MCU fault monitoring method, circuit system and electronic equipment

Abstract

The invention provides an MCU fault monitoring method, a circuit system and an electronic device, and the method comprises the steps: enabling an MCU to obtain a standard seed value from a fault monitoring unit in a first time window; in a second time window, the MCU converts the obtained seed value according to the first conversion relation to obtain a corresponding response value, and outputs the response value and the seed value to a fault monitoring unit; the fault monitoring unit performs fault judgment according to the first actual time, the second actual time, the actual conversion relation and the actual seed value and outputs a corresponding judgment signal to the MCU, and the MCU analyzes the judgment signal, so that not only can a single fault of the MCU be monitored, but also multiple faults of the MCU can be monitored; therefore, the safety of the MCU is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of integrated circuits, and in particular to a fault monitoring method, a circuit system and an electronic device of an MCU. Background Art

[0002] In automotive-grade embedded systems, MCU is the core processing unit. The stability and reliability of MCU will directly affect the safety of system functions, so fault monitoring of MCU is crucial.

[0003] The prior art monitors the fault of the MCU by setting a watchdog. The existing watchdog generally includes a window watchdog based on a timeout reset mechanism and a question-and-answer watchdog based on a question-and-answer result verification mechanism.

[0004] However, the existing technology can only monitor a single fault that occurs in the MCU. When the MCU has multiple faults, the existing technology may not be able to monitor and thus cannot meet the safety requirements of the MCU.

[0005] Therefore, providing a fault monitoring method that can monitor multiple faults in MCU has become a technical problem that the industry urgently needs to solve. Summary of the invention

[0006] The embodiment of the present invention provides a fault monitoring method, a circuit system and an electronic device of an MCU, so as to solve the problem that the prior art cannot monitor various faults of the MCU.

[0007] In order to solve the above technical problems, the technical solution of the present invention provides a fault monitoring method of an MCU, the method comprising:

[0008] In a first time window, the MCU obtains a standard seed value from the fault monitoring unit;

[0009] In the second time window, the MCU converts the obtained seed value according to the first conversion relationship to obtain a corresponding response value, and outputs both the response value and the seed value to the fault monitoring unit;

[0010] The fault monitoring unit performs fault determination according to the first actual time, the second actual time, the actual conversion relationship and the actual seed value and outputs a corresponding determination signal to the MCU;

[0011] The MCU analyzes the input determination signal to obtain a specific cause of the fault, so as to realize fault monitoring of the MCU;

[0012] Among them, the first actual time is used to represent the actual time when the fault monitoring unit outputs the standard seed value; the second actual time is used to represent the actual time when the fault monitoring unit receives the response value and the seed value; the actual conversion relationship is used to represent the actual conversion relationship between the response value and the seed value; the actual seed value is used to represent the actual value of the seed value received by the fault monitoring unit.

[0013] Optionally, the MCU analyzes the input determination signal, specifically including:

[0014] If the determination signal indicates that the first actual time exceeds the first time window or the second actual time exceeds the second time window, the MCU determines that there is a fault in its own program running cycle;

[0015] If the determination signal indicates that the actual conversion relationship is not equal to the first conversion relationship, the MCU determines that there is a fault in its own program calculation;

[0016] If the determination signal indicates that the seed value is not equal to the standard seed value, the MCU determines that a fault exists in its own communication link.

[0017] Optionally, the method further comprises: the fault monitoring unit performs fault counting in addition to fault determination;

[0018] If the first actual time exceeds the first time window or the second actual time exceeds the second time window, the fault monitoring unit increases the fault count value by a first value;

[0019] If the actual conversion relationship is not equal to the first conversion relationship and / or the actual seed value is not equal to the standard seed value, the fault monitoring unit increases the fault count value by a second value;

[0020] If the first actual time and the second actual time do not exceed the first time window and the second time window respectively, the actual conversion relationship is equal to the first conversion relationship, and the actual seed value is equal to the standard seed value, the fault monitoring unit reduces the fault count value by a third value;

[0021] The first value and the second value are both greater than the third value.

[0022] Optionally, the method further includes:

[0023] If the fault count value is greater than or equal to a first threshold, the fault monitoring unit outputs a first threshold signal to the MCU;

[0024] If the fault count value is less than or equal to a second threshold, the fault monitoring unit outputs a second threshold signal to the MCU;

[0025] The first threshold is greater than or equal to the second threshold.

