High-reliability MCU (Microprogrammed Control Unit) starting method, hardware structure and electronic equipment
By introducing security function modules for hardware self-test and error detection during MCU startup, the problem of lack of security verification during traditional MCU startup is solved, and higher system security and reliability are achieved.
Patent Information
- Application Number
- CN202411612103.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-12
- Publication Date
- 2025-03-04
AI Technical Summary
The lack of security verification of system hardware and firmware during the startup process of traditional MCUs makes the system susceptible to malware or firmware attacks during startup, affecting the stability and security of the system.
A highly reliable MCU startup method is adopted, by obtaining the MCU power-on reset signal, performing preset safety function module self-test, obtaining diagnostic results, and controlling the system startup method based on the diagnostic results. The safety function module includes a MEMORY BIST module and a LOGIC BIST module, which is used to detect the consistency of memory and logic circuits, and generate error signals to trigger interrupt processing.
Through the cooperation of hardware self-test and error indication modules, common faults in digital circuits can be detected and diagnosed, the safety and reliability of the MCU is increased, the cost of MCU is reduced, and the stability and safety of the system during startup is improved.
Smart Images
Figure CN119557886A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of integrated circuit design, and in particular to a highly reliable MCU startup method, hardware structure and electronic device. Background Art
[0002] With the rapid development of computer technology and information technology, embedded systems are increasingly used in various fields. As the core of embedded systems, the microcontroller unit (MCU) is crucial to the security and reliability of its boot process. However, traditional BOOTLOADERs only perform basic hardware initialization and firmware loading during the boot process, lacking security verification of system hardware and firmware. This makes the system vulnerable to malware or firmware attacks during the boot process, affecting the stability and security of the system.
[0003] Hardware self-check is a key part of the boot process, which can ensure that the system is in good condition when it boots up. Self-check mainly ensures the normal operation of system hardware by detecting whether the connection and function of hardware components are normal. At the same time, it can verify the authenticity and integrity of the firmware, prevent malware or firmware tampering to ensure system security. Record key events and error information during the boot process to help engineers quickly locate problems and repair them.
[0004] Therefore, self-checking plays a vital role in the booting process. However, the traditional BOOTLOADER does not fully consider the importance of self-checking during the booting process, and has problems such as insufficient self-checking function and imperfect self-checking process. Summary of the invention
[0005] In view of this, the present application proposes a highly reliable MCU startup method to solve the problems reflected in the above background technology.
[0006] The present application provides a highly reliable MCU startup method, including:
[0007] Obtaining an MCU power-on reset signal, and executing a preset safety function module self-test according to the power-on reset signal;
[0008] Obtain diagnostic results from the safety function module;
[0009] Control the system startup mode based on the diagnosis results.
[0010] Optionally, the highly reliable MCU startup method further includes:
[0011] The preset safety function modules include a MEMORY BIST module and a LOGIC BIST module.
[0012] Optionally, obtaining the diagnostic result issued by the safety function module includes:
[0013] Obtaining the data sequence judgment result of whether the MEMORY BIST module judges whether the storage before and after is consistent;
[0014] Obtaining a logic circuit scan chain judgment result of whether the storage before and after the LOGIC BIST module is consistent;
[0015] When the data sequence judgment result or the logic circuit scan chain judgment result is inconsistent, a diagnostic result of an error signal is issued.
[0016] Optionally, controlling the system operation state according to the diagnosis result includes:
[0017] According to the diagnostic results sent by the safety function module, when the diagnostic results of the error signal are issued, they are output through the pins and the error occurrence prompt is obtained at the same time;
[0018] According to the diagnostic result sent by the safety function module, when the diagnostic result of the error signal is issued, an interrupt signal is sent and the CPU interrupt mode is executed at the same time.
