Initialization detection method and device of laser radar equipment and readable medium

Abstract

The invention provides an initialization detection method and device of laser radar equipment and a readable medium. The method comprises the steps that software and hardware security mechanism verification in a starting stage is carried out on the laser radar equipment; if the software and hardware security mechanism verification is passed, performing a security mechanism fault injection test on the laser radar equipment; and if the safety mechanism fault injection test passes, guiding the laser radar equipment to enter a working state, firstly executing the verification of the function safety mechanism in the initialization stage to ensure the safety of the starting process, then executing the fault injection test, and realizing the function safety verification through the triggering of the safety mechanism. The function safety verification result is more convincing, it is guaranteed that after the laser radar enters the normal operation state, the safety mechanism can effectively and reliably work, the function safety requirement ASIL-B is met, the system robustness is considered, and the method can be suitable for other embedded system equipment with the function safety requirement.

Description

Technical Field

[0001] The present application relates to the field of laser radar, and specifically to an initialization detection method, device and readable medium for laser radar equipment. Background Art

[0002] In the increasingly booming field of automobile autonomous driving, more and more automobile manufacturers are using LiDAR to realize the perception function of autonomous driving. LiDAR point cloud information that meets functional safety is a prerequisite for realizing the safety function of automobile autonomous driving. According to the HARA analysis of OEMs in the automotive industry, the functional safety level of LiDAR is defined as ASIL-B. How to ensure the safety of the LiDAR startup process and the effectiveness of the safety mechanism is an important and urgent issue. In the current existing technologies and patents, the safe startup during the initialization startup of embedded system devices is mainly in the following aspects: focusing on encryption and decryption verification of information security requirements, only for operating system startup verification, BSP startup verification or only for application verification. None of the above solutions can guarantee the safety of the initialization startup process and the effectiveness of the safety mechanism, and ensure the reliable and safe operation of the system. Summary of the invention

[0003] In view of the problem that existing technical solutions are unable to guarantee the security of the initialization startup process and the effectiveness of the security mechanism, and to ensure the reliable and safe operation of the system, the present application provides an initialization detection method, device and readable medium for laser radar equipment.

[0004] A first aspect of the present application provides an initialization detection method for a laser radar device, wherein the initialization detection method is performed during an initialization startup phase of the laser radar device, and includes:

[0005] Verify the software and hardware safety mechanisms of the laser radar device during the startup phase;

[0006] If the software and hardware safety mechanism verification passes, a safety mechanism fault injection test is performed on the laser radar device;

[0007] If the safety mechanism fault injection test passes, the lidar device is guided to enter a working state.

[0008] In an optional implementation, the checking of the software and hardware safety mechanism of the laser radar device at the startup phase includes:

[0009] The laser radar device is subjected to main boot loader startup verification, first stage loader startup verification, running memory self-test verification, configuration data reading and loading verification, system chip safety monitoring status verification, key safety device safety monitoring verification and initialization program flow monitoring verification.

[0010] In an optional implementation, the performing of a safety mechanism fault injection test on the laser radar device includes:

[0011] The laser radar device is subjected to an external hardware watchdog fault injection test, a running memory error correction fault injection test, and a software test library initialization test.

[0012] In an optional implementation, the performing a software test library initialization test on the laser radar device includes:

[0013] The laser radar device is subjected to a fault injection test of a core lock-step mode, a fault injection test of an internal bus, and a fault injection test of an internal access right.

[0014] In an optional implementation, performing a fault injection test in a core lockstep mode on the laser radar device includes:

[0015] Perform fault injection operations in core lockstep mode;

[0016] Determine whether the fault register state is consistent with the expected state;

[0017] If they are consistent, the fault injection test in core lockstep mode passes.

[0018] In an optional implementation, performing a fault injection test on an internal bus of the laser radar device includes:

[0019] Performing internal bus fault injection operations;

[0020] Determine whether the error interrupt in the internal bus is triggered;

[0021] If triggered, the fault injection test of the internal bus passes.

[0022] In an optional implementation, performing a fault injection test on the internal access rights of the laser radar device includes:

[0023] Perform fault injection operations with internal access permissions;

[0024] Determine whether the error interrupt in the internal access is triggered;

[0025] If triggered, the fault injection test for internal access permissions passes.

[0026] In an optional implementation, performing configuration data reading and loading verification on the laser radar device includes:

[0027] During the process of saving the configuration data to the flash memory, a cyclic redundancy check is used to check the configuration data;

[0028] In the process of configuration data being called in the random access memory, erroneous data in the configuration data is detected and corrected by adding redundant information to the configuration data.

[0029] In an optional implementation, the safety monitoring verification of key safety components of the laser radar device includes:

[0030] Monitoring the voltage of the power supply device of the laser transmission link and the receiving link, and verifying the power supply device according to the voltage;

[0031] Monitoring the temperature of key components of the laser transmission link and the receiving link, and verifying the key components according to the temperature;

[0032] The optical preamble loop is used to perform safety verification on all devices on the laser transmission link and the receiving link.

[0033] A second aspect of the present application provides an initialization detection device for a laser radar device, comprising:

[0034] A software and hardware safety mechanism verification module is used to verify the software and hardware safety mechanism of the laser radar device during the startup phase;

[0035] A safety mechanism fault injection test module, which performs a safety mechanism fault injection test on the lidar device if the software and hardware safety mechanism verification passes;

[0036] A working state guiding module guides the laser radar device to enter a working state if the safety mechanism fault injection test passes.

