Security management system, method and device for chip faults and microcontroller

Abstract

The invention relates to the technical field of chip function safety, and discloses a safety management system, method and device for a chip fault and a microcontroller, and the system comprises an alarm module which is used for transmitting an alarm signal when the chip has a fault; the safety management module is connected with the alarm module and is used for receiving the alarm signal and processing the chip fault; and the CPU is connected with the safety management module and starts fault processing operation according to the interrupt signal output by the safety management module. The fault processing capability of the chip in the power-on stage can be improved, so that the fault response of the chip in the full work cycle is realized, and the chip safety problem caused by the fact that the fault is not processed in time is reduced.

Description

Technical Field

[0001] The present application relates to the field of chip functional safety technology, for example, to a safety management system, method, device and microcontroller for chip failures. Background Art

[0002] At present, in automotive systems, MCU (Micro controller unit) is the core of automotive electronic control systems and is responsible for controlling and managing various electronic components of vehicles. With the accelerated development of electrification, intelligence, and networking of automobiles, the application of safety MCUs is becoming more and more extensive, and the demand for functional safety is also increasing. Therefore, it is necessary to develop safety MCUs in accordance with functional safety requirements, which contain a large number of safety mechanisms to detect and monitor errors in key components. These mechanisms need to identify potential hardware or software failures, such as data errors, signal anomalies, etc.

[0003] In order to develop functional safety chips, the relevant technology discloses a response management system for chip fault processing, including: a fault response configuration module, a fault signal status bit module, a fault processing routing module, a fault preprocessing execution module, a fault preprocessing timer, a fault preprocessing response module, and a fault final processing module; wherein, the fault signal status bit module is used to latch the on-chip alarm signal during the chip power-on operation phase to the corresponding chip fault signal.

[0004] In the process of implementing the embodiments of the present disclosure, it is found that there are at least the following problems in the related art:

[0005] Although the related technology can respond to faults, it can only be enabled normally after the alarm signal is processed and the register configuration is completed. If an alarm signal is received during the power-on operation phase, the on-chip alarm signal of the chip power-on operation phase needs to be latched. As a result, faults during the power-on phase cannot be handled in a timely manner, and safe management of the chip's full working cycle cannot be achieved.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0007] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0008] The embodiments of the present disclosure provide a safety management system, method, device and microcontroller for chip failures to achieve failure response throughout the entire working cycle of the chip.

[0009] In some embodiments, the chip failure safety management system includes: an alarm module, used to send an alarm signal when a chip fails; a safety management module, connected to the alarm module, used to receive the alarm signal and process the chip failure; a CPU (Central Processing Unit), connected to the safety management module, and the CPU starts a fault handling operation based on the interrupt signal output by the safety management module.

[0010] Optionally, the safety management module includes: an alarm input management module, connected to the alarm module, for receiving an alarm signal of a chip failure; a status judgment module, connected to the alarm input management module, for judging whether the fault post-processing register is configured, and generating a post-processing trigger signal or an interrupt trigger signal; a fault post-processing register, connected to the status judgment module, for performing parameter configuration and sending the configuration parameters to the status judgment module; a post-processing execution module, connected to the status judgment module, for outputting a post-processing signal or an interrupt signal according to the configuration status of the fault post-processing register; and a watchdog, connected to the CPU, for timing to monitor the CPU's fault response time.

[0011] In some embodiments, the chip failure safety management method is applied to a safety management module, including: when an alarm signal of a chip failure is obtained, determining whether the fault post-processing register is configured; when the fault post-processing register is configured, the status judgment module generates a post-processing trigger signal and sends it to a post-processing execution module, and the post-processing execution module outputs a corresponding post-processing signal; when the fault post-processing register is not configured, the status judgment module generates an interrupt trigger signal and sends it to the post-processing execution module, and the post-processing execution module sends an interrupt signal to the CPU to start a fault processing operation according to the interrupt signal; when the CPU receives the interrupt signal, it starts the watchdog to start timing to monitor the CPU's fault response time.

[0012] Optionally, starting a fault processing operation according to an interrupt signal includes: acquiring configuration parameters of a fault post-processing register; and controlling a CPU to perform a reset operation according to the configuration parameters of the fault post-processing register.