[0026] Optionally, if the actual conversion relationship is equal to the first conversion relationship, and the actual seed value is equal to the standard seed value, the standard seed value is updated.

[0027] Optionally, the fault monitoring unit specifically includes a watchdog.

[0028] The technical solution of the present invention further provides a circuit system, comprising: an MCU and a solenoid valve driving chip, wherein the solenoid valve driving chip comprises a fault monitoring unit and a plurality of driving modules, each of which is used to drive a solenoid valve; the MCU is used to control the driving of the plurality of driving modules through a driving control signal;

[0029] The MCU and the fault monitoring unit perform fault monitoring on the MCU through the fault monitoring method for the MCU described in claim 4.

[0030] Optionally, if the fault count value of the fault monitoring unit is greater than or equal to a first threshold, the fault monitoring unit outputs a first threshold signal to the MCU;

[0031] The MCU is reset according to the first threshold signal;

[0032] If the fault count value of the fault monitoring unit is less than or equal to a second threshold, the fault monitoring unit outputs a second threshold signal to the MCU;

[0033] The MCU also controls the functional circuit module where the fault monitoring unit is located according to the second threshold signal;

[0034] The first threshold is greater than or equal to the second threshold.

[0035] Optionally, if the fault count value of the fault monitoring unit is greater than or equal to a first threshold, the fault monitoring unit controls the plurality of driving modules to be turned off;

[0036] If the fault count value of the fault monitoring unit is greater than or equal to a second threshold, the fault monitoring unit controls the plurality of driving modules to be turned on;

[0037] If the fault count value of the fault monitoring unit is greater than the second threshold value and less than the first threshold value, the fault monitoring unit controls the plurality of driving modules to be locked;

[0038] The first threshold is greater than or equal to the second threshold.

[0039] The technical solution of the present invention further provides an electronic device, comprising the circuit system.

[0040] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects:

[0041] The fault monitoring method of MCU provided by the technical solution of the present invention enables the MCU to obtain a standard seed value from a fault monitoring unit within a first time window, and output the obtained actual seed value and a response value corresponding to the actual seed value to the fault monitoring unit within a second time window. The fault monitoring unit will perform fault determination and output a corresponding determination signal to the MCU based on the first actual time, the second actual time, the actual conversion relationship and the actual seed value, so that the MCU can monitor a single fault of the MCU through analysis of the determination signal, and can also monitor the existence of multiple faults in the MCU, thereby greatly improving the safety of the MCU.

[0042] Furthermore, by setting the first value and the second value to be greater than the third value, intermittent faults of the MCU cannot be monitored.

[0043] The circuit system provided by the technical solution of the present invention controls a plurality of driving modules accordingly according to the interval in which the fault count value is located, thereby improving the safety performance of the solenoid valve driving chip. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 The process of the MCU fault monitoring method provided by the embodiment of the present invention Figure 1 ;

[0045] Figure 2 The process of the MCU fault monitoring method provided by the embodiment of the present invention Figure 2 ;

[0046] Figure 3 A schematic diagram of a module of a circuit system provided by an embodiment of the present invention;

[0047] Figure 4 A schematic diagram of a module of a fault monitoring unit provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present invention. The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0049] As described in the background technology, the existing technology can only monitor a single fault that occurs in the MCU. When the MCU has multiple faults, the existing technology may not be able to monitor, and thus cannot meet the safety requirements of the MCU. The following will explain the problems existing in the existing technology:

[0050] For the existing window-type watchdog, the window-type watchdog is equipped with a programmable down counter, and the MCU needs to feed the dog within the specified time window to refresh the counter. When the MCU fails to feed the dog within the specified time window, the counter will be reset to zero, and the watchdog will reset the MCU. However, the problem with this solution is that it can only monitor the program operation cycle failure of the MCU, but cannot monitor the program calculation failure of the MCU and the communication link failure of the MCU.