[0037] The third aspect of the present application provides a computer-readable medium on which a computer program is stored. When the computer program is executed by a processor, the initialization detection method of the laser radar device is implemented.

[0038] It can be seen from the above technical solution that the initialization detection method, device and readable medium of a laser radar device provided by the present application first perform the verification of the functional safety mechanism in the initialization phase to ensure the safety of the startup process. Then, a fault injection test is performed to trigger the safety mechanism to achieve functional safety verification, making the results of the functional safety verification more convincing, ensuring that the safety mechanism can work effectively and reliably after the laser radar enters the normal operating state, meeting the functional safety requirement ASIL-B, and taking into account the system robustness, and can be applied to other embedded system devices with functional safety requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 It is a flow chart of the initialization detection method of the laser radar device in the embodiment of the present application.

[0041] Figure 2 It is a schematic diagram of a specific process of fault injection in the core lock-step mode in an embodiment of the present application.

[0042] Figure 3 It is a specific flowchart of the fault injection of the internal bus in the embodiment of the present application.

[0043] Figure 4 It is a flowchart of fault injection of internal access rights in an embodiment of the present application.

[0044] Figure 5 It is a specific flow chart of configuration data reading and loading verification in the embodiment of the present application.

[0045] Figure 6 It is a specific flow chart of the safety monitoring verification of key safety devices in the embodiment of the present application.

[0046] Figure 7 It is a flowchart of a specific scenario in an embodiment of the present application.

[0047] Figure 8 It is a specific structural diagram of the initialization detection device of the laser radar equipment in the embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] It should be noted that the initialization detection method, system, electronic device and computer-readable medium of the laser radar device disclosed in the present application can be used in the field of initialization detection technology of the laser radar device, and can also be used in any field except the field of initialization detection technology of the laser radar device. The application field of the initialization detection method, system, electronic device and computer-readable medium of the laser radar device disclosed in the present application is not limited.

[0050] As cars become more and more intelligent, the requirements for functional safety are also increasing. It is necessary to create more automated, systematic and proactive solutions - commonly known as "functional safety". The ultimate goal of functional safety is to ensure the safe operation of the product and continue to provide protection even if problems occur.

[0051] Every industry has a standard to guide future development and define the minimum entry barrier. In the automotive electronics industry, this standard is ISO 26262, which defines functional safety as: "Avoid unreasonable risk due to failure of electrical / electronic systems."

[0052] It should be understood that standards in different fields are not completely consistent. For example, IEC61508 for electrical and electronic systems and DO-254 for aircraft electronic hardware have their own definitions, which will not be elaborated in this application.

[0053] The definition of functional safety level is to evaluate the risks brought by failure and guide the requirements to be followed to reduce the risks to an acceptable level. Generally referred to as ASIL (Automotive Safety Integration Level), ISO26262 conducts hazard analysis and risk assessment on the system in the product concept design stage according to the characteristics of the car, identifies the hazards of the system, and the greater the system safety risk, the higher the corresponding safety requirement level, and the higher the ASIL level it has.

[0054] ASIL assesses the risk level of hazardous events according to severity, exposure, and controllability. It is divided into five levels: QM, A, B, C, and D. ASIL D is the highest automotive safety integrity level and has the highest requirements for functional safety.

[0055] With the increasing application of LiDAR in the automotive field, assisted driving has gradually matured and has been deployed in large quantities on mass-produced vehicles. Drivers and passengers can already feel the convenience and speed brought by assisted driving. But at the same time, accidents caused by the use of assisted driving are also increasing. In this regard, whether it is the failure of some new scenarios caused by design defects in the algorithm, or the damage and failure of the assisted driving function caused by hardware damage, the vehicle will be out of control for a certain period of time. If the driver cannot take over in time or there is little time left for the human driver to take over, it will cause a serious accident. What functional safety wants to do is to eliminate these hidden faults as much as possible in the bud, that is, the development, design and verification stage of the product. From this perspective, functional safety guarantees the most basic safety attributes of the car.

[0056] It can be understood that when performing functional safety design according to the ISO 26262 standard, the system functions are first identified and all possible functional faults (Malfunction) or failures are analyzed. The current functional safety designs are designed by designers using analysis methods such as HAZOP, FMEA, brainstorming, etc., and the functional safety analysis and detection methods for lidar systems used in the automotive field are currently single. Furthermore, the functional safety analysis of safe startup during the initialization and startup of embedded system equipment does not require the safety of the entire startup process from the perspective of overall functional safety requirements. The reason is that those skilled in the art do not yet know from which dimensions the functional safety analysis of safe startup during the initialization and startup of embedded system equipment needs to be analyzed, and they are also unaware of the characteristics of the initialization and startup process.

[0057] Based on this, the inventor of the present application first starts with the hardware and performs hardware functional safety verification, and then performs functional safety verification of the system software, thereby requiring the safety of the entire startup process from the perspective of overall functional safety requirements. The implementation method of the present application is described in detail below in conjunction with the accompanying drawings.

[0058] Figure 1 An example of an initialization detection method for a laser radar device in an embodiment of the present application is shown. Figure 1 As shown, including:

[0059] S1: Verify the software and hardware security mechanisms of the LiDAR device during the startup phase.

[0060] In the implementation mode of this application, the verification of software and hardware safety mechanisms refers to the process of detecting and verifying the safety of the lidar equipment. The verification of software and hardware safety mechanisms is intended to ensure the hardware safety requirements of the hardware equipment during the design, manufacturing and use process, as well as the software safety requirements of the software program during the design, operation and use process, such as hardware architecture metrics, random hardware failure target value requirements, program startup verification results, etc.