[0019] Optionally, the highly reliable MCU startup method further includes:
[0020] The MEMORY BIST module is used to write the correct data sequence into the RAM and then perform a consistency comparison check with the stored data sequence;
[0021] The LOGIC BIST module is used to generate a preset number of predefined test patterns according to a specific data sequence written into the LOGIC BIST module, and the test patterns are sent to the input end of the logic circuit for consistency comparison check.
[0022] Optionally, according to the power-on reset signal, executing a preset safety function module to perform self-test, including:
[0023] According to the CPU executing the MEMORY BIST code and LOGIC BIST code in the BOOTLOADER program, the operation command of controlling the MEMORY BIST module and the LOGIC BIST module is sent to the bus.
[0024] Optionally, the method for generating a preset number of predefined test patterns includes:
[0025] According to the specific data sequence written into the LOGIC BIST module, the LOGIC BIST module generates the scan chain preset in the module.
[0026] Optionally, the present application further provides a highly reliable MCU hardware structure, including an MCU and a security function module, wherein the MCU can execute instructions to implement any of the aforementioned disclosed method startups;
[0027] Optionally, an error signal processing module is included, which is used to obtain a judgment result based on the diagnostic data sent by the safety function module and send an error signal when the judgment result is abnormal.
[0028] The present application also provides an electronic device, comprising:
[0029] MCU:
[0030] Microcontroller Unit is a chip that integrates multiple I / O interfaces;
[0031] Wherein, the MCU is configured to implement any one of the aforementioned disclosed MCU startup methods when executing the executable instructions.
[0032] The beneficial effects of this application are as follows: This application uses the hardware of the safety function module and the supporting BOOTLOADER software to detect and diagnose common faults in digital circuits and increase the safety of the MCU. The hardware of the safety function module is connected to the MCU via a bus. It can be operated through the test interface configuration register in the post-tapeline test phase, and the stimulus control work is sent by the CPU in the BOOT phase, which greatly improves the utilization rate of the module. The error indication module can cooperate with the safety function module to collect and detect error signals, assist testers in eliminating MCU defects generated during the tape-out process, and reduce the cost of MCU testing. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required in the embodiments or the description of the prior art. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.
[0034] Figure 1 A flow chart of a highly reliable MCU startup method disclosed in the present application is shown.
[0035] Figure 2 A specific MCU hardware structure diagram disclosed in this application is shown;
[0036] Figure 3 A flowchart of a specific MCU software startup method disclosed in the present application is shown. DETAILED DESCRIPTION
[0037] Various exemplary embodiments, features and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.
[0038] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "plurality" means two or more, unless otherwise clearly and specifically defined.
[0039] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.
[0040] In addition, in order to better illustrate the present application, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present application can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present application.
[0041] Hardware self-check is a key part of the boot process, which can ensure that the system is in good condition when it boots up. Self-check mainly ensures the normal operation of system hardware by detecting whether the connection and function of hardware components are normal. At the same time, it can verify the authenticity and integrity of the firmware, prevent malware or firmware tampering to ensure system security. Record key events and error information during the boot process to help engineers quickly locate problems and repair them.
[0042] Therefore, self-test plays a vital role in the boot process. However, the traditional BOOTLOADER does not fully consider the importance of self-test during the boot process, and has problems such as insufficient self-test function and imperfect self-test process. In order to solve these problems, this paper proposes a highly reliable hardware structure and BOOT boot design. This design improves the security and reliability of the MCU through key links such as hardware self-test, error indication, error handling, etc., combined with the corresponding BOOT boot code.
[0043] The scheme of the present application is applied in an embedded system, and the startup of the MCU (Microcontroller Unit) of the embedded system is controlled, and a self-check is performed during the startup process in order to reduce the probability of hardware defects or malicious attacks during the startup process of the MCU. Specifically, the present application is to add a security function module to the MCU hardware, including a MEMORY BIST module, a LOGIC BIST module, etc. The startup operation of the security function module is added to the software code of the BOOTLOADER (boot loader, the first code executed by the embedded system after power-on) to achieve the coordination of software and hardware. The corresponding security function module will generate a corresponding error indication signal, and when a corresponding error occurs in the hardware, the error information is summarized through the error signal collection module, and the error information is converted into an interrupt generation signal and output through an external pin at the same time.
