Screening method and system for fragile units in vehicle-gauge-level chip and storage medium

Abstract

The invention provides a method and system for screening fragile units in a vehicle-gauge-level chip and a storage medium, and the method comprises the steps: extracting a circuit module associated with a preset safety target through analyzing a circuit structure of a to-be-tested vehicle-gauge-level chip; and analyzing the circuit module, identifying a fragile module causing a fault event, carrying out analysis test on the screened fragile module based on an equivalence test mode, and screening out fragile units in the fragile module. According to the method provided by the invention, from the microscopic perspective, the fragile module which may have a fault is extracted from the circuit structure of the to-be-tested vehicle gauge level chip, formalized analysis is performed on the fragile module, and the fragile unit is screened out, so that the safe weak point in the chip circuit is efficiently and completely identified; and technical support is provided for targeted safety design reinforcement and safety performance improvement of the vehicle gauge level chip.

Description

Technical Field

[0001] The present invention relates to the field of integrated circuit testing technology, and in particular to a method, system and storage medium for screening fragile units in an automotive-grade chip. Background Art

[0002] The chips currently in use can be divided into military-grade, automotive-grade, industrial-grade and consumer-grade chips based on the level of the industry in which they are used. Automotive-grade chips refer to chips used in automotive control. As the intelligence of automobiles increases, the functional safety of automotive-grade chips is a key core issue in the development of automobiles.

[0003] As automotive-grade chips shift from single-function, large-size to multi-function, highly integrated, small-size, the failure rate of hardware increases. Common fault injection simulation methods rely on the selection of test vectors and cannot guarantee the completeness of the injected fault space characteristics, so accurate test results cannot be obtained, which in turn makes it impossible to evaluate the chip's safety functions based on the test results, limiting the further improvement of the safety performance of automotive-grade chips.

[0004] Therefore, the prior art needs to be further improved. Summary of the invention

[0005] In view of the above-mentioned deficiencies in the prior art, the present invention provides a method, system and storage medium for screening vulnerable units in automotive-grade chips, aiming to overcome the defect in the prior art that it is impossible to accurately test the functional safety of automotive-grade chips.

[0006] The technical solution adopted by the present invention to solve the technical problem is as follows:

[0007] In a first aspect, this embodiment provides a method for screening fragile units in an automotive-grade chip, which includes:

[0008] Analyze the circuit structure of the automotive-grade chip to be tested and extract the circuit modules associated with the preset safety goals;

[0009] Analyze circuit modules to identify vulnerable modules that cause failure events;

[0010] The screened vulnerable modules are analyzed and tested based on the equivalence test method to screen out the vulnerable units in the vulnerable modules.

[0011] Optionally, the step of analyzing the circuit structure of the automotive-grade chip to be tested and extracting a circuit module associated with a preset safety target includes:

[0012] Determine the top events that deviate from the preset safety goals in the automotive-grade chip to be tested based on the chip type and chip function;

[0013] According to the fault propagation path corresponding to the top event, the circuit structure of the automotive-grade chip to be tested is analyzed, and the circuit module associated with the preset safety target is extracted.

[0014] Optionally, the step of analyzing the circuit modules to identify the vulnerable modules causing the fault event includes:

[0015] Constructing a fault tree model according to the hierarchical structure between the connection nodes in the circuit module and the superior-subordinate decomposition relationship between the hierarchical levels;

[0016] The vulnerable modules in the circuit modules are screened out based on the fault tree model.

[0017] Optionally, the step of screening out vulnerable modules in circuit modules based on the fault tree model includes:

[0018] The fault tree model is solved by using Boolean operations to determine the minimum cut set of the fault tree model, and the circuit logic unit combination corresponding to the minimum cut set is used as the fragile module.

[0019] Optionally, the step of analyzing and testing the screened vulnerable modules based on the equivalence test to screen out vulnerable units in the vulnerable modules includes:

[0020] Inject faults into the analyzed nodes in the vulnerable module and establish a fault timing propagation dependency graph;

[0021] Based on the fault sequence propagation dependency graph, determine whether the output variables of the analysis node after the transient fault occurs are equivalent to the output variables before the transient fault occurs, and obtain the equivalence analysis results;

[0022] According to the location of the analysis nodes where the output variables are not equivalent in the equivalence analysis results, the fragile units are screened out.

[0023] Optionally, the step of injecting faults into the analyzed nodes in the vulnerable module and establishing a fault timing propagation dependency graph includes:

[0024] Establishing a replica circuit having the same circuit structure as that corresponding to the fragile module;

[0025] Adding a formally described fault model to the analysis node in the replica circuit to perform fault injection;

[0026] According to the fault propagation timing between each connection node when the fault is injected in the replica circuit, a fault timing propagation dependency graph is constructed.

[0027] Optionally, the step of determining whether the output variable of the analysis node after the transient fault occurs is equivalent to the output variable when the transient fault does not occur based on the fault timing propagation dependency graph, and obtaining the equivalence analysis result includes:

[0028] For each analysis node in the fault sequence propagation dependency graph, starting from the first dependency level where each analysis node is located, it is determined step by step whether each output node is equivalent to the output variable when no transient fault occurs at each dependency level, and the equivalence analysis result is obtained.

[0029] Optionally, after the step of screening out the vulnerable units in the vulnerable module, the method further includes:

[0030] According to the ratio of the change rate of the bottom event failure probability in the fragile module to the change rate of the top event occurrence probability corresponding to each fragile unit, the critical importance of each fragile unit is obtained;

[0031] And, according to the influence degree of the transient fault occurrence of each fragile unit on the occurrence of the top event, the structural importance of each fragile unit is obtained;

[0032] Determining the unit importance of each fragile unit according to the key importance and structural importance corresponding to each fragile unit;

[0033] According to the importance of each fragile unit, the probability of transient failure of the fragile units is ranked and output.

