Safety mechanism self-diagnosis control system and control method

Abstract

The present application relates to the technical field of MCU chip safety detection, and discloses a safety mechanism self-diagnosis control system, including: a user task module, used to perform safety mechanism self-diagnosis configuration and output configuration information; multiple functional circuits and corresponding multiple safety mechanism circuits, the safety mechanism circuit is used to perform safety mechanism detection on the functional circuit; a self-diagnosis control circuit, including a safety mechanism self-diagnosis control module, connected to the safety mechanism circuit and the user task module; used to receive the configuration information output by the user task module, and based on the configuration information, perform safety mechanism self-diagnosis on the safety mechanism circuit corresponding to the target functional circuit to determine whether the corresponding safety mechanism circuit is faulty. While ensuring the safety of the system, the system greatly reduces the software participation required by the existing self-diagnosis method, thereby reducing the software initialization time and workload rate. The present application also relates to a safety mechanism self-diagnosis control method.

Description

Technical Field

[0001] The present application relates to the technical field of MCU chip security detection, for example, to a security mechanism self-diagnosis control system and control method. Background Art

[0002] With the continuous improvement of automobile electrification and intelligence, the original functional controller solutions in the whole vehicle system are gradually shifting towards domain controllers. The control objects that traditional automotive MCU (Microcontroller Unit) chips are responsible for have also gradually changed from single mechanical / electrical loads to multi-channel and multi-domain electronic / electrical loads. Therefore, the impact of chip failure on the operation of the whole vehicle has also increased with the increase of its control range. Existing automotive MCU chip products often have more safety mechanism circuits, and self-diagnosis tests need to be performed on the safety mechanism circuits during the power-on / power-off phase to prevent existing safety mechanism circuit failures from becoming latent failures. At the same time, it also avoids the situation where the functional circuit fails during the operation of the chip and the fault event cannot be reported, which causes the functional circuit failure to spread and cause safety hazards.

[0003] like Figure 1 As shown, the existing automotive MCU chip generally diagnoses and judges the safety mechanism circuit through the user software task program (ie, the user task module). For example, first enable the safety mechanism fault injection, then observe and judge the fault status bit, and finally cancel the enablement of the safety mechanism fault injection. In this way, repeat the above operations for other involved safety mechanisms until all the safety mechanism modules that need to be tested are traversed. Although this method can cover the target circuits that need to be tested, it can accurately judge the safety mechanism modules with faults. However, since the user software task program needs to perform many cycles, the self-diagnosis time of the safety mechanism is relatively long. This method increases the user's power-on initialization time, and during the self-diagnosis operation, the functional core that executes this part of the program must be occupied all the time. This affects the access operation to other functional applications, reduces the execution efficiency of the software, and is not conducive to the realization of the chip system performance requirements.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0006] The disclosed embodiments provide a safety mechanism self-diagnosis control system and control method to reduce the depth of software involvement, thereby reducing the self-diagnosis test time and software workload.

[0007] In some embodiments, the system comprises:

[0008] A user task module is used to perform self-diagnosis configuration of the safety mechanism and output configuration information; multiple functional circuits and corresponding multiple safety mechanism circuits, the safety mechanism circuit is used to perform safety mechanism detection on the functional circuits; a self-diagnosis control circuit includes a safety mechanism self-diagnosis control module, which is connected to the safety mechanism circuit and the user task module; it is used to receive the configuration information output by the user task module, and based on the configuration information, perform safety mechanism self-diagnosis on the safety mechanism circuit corresponding to the target functional circuit to determine whether the corresponding safety mechanism circuit is faulty.

[0009] In some embodiments, the method comprises:

[0010] During power-on initialization, configure the self-diagnosis information of the safety mechanism to output the configuration information and enable the self-diagnosis circuit of the safety mechanism; according to the configuration information, control the fault injection enable of the safety mechanism circuit corresponding to the target functional circuit to perform a self-diagnosis test on the safety mechanism circuit; according to the received alarm signal, determine whether the safety mechanism circuit corresponding to the alarm signal has a fault; wherein the alarm signal is sent by the safety mechanism circuit.