[0044] The MCU is a single-chip computer that integrates CPU (Central Processing Unit), memory, input and output interface, timer, analog-to-digital converter and other functions. The design of MCU is more focused on specific embedded applications, mainly for control, with low computing power, excellent real-time performance and reliability, and is usually used for control tasks. The CPU is mainly used to perform complex general computing tasks, has high computing power and multi-tasking capabilities, and is often used in complex occasions that require large amounts of data processing.
[0045] like Figure 2 As shown in the figure, the MCU hardware structure diagram includes the following contents:
[0046] The internal hardware of the MCU is connected through a bus (BUS). After the central processing unit (CPU) is powered on, it reads and executes the code stored in the read-only memory (BOOTROM), random access memory (RAM) and flash memory (FLASH) through the bus. After executing the code for operating the safety function module in the BOOTLOADER code stored in the read-only memory, it sends corresponding commands to the safety function module (MEMORY BIST module and LOGIC BIST module) through the bus to drive it to perform self-test; when an error is detected in the self-test of the safety function module, the safety management module will send an error signal to the error signal handling module (ERRORSIGNAL HANDLING), and the error signal handling module that receives the error signal will send an interrupt signal to the central processing unit through the bus, so that the central processing unit enters the interrupt mode and the MCU is in an unstarted state.
[0047] like Figure 3 As shown, the flowchart of the MCU software startup method includes the following contents:
[0048] After obtaining the MCU power-on reset signal, when the CPU executes the security function module code in the BOOTLOADER code, it first executes the MEMORY BIST code, sends the instruction to control the MEMORY BIST module through the BUS, and detects the storage space BOOTROM, RAM and FLASH; after completing the execution of the MEMORY BIST code, the CPU continues to execute the LOGIC BIST code in the BOOTLOADER code, sends the instruction to control the LOGIC BIST module through the BUS, and detects the logic circuit; after running the security function module, the BOOTLOADER program solution will be divided into three types of BOOT modes according to the external pin configuration. The FLASH BOOT mode burns the user code into the on-chip FLASH through the serial port through the prescribed protocol; the FUNCTIONAL BOOT mode transfers the user code in the FLASH to the RAM, and remaps the address 0x0000_0000 to the starting address of the RAM; the DEBUG BOOT mode provides a debugging solution.
[0049] like Figure 1 As shown, the highly reliable MCU startup method of the embodiment of the present application. The method comprises the following steps:
[0050] S100, the present application is to perform a self-test when the embedded system is powered on and started to check whether it is accurate. Therefore, in the method of this embodiment, the power-on reset signal of the embedded system is first obtained. In the specific implementation process, the power-on reset signal can be obtained through the fixed pin of the MCU. After the CPU module in the MCU obtains the signal, it controls the safety function module in the startup system to perform a self-test on the system. Before the test is passed, the embedded system is in a non-starting state.
[0051] Specifically, the present invention provides an MCU architecture integrating multiple safety function modules in the hardware structure, wherein the safety function modules include a MEMORY BIST module and a LOGIC BIST module; and provides a BOOTLOADER program solution for cooperating with the safety function modules to start at the software level.
[0052] The MEMORY BIST is a built-in self-test technology, which is specially used to test the memory (such as RAM, ROM, etc.) in the integrated circuit. The MEMORY BIST can automatically test the memory on the MCU by building a self-test module in the design. The MEMORY BIST can generate test data, perform tests and detect errors without external equipment. The LOGIC BIST is a built-in self-test technology, which is used to test the logic circuit part of the integrated circuit. The LOGIC BIST realizes automatic testing of the logic circuit on the MCU by building a self-test module. The LOGIC BIST can generate test vectors, perform tests and detect errors without external test equipment; The BOOTLOADER is the first code executed by the embedded system after power-on. After it completes the initialization of the CPU and related hardware, it loads the operating system image or the solidified embedded application into the memory and then jumps to the space where the operating system is located to start the operating system.