[0034] In a second aspect, this embodiment provides a system for screening fragile units in automotive-grade chips, which includes:

[0035] The circuit analysis module is used to analyze the circuit structure of the automotive-grade chip to be tested and extract the circuit modules associated with the preset safety goals;

[0036] A circuit analysis module is used to analyze the circuit modules and identify the vulnerable modules that cause the failure events;

[0037] The screening module is used to analyze and test the screened vulnerable modules based on an equivalence test method, and screen out the vulnerable units in the vulnerable modules.

[0038] In the third aspect, this embodiment provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more computer-readable programs, and the one or more computer-readable programs can be executed by one or more processors. When the computer-readable program is executed by the processor, the method for screening fragile units in the automotive-grade chip is implemented.

[0039] Beneficial effect: The present invention provides a method, system and storage medium for screening vulnerable units in automotive-grade chips. By analyzing the circuit structure of the automotive-grade chip to be tested, the circuit modules associated with the preset safety goals are extracted; the circuit modules are analyzed to identify the vulnerable modules that cause the failure events, and the screened vulnerable modules are analyzed and tested based on the equivalence test method to screen out the vulnerable units in the vulnerable modules. The method disclosed in this embodiment extracts the vulnerable modules that may fail from the automotive-grade chips, performs formal analysis on the vulnerable modules, and screens out the vulnerable units. The present invention cleverly combines the fault tree analysis method with the formal analysis technology to achieve efficient and complete identification of security weaknesses in the chip circuit, providing technical support for the targeted security design reinforcement and safety performance improvement of automotive-grade chips. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flowchart of the steps of a method for screening fragile units in an automotive-grade chip provided by an embodiment of the present invention;

[0041] Figure 2 is a structural schematic diagram of establishing a fault tree model through unexpected steering assistance in an embodiment of the present invention;

[0042] Figure 3 It is a structural schematic diagram of a fault tree model of CAN transmitter failure in an embodiment of the present invention;

[0043] Figure 4 It is a flowchart of the steps of the screening method of fragile units in a specific application embodiment of the method of the present invention;

[0044] Figure 5 It is a principle structural block diagram of a system for screening fragile units in automotive-grade chips in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present invention clearer and more specific, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0046] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when an element is said to be "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0047] With the rapid development of intelligent connected vehicles at home and abroad, the functional safety of automotive-grade chips has become a key issue in the development of intelligent connected vehicles. Since automotive-grade chips need to work in a variety of pressure and dynamic environments, the temperature range can be as wide as -40 to 155°C, high vibration, dust, radiation, electromagnetic interference, etc. In addition, personal safety issues are also involved. Automotive chips have higher requirements for reliability and safety, and the general design life is 10 to 15 years. Therefore, automotive-grade chips must meet the requirements of reliability, consistency and stability. As automotive-grade chips change from traditional large size and single function to small size, high integration, high computing power and multi-function, the random hardware failure rate of automotive-grade chips has also increased, and functional safety issues are also in urgent need of improvement.

[0048] The functional safety of automotive-grade chips means that the chips used in automotive electronic systems must strictly comply with a series of functional safety standards and specifications to ensure that even if a random hardware failure occurs inside the chip, it can still stably and reliably perform the corresponding functions, thereby effectively preventing accidents or potential dangers caused by failures. Functional safety standards and requirements usually include specifications for chip design, development, testing and verification processes to ensure that the chip takes into account various potential failure conditions during the design phase and can maintain a high degree of reliability and safety in actual use. In order to ensure the safety of vehicle electronic systems, the international functional safety standard ISO 26262: Road vehicles—Functional safety and the national standard GB / T 34590 functional safety standard "Road vehicles—Functional safety" came into being, which clearly include chip analysis and testing requirements.

[0049] The functional safety of chips is mainly based on failures. Chip failures are mainly divided into systematic failures and random hardware failures. Among them, systematic failures refer to failures that cannot be predicted during the life cycle of the chip and are the focus of chip functional safety analysis. Random hardware failures refer to unexpected and random hardware failures caused by factors such as physical processes or environmental stress during the hardware life cycle. The time of occurrence of this failure cannot be predicted, but it follows a certain probability distribution, such as exponential distribution. Random hardware failures are usually caused by a variety of degradation mechanisms, such as component aging, fatigue, physical degradation, and external environmental stress. Random hardware failures are mainly divided into two categories: permanent failures and transient failures. Permanent failures are usually caused by chip manufacturing process problems and physical processes, such as open circuits, short circuits, etc. Transient failures are usually caused by the chip's own packaging materials or environmental factors, such as single event effects (SEE) induced by high-energy radiation particles in the driving environment of the car, which cause bit flips. Random hardware failures are the root cause of functional safety failures in chips. Efficient security vulnerability detection methods will help identify negligence or weak links in chip functional safety design, which is of great significance for targeted security mechanism optimization and accurate and objective security assessment.