[0051] For the existing question-and-answer watchdog based on pseudo-random sequence, the question-and-answer watchdog is provided with seed values ​​arranged in order, each seed value corresponds to a response value and a response window, and the MCU will obtain the seed value in order and calculate the corresponding response value, and feed the corresponding response value to the dog within the specified time window. The watchdog will make a judgment based on the response value corresponding to the feeding time window to detect whether there is a fault in the program calculation and program operation cycle of the MCU. However, the problem with this solution is that when there is a fault in the program calculation and program operation cycle of the MCU, for example, the seed value obtained by the MCU is S1, and when the MCU has no fault, the dog response value A1 should be fed in the response window T1. However, due to the fault of the program calculation and program operation cycle of the MCU, the MCU feeds the dog response value A2 in the response window T2. Since the response value of the response window T2 corresponds to A2, the watchdog will not be able to detect that the MCU has a fault, and thus cannot monitor the above fault.

[0052] In view of this, an embodiment of the present invention provides a new fault monitoring method for MCU, wherein the MCU and the fault monitoring unit communicate via SPI. The method can monitor various faults of the MCU, thereby greatly improving the safety of the MCU.

[0053] Before describing the embodiments of the present invention, a brief description of possible faults of the MCU is given below:

[0054] 1. There may be a fault in the MCU's program running cycle, causing the MCU to be unable to complete the corresponding task within the set time.

[0055] 2. There may be a fault in the MCU's program calculation, causing the MCU to be unable to accurately perform the corresponding task.

[0056] 3. The MCU's communication link may fail due to electromagnetic interference, causing the MCU to be unable to communicate normally with other functional modules in the system.

[0057] in, Figure 1 The process of the MCU fault monitoring method provided by the embodiment of the present invention Figure 1 .

[0058] Please refer to Figure 1 The MCU fault monitoring method provided by the embodiment of the present invention comprises the following steps:

[0059] S1: Within the first time window, the MCU obtains a standard seed value from the fault monitoring unit.

[0060] S2: In the second time window, the MCU converts the obtained seed value according to the first conversion relationship to obtain a corresponding response value, and outputs both the response value and the seed value to the fault monitoring unit.

[0061] S3: the fault monitoring unit performs fault determination according to the first actual time, the second actual time, the actual conversion relationship and the actual seed value and outputs a corresponding determination signal to the MCU;

[0062] Among them, the first actual time is used to represent the actual time when the fault monitoring unit outputs the standard seed value; the second actual time is used to represent the actual time when the fault monitoring unit receives the response value and the seed value; the actual conversion relationship is used to represent the actual conversion relationship between the response value and the seed value; the actual seed value is used to represent the actual value of the seed value received by the fault monitoring unit.

[0063] S4: The MCU analyzes the input determination signal to obtain a specific cause of the fault, so as to implement fault monitoring of the MCU.

[0064] Through the above technical means, the embodiment of the present invention can not only monitor a single fault of the MCU, but also monitor multiple faults of the MCU. The specific principle is as follows:

[0065] First, an example is given of the setting of the standard seed value in the fault monitoring unit: several standard seed values ​​are set in sequence in the fault monitoring unit, including: standard seed value S1, standard seed value S2, standard seed value S3 and standard seed value S4, each seed value is also set with a corresponding response value: response value A1, response value A2, response value A3 and response value A4, each response value is also set with a corresponding response window: response window T1, response window T2, response window T3 and response window T4.

[0066] Since the first actual time and the second actual time both represent whether there is a fault in the program running cycle of the MCU, the actual conversion relationship represents whether there is a fault in the program calculation of the MCU, and the actual seed value represents whether there is a fault in the communication link of the MCU, the fault monitoring unit makes a fault judgment based on the first actual time, the second actual time, the actual conversion relationship and the actual seed value, respectively, and can monitor the program running cycle fault, program calculation fault and communication link fault that exist separately in the MCU.