[0053] like Figure 2 A specific MCU hardware structure is shown, in which BOOTLOADER code is stored in BOOTROM, and the MEMORYBIST module is connected to the LOGIC BIST hardware module through a bus. After the CPU is powered on and reset, the CPU reads the code in the BOOTROM and works. After executing the code for operating the safety function module in the BOOTLOADER, the CPU sends corresponding commands to the safety function module through the bus to drive it to perform self-test.
[0054] like Figure 3 As shown, after the CPU is powered on and reset, the CPU executes the MEMORY BIST code in the BOOTLOADER program, sends a command to the bus to control the MEMORY BIST module, sends a specific sequence to the RAM or other storage space, and then reads it out to achieve detection.
[0055] The main function of the MEMORY BIST module is to write a specific sequence into the RAM and then read and check it; the specific sequence written is the data sequence written to correctly start the MEMORY BIST module; the reading and checking is to compare the consistency of the data sequences stored before and after the MEMORY BIST module.
[0056] like Figure 3 As shown, after completing MEMORY BIST, LOGIC BIST operation is similarly performed to implement logic unit detection. After the CPU executes the LOGIC BIST code in the BOOTLOADER program, it sends a command to control the LOGIC BIST module to the bus, generating a series of predefined test modes to implement detection.
[0057] The function of the LOGIC BIST is to generate a series of predefined test modes, which are sent to the input end of the logic circuit to simulate different logic states and signal conversions; the predefined test mode is based on writing a specific data sequence to the LOGIC BIST module to start the scan chain preset in the module; and then the consistency of the logic circuit scan chain stored before and after the LOGIC BIST module judgment is compared.
[0058] S200, the present application is that the security function module of the embedded system obtains a specific sequence, checks whether the stored data sequence is consistent, and obtains a diagnostic result. Therefore, in the method of this embodiment, the specific sequence input into the security function module is first obtained. In the specific implementation process, the specific sequence can be obtained by reading the BOOTLOADER program through the CPU, and then the specific sequence is input into the security management module. Before the detection is passed, the embedded system is in a non-starting state.
[0059] Specifically, the diagnostic result is obtained according to the judgment result after the MEMORY BIST module and the LOGIC BIST module of the safety function module perform self-inspection. The data sequence judgment result of the MEMORY BIST module to judge whether the storage before and after is consistent is obtained; the data sequence judgment result is a consistency comparison between the correct data sequence input into the MEMORY BIST module and the data sequence in the RAM. If the compared data sequences are consistent, the MEMORY BIST module self-inspects and the system is running normally. If the compared data sequences are inconsistent, an error is detected and an error signal is generated and sent to the error handling module. The logic circuit scan chain judgment result of the LOGICBIST module to judge whether the storage before and after is consistent is obtained; the logic circuit scan chain judgment result is a consistency comparison of the preset scan chain sent to the logic circuit input end; if the scan chain comparison is consistent, the LOGIC BIST module self-inspects and the system is running normally. If the scan chain comparison is inconsistent, an error is detected and an error signal is generated and sent to the error handling module.
[0060] like Figure 2 As shown, the error signals generated by the MEMORY BIST module and the LOGIC BIST module will be sent to the error signal handling module (ERROR SIGNAL HANDLING) for processing.
[0061] Among them, the error signal processing module performs processing, which means that the error signal processing module collects the error signal sent by the safety function module, and then the error signal processing module sends an interrupt signal to the CPU according to the error signal, so that the CPU enters the interrupt mode, and at the same time indicates the error occurrence to the hardware user through the pin output.