[0050] The vulnerable units in automotive-grade chips are those logic units that are propagative in the fault state and will directly violate the chip safety goals once a fault occurs. These logic units are potential threats to the functional safety of the chip and the source of security vulnerabilities in the chip. The vulnerable unit is a physical property based on the logic implementation level of the chip, rather than the physical circuit layout or the physical properties of the component itself. From the microscopic perspective of the circuit, not all faults in the circuit will cause chip failure, and not all failures are related to the safety of the entire vehicle. Whether a logic unit in the chip circuit is a vulnerable unit is mainly reflected in the following two aspects: first, analyze whether the fault effect of the logic unit will be shielded by other logic units or system-level designs when a fault occurs, thereby avoiding fault propagation; second, evaluate whether the circuit failure caused by the unit failure is directly related to safety, that is, whether it violates the established safety goals. If the fault of the logic unit will not be shielded by other logic units or system-level designs, and will propagate to cause chip failure, then the logic unit is a vulnerable unit. If the circuit failure caused by the logic unit violates the established safety goals, then the logic unit is a vulnerable unit. Vulnerable units are the focus of protection in chip design and the focus of detection in safety assessment. If the vulnerable units in the chip can be accurately identified during the chip design and testing phase, it can provide technical support for the design of high-quality automotive-grade chips.

[0051] The usual way to test the safety functions of automotive-grade chips is usually the fault injection simulation method. However, the fault injection simulation method relies on the selection of test vectors and cannot guarantee the completeness of the fault space characteristics, so it cannot achieve good safety function testing results.

[0052] In order to implement integrity testing of automotive-grade chips and accurately screen out vulnerable units, the present application provides a method, system, and storage medium for screening vulnerable units in automotive-grade chips. By analyzing the circuit structure of the automotive-grade chip to be tested, the circuit modules associated with the preset security goals are extracted; the circuit modules are analyzed to identify the vulnerable modules that cause the failure events, and the screened vulnerable modules are analyzed and tested based on the equivalence test method to screen out the vulnerable units in the vulnerable modules. The method provided by the present application evaluates the security vulnerabilities existing inside the chip from a microscopic perspective, efficiently and accurately screens out vulnerable units, and provides technical support for the optimization of chip structure and accurate evaluation of chip functions.

[0053] The embodiments of the present invention are further described below in conjunction with the accompanying drawings.

[0054] In the first aspect, this embodiment proposes a method for screening fragile units in automotive-grade chips, such as Figure 1 ,include:

[0055] Step S1: Analyze the circuit structure of the automotive-grade chip to be tested and extract the circuit modules associated with the preset safety goals.

[0056] For the automotive-grade chip to be tested, its circuit structure is obtained and analyzed to extract the circuit modules related to the preset safety goals.

[0057] Specifically, the method of obtaining the circuit structure of the automotive-grade chip may include: searching for the product model of the automotive-grade chip to be tested, and searching for relevant information based on the product model, for example: searching for technical documents related to the automotive-grade chip from the official website of the chip manufacturer, and the technical documents contain detailed information related to the circuit structure of the chip, or browsing technical analysis, evaluation articles or related materials related to the automotive-grade chip on professional websites to obtain relevant information on the circuit structure of the automotive-grade chip. The detailed circuit structure of the chip can also be obtained by studying the circuit diagram of the automotive-grade chip and understanding the connection method and signal transmission path between the various components.

[0058] In this step, a fault tree model is first established with events that violate chip safety goals as top events and weak security modules as bottom events. The propagation path of the fault is analyzed, and the circuit is pruned based on Boolean logic functions. Circuit modules that are irrelevant to the preset safety goals or will not cause safety failures are eliminated, and only circuit modules related to the preset safety goals are obtained, thereby improving the efficiency of chip circuit structure analysis.

[0059] In detail, this step includes:

[0060] Step S11: determine the top events that deviate from the preset safety targets in the automotive-grade chip to be tested according to the chip type and chip function.

[0061] First, we need to have a detailed understanding of the type and function of the automotive-grade chip to be tested, and clarify the chip type and function of the automotive-grade chip. For example, the chip type of the automotive-grade chip can be computing and control chips (such as MCU chips and SOC chips), power chips (such as MOSFET chips and IGBT chips), sensor chips, or storage chips, positioning chips, etc. The functions of the chip include: data processing, storage, control, communication or perception functions.

[0062] Because automotive-grade chips need to have failure risks under extreme temperature ranges, high vibrations, and high magnetic fields. Failure risks may include: system failures, data leakage, etc., which pose threats to the safety and stability of the vehicle. Therefore, based on the type and functional characteristics of the automotive-grade chip to be tested, the possible risks of the chip in specific applications are analyzed, and the risk level is evaluated, and then the functional safety goals are determined based on the possible risks and risk levels. The safety goal can be the determined safety integrity level, which reflects the safety importance of the chip in the system. The safety goal can also be reflected by customizing safety function requirements. Safety function requirements can be: chip fault detection and response capabilities, data protection capabilities, and redundant design requirements. Determine the safety goal based on the above-mentioned safety integrity level requirements and / or safety function requirements.

[0063] Chip functional safety analysis is not only the basis for the ASI L level certification of automotive-grade chips, but also provides optimization direction for the functional safety design iteration of automotive-grade chips. Functional safety analysis is based on top-level safety requirements.

[0064] Generally speaking, there are two methods for deriving top-level security requirements: The first method is to derive the top-level security requirements of the chip step by step based on specific application requirements, which is usually suitable for chip development for specific applications. The second method is to obtain the top-level security requirements of the chip based on security factors independent of the environment. This method can make the chip suitable for a variety of applications and is also the more commonly used method at present. In order to focus more on the problem to be solved by the present invention, the present invention adopts the second method to obtain the security target, regards the events in the circuit that deviate from the security target as top events, and regards the circuit modules that cause the top events as bottom events. After the current security target is determined, the top event that deviates from the security target can be determined based on the preset security target.

[0065] Specifically, the determined security goal may be that the security level needs to reach any level from ASI LA to ASI LD in the safety integrity level, or the security function requirement may be that the data protection capability meets the specified requirements.