[0067] In addition, when the MCU has both a program operation cycle failure and a communication link failure, for example, due to a failure in the communication link of the MCU, the standard seed value S1 that the MCU should have obtained becomes the standard seed value S2, that is, the actual seed value is equal to the standard seed value S2, and the standard seed value S2 is converted into the response value A2 according to the first conversion relationship. Due to a failure in the program operation cycle of the MCU, the time window for the MCU to output the response value will change from the response window T1 to the response window T2 because it exceeds the second time window, so the fault monitoring unit will first determine that the second actual time is not within the second time window, and output the corresponding determination signal to the MCU. Of course, in other examples, the time for the MCU to output the response value may also be advanced due to a program operation cycle failure, which is not given as an example here. After receiving the response value A2 and the actual seed value S2 in the response window T2, the fault monitoring unit will determine that the actual seed value S2 does not meet the standard seed value S1 that the MCU should have obtained and output the corresponding determination signal to the MCU. The MCU determines that both the program operation cycle and the communication link are faulty according to the input determination signal.

[0068] When the MCU has both a program running cycle fault and a program calculation fault, for example, after the MCU obtains the standard seed value S1, the standard seed value S1 is converted into the response value A2 due to the program calculation fault of the MCU. Since there is a fault in the program running cycle of the MCU, the time window for the MCU to output the response value will change from response window T1 to response window T2 because it exceeds the second time window. Therefore, the fault monitoring unit will first determine that the second actual time is not within the second time window, and output the corresponding determination signal to the MCU. After receiving the response value A2 and the actual seed value S1 in the response window T2, the fault monitoring unit will determine that the actual seed value S1 and the response value A2 do not conform to the first conversion relationship, and output the corresponding determination signal to the MCU. The MCU determines that both the program running cycle and the program calculation fault are faulty based on the input determination signal.

[0069] When the MCU has both a communication link failure and a program calculation failure, for example, due to a failure in the communication link of the MCU, the standard seed value S1 that the MCU should have obtained becomes the standard seed value S2, that is, the actual seed value is equal to the standard seed value S2. And because the MCU has a program calculation failure, the standard seed value S2 is converted into the response value A1. After receiving the response value A1 and the actual seed value S2 in the response window T1, the fault monitoring unit will determine that the actual seed value S2 and the response value A1 do not conform to the first conversion relationship, and that the actual seed value S2 does not conform to the standard seed value S1 that the MCU should have obtained, and output a corresponding determination signal to the MCU. The MCU determines that both the communication link and the program calculation failures are faulty based on the input determination signal.

[0070] Based on the above description, the embodiment of the present invention can not only monitor a single fault of the MCU, but also monitor multiple faults of the MCU.

[0071] In order to make the above-mentioned objects, features and beneficial effects of the present invention more obvious and easy to understand, specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0072] in, Figure 2 The process of the MCU fault monitoring method provided by the embodiment of the present invention Figure 1 .

[0073] Please refer to Figure 2 As a specific implementation, in step S3, the fault monitoring unit not only performs fault determination and outputs a corresponding determination signal to the MCU, but also performs fault counting according to the fault determination. The specific steps include the following:

[0074] S31: If the first actual time exceeds the first time window or the second actual time exceeds the second time window, the fault monitoring unit increases the fault count value by a first value.

[0075] S32: If the actual conversion relationship is not equal to the first conversion relationship and / or the actual seed value is not equal to the standard seed value, the fault monitoring unit increases the fault count value by a second value.

[0076] S33: If the first actual time and the second actual time do not exceed the first time window and the second time window respectively, the actual conversion relationship is equal to the first conversion relationship, and the actual seed value is equal to the standard seed value, then the fault monitoring unit reduces the fault count value by a third value.

[0077] It should be noted that the first actual time exceeding the first time window and the second actual time exceeding the second time window will not occur in the same round of fault determination. Therefore, when the MCU fails to obtain the seed value within the first time window, the fault monitoring unit will determine that a fault exists and increase the first value of the fault count value, and end this round of clock fault determination. If the subsequent MCU also times out when outputting the obtained seed value and the corresponding response value to the fault determination unit, the fault determination unit will not increase the fault count value because the fault determination of this round of clock has ended. However, if the actual conversion relationship is not equal to the first conversion relationship and / or the actual seed value is not equal to the standard seed value, the fault monitoring unit will increase the second value of the fault count value. Therefore, the fault monitoring unit's fault determination of the clock and the fault determination of the logic are independent of each other.

[0078] It should be supplemented that when the first actual time and the second actual time do not exceed the first time window and the second time window respectively, the actual conversion relationship is equal to the first conversion relationship, and the actual seed value is equal to the standard seed value, the fault monitoring unit updates the standard seed value according to the set order.