[0011] The safety mechanism self-diagnosis control system and control method provided by the embodiments of the present disclosure can achieve the following technical effects:

[0012] Through the design of the safety mechanism self-diagnosis control module, the automatic diagnosis control and diagnosis result judgment of the safety mechanism circuit corresponding to the target functional circuit are realized in hardware. While ensuring the safety of the system, the software participation required by the existing self-diagnosis method is greatly reduced, thereby reducing the software initialization time and workload rate. In addition, the safety mechanism self-diagnosis control system can also select the target functional circuit to be tested; to a certain extent, the availability of the chip is improved.

[0013] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0015] Figure 1is a schematic diagram of a safety mechanism self-diagnosis in the prior art provided by an embodiment of the present disclosure;

[0016] Figure 2 It is a structural schematic diagram of a safety mechanism self-diagnosis control system provided by an embodiment of the present disclosure;

[0017] Figure 3 is a structural diagram of a safety mechanism self-diagnosis control module in a system provided by an embodiment of the present disclosure;

[0018] Figure 4 is a schematic diagram of another safety mechanism self-diagnosis control module in the system provided by an embodiment of the present disclosure;

[0019] Figure 5 is a structural schematic diagram of another safety mechanism self-diagnosis control system provided by an embodiment of the present disclosure;

[0020] Figure 6 is a schematic diagram of a safety mechanism self-diagnosis control method provided by an embodiment of the present disclosure;

[0021] Figure 7 It is a schematic diagram of a self-diagnosis test operation process of a safety mechanism self-diagnosis control system provided by an embodiment of the present disclosure;

[0022] Figure 8 is a schematic diagram of a safety mechanism self-diagnosis application 1 provided in an embodiment of the present disclosure;

[0023] Fig. 9 It is a schematic diagram of the second safety mechanism self-diagnosis application provided by the embodiment of the present disclosure.

[0024] Reference numerals:

[0025] 100: self-diagnosis control circuit; 200: user task module; 300: function circuit; 400: safety mechanism circuit; 500: alarm status recording module;

[0026] 10: self-diagnosis control state machine; 20: self-diagnosis test trigger unit; 30: self-diagnosis result judgment unit; 40: fault location recording unit; 50: register configuration unit; 60: self-diagnosis test state recording unit; 70: self-diagnosis timeout monitoring unit. DETAILED DESCRIPTION

[0027] In order to be able to understand the features and technical contents of the embodiments of the present disclosure in more detail, the implementation of the embodiments of the present disclosure is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present disclosure. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0028] The terms "first", "second", etc. in the specification and claims of the embodiments of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present disclosure described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0029] In the embodiments of the present disclosure, the terms "upper", "lower", "inside", "middle", "outside", "front", "back" and the like indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings. These terms are mainly intended to better describe the embodiments of the present disclosure and their embodiments, and are not intended to limit the indicated devices, elements or components to have a specific direction, or to be constructed and operated in a specific direction. Moreover, in addition to being used to indicate directions or positional relationships, some of the above terms may also be used to indicate other meanings. For example, the term "upper" may also be used to indicate a certain dependency or connection relationship in certain circumstances. For those of ordinary skill in the art, the specific meanings of these terms in the embodiments of the present disclosure can be understood according to specific circumstances.

[0030] In addition, the terms "disposed", "connected", and "fixed" should be understood in a broad sense. For example, "connected" can be a fixed connection, a detachable connection, or an integral structure; it can be a mechanical connection, or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be an internal connection between two devices, elements, or components. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present disclosure can be understood according to specific circumstances.

[0031] Unless otherwise stated, the term "plurality" means two or more.

[0032] In the embodiment of the present disclosure, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B indicates: A or B.

[0033] The term "and / or" is a description of the association relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or, A and B.

[0034] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other.