[0066] Step S12: Analyze the circuit structure of the automotive-grade chip to be tested according to the fault propagation path corresponding to the top event, and extract the circuit module associated with the preset safety target.

[0067] According to the determined safety goals, the transmission order between the output signals of each circuit element is determined from the connection relationship between the various elements in the circuit corresponding to the automotive-grade chip to be tested. Then, based on the determined transmission order between the output signals of each circuit element, the fault propagation path corresponding to the top event is obtained. Since there is a logical relationship between the signals output by each circuit module in the automotive-grade chip, it is possible to start from the top event and analyze it from top to bottom, and represent the previous level event with the next level until the bottom-level circuit logic is analyzed. Therefore, the fault propagation path corresponding to the top event can be obtained, and the circuit module associated only with the preset safety goal can be determined based on the fault propagation path.

[0068] Specifically, according to the calculation logic of the output signal in the circuit, the circuit module related to the safety target is extracted from the circuit of the chip as a whole, and the circuit structure related to the top event is obtained. Since the circuit structure of the automotive-grade chip contains a part of the circuit structure that is not related to the preset safety target, in this step, the circuit information related to the set safety target can be extracted from the circuit structure based on the calculation logic of the output signal in the chip.

[0069] Step S2: Analyze the circuit modules to identify the vulnerable modules that cause the fault events.

[0070] Screen out vulnerable units that may fail from the extracted circuit modules. In this step, based on the hierarchical relationship between the various components in the circuit module, after fully understanding the system failure mode, failure cause and failure phenomenon, the vulnerable modules that may only fail can be identified based on the hierarchical relationship between the various components in the circuit.

[0071] Specifically, this step includes:

[0072] Step S21: construct a fault tree model according to the hierarchical structure between the connection nodes in the circuit module and the superior-subordinate decomposition relationship between the hierarchical levels.

[0073] According to the hierarchical relationship of the output signals between the components in the circuit module, the causal relationship between the events in the circuit module is obtained, and then the corresponding event symbols, logic gate symbols and transfer symbols are determined according to the causal relationship between the events. Event symbols are used to represent events or states that occur in the circuit. Logic gate symbols are basic elements in digital circuits and are used to represent logical operation relationships. Transfer symbols are used to represent state transfer relationships in state machines or sequential circuits.

[0074] The hierarchical relationship between logic events can be determined by the event symbols, logic gate symbols and transfer symbols determined in the above steps.

[0075] A fault tree model is established based on the hierarchical relationship between logical events. Since the fault tree analysis (FTA) is an inverted tree-like logical causal relationship diagram, which describes the causal relationship between various events in the system through event symbols, logic gate symbols, and transfer symbols, the fault tree model can be used to reflect the fault mechanism in the chip. In the fault tree model, the event that violates the safety goal in the chip is the top event, and the vulnerable unit is the bottom event. The random hardware fault is located by finding the vulnerable unit in the system that may cause the violation of the safety goal.

[0076] Step S22: Screen out vulnerable modules in circuit modules based on the fault tree model.

[0077] The qualitative analysis process of the fault tree model is actually the process of solving the cut set of the fault tree model. All the bottom-level direct cause events constitute the cut set of the fault tree model. In the present invention, the cut set is the fragile module in the decomposed circuit.

[0078] In one implementation, the fault tree model is solved by Boolean logic function operation to determine the minimum cut set of the fault tree model, and the circuit logic unit combination corresponding to the minimum cut set is used as the fragile unit. Since the minimum cut set of the fault tree is found by calculation, the simplest combination of the top event occurrence logic unit is determined, and the set of these simplest combinations is the fragile module, thereby screening out the fragile modules in the circuit module.

[0079] In one implementation, a fault tree model is established by taking the safety failure event of abnormal acceleration and deceleration generated by the MCU chip as an example. The top event of this fault tree model indicates the occurrence of unexpected acceleration and deceleration control signals. After the top event is established, the MCU failure mode is decomposed from top to bottom using a deductive analysis method to find the second-top event. In the MCU, the generation of acceleration and deceleration control signals is mainly related to the three major component modules of the CPU, peripherals and storage devices. Therefore, the second-top events of the fault tree include CPU failure, storage unit failure and peripheral failure. After determining the second-top event, it is decomposed from top to bottom according to the Boolean logic between the modules, and linked using appropriate logic gates to form a fault tree model. In the present invention, it is only necessary to decompose the fault tree model to the circuit module level suitable for formal analysis.

[0080] Step S3: Analyze and test the selected vulnerable modules based on an equivalence test to select the vulnerable units in the vulnerable modules.

[0081] In this step, the vulnerable modules identified above are formally analyzed to screen out the vulnerable units in the vulnerable modules. The method of formal analysis is specifically a formal verification, which is mainly divided into three categories: equivalence test, model test and theorem proof. Equivalence test: It mainly verifies the consistency of functions before and after a design is transformed. The design changes here can be synthesis, layout and routing, test or clock tree insertion, scan chain reordering, field programmable gate array to application-specific integrated circuit conversion, etc. The basic principle of equivalence test is to establish the relationship between the two models being compared. The basis of the test is mathematical theorems and axioms, as well as the precise description of the standard cell library used in the design implementation, and the data structures of each other are analyzed by formal algorithms for comparison. In order to verify whether the system properties of the automotive-grade chip to be tested are equivalent before and after fault injection, the timing equivalence test method is used in this step to identify the vulnerable units in the circuit.

[0082] Based on the principle of equivalence testing, in this step, a replica circuit is first constructed for the vulnerable module. By injecting faults into the replica circuit, it is analyzed whether the output variables of the analyzed nodes in the replica circuit after fault injection are equivalent to the output changes without fault injection, and then it is determined whether each analysis node in the vulnerable module is a vulnerable unit.