[0061] S2: If the software and hardware safety mechanism verification passes, perform a safety mechanism fault injection test on the lidar device.

[0062] In this embodiment, the safety mechanism fault injection test of the lidar device is performed to evaluate the performance and reliability of the device when facing software failures. By simulating and injecting various software failure conditions, the device's data processing, algorithm processing, communication capabilities, and system stability performance can be tested. Software failures that may be encountered in actual applications of the lidar device can be discovered, and the fault tolerance and recovery capabilities of the device can be evaluated.

[0063] S3: If the safety mechanism fault injection test passes, guide the lidar device to enter a working state.

[0064] From the above description, it can be seen that the initialization detection method of the laser radar device provided in the embodiment of the present application first performs the verification of the functional safety mechanism in the initialization phase to ensure the safety of the startup process. Then, a fault injection test is performed to trigger the safety mechanism to achieve functional safety verification, making the results of the functional safety verification more convincing, ensuring that the safety mechanism can work effectively and reliably after the laser radar enters the normal operating state, meeting the functional safety requirement ASIL-B, and taking into account the system robustness, and can be applied to other embedded system devices with functional safety requirements.

[0065] Specifically, in step S1, a laser radar device is installed on a car, and the laser radar device includes one or more laser transmitters, a beam receiver, and an information processing module. The information processing module may include a logic circuit with an embedded processor or a processing hardware such as an MCU and a storage device, such as a flash memory and a random access memory, etc., which is not limited in this application. A laser radar system is installed on the information processing module, which can perform emission control, reception control, and calculation processing of laser radar waves.

[0066] As an example, the processing hardware can be a ZYNP development board, which can be divided into a processor system part (PS) and a programmable logic part (PL). Generally speaking, the system of the ZYNP development board is divided into a hardware layer, a hardware interface layer, a driver layer, a system layer, and an application layer, wherein the hardware layer and the hardware interface layer belong to the system hardware module, which are implemented based on the PL part and are mainly responsible for processing the hardware implementation and the RF peripheral control function. The driver layer, the system layer, and the application layer are all software modules, which can be implemented based on the processor system and are mainly responsible for the control center of the system, responsible for data preprocessing, data transmission control between various hardware, and system parameter configuration functions.

[0067] The core concept of this application is that on the one hand, the characteristics and laws of the initialization process of the laser radar equipment are discovered, and on the other hand, a functional safety verification method of the system hardware module and software module is designed based on the characteristics and laws. The hardware and software safety mechanism of the laser radar equipment is first verified to ensure that the software program and hardware equipment are in a normal state, and then the fault injection of the safety mechanism is tested to ensure that the safety mechanism involved in the verification is in a normal state. Functional safety verification is achieved by triggering the safety mechanism, which ensures that the safety mechanism can work effectively and reliably after the laser radar enters the normal operating state, meets the functional safety requirement ASIL-B, and takes into account the robustness of the system.

[0068] In step S1, in order to explain the software and hardware security mechanism verification of this application in detail, Figure 2 As shown, the software and hardware security mechanism verification of the present application is a functional verification based on the order of the above-mentioned hardware power-on. Specifically, the software and hardware security mechanism verification of the present application includes primary boot loader startup verification (Primary Boot Loader, PBL), first stage loader startup verification, running memory self-test verification, configuration data reading and loading verification, system chip security monitoring status verification, key security device security monitoring verification and initialization program flow monitoring verification.

[0069] Specifically, the main boot loader startup check is located in ROM, which is the real first line of code executed after the chip is powered on. SBL1 will be loaded in the normal startup process. The main boot loader startup check mainly includes MBIST (Memory Built-In Self-Test) and LBIST (Logic Built-In Self-Test), etc., which will not be described in detail here.

[0070] Exemplarily, in the embodiment of the present application, the first stage loader startup verification includes verification of the image file. During the startup process, the main boot loader reads the image file stored on the startup medium (such as a hard disk, a solid-state drive, an optical disk, etc.). In order to ensure the integrity and correctness of the image file, the image file is verified by the first stage loader startup verification.

[0071] For example, in the embodiment of the present application, when running the memory self-check, the hardware boot program and the system program are placed in the Flash. After power-on booting, the system program will be moved to the DDR space and run in the DDR space. The self-check of the DDR RAM can be checked by writing specific data (such as 0x55, 0xAA) and then reading back for comparison; it can also be checked by checking the row and column address data lines, and the present application does not limit this.

[0072] To further illustrate the specific process of configuration data reading and loading verification, in the embodiment of the present application, the configuration data will affect the ranging performance of the laser radar, and the failure of the configuration data will lead to a violation of the safety objectives of the laser radar, such as Figure 5 As shown, the safety mechanism (including but not limited to the following contents) is designed to ensure that the hardware quantitative index LFM of ASIL-B products is met:

[0073] S111: To prevent data errors caused by random hardware failures during the FLASH storage process, a CRC cyclic verification safety mechanism is used for protection.

[0074] Specifically, during the process of saving the configuration data of the LiDAR, if the hardware fails randomly and causes data errors, the CRC (cyclic redundancy check) security mechanism can be used for protection. The integrity of the data is verified by calculating the check value of the data. The specific implementation steps are as follows:

[0075] Step 1: Calculate CRC check value: Before saving the configuration data, calculate the CRC check value of the data. The CRC check value is a fixed-length check code calculated by a specific algorithm on the data.