[0013] Optionally, monitoring the fault response time of the CPU includes: when the fault response time of the CPU does not exceed the timeout threshold of the watchdog, turning off the watchdog; when the fault response time of the CPU exceeds the timeout threshold of the watchdog, the watchdog outputs a WDT ALM signal to the alarm input management module to perform post-processing operations with a high severity level.

[0014] Optionally, the watchdog outputs a WDT ALM signal to the alarm input management module to perform post-processing operations with a high severity level, including: when the alarm input management module receives the WDT ALM signal, the control state judgment module obtains the configuration of the fault post-processing register; when it is configured to perform a reset operation when the WDT ALM signal is received, the control post-processing execution module generates a reset signal to reset the chip; when it is configured to execute the factory instrument protocol FIP output when the WDT ALM signal is received, the fault status information is sent to the external system.

[0015] Optionally, when an alarm signal of a chip failure is obtained, determining whether a post-fault processing register has been configured, including: when an alarm signal of a chip failure is obtained, obtaining configuration parameters of the chip's post-fault processing register and an operating status of a state machine; wherein the operating status of the state machine is used to indicate whether the state machine is in a power-on mode; when the state machine is set to a power-on mode, determining whether the post-fault processing register has been configured based on the configuration parameters of the post-fault processing register.

[0016] Optionally, the chip failure safety management method further includes: classifying the alarm signal according to a preset grouping rule to obtain a classification result; wherein the classification result includes the fault type and / or severity.

[0017] In some embodiments, the safety management device for chip failure includes a processor and a memory storing program instructions, and the processor is configured to execute the safety management method for chip failure as described above when running the program instructions.

[0018] In some embodiments, the microcontroller includes: a microcontroller unit MCU body; and the safety management device for chip failure as described above, installed in the MCU body.

[0019] The chip failure safety management system, method, device and microcontroller provided by the embodiments of the present disclosure can achieve the following technical effects:

[0020] In the disclosed embodiment, a chip fault response is achieved by obtaining an alarm signal of a chip fault and starting a CPU fault handling operation. It is possible to identify and respond to faults during the chip power-on phase, ensuring the stability and safety of the system. Specifically, when an alarm signal is received, an interrupt signal is immediately sent to the CPU through the security management module to trigger the fault handling process. In this way, the fault handling capability of the chip during the power-on phase is improved, thereby achieving a fault response throughout the chip's full working cycle and reducing chip safety issues caused by failure to handle faults in a timely manner.

[0021] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0023] Figure 1 is a schematic diagram of a safety management system for chip failure according to an embodiment of the present disclosure;

[0024] Figure 2 is a schematic diagram of a method for safely managing chip failures provided by an embodiment of the present disclosure;

[0025] Figure 3 is a schematic diagram of another method for safely managing chip failures provided by an embodiment of the present disclosure;

[0026] Figure 4 is a schematic diagram of another method for safely managing chip failures provided by an embodiment of the present disclosure;

[0027] Figure 5 It is a schematic diagram of a safety management device for chip failure provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] In order to be able to understand the features and technical contents of the embodiments of the present disclosure in more detail, the implementation of the embodiments of the present disclosure is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present disclosure. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0029] The terms "first", "second", etc. in the technical solutions described in the embodiments of the present disclosure are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so as to describe the embodiments of the present disclosure described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0030] Unless otherwise stated, the term "plurality" means two or more.

[0031] In the embodiment of the present disclosure, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B indicates: A or B.

[0032] The term "and / or" is a description of the association relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or, A and B.

[0033] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0034] At present, with the development of electrification, intelligence and networking of automobiles, automobiles have gradually become important carriers for large-scale intelligent terminals, computing centers, and storage and consumption of renewable energy. In the automotive system, MCU, as the core of the automotive electronic control system, bears the heavy responsibility of controlling and managing various electronic components of the vehicle. If a fault occurs inside the chip, the safety mechanism will send an alarm signal, which needs to be sent to the safety management module for processing. The safety management module will parse and evaluate the alarm signal according to the pre-configured strategy to determine the severity and scope of the error. According to the processing results of the alarm signal, the safety management module will trigger the corresponding response operation. Therefore, as the most important part to ensure the safety of MCU functions, high requirements are also placed on the functions and performance of the safety management module.