[0035] Combination Figure 2 As shown, the embodiment of the present disclosure provides a safety mechanism self-diagnosis control system, including a user task module 200, multiple functional circuits 300, multiple safety mechanism circuits 400 and a self-diagnosis control circuit 100. Among them, the user task module 200 is used to perform safety mechanism self-diagnosis configuration and output configuration information. Multiple functional circuits 300 correspond to multiple safety mechanism circuits 400 one by one. During the operation of the functional circuit, the safety mechanism circuit 400 is used to perform safety mechanism detection on the functional circuit 300 to ensure that the functional circuit 300 works normally.

[0036] The self-diagnosis control circuit 100 includes a safety mechanism self-diagnosis control module 110, which is connected to the safety mechanism circuit 400 and the user task module 200. The safety mechanism self-diagnosis control module 110 is used to receive the configuration information output by the user task module, and perform safety mechanism self-diagnosis on the safety mechanism circuit 400 corresponding to the target function circuit 300 based on the configuration information to determine whether the corresponding safety mechanism circuit is faulty.

[0037] Here, in order to reduce the software (i.e., user task module) from deeply participating in the self-diagnosis of the safety mechanism circuit and reduce the software load rate, a safety mechanism self-diagnosis control module is set in the self-diagnosis control circuit. The safety mechanism self-diagnosis control module realizes the fault injection control of the safety mechanism circuit and the self-diagnosis result judgment. This makes it unnecessary to continuously occupy the software during the self-diagnosis process. At the same time, the target functional circuit to be tested can also be selected, and the target functional circuit can be selected based on the actual situation of the chip (the test target functional circuit can be one or more).

[0038] In detail, the safety mechanism self-diagnosis control module is connected to the user task module and the safety mechanism circuit. When testing the safety mechanism circuit, the user task module configures information based on the test requirements and sends the configuration information to the safety mechanism self-diagnosis control module. The safety mechanism self-diagnosis module performs fault injection enable control on the safety mechanism circuit corresponding to the target functional circuit to be tested based on the configuration information. Then, the safety mechanism circuit performs safety mechanism self-detection and feeds back the alarm signal to the safety mechanism self-diagnosis control module. The safety mechanism self-diagnosis control module determines whether the corresponding safety mechanism circuit is faulty based on the alarm signal.

[0039] Recombination Figure 2 , the working principle of the safety mechanism self-diagnosis control system of the safety mechanism self-diagnosis control system is explained.

[0040] 1) In the initial configuration phase after the chip is powered on, the user task module configures the safety mechanism self-diagnosis control module and enables the self-diagnosis control circuit according to the test requirements of the safety mechanism circuit.

[0041] 2) The safety mechanism self-diagnosis control module performs fault injection enable control on the safety mechanism circuit corresponding to the selected target functional circuit according to the configuration information, that is, inputs the fault injection enable control signal into the safety mechanism circuit corresponding to the target functional circuit.

[0042] 3) When each target functional circuit receives the fault injection enable control signal, each safety mechanism circuit performs a fault self-diagnosis test and outputs an alarm signal.

[0043] 4) The alarm signal generated by each target functional circuit is fed back to the safety mechanism self-diagnosis control module, which judges the received alarm signal to confirm whether the corresponding safety mechanism circuit has a fault, and then turns off the fault injection enable control of each target functional circuit.

[0044] By adopting the safety mechanism self-diagnosis control system provided by the embodiment of the present disclosure, by designing a safety mechanism self-diagnosis control module in the self-diagnosis control circuit, the automatic diagnosis control of the safety mechanism circuit of the target functional circuit and the judgment of the diagnosis result are realized in hardware. While ensuring the safety of the system, the software participation required by the existing self-diagnosis method is greatly reduced, thereby reducing the software initialization time and workload rate. In addition, the safety mechanism self-diagnosis control module can also select the target functional circuit to be tested; to a certain extent, the availability of the chip is improved.

[0045] Combination Figure 3 As shown, the safety mechanism self-diagnosis control module 1 includes: a self-diagnosis control state machine 10 , a self-diagnosis test trigger unit 20 and a self-diagnosis result judgment unit 30 .