[0062] S300, the present application detects an error in the embedded system and sends an error signal to the error signal processing module. Therefore, in the method of this embodiment, the error signal sent by the safety function module is first obtained. In the specific implementation process, the error signal can be obtained by the error signal processing module. After obtaining the signal, the error signal processing module sends an interrupt signal to the CPU to put the CPU into interrupt mode. In the case of obtaining the error signal, the embedded system is in a non-starting state.
[0063] Specifically, if the safety function module detects an error during the operation phase, it will send an error signal to the error signal processing module. The error signal processing module will then output the error to the hardware user through the pin. At the same time, a corresponding interrupt signal will also be generated, causing the CPU to enter the interrupt mode to execute the interrupt processing function.
[0064] Among them, the error signal processing module will then send an error indication signal to the MCU pin through a pin output. The error indication signal is a high or low level signal output by the pin, and a low level is defined as no error and a high level as an error. The indication of an error to the hardware user means that the user observes the signal after powering on and resetting the MCU. If an error occurs, the pin signal will be monitored to be pulled high.
[0065] If no error is detected in the operation phase of the safety function module, the BOOTLOADER program solution is divided into three types of BOOT modes according to the external pin configuration after running the safety function module. The FLASH BOOT mode burns the user code into the on-chip FLASH through the serial port through the prescribed protocol; the FUNCTIONAL BOOT mode transfers the user code in the FLASH to the RAM, and remaps the address 0x0000_0000 to the starting address of the RAM; the DEBUG BOOT mode provides a debugging solution.
[0066] The beneficial effect of the present application is that the present application uses the hardware of the safety function module and the supporting BOOTLOADER software to detect and diagnose common faults in digital circuits and increase the safety of the MCU. The hardware of the safety function module is connected to the MCU via a bus, and can be operated through the test interface configuration register in the post-tapeline test phase, and the stimulus control work is sent by the CPU in the BOOT phase, which greatly improves the utilization rate of the module. The error indication module can cooperate with the safety function module to collect and detect error signals, assist testers in eliminating MCU defects generated during the tape-out process, and reduce the cost of MCU testing.
[0067] In the prior art, due to the potential faults of MCU hardware such as fixed faults and bridge faults in the process of tape-out manufacturing, the DFT (Design for Test) strategy is used to insert structures such as scan chains and MEMORY BIST in the MCU design stage. The DFT strategy refers to a technology that considers the feasibility and efficiency of testing in the integrated circuit design process, aiming to ensure high-quality testing in the manufacturing process, and starts these circuits to detect these faults in the test stage after the MCU tape-out. This strategy increases the test cost and MCU area of the MCU while reducing the risk of MCU failure. Traditional testing means operate through the test port. After the post-tape-out test is completed, this part of the test circuit is generally shielded or does not work, which leads to a waste of MCU resources. At the same time, some test functions are often invisible when used by users, which will cause some MCU hardware faults (such as memory faults) that occur when users use them to be unable to be effectively detected and cleared.
[0068] The technical solution described in this article adds a safety function module and an error signal collection module to the hardware. The safety function module can be operated through the test interface configuration register in the post-tapeline test phase, and the stimulus control work is sent by the CPU in the BOOT phase, which greatly improves the utilization rate of the module and avoids the waste of MCU resources; the error indication module can cooperate with the safety function module to collect and detect error signals, assist testers in eliminating MCU defects generated during the tape-out process, and reduce the MCU testing cost.
[0069] In the existing technical solutions, the importance of self-checking is not fully considered during the restart process of the BOOTLOADER code of the traditional MCU. There are problems such as insufficient self-checking function and imperfect self-checking process. The normal working status of the hardware components cannot be verified, making the system vulnerable to malware or firmware attacks during the startup process, thereby affecting the security and stability of the system. At the same time, due to insufficient self-checking, the traditional BOOTLOADER code cannot detect and repair potential hardware and firmware problems, resulting in a decrease in system stability, affecting the reliability and service life of the equipment.