[0035] At present, in the security management modules of several widely used MCU chips, the alarm signal in the chip is usually received before the post-processing register configuration is completed. The alarm signal needs to be recorded or triggered again after the configuration is completed to handle the fault, and the chip security management within the full working cycle cannot be achieved. The embodiment of the present disclosure needs to implement fault handling during the power-on operation phase of the chip, so as to achieve security management of the chip throughout the working cycle.

[0036] Figure 1 The present invention provides a safety management system for chip failures. Figure 1 As shown, the system may include a security management module 100 , an alarm module 200 and a CPU 300 .

[0037] The alarm module 200 is used to send an alarm signal when a chip fails. The security management module 100 is connected to the alarm module 200 and is used to receive the alarm signal and process the chip failure. The central processing unit CPU is connected to the security management module, and the CPU starts the fault processing operation according to the interrupt signal output by the security management module.

[0038] When the alarm module 200 fails, an alarm signal is sent to the security management module 100. The state judgment module 101 and the post-processing execution module 102 of the security management module 100 process the alarm signal and send an interrupt signal to the CPU 300 to start the fault processing operation according to the interrupt signal.

[0039] In the disclosed embodiment, a chip fault response is achieved by obtaining an alarm signal of a chip fault and starting a CPU fault handling operation. It is possible to identify and respond to faults during the chip power-on phase, ensuring the stability and safety of the system. Specifically, when an alarm signal is received, an interrupt signal is immediately sent to the CPU through the security management module to trigger the fault handling process. In this way, the fault handling capability of the chip during the power-on phase is improved, thereby achieving a fault response throughout the chip's full working cycle and reducing chip safety issues caused by failure to handle faults in a timely manner.

[0040] Alternatively, if Figure 1 As shown, the safety management module 100 includes an alarm input management module 101 , a state judgment module 102 , a fault post-processing register 103 , a post-processing execution module 104 and a watchdog 105 .

[0041] The alarm input management module 101 is connected to the alarm module 200 and is used to receive the alarm signal of the chip failure. The state judgment module 102 is connected to the alarm input management module 101 and is used to judge whether the fault post-processing register 103 is configured and generate a post-processing trigger signal or an interrupt trigger signal. The fault post-processing register 103 is connected to the state judgment module 102 and is used to configure parameters and send the configuration parameters to the state judgment module 102. The post-processing execution module 104 is connected to the state judgment module 102 and outputs a post-processing signal or an interrupt signal according to the configuration state of the fault post-processing register 103. The watchdog 105 is connected to the CPU 300 and is used to time and monitor the fault response time of the CPU 300.

[0042] In the disclosed embodiment, the security management module 100 receives the chip fault alarm signal from the alarm module 200 through the internal alarm input management module 101. The state judgment module 102 further analyzes these signals to determine whether the fault post-processing register 103 has completed the necessary parameter configuration, and generates a post-processing trigger signal or an interrupt trigger signal accordingly. The fault post-processing register 103 is responsible for storing and managing these parameter configurations and sending them to the state judgment module 102 for further processing. The post-processing execution module 104 outputs the corresponding post-processing signal or interrupt signal according to the configuration status of the fault post-processing register 103 to execute the predetermined fault handling procedure. In addition, the watchdog 105 monitors the fault response time of the CPU 300 to ensure that the system responds within the specified time to prevent the system from stagnating due to a fault.

[0043] This ensures that when a chip fails, the system can quickly and accurately determine and handle the fault, improving the stability and reliability of the system. Through modular design, the system can flexibly configure fault handling strategies, while ensuring the CPU response efficiency through the watchdog mechanism, thereby improving the overall security and robustness of the system.