[0079] As a preferred implementation, the first value and the second value are both set to be greater than the third value. This implementation can prevent the intermittent fault of the MCU from being unable to be recognized by the system, and the specific principle is as follows:

[0080] For example, the first value, the second value, and the third value are all set to 2.

[0081] In the first round of fault determination, if only the first actual time exceeds the first time window or the second actual time exceeds the second time window, the fault count value is increased by two.

[0082] In the second round of fault determination, if no fault occurs, the fault count value is reduced by two.

[0083] In the third round of fault determination, if only the actual conversion relationship is not equal to the first conversion relationship and / or the actual seed value is not equal to the standard seed value, the fault count value is increased by two.

[0084] In the fourth round of fault determination, if no fault occurs, the fault count value is reduced by two.

[0085] After the above four rounds of fault determination are completed, the fault count value is equal to zero, so the system cannot identify that the MCU has a fault through the fault count value, but this does not mean that the MCU does not have a fault.

[0086] If the first value and the second value are both set equal to three, and the third value is set equal to one.

[0087] After repeating the above four rounds of fault determination, the fault count value is equal to four, so the system can identify that the MCU has a fault through the fault count value, thereby avoiding the system being unable to identify due to intermittent faults of the MCU, and further improving the safety of the MCU.

[0088] Of course, the specific values ​​of the first value, the second value and the third value can be set according to the system's tolerance to MCU failures. If the system's tolerance to MCU failures is relatively high, the difference between the first value and the third value can be reduced, as well as the difference between the second value and the third value. If the system's tolerance to MCU failures is relatively low, the difference between the first value and the third value can be increased, as well as the difference between the second value and the third value can be increased.

[0089] In addition, the first value and the second value can be set to be the same or different, and can be set specifically according to the importance the system attaches to different MCU faults in different application scenarios. For example, if the system attaches more importance to the program running cycle of the MCU, the first value can be set to be greater than the second value; if the system attaches more importance to the communication link and degree calculation of the MCU, the second value can be set to be greater than the first value, and there is no limitation here.

[0090] Please refer to Figure 2 As a specific implementation, after counting the faults, step S3 may further include:

[0091] S34: Determine whether the fault count value is greater than or equal to the first threshold value, if so, jump to S35; if not, jump to S36.

[0092] S35: The fault monitoring unit outputs a first threshold signal to the MCU.

[0093] S36: If the fault count value is less than or equal to a second threshold, the fault monitoring unit outputs a second threshold signal to the MCU.

[0094] The first threshold value may be used to represent the upper limit of the number of MCU failures that the system can tolerate, or may be represented as the number of failures for which a stage warning is issued to the MCU, which is not limited this time.

[0095] If the first threshold represents the upper limit of the number of MCU failures, the first threshold signal can be used to reset the MCU. If the first threshold represents the number of failures for which the MCU is given a stage warning, the first threshold signal can be used to warn the MCU.

[0096] The second threshold is used to characterize the upper limit of the number of failures at which the communication, degree operation status and program calculation results of the MCU are all valid, so the second threshold is less than or equal to the first threshold. The second threshold signal is used to indicate that the communication, degree operation status and program calculation results of the MCU are all valid.

[0097] In summary, the MCU fault monitoring method provided by the embodiment of the present invention enables the MCU to output the response value together with the obtained seed value, so that the fault monitoring unit performs fault determination and outputs the corresponding determination signal to the MCU according to the first actual time, the second actual time, the actual conversion relationship and the actual seed value, so as to obtain the specific cause of the fault through the analysis of the determination signal by the MCU. Therefore, the fault monitoring unit can not only monitor a single fault of the MCU, but also monitor the existence of multiple faults in the MCU, thereby greatly improving the safety of the MCU.

[0098] Furthermore, by setting the first value and the second value to be greater than the third value, it is avoided that the intermittent fault of the MCU cannot be monitored, and the safety of the MCU is further improved.

[0099] Furthermore, after obtaining the specific cause of the fault, the MCU can take different measures according to different application scenarios.

[0100] in, Figure 3 A schematic diagram of a module of a circuit system provided by an embodiment of the present invention.