[0083] Specifically, this step includes:

[0084] Step S31: inject faults into the analyzed nodes in the vulnerable module and establish a fault timing propagation dependency graph.

[0085] In this step, fault injection is performed on the analyzed nodes in the vulnerable module, and variable relationships are defined according to the fault injection of the analyzed nodes. For example, the fault model of the fault injection is added to the analyzed nodes of the replica circuit C′ (the circuit corresponding to the vulnerable module) to implement fault injection. The fault injection of y is performed by defining the variable relationship between nodes y and y′ in the 0th frame. to achieve.

[0086] Specifically, the steps of injecting faults into the analyzed nodes in the fragile module and establishing a fault timing propagation dependency graph include: establishing a replica circuit with the same circuit structure as that corresponding to the fragile module; adding a formally described fault model to the analysis nodes in the replica circuit to perform fault injection; and constructing a fault timing propagation dependency graph according to the fault propagation timing between each connection node when the fault is injected in the replica circuit.

[0087] First, according to the circuit structure of the vulnerable module, a replica circuit is constructed to sense the function corresponding to the vulnerable module, and a fault model is constructed by injecting the fault mode, fault cause or fault phenomenon to be injected. The constructed fault model is injected into the replica circuit to complete the fault injection. When the analysis node in the vulnerable module is injected with a fault, the fault propagation timing dependency graph SDG = (V, E) of the analysis node can be established based on the propagation order of the fault. The fault propagation timing dependency graph is a directed graph with a directed edge from node a to node b.<a,b> , the directed edges connecting nodes represent data dependencies between nodes, that is, the node represented by the source of the edge depends on the node represented by its end point. TFS(y) represents the set of all nodes in SDG that directly depend on y. Dependencies are transitive, so indirect dependencies can be derived from SDG. TFS(y,n) represents the set of nodes that depend on node y and have a dependency level of n.

[0088] Step S32: Based on the fault sequence propagation dependency graph, determine whether the output variable of the analysis node after the transient fault occurs is equivalent to the output variable when the transient fault does not occur, and obtain an equivalence analysis result.

[0089] After the fault sequence propagation dependency graph is established, it is possible to determine whether any node is a vulnerable point based on the fault propagation characteristics. That is, starting from the first dependency level of the node, it is gradually determined whether each output node is affected by the fault propagation. If it is affected by the fault propagation, it means that the node is not equivalent in the original circuit and the replica circuit after the transient fault occurs, and is a vulnerable point.

[0090] Specifically, based on the fault sequence propagation dependency graph, starting from the first dependency level where each analysis node is located, it is determined at each dependency level d whether the nodes in TFS(y,d) are equivalent in the original circuit and the replica circuit after the transient fault of y occurs. Expand each frame and determine whether all output variable pairs in TFS(y,d) are equivalent pairs to obtain the equivalence analysis results corresponding to each analysis node.

[0091] Step S33: Screen out vulnerable units according to the locations of analysis nodes where the output variables are not equivalent in the equivalence analysis results.

[0092] When the equivalence analysis results of each analysis node are obtained, whether the analysis node is a vulnerable point can be determined based on the conclusion of whether the output variables in the analysis results are equivalent. Based on the analysis of each vulnerable point, the vulnerable unit can be screened out.

[0093] For example, in the above steps, if any pair of output variables is not equivalent, then y is a transient fault vulnerable point; otherwise, if in frame d, every secondary state pair and main output pair are equivalent pairs, if C i With C i 'Timing equivalence, y is a transient fault safety point and does not require protection.

[0094] Since the existing chip functional safety analysis only evaluates the overall chip safety mechanism coverage and failure level from a macro perspective, it does not consider which circuit modules or logic units are the core and key to the chip functional safety from a micro level, and thus cannot carry out targeted design reinforcement and detection of the chip. The method of this embodiment combines the fault tree analysis method with the formal technology, uses the fault tree analysis method to decompose the safety goals into key circuit modules, and then uses the formal method to establish the fault timing propagation dependency graph and the equivalence verification model, so as to efficiently and completely identify the vulnerable units (safety weaknesses) in the circuit. The present invention cleverly combines the fault tree analysis method with the formal method, which can not only obtain complete vulnerable points, but also avoid the problems of spatial "state explosion" and limited processing circuit scale in the formal method.

[0095] In addition, based on the different failure modes of the fault, the screening methods used in the specific implementation of the method of this embodiment are different. Since faults are generally divided into permanent faults and transient faults. A permanent fault refers to a fault that occurs and persists until it is removed or repaired. Once this fault occurs, it will continue to affect the performance and function of the chip until appropriate measures are taken to repair it. Permanent faults may be caused by a variety of reasons, such as circuit connection errors, component failure, chip connection burnout, and corrosion of the connection between the chip core logic and the package. A transient fault refers to a fault that occurs once and then disappears. This fault is short-lived and random, and may be caused by external factors (such as particle radiation) or internal factors (such as component aging, timing problems). Transient faults may lead to consequences such as chip performance degradation, data errors, or functional failures. A typical example of a transient fault is a soft error caused by a single particle upset effect (SEU) and a single particle transient pulse (SET). These faults are caused by a single high-energy particle in the universe shooting into the sensitive area of ​​a semiconductor device, causing the device logic state to flip. Due to the randomness and unpredictability of particles, the occurrence and consequences of this fault are very uncertain.

[0096] Since permanent faults persist once they occur, no external environment is required to detect them. However, transient faults are caused by external environment, so external error-causing environment needs to be applied to detect them.