[0076] Step 2: Save data and CRC check value: Save the configuration data and the calculated CRC check value together into the FLASH memory. Make sure that the data and check value are written together so that the integrity of the data can be verified later.

[0077] Step 3: Read data and CRC check value: When reading the configuration data, read the saved CRC check value at the same time.

[0078] Step 4: Verify data integrity: Calculate the CRC check value for the read configuration data again and compare it with the saved CRC check value. If the calculated check value is the same as the saved check value, it means that there is no error in the data. If the check values ​​do not match, it means that there may be an error in the data.

[0079] Step 5: Error handling: If the CRC check value verification of the data fails, appropriate error handling measures can be taken, such as re-reading the data, restoring backup data, notifying the user or system administrator, etc.

[0080] The above steps of this application can verify the integrity of the configuration data of the LiDAR by using the CRC cyclic verification security mechanism, thereby protecting the data from errors caused by random hardware failures. This can improve the reliability and security of the data and ensure the normal operation of the LiDAR equipment.

[0081] S112: For data errors caused by random hardware failures during the use of RAM, an ECC check safety mechanism is used to correct and report errors.

[0082] The implementation method of the present application is based on the fact that data is generally in use when it is called in the RAM cache. Therefore, based on this, the error correction capability of the ECC check is used to use the ECC check in the RAM cache. The specific steps include:

[0083] Step 1: ECC encoding: Before saving the configuration data, perform ECC encoding on the data. ECC encoding is redundant information calculated by a specific algorithm on the data, which is used to detect and correct errors.

[0084] Step 2: Save data and ECC code: Save the configuration data and the calculated ECC code together into RAM. Make sure that the data and code are written together so that the data integrity and error correction can be verified later.

[0085] Step 3: Read data and ECC code: When reading the configuration data, the saved ECC code is also read.

[0086] Step 4: Verify data integrity and error correction: Calculate the ECC code again for the read configuration data and compare it with the saved ECC code. If the calculated code is the same as the saved code, it means that there is no error in the data. If the code does not match, it means that the data may be erroneous. According to the characteristics of ECC coding, the correct value of the data can be restored by correcting the error bit.

[0087] Step 5: Error handling: If the ECC code verification of the data fails, error handling can be performed based on the error correction capability. If the number of error bits is within the error correction capability range, the error correction algorithm can be used to recover the data. If the number of error bits exceeds the error correction capability range, appropriate error handling measures are required, such as re-reading the data, restoring backup data, notifying the user or system administrator, etc.

[0088] In order to verify the security monitoring status of the system chip, in the embodiment of the present application, the system chip security monitoring status verification is a verification mechanism for ensuring the security and integrity of the system chip. It is usually used to detect whether the system chip is in the expected security state to prevent unauthorized access and potential security vulnerabilities. The system chip security monitoring status verification includes the following aspects:

[0089] Security status monitoring: The hard core can monitor the security status of the processor, including security mode, privilege level, access rights, etc. The hard core can record and maintain the current security status through internal security status registers or other mechanisms.

[0090] State check logic: There will be special logic circuits or microcodes in the hard core to implement the state check function. These logic circuits or microcodes can compare with the security status register to ensure that the current security state is consistent with the expected security state.

[0091] Exception handling: If the status check fails, the hard core will trigger the corresponding exception handling mechanism. This may include interrupt handling, error handling, security mode switching, etc. Through these exception handling mechanisms, the hard core can respond to changes in security status in a timely manner and take corresponding measures to protect the security of the system.

[0092] In addition, in the implementation manner of the present application, the key safety devices in the laser radar refer to the safety performance components or assemblies that play a key role in the laser radar system. These safety devices are used to ensure the normal operation of the laser radar and protect the system from potential safety threats. For example: devices on the laser transmission link: one of the core components of the laser radar, responsible for emitting laser beams; devices on the laser receiving link: responsible for receiving the signal returned by the laser radar and converting it into an electrical signal for processing; data processing unit: responsible for processing and analyzing the received laser radar data; power supply and power management devices: responsible for providing a stable and reliable power supply for the laser radar system.

[0093] Furthermore, in some implementations of the present application, key safety devices may include a power overload protector and a power failure monitor to ensure the stability of the power supply and the reliability of the system.

[0094] In order to monitor and verify the safety of key safety devices, the implementation of this application mainly performs safety monitoring and verification on the devices on the laser transmission link and the laser receiving link. The failure of the above key devices will lead to violation of the safety goals of the radar. Therefore, this application designs a safety mechanism and performs fault injection inspection in the initialization phase to improve the LFM quantitative indicators. Specifically, Figure 6 As shown, the safety monitoring verification of key safety components of the laser radar equipment includes:

[0095] S121: monitoring the voltage of the power supply device of the laser transmission link and the receiving link, and verifying the power supply device according to the voltage;

[0096] S122: monitoring the temperature of key components of the laser transmission link and the receiving link, and verifying the key components according to the temperature;

[0097] S123: Use the optical preamble loop to perform safety verification on all devices on the laser transmission link and the receiving link.

[0098] The above steps are described in detail below.

[0099] 1. Use voltage monitoring safety mechanism to prevent random hardware failures of power devices in laser transmission link and receiving link.

[0100] Specifically, for random hardware failures of power devices in the laser transmission link and receiving link, a voltage monitoring safety mechanism can be used to monitor the stability and abnormal conditions of the power supply. First, a voltage monitoring circuit can be used to add a voltage monitoring circuit to the power input end of the laser transmission link and receiving link. This circuit can monitor the input voltage of the power supply in real time and feed back the monitoring results to the system control unit.