[0070] The technical solution described in this article uses BOOTLOADER software that is compatible with the safety function module hardware. It works in conjunction with the safety module hardware to automatically perform safety checks after each power-on reset of the MCU, detect and diagnose common faults in digital circuits, and increase the safety of the MCU.
[0071] The beneficial effect of the present application is that, in order to reduce the probability of hardware defects or malicious attacks during the MCU startup process, the present application adds a security function module to the MCU hardware, including a MEMORY BIST module, a LOGIC BIST module, etc. The startup operation of the security function module is added to the software code of the BOOTLOADER to achieve the coordination of software and hardware. The corresponding security function module will generate a corresponding error indication signal. When a corresponding error occurs in the hardware, the error information is collected through the error signal collection module, and the error information is converted into an interrupt generation signal and output through an external pin at the same time.
[0072] The embodiments of the present application have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.
Claims
1. A highly reliable MCU startup method, characterized in that: include: Obtaining a power-on reset signal of the MCU, and executing a preset safety function module to perform a self-check according to the power-on reset signal; Obtain diagnostic results from the safety function module; Control the system startup mode based on the diagnosis results.
2. The highly reliable MCU startup method according to claim 1, characterized in that: The preset safety function modules include a MEMORY BIST module and a LOGIC BIST module.
3. The highly reliable MCU startup method as claimed in claim 2, characterized in that: The obtaining of the diagnostic result issued by the safety function module includes: Obtaining the data sequence judgment result of whether the MEMORY BIST module judges whether the storage before and after is consistent; Obtaining a logic circuit scan chain judgment result of whether the storage before and after the LOGIC BIST module is consistent; When the data sequence judgment result or the logic circuit scan chain judgment result is inconsistent, an error signal diagnosis result is issued.
4. The highly reliable MCU startup method according to claim 1, characterized in that: The controlling of the system operation state according to the diagnosis result comprises: According to the diagnostic results sent by the safety function module, when the diagnostic results of the error signal are issued, they are output through the pins and the error occurrence prompt is obtained at the same time; According to the diagnostic result sent by the safety function module, when the diagnostic result of the error signal is issued, an interrupt signal is sent and the CPU interrupt mode is executed at the same time.
5. The highly reliable MCU startup method as claimed in claim 2, characterized in that: The MEMORY BIST module is used to write the correct data sequence into the RAM and then perform a consistency comparison check with the stored data sequence; The LOGIC BIST module is used to generate a preset number of predefined test patterns according to a specific data sequence written into the LOGIC BIST module, and the test patterns are sent to the input end of the logic circuit for consistency comparison check.
6. A highly reliable MCU hardware structure and startup method as claimed in claim 1, characterized in that: According to the power-on reset signal, a preset safety function module is executed to perform self-test, including: According to the CPU executing the MEMORY BIST code and LOGIC BIST code in the BOOTLOADER program, the operation command of controlling the MEMORY BIST module and the LOGIC BIST module is sent to the bus.
7. A highly reliable MCU hardware structure and startup method as claimed in claim 5, characterized in that: The method for generating a preset number of predefined test patterns includes: According to the specific data sequence written into the LOGIC BIST module, the LOGIC BIST module generates a scan chain preset in the module and inputs it into the logic circuit for comparison.
8. A highly reliable MCU hardware structure, characterized in that: The invention comprises an MCU and a safety function module, wherein the MCU is started using the method described in any one of claims 1 to 7.
9. The highly reliable MCU hardware structure according to claim 8, characterized in that: It also includes an error signal processing module, which is used to obtain a judgment result based on the diagnostic data sent by the safety function module and send an error signal when the judgment result is abnormal.
10. An electronic device, characterized in that: include: MCU: Microcontroller Unit is a chip that integrates multiple I / O interfaces; Wherein, the MCU is configured to implement the MCU startup method described in any one of claims 1 to 7 when executing the executable instructions.