[0097] In order to efficiently and accurately screen out vulnerable units, this step includes the following steps during its specific implementation:

[0098] Step K1: Identify safety-related circuit modules.

[0099] a. Determine the safety target: Based on the function and type of the chip circuit, consider the events in the circuit structure that deviate from the preset safety target as top events, and consider the circuit modules that cause the top events as bottom events to determine the safety target.

[0100] b. Constructing a fault tree model: Starting from the top event of the fault tree, from top to bottom, the previous level event is represented by the next level event, until it is decomposed to a level suitable for formal analysis. The specific level of decomposition is determined according to factors such as the scale of the circuit, the overall analysis efficiency, and the granularity of the analysis.

[0101] c. Identification of fragile modules: Use Boolean logic functions to solve the cut sets of the fault tree model. All the bottom-level direct cause events constitute the cut sets of the fault tree. The cut sets are the fragile modules in the decomposed circuit.

[0102] Step K2: Screen vulnerable units based on formal methods.

[0103] a. Describe the fault model: Use a formal language to describe the fault model, add the fault model to the analyzed node of the replica circuit, and implement fault injection.

[0104] b. Establish a fault timing propagation dependency graph: Based on the dependency relationship between fault propagation, establish a fault timing propagation dependency graph.

[0105] c. Establish a timing equivalence check model: Based on the fault propagation characteristics, at each dependency level, determine whether the detection nodes in the original circuit and the replica circuit after the transient fault occurs are equivalent.

[0106] d. Identify vulnerable units: Determine whether all pairs of output variables in the replica circuit are equivalent pairs. If any pair of output variables is not equivalent, then the analysis node is a transient fault vulnerable point; otherwise, it is not a vulnerable point. Based on the screened vulnerable points, the vulnerable units are determined.

[0107] The method of the present invention is further described in detail below with reference to a specific application example. Specifically, the safety function of the chip is analyzed by taking the torque management function as an example.

[0108] First, combine Figure 3 As shown in the figure, a fault tree is established with the safety goal of "MCU failure leading to unexpected steering assistance", and the problem of functional failure caused by failure of three modules, CAN, CPU and memory, is located; then a more detailed fault tree analysis is performed on these modules, in which the next layer of CAN is decomposed into two main problems, "CAN transceiver" and "CAN line short circuit". In order to complete more accurate fault location, it is necessary to further subdivide the cause of the fault, and select "CAN transceiver" and "RAM fault" for fault disassembly. The former can locate two problems, "signal fault" and "transmission protocol fault"; the latter can locate three problems, "control logic", "power supply" and "timing logic". So far, some relatively low-level fault event types for the top event "MCU failure leading to unexpected steering assistance" have been obtained, but for the transient fault location of automotive-grade chips, this type of fault cause is still too large, and it is necessary to continue to subdivide and locate it to the specific signal and component level. Therefore, the "transmitter signal fault" event in the fault tree is selected for the second stage of fault tree location analysis.

[0109] Combination Figure 4 As shown in the figure, we select "CAN transmitter signal failure" as the top event of the fault tree in the second part, carry out the analysis at the component level and use the analysis results to verify the importance of the calculation unit. Through the fault tree analysis of "CAN transmitter signal failure", we first get three signals that are critical to the top event, and then analyze the signals to get 11 register units that affect them. So far, the analysis has reached the component level. The next step is to calculate the probability of transient failure of each of these registers, qi , and sort them by importance to obtain the importance of these registers for protecting the top event.

[0110]

[0111] Table 1 above shows the importance of the located registers for the bus transmission module. When testing or designing, the registers with high importance that are arranged in front can be tested for key safety first to improve the safety performance of the entire chip, thereby obtaining a high-performance automotive-grade chip.

[0112] Combination Figure 2 As shown, in order to evaluate the impact of multiple screened fragile units when a chip fails, this embodiment also discloses a method for measuring the importance of the screened fragile units, and sorts each fragile unit according to the calculated importance measurement.

[0113] Fragile Unit X i There are two states of occurrence: state 1 when a transient fault occurs, and state 0 when no transient fault occurs, which can be expressed as:

[0114]

[0115] Set safety failure events that violate safety goals There are two states of occurrence: state 1 when it occurs, and state 0 when it does not occur, which can be expressed as:

[0116]

[0117] F s (t) is the probability of safety failure of the top event, which can be expressed as:

[0118]

[0119] The importance of a fragile unit reflects the degree of influence of a transient fault in a fragile unit on the functional safety failure of the chip. The importance of a fragile unit is the basis for targeted safety design optimization and efficient safety testing and fault diagnosis. In the test and verification phase, priority is given to testing logic units with high importance, so that faults can be discovered early with a higher probability. In the importance analysis, it is necessary to structurally analyze the influence of each transient fault on the occurrence of the top event, and also to consider the influence of the change in the probability of transient fault on the change in the probability of the top event.

[0120] Specifically, the steps of evaluating and ranking the importance of vulnerable units include:

[0121] Step S41, obtaining the critical importance of each fragile unit according to the ratio of the change rate of the bottom event failure probability in the fragile module to the change rate of the probability of causing the top event corresponding to each fragile unit; and obtaining the structural importance of each fragile unit according to the influence of the transient failure of each fragile unit on the occurrence of the top event.

[0122] Step S42: Determine the unit importance of each fragile unit according to the key importance and the structural importance corresponding to each fragile unit.

[0123] Step S43: sort the probability of transient failure of fragile units according to the importance of each fragile unit, and output it.

