the security domain subsystems are connected to the fault management subunits in a one-to-one correspondence.

3. The fault handling system according to claim 1, characterized in that: The fault management unit is used to determine the level of fault information of the fault that has occurred and / or the type of the fault information when a fault occurs in the security domain system; The first fault processing is performed according to the level of the fault information and / or the type of the fault information.

4. The fault handling system according to claim 1, characterized in that: The fault management unit is used to perform the first fault management on the fault again if it is determined that the first fault processing has not been successfully processed, and obtain the cumulative number of executions of the first fault management and determine whether the cumulative number of executions exceeds the preset threshold.

5. The fault handling system according to claim 2, characterized in that: The central fault management unit is used to determine, based on the fault information, that the fault of the target security domain subsystem has not been successfully handled, and send a reset instruction to the system reset management unit; The system reset management unit is used to reset the target security domain subsystem according to the reset instruction, obtain the reset result of the target security domain subsystem, and send the reset result to the central fault management unit.

6. The fault handling system according to claim 5, characterized in that: The central fault management unit is used to control the fault processing system to power off when the reset result indicates that the target security domain subsystem has not been reset successfully.

7. The fault handling system according to claim 1, characterized in that: The central fault management unit is used to determine the type of the fault information according to the fault information, and when it is determined that the type of the fault information is a shared safety mechanism fault type, perform the second fault processing on the fault according to the processing method corresponding to the shared safety mechanism fault type.

8. A fault handling method, characterized in that: The fault handling system according to any one of claims 1 to 7 comprises: In the event that a fault occurs in the security domain system, performing a first fault processing on the fault occurring in the security domain system by the fault processing unit; When the cumulative number of executions of the first fault processing exceeds a preset threshold and the fault is not successfully processed, obtaining fault information of the fault that is not successfully processed through the central fault processing unit; The central fault processing unit performs a second fault processing on the fault according to the fault information.

9. The fault handling method according to claim 8, characterized in that: The fault management unit includes: a plurality of fault management sub-units, and the security domain system includes: a plurality of security domain sub-systems; wherein, The number of the multiple fault management subunits is the same as the number of the multiple security domain subsystems, and the security domain subsystems are connected to the fault management subunits in a one-to-one correspondence.

10. The fault handling method according to claim 8, characterized in that: Performing a first fault processing on the fault occurring in the security domain system includes: In the event of a failure in the security domain system, determining a level of failure information of the failure and / or a type of the failure information; The first fault processing is performed according to the level of the fault information and / or the type of the fault information.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the fault handling method described in any one of claims 8 to 10 when running.

12. An electronic device comprising a memory and a processor, characterized in that: The memory stores a computer program, and the processor is configured to execute the fault handling method described in any one of claims 8 to 10 through the computer program.

Images