[0101] Please refer to Figure 3 The embodiment of the present invention further provides a circuit system, including: an MCU 10 and a solenoid valve driving chip 20, wherein the solenoid valve driving chip 20 includes a fault monitoring unit 21 and a plurality of driving modules 22, each of which is used to drive a solenoid valve; the MCU 10 is used to control the driving of the plurality of driving modules 21 through a driving control signal v1;

[0102] The MCU 10 is used to control the solenoid valve driving chip 20; the solenoid valve driving chip 20 includes a fault monitoring unit 21 and a plurality of driving modules 22, each of which is used to drive a solenoid valve;

[0103] The MCU 10 and the fault monitoring unit 21 perform fault monitoring on the MCU by using the fault monitoring method of the MCU.

[0104] Please refer to Figure 3 , the fault monitoring of MCU10 is described below:

[0105] The MCU 10 obtains a standard seed value from the fault monitoring unit 21 within a first time window;

[0106] After acquiring the standard seed value, the MCU 10 converts the acquired seed value according to the first conversion relationship within the second time window, and outputs both the response value and the seed value to the fault monitoring unit 21 .

[0107] After receiving the seed value and the response value, the fault monitoring unit 21 performs fault determination according to the first actual time, the second actual time, the actual conversion relationship and the actual seed value and outputs a corresponding determination signal to the MCU 10 .

[0108] Among them, the first actual time is used to represent the actual time when the fault monitoring unit 21 outputs the standard seed value; the second actual time is used to represent the actual time when the fault monitoring unit 21 receives the response value and the seed value; the actual conversion relationship is used to represent the actual conversion relationship between the response value and the seed value; the actual seed value is used to represent the actual value of the seed value received by the fault monitoring unit 21.

[0109] The MCU 10 analyzes the input determination signal to obtain the specific cause of the fault, so as to realize its own fault monitoring.

[0110] Specifically: if the determination signal indicates that the first actual time exceeds the first time window or the second actual time exceeds the second time window, the MCU 10 determines that there is a fault in its own program running cycle;

[0111] If the determination signal indicates that the actual conversion relationship is not equal to the first conversion relationship, the MCU 10 determines that there is a fault in its own program calculation;

[0112] If the determination signal indicates that the seed value is not equal to the standard seed value, the MCU 10 determines that a fault exists in its own communication link.

[0113] In addition to monitoring a single fault, multiple faults can also be monitored based on the fault determination of multiple determination signals. For example, if there is a determination signal indicating that the actual conversion relationship is not equal to the first conversion relationship, and there is a determination signal indicating that the seed value is not equal to the standard seed value, then MCU10 determines that both its communication link and program calculation are faulty.

[0114] After obtaining the specific cause of the fault, the MCU 10 can take corresponding measures according to different application scenarios of the solenoid valve driving chip 20 , which is not limited here.

[0115] In addition to monitoring the faults of the MCU 10, it is also necessary to monitor the severity of the faults. Therefore, the fault monitoring unit 21 performs fault counting in addition to fault determination, as follows:

[0116] If the first actual time exceeds the first time window or the second actual time exceeds the second time window, the fault monitoring unit 21 increases the fault count value by a first value;

[0117] If the actual conversion relationship is not equal to the first conversion relationship and / or the actual seed value is not equal to the standard seed value, the fault monitoring unit 21 increases the fault count value by a second value;

[0118] If the first actual time and the second actual time do not exceed the first time window and the second time window respectively, the actual conversion relationship is equal to the first conversion relationship, and the actual seed value is equal to the standard seed value, the fault monitoring unit 21 reduces the fault count value by a third value;

[0119] The first value and the second value are both greater than the third value, so as to avoid the circuit system being unable to recognize when an intermittent fault occurs in the MCU 10 .

[0120] When the fault count value is greater than or equal to the first threshold, it indicates that the MCU 10 can no longer normally control the functional circuit module 20 where the fault monitoring unit is located. Therefore, the fault monitoring unit 21 not only outputs the first threshold signal to the MCU 10 to reset the MCU 10, but also shuts down the plurality of drive modules 22, thereby ensuring the safety of the solenoid valve drive chip 20. Only when the fault count value is less than or equal to the second threshold can the plurality of drive modules 22 be restarted and the control of the plurality of drive modules 22 by the MCU 10 be restored.