[0124] Importance includes: key importance and structural importance, among which structural importance It is to structurally analyze and calculate the impact of transient failures of each vulnerable unit on the occurrence of the top event. The larger the calculated value, the more important the transient failure of this logic unit is to the top event. The critical importance is mainly used to measure the importance of each logic unit from the dual perspectives of sensitivity and probability.

[0125] At time t, if the fault tree model contains n logical units (X1, X2, …, X n ). Set the logical unit X i As the analysis object, the number of occurrence state combinations of other logic units is 2 n-1 The combination of the occurrence states of these logic units ( i ,x), some combinations can make the logic unit X i When the occurrence state of is 1, the top event occurs, that is, The logic unit X i When no transient fault occurs, the top event will not occur, that is, In this case, the logic unit X i The occurrence of the top event becomes critical. These make the logic unit X i The number of state combinations that become key logic units is:

[0126]

[0127] Therefore, we get the computational logic unit X i The structural importance of

[0128]

[0129] Key Importance I CR(i) represents the ratio of the rate of change of the bottom event failure probability to the rate of change of the top event caused by it. This is a standard for measuring the importance of each logic unit from the perspective of sensitivity and probability. The key importance calculation expression is:

[0130]

[0131] From the above analysis, we can see that structural importance and key importance reflect the impact of transient faults on top events from different perspectives, so the concept of unit importance is proposed. i The unit importance is the weighted sum of the structural importance and the key importance. By adjusting the weights of the two importances, the focus of the investigation can be changed according to the goal when analyzing chip transient failures. The formula for unit importance is as follows:

[0132]

[0133] ω1+ω2=1

[0134] Among them, R i It is the relative importance of the failure of the top event safety goal. is the structural importance, I CR (i) is the key importance. ω1,ω2 represent the weights of these two importances.

[0135] In this embodiment, the vulnerability of each vulnerable unit can be ranked by the unit importance standard, thereby improving the efficiency of locating transient faults.

[0136] Based on the above-mentioned method for screening fragile units in automotive-grade chips, the present application also provides a system for screening fragile units in automotive-grade chips, such as Figure 5 As shown, including:

[0137] The circuit extraction module 510 is used to analyze the circuit structure of the automotive-grade chip to be tested and extract the circuit module associated with the preset safety target; its function is as described in step S1.

[0138] The circuit analysis module 520 is used to analyze the circuit module and identify the vulnerable module that causes the fault event; its function is as described in step S2.

[0139] The screening module 530 is used to analyze and test the screened vulnerable modules based on an equivalence test method to screen out vulnerable units in the vulnerable modules. Its function is as described in step S3.

[0140] Furthermore, the circuit extraction module includes: a top event determination unit and a circuit module extraction unit.

[0141] The top event determination unit is used to determine the top events that deviate from the preset safety target in the automotive-grade chip to be tested according to the chip type and chip function;

[0142] The circuit module extraction unit is used to analyze the circuit structure of the automotive-grade chip to be tested according to the fault propagation path corresponding to the top event, and extract the circuit module associated with the preset safety target.

[0143] Furthermore, the circuit analysis module includes: a fault tree construction unit and a fragile module screening unit.

[0144] A fault tree construction unit, used to construct a fault tree model according to the hierarchical structure between the connection nodes in the circuit module and the superior-subordinate decomposition relationship between the hierarchical levels;

[0145] The fragile module screening unit is used to screen out fragile modules in the circuit module based on the fault tree model.

[0146] Furthermore, the vulnerable module screening unit includes: a calculation and derivation subunit.

[0147] The calculation and derivation subunit is used to solve the fault tree model by using Boolean operations, determine the minimum cut set of the fault tree model, and use the circuit logic unit combination corresponding to the minimum cut set as the fragile module.

[0148] Furthermore, the screening module includes: a dependency graph construction unit, a screening node unit and a screening determination unit.

[0149] The dependency graph construction unit is used to perform fault injection on the analyzed nodes in the vulnerable module and establish a fault timing propagation dependency graph;

[0150] The node screening unit is used to determine whether the output variable of the analysis node after the transient fault occurs is equivalent to the output variable when the transient fault does not occur based on the fault timing propagation dependency graph, and obtain an equivalence analysis result;

[0151] The screening and determination unit is used to screen out the vulnerable unit according to the location of the analysis node where the output variables are not equivalent in the equivalence analysis result.

[0152] Furthermore, the dependency graph construction unit includes: a replica establishment subunit, a fault injection subunit and a dependency graph generation subunit.

[0153] The replica establishing subunit is used to establish a replica circuit with the same circuit structure as that corresponding to the fragile module;

[0154] The fault injection subunit is used to add a formally described fault model to the analysis node in the replica circuit to perform fault injection;

[0155] The dependency graph generation subunit is used to construct a fault timing propagation dependency graph according to the fault propagation timing between various connection nodes when a fault is injected into the replica circuit.

[0156] Furthermore, the step of determining whether the output variable of the analysis node after the transient fault occurs is equivalent to the output variable when the transient fault does not occur based on the fault sequence propagation dependency graph to obtain the equivalence analysis result includes:

[0157] For each analysis node in the fault sequence propagation dependency graph, starting from the first dependency level where each analysis node is located, it is determined step by step whether each output node is equivalent to the output variable when no transient fault occurs at each dependency level, and the equivalence analysis result is obtained.

[0158] Furthermore, the system also includes: a key importance calculation module, a structure importance calculation module, a unit importance calculation module and a sorting module.

[0159] A critical importance calculation module is used to obtain the critical importance of each fragile unit according to the ratio of the change rate of the bottom event failure probability in the fragile module to the change rate of the probability of the top event corresponding to each fragile unit;

[0160] The structural importance calculation module is used to obtain the structural importance of each fragile unit according to the influence of the transient fault of each fragile unit on the occurrence of the top event;

[0161] A unit importance calculation module, used to determine the unit importance of each fragile unit according to the key importance and structural importance corresponding to each fragile unit;

[0162] The sorting module is used to sort the probability of transient failure of fragile units according to the importance of each fragile unit and output it.