[0044] Combination Figure 2 As shown, the embodiment of the present disclosure provides a safety management method for chip faults. After the chip is powered on, a fault occurs in the chip and an alarm signal is generated. The alarm input module receives the alarm information and sends it to the state judgment module to determine whether the fault post-processing register is configured. In the case where the fault post-processing register is configured, a processing trigger signal is generated and sent to the post-processing execution module, and the post-processing execution module outputs the corresponding post-processing signal. In the case where the fault post-processing register is not configured, an interrupt trigger signal is generated and sent to the post-processing execution module, and the post-processing execution module sends an interrupt signal to the CPU to start the fault processing operation according to the interrupt signal. At the same time, the watchdog is started for timing. It is determined whether the CPU performs fault processing and turns off the watchdog. If the CPU completes the fault processing and turns off the watchdog, the fault processing ends. If the CPU does not complete the fault processing and turns off the watchdog, the watchdog outputs a WDT ALM signal to perform a post-processing operation with a high severity level.

[0045] Combination Figure 3 As shown, the embodiment of the present disclosure provides another safety management method for chip failure, which is applied to a safety management module and includes:

[0046] S301, when the safety management module obtains an alarm signal of a chip failure, it determines whether the post-failure processing register is configured.

[0047] S302, when the fault post-processing register configuration is completed, the state judgment module generates a post-processing trigger signal and sends it to the post-processing execution module, and the post-processing execution module outputs a corresponding post-processing signal.

[0048] S303, when the fault post-processing register configuration is not completed, the state judgment module generates an interrupt trigger signal and sends it to the post-processing execution module, and the post-processing execution module sends an interrupt signal to the CPU to start the fault processing operation according to the interrupt signal.

[0049] S304, the CPU receives an interrupt signal and starts a watchdog to perform timing to monitor the fault response time of the CPU.

[0050] The safety management method for chip failures provided by the embodiment of the present disclosure is adopted to achieve rapid response and processing of chip failures, thereby improving the stability and reliability of the system. First, when the safety management module receives an alarm signal of a chip failure, the status judgment module checks whether the fault post-processing register has been configured. If the configuration is complete, the status judgment module will generate a post-processing trigger signal and send it to the post-processing execution module, which will then output a corresponding post-processing signal to quickly respond to the failure. If the configuration is not completed, the status judgment module will generate an interrupt trigger signal. After receiving the signal, the post-processing execution module will send an interrupt signal to the CPU, and the CPU will start the fault handling operation according to the interrupt signal. At the same time, after receiving the interrupt signal, the CPU will start the watchdog to time and monitor the CPU's fault response time to ensure the timeliness of fault handling.

[0051] First, through modular design, the fault handling process is clearer and more efficient, and chip faults can be quickly located and responded to. Secondly, through the collaborative work of the state judgment module and the post-processing execution module, the automation of fault handling is realized, human intervention is reduced, and the response speed and processing efficiency of the system are improved. Finally, the introduction of the watchdog adds a layer of protection mechanism. By monitoring the response time of the CPU, the timeliness of fault handling is ensured, and further damage to the system caused by response delays is prevented. The disclosed embodiment significantly improves the safety and reliability of the system through accurate fault detection and timely response mechanism.

[0052] Optionally, starting a fault processing operation according to an interrupt trigger signal includes: sending the interrupt trigger signal to a CPU; obtaining configuration parameters of a fault post-processing register; and controlling a reset operation according to the configuration parameters of the fault post-processing register.

[0053] In the disclosed embodiment, the CPU identifies the interrupt trigger signal and determines the operation to be performed based on the configuration parameters in the fault post-processing register, which may include a soft reset or a hard reset. The reset operation includes resetting the internal state machine, clearing the relevant registers, or reinitializing the hardware module. After the reset operation is completed, the system returns to a stable state and is ready to re-execute normal operations or perform further fault diagnosis.

[0054] In this way, the effect of rapid response and processing of internal chip faults is achieved, and the reliability and stability of the system are improved. During the power-on stage, the fault response can prevent the fault from spreading and avoid possible system crashes or performance degradation. In addition, through the reset operation, it can automatically restore to a safe state, reducing the need for human intervention and improving the level of automation.

[0055] Optionally, monitoring the fault response time of the CPU includes: when the fault response time of the CPU does not exceed the timeout threshold of the watchdog, turning off the watchdog; when the fault response time of the CPU exceeds the timeout threshold of the watchdog, the watchdog outputs a WDT ALM signal to the alarm input management module to perform post-processing operations with a high severity level.