[0121] When the fault count value is less than or equal to the second threshold, the fault monitoring unit 21 outputs a second threshold signal to the MCU 10 to indicate that the program running status, communication and calculation results of the MCU 10 are valid and can control the plurality of driving modules 22 normally.

[0122] If the first threshold is greater than the second threshold, when the fault count value is less than the first threshold and greater than the second threshold, the functional circuit module 20 where the fault monitoring unit is located is in a locked state, so that the MCU 10 cannot control the plurality of the driving modules 22. Only when the fault count value is less than or equal to the second threshold can the MCU 10 restore control over the plurality of the driving modules 22.

[0123] in, Figure 4 A schematic diagram of a module of a fault monitoring unit provided in an embodiment of the present invention.

[0124] Please refer to Figure 4As a specific implementation, the fault monitoring unit 21 includes: a configuration register 211, a seed value generator 212, a fault counter 217, a fault protection logic 218, a request window timer 214, a response window timer 215, a response value / seed value write-back detection logic 216 and a response value calculator 216;

[0125] The configuration register 211 includes: a request register 2111, a request timing window register 2112, a response timing window register 2113, a response value and seed value receiver 2114, a fault / correct count step configuration register 2115 and a fault count upper / lower limit configuration register 2116.

[0126] The working principle of the fault monitoring unit 21 will be described below in conjunction with the internal structure of the fault monitoring unit 21:

[0127] When the MCU initiates a request through the request register 2111, the seed value generator 212 generates a new seed value and outputs it to the response value calculator 216. The response value calculator 216 obtains the corresponding response value according to the input seed value, and outputs the standard seed value and the corresponding response value to the response value / seed value write back detection logic 216 as the dog feeding monitoring benchmark under the request. At the same time, the request timing window register 2112 also stores the time interval from the last response to this request and outputs it to the request window timer 214. If the time interval times out, the request window timer 214 outputs a first timeout signal to the fault counter 217.

[0128] When the response value and seed value acceptor 2114 accepts the actual response value and actual seed value returned by the MCU and outputs them to the response value / seed value write-back detection logic 216, the response value / seed value write-back detection logic 216 will determine whether the actual response value and actual seed value of the dog feeding are correct according to the standard seed value and the corresponding response value. If they are wrong, a dog feeding failure signal is output to the fault counter 217, and if they are successful, a dog feeding success signal is output to the fault counter 217. At the same time, the response timing window register 2113 will store the time interval from the last request to this response and output it to the response window timer 215. If the time interval is overdue, the request window timer 214 outputs a second timeout signal to the fault counter 217.

[0129] When the fault counter 217 receives the first timeout signal or the second timeout signal or the dog feeding failure signal, the fault count value is increased according to the fault step value stored in the fault / correct count step configuration register 2115. When the fault counter 217 does not receive the first timeout signal and the second timeout signal, and receives the dog feeding success signal, the fault count value is decreased according to the correct step value stored in the fault / correct count step configuration register 2115. The fault counter 217 outputs the fault count value to the fault protection logic 218.

[0130] The fault protection logic 218 compares the fault count upper limit value and the fault count lower limit value stored in the fault count upper / lower limit configuration register 2116 with the fault count value;

[0131] If the fault count value is greater than the fault count upper limit value, the fault protection logic 218 outputs the first threshold signal to the MCU and shuts down a plurality of drive modules 22 in the solenoid valve drive chip 20 .

[0132] If the fault count value is less than the fault count upper limit value and greater than the fault count lower limit value, the fault protection logic 218 controls the configuration register 211 in the solenoid valve driver chip 20 to be disabled, so that the internal circuit of the functional circuit module maintains the current state.

[0133] If the fault count value is less than the fault count lower limit value, the fault protection logic 218 outputs the second threshold signal to the MCU, and re-accepts the configuration of the configuration register 211 in the solenoid valve driver chip 20 by the MCU.