[0163] Based on the disclosure of the above-mentioned method and system, the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more computer-readable programs, and the one or more computer-readable programs can be executed by one or more processors. When the computer-readable program is executed by the processor, the hardware fault location method of the automotive-grade chip is implemented.

[0164] Existing automotive chip detection methods mostly focus on macro testing, lacking the ability to analyze and reveal security vulnerabilities from a micro level, thus limiting targeted design and accurate safety assessment. Aiming at the problem that the current functional safety testing methods for automotive-grade chips cannot accurately identify vulnerable units, the present invention establishes a method combining the fault tree method and equivalence test according to the characteristics of fault signal transmission in the chip circuit, and conducts a comprehensive analysis of possible fault events in the chip, thereby achieving efficient and complete identification of vulnerable units in the chip circuit, and providing a guarantee for the safety performance of automotive-grade chips.

[0165] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for screening fragile units in automotive-grade chips, characterized in that: include: Analyze the circuit structure of the automotive-grade chip to be tested and extract the circuit modules associated with the preset safety goals; Analyze circuit modules to identify vulnerable modules that cause failure events; The screened vulnerable modules are analyzed and tested based on the equivalence test method to screen out the vulnerable units in the vulnerable modules.

2. The method for screening fragile units in automotive-grade chips according to claim 1, characterized in that: The step of analyzing the circuit structure of the automotive-grade chip to be tested and extracting the circuit module associated with the preset safety target includes: Determine the top events that deviate from the preset safety goals in the automotive-grade chip to be tested based on the chip type and chip function; According to the fault propagation path corresponding to the top event, the circuit structure of the automotive-grade chip to be tested is analyzed, and the circuit module associated with the preset safety target is extracted.

3. The method for screening fragile units in automotive-grade chips according to claim 1, characterized in that: The step of analyzing the circuit modules to identify the vulnerable modules causing the fault events includes: Constructing a fault tree model according to the hierarchical structure between the connection nodes in the circuit module and the superior-subordinate decomposition relationship between the hierarchical levels; The vulnerable modules in the circuit modules are screened out based on the fault tree model.

4. The method for screening fragile units in automotive-grade chips according to claim 3, characterized in that: The step of screening out vulnerable modules in the circuit modules based on the fault tree model comprises: The fault tree model is solved by using Boolean operations to determine the minimum cut set of the fault tree model, and the circuit logic unit combination corresponding to the minimum cut set is used as the fragile module.

5. The method for screening fragile units in automotive-grade chips according to claim 1, characterized in that: The steps of analyzing and testing the screened vulnerable modules based on the equivalence test method to screen out the vulnerable units in the vulnerable modules include: Inject faults into the analyzed nodes in the vulnerable module and establish a fault timing propagation dependency graph; Based on the fault sequence propagation dependency graph, determine whether the output variables of the analysis node after the transient fault occurs are equivalent to the output variables before the transient fault occurs, and obtain the equivalence analysis results; According to the location of the analysis nodes where the output variables are not equivalent in the equivalence analysis results, the fragile units are screened out.

6. The method for screening fragile units in automotive-grade chips according to claim 5, characterized in that: The steps of injecting faults into the analyzed nodes in the vulnerable module and establishing a fault timing propagation dependency graph include: Establishing a replica circuit having the same circuit structure as that corresponding to the fragile module; Adding a formally described fault model to the analysis node in the replica circuit to perform fault injection; According to the fault propagation timing between each connection node when the fault is injected in the replica circuit, a fault timing propagation dependency graph is constructed.

7. The method for screening fragile units in automotive-grade chips according to claim 5, characterized in that: The step of determining whether the output variable of the analysis node after a transient fault occurs is equivalent to the output variable when no transient fault occurs based on the fault sequence propagation dependency graph, and obtaining the equivalence analysis result comprises: For each analysis node in the fault sequence propagation dependency graph, starting from the first dependency level where each analysis node is located, it is determined step by step whether each output node is equivalent to the output variable when no transient fault occurs at each dependency level, and the equivalence analysis result is obtained.

8. The method for screening fragile units in an automotive-grade chip according to any one of claims 1 to 7, characterized in that: After the step of screening out the vulnerable units in the vulnerable module, the method further includes: According to the ratio of the change rate of the bottom event failure probability in the fragile module to the change rate of the top event occurrence probability corresponding to each fragile unit, the critical importance of each fragile unit is obtained; And, according to the influence degree of the transient fault occurrence of each fragile unit on the occurrence of the top event, the structural importance of each fragile unit is obtained; Determining the unit importance of each fragile unit according to the key importance and structural importance corresponding to each fragile unit; According to the importance of each fragile unit, the probability of transient failure of the fragile units is ranked and output.

9. A screening system for fragile units in automotive-grade chips, characterized in that: include: The circuit extraction module is used to analyze the circuit structure of the automotive-grade chip to be tested and extract the circuit modules associated with the preset safety goals; A circuit analysis module is used to analyze the circuit modules and identify the vulnerable modules that cause the failure events; The screening module is used to analyze and test the screened vulnerable modules based on an equivalence test method, and screen out the vulnerable units in the vulnerable modules.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more computer-readable programs, and the one or more computer-readable programs can be executed by one or more processors. When the computer-readable program is executed by the processor, the method for screening fragile units in the automotive-grade chip as described in any one of claims 1-8 is implemented.

Images