[0056] In the disclosed embodiment, when the chip detects a fault, the CPU starts to perform fault handling operations, and the watchdog is started to start timing the CPU's fault response time. If the CPU completes the fault handling within the watchdog's timeout threshold, the timer stops timing. However, if the CPU fails to complete the fault handling within the timeout threshold, the watchdog will continue to run until the preset timeout threshold is reached, at which point the timer will output a WDT ALM signal to trigger a higher severity level post-processing operation, such as the system sending fault status information to an external module to ensure the safety of the system.

[0057] In this way, emergency measures can be taken when the CPU fails to respond to a fault in time to prevent the fault from spreading further, thus ensuring the reliability and safety of the system. By accurately controlling the fault response time, the system downtime caused by untimely fault handling is reduced, and the system availability and maintenance convenience are improved.

[0058] Optionally, the watchdog outputs a WDT ALM signal to the alarm input management module to perform post-processing operations with a high severity level, including: when the alarm input management module receives the WDT ALM signal, the control state judgment module obtains the configuration of the fault post-processing register; when it is configured to perform a reset operation when the WDT ALM signal is received, the control post-processing execution module generates a reset signal to reset the chip; when it is configured to execute the factory instrument protocol FIP output when the WDT ALM signal is received, the fault status information is sent to the external system.

[0059] In the disclosed embodiment, when the watchdog outputs the WDT ALM signal, it indicates that the CPU has failed to complete the fault processing within the specified time. After receiving the WDT ALM signal, the system immediately reads the configuration of the fault post-processing register to determine the next action. For example, a reset operation is performed to generate a reset signal to reset the chip to restore it to a stable state, thereby preventing the fault from spreading and protecting the system from further damage. Or a FIP output is performed to send fault status information to an external system, allowing the external system to understand the fault condition of the chip and take corresponding measures, such as fault diagnosis, system maintenance or performance optimization.

[0060] The WDT ALM signal can automatically execute high-severity post-processing operations when the CPU fails to respond to the fault in time, ensuring the stability and security of the system. In addition, the system can select the most appropriate response strategy based on the specific fault situation and system requirements.

[0061] Optionally, when an alarm signal of a chip failure is obtained, determining whether a post-fault processing register has been configured, including: when an alarm signal of a chip failure is obtained, obtaining configuration parameters of the chip's post-fault processing register and an operating status of a state machine; wherein the operating status of the state machine is used to indicate whether the state machine is in a power-on mode; when the state machine is set to a power-on mode, determining whether the post-fault processing register has been configured based on the configuration parameters of the post-fault processing register.

[0062] In the disclosed embodiment, first, after obtaining the alarm signal of the chip fault, the system will obtain the configuration parameters of the chip's fault post-processing register and the operating status of the state machine. The operating status of the state machine is used to indicate whether the state machine is in power-on mode. If the state machine is set to power-on mode, the system will determine whether the fault post-processing register is configured based on the configuration parameters of the fault post-processing register. This judgment is the premise of automated fault handling, ensuring that the system can automatically respond to faults according to preset parameters.

[0063] When the fault post-processing register configuration is completed, the state judgment module generates a post-processing trigger signal and sends it to the post-processing execution module, which outputs the corresponding post-processing signal. This can quickly start the predetermined fault handling program, reduce manual intervention, and improve response speed.

[0064] If the fault post-processing register configuration is not completed, the status judgment module generates an interrupt trigger signal and sends it to the post-processing execution module. The post-processing execution module sends an interrupt signal to the CPU to start the fault processing operation according to the interrupt signal. This allows the system to attract the attention of the CPU through interrupts when the configuration is incomplete, ensuring that the fault can be handled in a timely manner. After the CPU receives the interrupt signal, it starts the watchdog to time and monitor the CPU's fault response time. The existence of the watchdog timer can prevent the system from falling into an infinite waiting state when a fault occurs, thereby avoiding system crashes.

[0065] Through accurate fault detection and timely response mechanism, the safety and reliability of the system are significantly improved. Through the running state judgment of the state machine and the configuration check of the fault post-processing register, the system can flexibly configure the fault handling strategy, and at the same time, the response efficiency of the CPU is guaranteed through the watchdog mechanism, thereby improving the safety and robustness of the system as a whole.