[0101] In addition, in other implementations, a voltage anomaly detection algorithm may be configured, and the algorithm may determine whether the power supply is within a normal operating range based on the feedback result of the voltage monitoring circuit.

[0102] Furthermore, when the voltage is abnormal, the system control unit can take corresponding measures to deal with it, for example, it can send out an alarm signal, automatically switch to a backup power supply, shut down the laser transmission link and the receiving link, etc.

[0103] Of course, the implementation methods of the present application may further perform regular calibration and testing on the voltage monitoring circuit and the anomaly detection algorithm, such as checking the accuracy and precision of the voltage monitoring circuit and verifying the correctness and reliability of the anomaly detection algorithm.

[0104] This implementation method uses a voltage monitoring safety mechanism to monitor the power supply of the laser transmission link and the receiving link in real time, detect and handle power supply anomalies in a timely manner, and ensure the stability and reliability of the laser radar system. At the same time, it can also improve the safety of the system and prevent potential dangers and losses caused by power failures.

[0105] 2. Use temperature monitoring safety mechanism to prevent systematic failure of key components in laser transmission link and receiving link.

[0106] Specifically, a temperature monitoring circuit can be added to the key components of the laser transmission link and the receiving link. The circuit can monitor the temperature of the device in real time and feed back the monitoring results to the system control unit. Then, a temperature anomaly detection algorithm is implemented in the system control unit. The algorithm can determine whether the device is within the normal operating temperature range based on the feedback results of the temperature monitoring circuit. When the temperature anomaly detection algorithm detects that the device temperature is abnormal, the system control unit can take corresponding measures to deal with it. For example, an alarm signal can be issued, the device power can be automatically reduced, or the laser transmission link and the receiving link can be shut down.

[0107] Furthermore, the present application can formulate a reasonable temperature management strategy based on the above implementation methods to ensure that the device operates within the normal operating temperature range, such as optimizing the device heat dissipation design, controlling the ambient temperature, limiting the device power, etc.

[0108] This embodiment uses a temperature monitoring safety mechanism to monitor the temperature of key components in the laser transmission link and the receiving link in real time, detect and handle temperature anomalies in a timely manner, and ensure the stability and reliability of the laser radar system. At the same time, it can also improve the safety of the system and prevent potential dangers and losses caused by excessive device temperature.

[0109] 3. Design an optical preamble loop integrity monitoring safety mechanism to prevent device failures in the laser transmission and reception links.

[0110] In the implementation mode of the present application, the optical guide loop refers to a light path of laser emission-radar window-receiver reception. After the laser emitted by the laser radar reaches the window, there will be a small amount of reflected or scattered light, and enter the receiver along the receiving optical path, and be responded by the receiver; this part of light is the guide light, which is an unexpected light common to all coaxial radars and has an impact on radar ranging. This embodiment uses the guide light to detect the transmitting link and the receiving link. Since the guide light only propagates inside the laser radar, it has high energy intensity and short flight time, and can be detected quickly. Moreover, the flight time (i.e., the receiving time) and the receiving intensity of the guide light can be obtained in advance through calibration, and can be detected by comparing the actual measurement and the calibration amount.

[0111] Specifically, after the laser emitted by the lidar reaches the window, there will be a small amount of reflected or scattered light. This part of the reflected or reflected light enters the receiver along the receiving optical path, and after being responded to by the receiver, it outputs a leading signal and sends the leading signal to the system control unit.

[0112] The reception time and reception intensity of the leading light can be obtained in advance through calibration. Since the reception time of the leading light is the flight time of the emitted laser inside the laser radar from the emission time, the reception time of the leading light is relatively stable in each detection cycle. Correspondingly, since the conditions for generating the leading light inside the laser radar are fixed, the intensity of the leading light is also relatively stable. Actual measurements can be performed during offline calibration to record the intensity of the signal received at the reception time of the leading light, which is the signal strength of the leading signal; the measured reception time and signal strength of the leading light are used as calibration values.

[0113] The present application can implement an integrity detection algorithm in the system control unit, and can determine whether the integrity of the laser transmission link and the receiving link is affected based on the feedback results of the leading light detection circuit. For example, the difference between the measured leading light receiving time and receiving intensity and the calibration value can be compared to determine whether there is an abnormality.

[0114] This implementation method innovatively utilizes the leading light to detect the transmitting link and the receiving link, which can monitor the integrity of the laser signal in real time and determine whether there is an abnormality by comparing it with the calibration value. This method is fast and accurate and can effectively improve the safety and reliability of the lidar system.

[0115] The initialization program flow monitoring verification of the LiDAR is a verification mechanism used to ensure the integrity and security of the LiDAR initialization program. LiDAR is one of the important sensors used to perceive the surrounding environment in intelligent vehicle systems. The correctness and reliability of its initialization program are crucial to the normal operation of the system.

[0116] In order to monitor and verify the initialization program flow, in the embodiment of the present application, the following specific steps can be taken:

[0117] 1. Design the initialization program flow: First, you need to design a complete initialization program flow, including the initialization order and steps of each module of the lidar system. These initialization steps can include hardware initialization, software initialization, parameter configuration, etc.

[0118] 2. Monitor the initialization program flow: By adding a monitoring module in the system control unit, the execution of the initialization program flow can be monitored in real time. The monitoring module can determine whether the currently executed initialization steps meet expectations by reading the relevant status registers or flag bits.