[0134] Therefore, according to the interval in which the fault count value is located, a number of driving modules are controlled accordingly, thereby improving the safety performance of the solenoid valve driving chip.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A fault monitoring method for MCU, characterized in that: The method includes: In a first time window, the MCU obtains a standard seed value from the fault monitoring unit; In the second time window, the MCU converts the obtained seed value according to the first conversion relationship to obtain a corresponding response value, and outputs both the response value and the seed value to the fault monitoring unit; The fault monitoring unit performs fault determination according to the first actual time, the second actual time, the actual conversion relationship and the actual seed value and outputs a corresponding determination signal to the MCU; The MCU analyzes the input determination signal to obtain a specific cause of the fault, so as to realize fault monitoring of the MCU; Among them, the first actual time is used to represent the actual time when the fault monitoring unit outputs the standard seed value; the second actual time is used to represent the actual time when the fault monitoring unit receives the response value and the seed value; the actual conversion relationship is used to represent the actual conversion relationship between the response value and the seed value; the actual seed value is used to represent the actual value of the seed value received by the fault monitoring unit.

2. The MCU fault monitoring method according to claim 1, characterized in that: The MCU analyzes the input determination signal, specifically including: If the determination signal indicates that the first actual time exceeds the first time window or the second actual time exceeds the second time window, the MCU determines that there is a fault in its own program running cycle; If the determination signal indicates that the actual conversion relationship is not equal to the first conversion relationship, the MCU determines that there is a fault in its own program calculation; If the determination signal indicates that the seed value is not equal to the standard seed value, the MCU determines that a fault exists in its own communication link.

3. The MCU fault monitoring method according to claim 2, characterized in that: The method further comprises: the fault monitoring unit performs fault counting in addition to fault determination; If the first actual time exceeds the first time window or the second actual time exceeds the second time window, the fault monitoring unit increases the fault count value by a first value; If the actual conversion relationship is not equal to the first conversion relationship and / or the actual seed value is not equal to the standard seed value, the fault monitoring unit increases the fault count value by a second value; If the first actual time and the second actual time do not exceed the first time window and the second time window respectively, the actual conversion relationship is equal to the first conversion relationship, and the actual seed value is equal to the standard seed value, the fault monitoring unit reduces the fault count value by a third value; The first value and the second value are both greater than the third value.

4. The MCU fault monitoring method according to claim 3, characterized in that: The method further includes: If the fault count value is greater than or equal to a first threshold, the fault monitoring unit outputs a first threshold signal to the MCU; If the fault count value is less than or equal to a second threshold, the fault monitoring unit outputs a second threshold signal to the MCU; The first threshold is greater than or equal to the second threshold.

5. The MCU fault monitoring method according to claim 1, characterized in that: If the actual conversion relationship is equal to the first conversion relationship, and the actual seed value is equal to the standard seed value, the standard seed value is updated.

6. The MCU fault monitoring method according to any one of claims 1 to 5, characterized in that: The fault monitoring unit specifically includes a watchdog.

7. A circuit system, characterized in that: It includes: an MCU and a solenoid valve driving chip; the solenoid valve driving chip includes a fault monitoring unit and a plurality of driving modules, each of which is used to drive a solenoid valve; the MCU is used to control the driving of the plurality of driving modules through a driving control signal; The MCU and the fault monitoring unit perform fault monitoring on the MCU through the fault monitoring method for the MCU described in claim 4.

8. The circuit system according to claim 7, characterized in that: If the fault count value of the fault monitoring unit is greater than or equal to a first threshold, the fault monitoring unit outputs a first threshold signal to the MCU; The MCU is reset according to the first threshold signal; If the fault count value of the fault monitoring unit is less than or equal to a second threshold, the fault monitoring unit outputs a second threshold signal to the MCU; The MCU also controls the functional circuit module where the fault monitoring unit is located according to the second threshold signal; The first threshold is greater than or equal to the second threshold.

9. The circuit system according to claim 7, characterized in that: If the fault count value of the fault monitoring unit is greater than or equal to a first threshold, the fault monitoring unit controls the plurality of driving modules to be turned off; If the fault count value of the fault monitoring unit is greater than or equal to a second threshold, the fault monitoring unit controls the plurality of driving modules to be turned on; If the fault count value of the fault monitoring unit is greater than the second threshold value and less than the first threshold value, the fault monitoring unit controls the plurality of driving modules to be locked; The first threshold is greater than or equal to the second threshold.

10. An electronic device, characterized in that: A circuit system comprising any one of claims 7 to 9.

Images