[0066] Optionally, the chip failure safety management method further includes: classifying the alarm signal according to a preset grouping rule to obtain a classification result; wherein the classification result includes the fault type and / or severity.

[0067] Combination Figure 4 As shown, the embodiment of the present disclosure provides another safety management method for chip failure, including:

[0068] S401, when the safety management module obtains an alarm signal of a chip failure, the safety management module classifies the alarm signal according to a preset grouping rule to obtain a classification result; wherein the classification result includes the fault type and / or severity.

[0069] S402, the status judgment module judges whether the post-fault processing register is configured.

[0070] S403, when the fault post-processing register configuration is completed, the state judgment module generates a post-processing trigger signal and sends it to the post-processing execution module, and the post-processing execution module outputs a corresponding post-processing signal.

[0071] S404, when the fault post-processing register configuration is not completed, the state judgment module generates an interrupt trigger signal and sends it to the post-processing execution module, and the post-processing execution module sends an interrupt signal to the CPU to start the fault processing operation according to the interrupt signal.

[0072] S405, the CPU receives an interrupt signal and starts a watchdog to perform timing to monitor the fault response time of the CPU.

[0073] In the disclosed embodiment, the alarm signal is classified according to a preset grouping rule, which may include the type of fault (such as hardware fault, software fault, communication fault, etc.) and the severity (such as minor, moderate, severe). During the classification process, the characteristics of the alarm signal, such as error code, signal source, timestamp, etc., are analyzed to determine the specific type and severity of the fault. The classification result obtained will include detailed fault information, such as "module A hardware fault, severity is severe" or "communication link B, minor fault".

[0074] After the classification is completed, the corresponding post-processing operations are performed according to the classification results. For example, for a high-severity fault, the CPU interrupt may be triggered immediately, the watchdog may be started, and emergency reset or fault isolation operations may be prepared. For a minor fault, the system may record the fault information, perform log analysis, or simply notify the system administrator for follow-up inspection.

[0075] Classifying alarm signals enables more refined and personalized fault handling, quickly identifying serious faults and taking immediate action to reduce the impact of faults on system operation. Timely handling of serious faults helps prevent the spread of faults. In addition, by distinguishing the severity of faults, the system can prioritize faults that have a greater impact on system operation and reasonably allocate processing resources.

[0076] Combination Figure 5 As shown, the embodiment of the present disclosure provides a safety management device 50 for chip failure, including a processor 500 and a memory 501. Optionally, the device 50 may also include a communication interface 502 and a bus 503. Among them, the processor 500, the communication interface 502, and the memory 501 can communicate with each other through the bus 503. The communication interface 502 can be used for information transmission. The processor 500 can call the logic instructions in the memory 501 to execute the safety management method for chip failure of the above embodiment.

[0077] In addition, the logic instructions in the memory 501 described above can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0078] The memory 501 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor 500 executes functional applications and data processing by running the program instructions / modules stored in the memory 501, that is, implementing the safety management method for chip failure in the above embodiment.

[0079] The memory 501 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 501 may include a high-speed random access memory and may also include a non-volatile memory.

[0080] The disclosed embodiments provide a microcontroller, including: a microcontroller unit MCU body, and the above-mentioned safety management device for chip failure. The safety management device for chip failure is installed in the microcontroller unit MCU body. The installation relationship described here is not limited to placement inside the microcontroller unit MCU body, but also includes installation connections with other components of the microcontroller unit MCU, including but not limited to physical connections, electrical connections or signal transmission connections, etc. Those skilled in the art can understand that the safety management device for chip failure can be adapted to a feasible microcontroller unit MCU body, thereby realizing other feasible embodiments.

[0081] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiment of the present disclosure. The aforementioned storage medium may be a non-transient storage medium, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes.

[0082] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible changes. Unless explicitly required, separate components and functions are optional, and the order of operation may vary. The parts and features of some embodiments may be included in or replace the parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and the claims, unless the context clearly indicates, the singular forms of "a", "an" and "the" are intended to include plural forms as well. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of listings containing one or more associated ones. In addition, when used in the present application, the term "comprise" and its variants "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical elements in the process, method or device comprising the elements. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments may refer to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can refer to the description of the method part.