[0119] 3. Check the initialization program flow: When designing the initialization program flow, you can predefine the expected results of each initialization step. By comparing the status register or flag bit read by the monitoring module with the expected results, it can be determined whether the execution of the initialization program flow is correct.

[0120] 4. Exception handling mechanism: When the monitoring module detects that the execution of the initialization program flow is not in line with expectations, the system control unit can take corresponding exception handling measures according to the specific situation. For example, it can issue an alarm signal, record a log, re-execute the initialization steps, etc.

[0121] 5. Log recording and analysis: The monitoring and verification results of the initialization program flow can be recorded and analyzed. By analyzing the log, problems in the initialization program flow can be discovered and solved in a timely manner, and optimization and improvement can be carried out.

[0122] The implementation method of the present application can monitor and verify the initialization program flow of the laser radar system to ensure that the system can be initialized in the expected manner when it is started, and abnormal situations can be discovered and handled in a timely manner. This can improve the reliability and stability of the system and ensure the normal operation of the laser radar system in practical applications.

[0123] The safety mechanism fault injection test in the embodiment of the present application is described in detail below. In the embodiment of the present application, the inventor creatively detects the functional safety of each software level by means of functional fault injection during the initialization process of the lidar device.

[0124] Specifically, based on the specific situation of the lidar device, this application configures an external hardware watchdog fault injection test, a running memory error correction fault injection test, and a software test library initialization test.

[0125] In an implementation manner of the present application, in step S2, the safety mechanism fault injection test of the laser radar device includes: performing an external hardware watchdog fault injection test, a running memory error correction fault injection test and a software test library initialization test on the laser radar device.

[0126] Specifically, for the external hardware watchdog fault injection test, a fault injection scheme can be designed in the implementation of the present application based on the hardware design of the laser radar system and the working principle of the hardware watchdog. For example, the occurrence of a hardware failure can be simulated by controlling the disconnection or short circuit of the power or signal line of a hardware module. Afterwards, based on the hardware design and the location of the hardware watchdog, the fault injection point is determined. For example, it can be a specific hardware module, such as a laser transmitter or receiver, or a signal line or power line. Then, according to the fault injection scheme, a corresponding fault injection module is prepared to control the status of the power or signal line of the hardware module. The device can communicate with the laser radar system through a hardware interface or a wireless connection.

[0127] What needs to be understood about the injection module is that the fault injection module of the present application can be implemented by writing a fault injection program into the main control chip of the laser radar system. In this embodiment, the main control chip of the laser radar system includes a fault injection module. In addition, the fault injection module of the present application can also be implemented by embedding an independent chip into the main control chip of the laser radar system, that is, an integrated chip is embedded in the main control chip, and the fault injection program is written into the integrated chip, or further, it can be implemented by a fault injection device that forms a communication connection with the main control chip of the laser radar system. The present application does not impose any restrictions on this.

[0128] In a preferred embodiment, the fault injection test of the present application is performed during the normal startup process of the radar, so the fault injection needs to be performed in a relatively short time under the control of the main control chip, and certain faults such as the external hardware watchdog fault injection test are performed by disconnecting the hardware watchdog connection within a specified time to determine whether the lidar system will restart. Therefore, when the fault injection program is directly written through the main control chip, the main control chip can meet the timeliness and interactive authority control required by this application when the program is called.

[0129] It should be further explained that the fault injection test in the implementation manner of the present application includes multiple items, that is, part of the fault injection test can be completed through the main control chip, and another part of the fault injection test is performed through an independent fault injection module. The present application can even integrate some sub-steps of a certain fault injection test in the main control chip based on the characteristics of each fault injection test, and integrate the other part in an independent fault injection module for execution. For example, the hardware watchdog fault injection test can be directly integrated on the main control chip of the lidar system, while other fault injections are performed through one or more independent fault injection modules. The injection module / fault injection module mentioned in the following implementation manner can be extended to this, that is, it can be an independent physical module or a non-physical module in the main control chip. Since the fault injection test is during the normal startup of the radar, it is preferably a non-physical module in the main control chip, and the present application will not elaborate on this.

[0130] According to the fault injection scheme, the injection module is connected to the power supply or signal line of the hardware module to be injected with the fault. Through the fault injection module, the state of the power supply or signal line of the hardware module is controlled to implement fault injection. For example, a power line can be disconnected or short-circuited, or the state of a signal line can be changed. Finally, during the fault injection process, the response of the LiDAR system is monitored in real time. The monitoring module in the system control unit can read the relevant status register or flag bit to determine whether the system can correctly detect the hardware fault and perform corresponding processing. When the system detects a hardware fault, the system control unit can take corresponding exception handling measures according to the specific situation. For example, an alarm signal can be issued, a log can be recorded, the LiDAR system can be restarted, etc., and this application does not limit this.

[0131] The purpose of running a memory error correction fault injection test in the implementation mode of the present application is to verify the error correction capability and stability of the system when a memory error occurs. Specifically, a fault injection scheme can be designed based on the memory design and error correction mechanism of the laser radar system. For example, the occurrence of a memory error can be simulated by modifying the data at a specific location in the memory, and then the fault injection point is determined based on the memory design and error correction mechanism. According to the fault injection scheme, a corresponding fault injection module is prepared to modify the data in the memory. The device can communicate with the laser radar system through a hardware interface or a wireless connection, and then the fault injection module is connected to the memory of the laser radar system. According to the fault injection scheme, the injection module is connected to the memory address or memory area to be injected with the fault, and then the data at a specific location in the memory is modified through the fault injection module to implement fault injection. For example, the value of a memory address can be changed, or the data in a memory area can be modified. Finally, during the fault injection process, the response of the laser radar system is monitored in real time. The monitoring module in the system control unit can be used to read relevant memory error correction information, determine whether the system can correctly detect the memory error, and perform corresponding processing. For example, when the system detects a memory error, the system control unit can take corresponding exception handling measures according to the specific situation, such as correcting the memory error, reloading data, restarting the lidar system, etc. This application does not impose any restrictions on this.