[0083] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods for each specific application to implement the described functions, but such implementations should not be considered to exceed the scope of the embodiments of the present disclosure. The technicians may clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0084] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units can be only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, each functional unit in the embodiment of the present disclosure may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit.

[0085] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A safety management system for chip failure, characterized in that: include: An alarm module is used to send an alarm signal when a chip fails; A safety management module, connected to the alarm module, for receiving alarm signals and processing chip failures; The central processing unit CPU is connected to the safety management module, and the CPU starts the fault processing operation according to the interrupt signal output by the safety management module.

2. The safety management system according to claim 1, characterized in that: The security management module includes: An alarm input management module, connected to the alarm module, for receiving an alarm signal of a chip failure; The status judgment module is connected to the alarm input management module, and is used to judge whether the fault post-processing register is configured and generate a post-processing trigger signal or an interrupt trigger signal; A post-fault processing register is connected to the status judgment module and is used to configure parameters and send the configuration parameters to the status judgment module; The post-processing execution module is connected to the state judgment module and outputs a post-processing signal or an interrupt signal according to the configuration state of the fault post-processing register; A watchdog is connected to the CPU and is used for timing to monitor the CPU's fault response time.

3. A method for safe management of chip failures, characterized in that: Applicable to security management module, including: In case of obtaining an alarm signal of a chip fault, determining whether the post-fault processing register is configured; When the fault post-processing register configuration is completed, the state judgment module generates a post-processing trigger signal and sends it to the post-processing execution module, and the post-processing execution module outputs the corresponding post-processing signal; In the case where the fault post-processing register configuration is not completed, the state judgment module generates an interrupt trigger signal and sends it to the post-processing execution module, and the post-processing execution module sends an interrupt signal to the CPU to start the fault processing operation according to the interrupt signal; When the CPU receives an interrupt signal, it starts the watchdog to start timing to monitor the CPU's fault response time.

4. The safety management method according to claim 3, characterized in that: Initiate fault handling operations based on the interrupt signal, including: Get the configuration parameters of the fault post-processing register; The control CPU performs a reset operation according to the configuration parameters of the post-fault processing register.

5. The safety management method according to claim 3, characterized in that: Monitors CPU fault response time, including: When the CPU fault response time does not exceed the watchdog timeout threshold, the watchdog is turned off; In the case that the CPU's fault response time exceeds the watchdog's timeout threshold, the watchdog outputs a WDT ALM signal to the alarm input management module to perform a post-processing operation with a high severity level.

6. The safety management method according to claim 5, characterized in that: The watchdog outputs the WDT ALM signal to the alarm input management module to perform post-processing operations with high severity levels, including: When the alarm input management module receives the WDT ALM signal, the control state judgment module obtains the configuration of the fault post-processing register; configured to control the post-processing execution module to generate a reset signal to reset the chip when a reset operation is performed upon receiving a WDT ALM signal; Configured to send fault status information to an external system when executing the Factory Instrumentation Protocol (FIP) output upon receiving a WDT ALM signal.

7. The safety management method according to claim 3, characterized in that: When a chip fault alarm signal is obtained, it is determined whether the fault post-processing register is configured, including: When an alarm signal of a chip failure is obtained, the configuration parameters of the chip's post-fault processing register and the running state of the state machine are obtained; wherein the running state of the state machine is used to indicate whether the state machine is in a power-on mode; When the state machine is set to the power-on mode, it is determined whether the configuration of the post-fault processing register is completed according to the configuration parameters of the post-fault processing register.

8. The safety management method according to any one of claims 3 to 7, characterized in that: Also includes: The alarm signal is classified according to a preset grouping rule to obtain a classification result; wherein the classification result includes the fault type and / or severity.

9. A safety management device for chip failure, comprising a processor and a memory storing program instructions, characterized in that: The processor is configured to execute the safety management method for chip failure according to any one of claims 3 to 8 when running the program instructions.

10. A microcontroller, characterized in that: include: Microcontroller unit MCU body; The safety management device for chip failure as described in claim 9 is installed in the MCU body.

Images