[0132] The following is a detailed description of the software test library initialization test in the embodiment of the present application. Specifically, the software test library (STL) initialization test includes various safety mechanism fault injection tests of Soc, including but not limited to fault injection of core lockstep mode, fault injection of internal bus, fault injection of internal access rights, etc., as follows Figures 2 to 4 shown.

[0133] Specifically, in some embodiments, Figure 2As shown, a fault injection test in a core lock-step mode is performed on the laser radar device, including:

[0134] S211: Execute a fault injection operation in a core lock-step mode;

[0135] S212: Determine whether the fault register state is consistent with the expected state;

[0136] S213: If they are consistent, the fault injection test of the core lock-step mode passes.

[0137] Specifically, the core lock-step mode in the implementation manner of the present application may be that the core processor and the phase-locked loop circuit in the lidar device operate under clock synchronization.

[0138] Specifically, the specific process of the LiDAR device performing a fault injection test in core lock-step mode is as follows:

[0139] Design a fault injection scheme: Design the registers and injection methods for fault injection based on the working principle and design of the core lock-step mode of the lidar device.

[0140] Prepare fault injection module: According to the fault injection scheme, prepare the corresponding fault injection module to modify the data in the device or simulate the fault situation. The device can communicate with the device through a hardware interface or a wireless connection.

[0141] Connect the injection module: electrically connect the fault injection module to the lidar device, and according to the fault injection plan, connect the injection module to the registers, circuit interfaces, etc. where the fault is to be injected.

[0142] Start Core Lockstep Mode: Switch the LiDAR device to Core Lockstep mode. Ensure that the clocks of the core processor and the phase-locked loop circuit are synchronized and the device is in normal working condition.

[0143] Perform fault injection operations: The fault injection module can be used to modify data at a specific location in the device or simulate a fault condition. For example, the value of a register can be changed or a fault in a phase-locked loop circuit can be simulated.

[0144] Monitor the status of the fault register: During the fault injection process, monitor the status of the fault register in the LiDAR device in real time. By reading the value of the fault register, determine whether the device can correctly detect the fault and is consistent with the expected state.

[0145] Determine the test result: According to the fault injection scheme and the expected state, determine whether the fault register state is consistent with the expected state. If consistent, the fault injection test of the core lockstep mode passes.

[0146] Exception handling mechanism: When the device detects a fault, the device should have a corresponding exception handling mechanism. Depending on the specific situation, the fault can be corrected, data can be reloaded, the device can be restarted, etc.

[0147] Fault injection result analysis: Analyze and evaluate the results of fault injection. By analyzing the results of the injection test, the fault detection and handling capabilities of the LiDAR device in the core lock-step mode can be evaluated, and optimization and improvement can be carried out.

[0148] Through the above steps, the LiDAR device can be subjected to a fault injection test in core lock-step mode, and it can be determined whether the fault register state is consistent with the expected state to verify the reliability and stability of the device.

[0149] Furthermore, the fault injection test of the internal bus of the present application and the fault injection test of the second internal access right can adopt a similar method to the above injection, the main difference being the injection point and the fault judgment logic, which will not be elaborated here.

[0150] That is, in some embodiments, Figure 3 As shown, a fault injection test of the internal bus of the laser radar device is performed, including:

[0151] S221: Execute a fault injection operation of the internal bus;

[0152] S222: Determine whether an error interrupt in the internal bus is triggered;

[0153] S223: If triggered, the fault injection test of the internal bus passes.

[0154] Furthermore, in some embodiments, Figure 4 As shown, a fault injection test of internal access rights of the lidar device is performed, including:

[0155] S231: Execute a fault injection operation for internal access rights;

[0156] S232: Determine whether an error interrupt in internal access is triggered;

[0157] S233: If triggered, the fault injection test of internal access rights passes.

[0158] Figure 7 The whole process of initialization verification in a specific scenario of this application is shown, such as Figure 7 As shown, the functional safety initialization startup and detection method proposed in the present invention has the following beneficial effects:

[0159] 1. First, the functional safety mechanism verification is performed in the initialization phase to ensure the safety of the startup process. Then, the fault injection test is performed to trigger the safety mechanism to achieve functional safety verification, making the results of the functional safety verification more convincing, ensuring that the safety mechanism can work effectively and reliably after the LiDAR enters the normal operation state, meeting the functional safety requirement ASIL-B, and taking into account the system robustness.

[0160] 2. The initialization startup and detection method proposed in the present invention that meets the functional safety requirements can be applied to other embedded system devices with functional safety requirements.

[0161] Furthermore, in other optional embodiments, the present application also provides an initialization detection device for a laser radar device, such as Figure 8 As shown, including:

[0162] A software and hardware safety mechanism verification module 1 is used to verify the software and hardware safety mechanism of the laser radar device during the startup phase;

[0163] Safety mechanism fault injection test module 2, if the software and hardware safety mechanism verification passes, the safety mechanism fault injection test is performed on the laser radar device;

[0164] The working state guiding module 3 guides the laser radar device to enter the working state if the safety mechanism fault injection test passes.

[0165] It can be understood that the initialization detection device for a laser radar device provided by the present application first performs the verification of the functional safety mechanism in the initialization phase to ensure the safety of the startup process. Then, a fault injection test is performed to trigger the safety mechanism to achieve functional safety verification, making the results of the functional safety verification more convincing, ensuring that the safety mechanism can work effectively and reliably after the laser radar enters the normal operating state, meeting the functional safety requirement ASIL-B, and taking into account the system robustness, and can be applied to other embedded system devices with functional safety requirements.

[0166] The embodiments of the present application also provide a computer-readable medium capable of implementing all the steps in the initialization detection method of the laser radar device in the above embodiments. The computer-readable medium stores a computer program. When the computer program is executed by a processor, all the steps of the initialization detection method of the laser radar device in the above embodiments are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0167] S1: Verify the software and hardware safety mechanism of the laser radar device during the startup phase;

[0168] S2: If the software and hardware safety mechanism verification passes, a safety mechanism fault injection test is performed on the laser radar device;

[0169] S3: If the safety mechanism fault injection test passes, guide the lidar device to enter a working state.

[0170] From the above description, it can be seen that the computer-readable medium provided by the embodiment of the present application first performs the verification of the functional safety mechanism in the initialization phase to ensure the safety of the startup process. Then, a fault injection test is performed to trigger the safety mechanism to achieve functional safety verification, making the results of the functional safety verification more convincing, ensuring that the safety mechanism can work effectively and reliably after the laser radar enters the normal operating state, meeting the functional safety requirement ASIL-B, and taking into account the system robustness, and can be applied to other embedded system devices with functional safety requirements.

[0171] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0172] The present application is described with reference to the flowcharts and / or block diagrams of the methods (devices) and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0173] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0174] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0175] Specific embodiments are used in this application to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core idea of ​​this application. At the same time, for those skilled in the art, according to the idea of ​​this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this application.

Claims

1. An initialization detection method for a laser radar device, wherein the initialization detection method is performed during the initialization startup phase of the laser radar device, and is characterized in that: include: Verify the software and hardware safety mechanisms of the laser radar device during the startup phase; If the software and hardware safety mechanism verification passes, a safety mechanism fault injection test is performed on the laser radar device; If the safety mechanism fault injection test passes, the lidar device is guided to enter a working state.

2. The initialization detection method of the laser radar device according to claim 1, characterized in that: The checking of the software and hardware safety mechanism of the laser radar device at the startup stage includes: The laser radar device is subjected to main boot loader startup verification, first stage loader startup verification, running memory self-test verification, configuration data reading and loading verification, system chip safety monitoring status verification, key safety device safety monitoring verification and initialization program flow monitoring verification.

3. The initialization detection method of the laser radar device according to claim 1, characterized in that: The safety mechanism fault injection test of the laser radar device includes: The laser radar device is subjected to an external hardware watchdog fault injection test, a running memory error correction fault injection test, and a software test library initialization test.

4. The initialization detection method of the laser radar device according to claim 3, characterized in that: The performing of a software test library initialization test on the laser radar device includes: The laser radar device is subjected to a fault injection test of a core lock-step mode, a fault injection test of an internal bus, and a fault injection test of an internal access right.

5. The initialization detection method of the laser radar device according to claim 4, characterized in that: Performing a fault injection test in a core lockstep mode on the laser radar device includes: Perform fault injection operations in core lockstep mode; Determine whether the fault register state is consistent with the expected state; If they are consistent, the fault injection test in core lockstep mode passes.

6. The initialization detection method of the laser radar device according to claim 4, characterized in that: Performing a fault injection test on the internal bus of the laser radar device, including: Performing internal bus fault injection operations; Determine whether the error interrupt in the internal bus is triggered; If triggered, the fault injection test of the internal bus passes.

7. The initialization detection method of the laser radar device according to claim 4, characterized in that: Perform fault injection testing on the internal access rights of the LiDAR device, including: Perform fault injection operations with internal access permissions; Determine whether the error interrupt in the internal access is triggered; If triggered, the fault injection test for internal access permissions passes.

8. The initialization detection method of laser radar equipment according to claim 2, characterized in that: The configuration data of the laser radar device is read and loaded for verification, including: During the process of saving the configuration data to the flash memory, a cyclic redundancy check is used to check the configuration data; In the process of configuration data being called in the random access memory, erroneous data in the configuration data is detected and corrected by adding redundant information to the configuration data.

9. The initialization detection method of the laser radar device according to claim 2, characterized in that: The safety monitoring and verification of key safety components of the laser radar equipment includes: Monitoring the voltage of the power supply device of the laser transmission link and the receiving link, and verifying the power supply device according to the voltage; Monitoring the temperature of key components of the laser transmission link and the receiving link, and verifying the key components according to the temperature; The optical preamble loop is used to perform safety verification on all devices on the laser transmission link and the receiving link.

10. An initialization detection device for a laser radar device, characterized in that: include: A software and hardware safety mechanism verification module is used to verify the software and hardware safety mechanism of the laser radar device during the startup phase; A safety mechanism fault injection test module, which performs a safety mechanism fault injection test on the lidar device if the software and hardware safety mechanism verification passes; A working state guiding module guides the laser radar device to enter a working state if the safety mechanism fault injection test passes.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images