[0046] The self-diagnosis control state machine 10 is connected to the user task module 200; it is used to receive configuration information, parse the user configuration information and generate a self-diagnosis control instruction according to the parsing result. Among them, the configuration information includes the target functional circuit and the test status notification method. The self-diagnosis test trigger unit 20 is connected to the self-diagnosis control state machine 10 and the safety mechanism circuit 400; it is used to output a fault injection enable control signal to the safety mechanism circuit corresponding to the target functional circuit according to the received self-diagnosis control instruction. The self-diagnosis result judgment unit 30 is connected to the safety mechanism circuit 400; it is used to receive the alarm signal sent by the safety mechanism circuit corresponding to the target functional circuit, and judge whether the safety mechanism circuit has a fault according to the alarm signal, and output the fault information.

[0047] Here, the self-diagnosis control state machine is mainly used to generate control instructions to control the start and end of the self-diagnosis test trigger unit. In detail, the self-diagnosis control state machine controls the self-diagnosis test trigger unit to output a fault injection enable control signal based on the configuration information issued by the user task module to start or end the self-diagnosis test. The configuration information includes the target functional circuit and the test status notification method. The target functional circuit includes one or more. In the case where there are multiple target functional circuits, the fault injection enable control signal can be output in sequence or simultaneously to perform safety mechanism self-diagnosis on the safety mechanism circuits of multiple target functional circuits. In this way, self-diagnosis of multiple target functional circuits at the same time helps to improve the efficiency of self-diagnosis. The test status notification method includes a flag bit or an interruption method to prompt the user task module of the test status.

[0048] The self-diagnosis test trigger unit receives the self-diagnosis control instruction of the self-diagnosis control state machine, and based on the self-diagnosis control instruction, outputs a fault injection enable control signal for the safety mechanism self-diagnosis test to the safety mechanism circuit corresponding to the target functional circuit. The self-diagnosis result judgment unit is used to receive the alarm signal fed back by the safety mechanism circuit corresponding to the target functional circuit, judge whether the corresponding safety mechanism circuit is faulty based on the alarm signal, and output the judgment result. In detail, the self-diagnosis result judgment unit makes a judgment based on the presence, type, triggering duration of the alarm signal, etc. to determine whether there is a safety mechanism fault. As an example, the self-diagnosis result judgment unit compares the received alarm signal with the preset result to determine whether there is a fault.

[0049] The self-diagnosis test trigger unit 20 and the self-diagnosis result judgment unit 30 are both connected to the safety mechanism circuit 400. Thus, the fault injection enable control signal is sent to the safety mechanism circuit corresponding to the target functional circuit 300, and the self-diagnosis result, i.e., the alarm signal, is collected and judged.

[0050] Optionally, the self-diagnosis test trigger unit 20 and the self-diagnosis result judgment unit 30 are connected to the safety mechanism circuit corresponding to the target functional circuit in a hard-wired manner.

[0051] Here, the fault injection trigger signal of the safety mechanism is sent to the safety mechanism circuit by hard-wire, and the alarm signal returned by the safety mechanism circuit is also transmitted to the automatic diagnosis result judgment module by hard-wire. In this way, the reliability and transmission speed of communication can be improved, and the security of the chip system can be ensured. Preferably, the safety mechanism circuit is provided with a fault injection control interface to receive the fault injection trigger signal sent by the self-diagnosis trigger unit, and to feed back the alarm information to the automatic diagnosis result judgment module.

[0052] Optionally, the self-diagnosis test trigger unit 20 sends the fault injection enable control signal to the safety mechanism circuit of the target functional circuit in a serial manner or in a parallel manner.

[0053] Here, the user configuration information also includes a test mode, that is, when there are multiple target functional circuits, the fault injection enable control signal can be sent to the safety mechanism circuit corresponding to each target functional circuit in a serial or parallel manner. The test mode can be configured based on the requirements. Preferably, the fault injection enable control signal is sent in parallel. In this way, the self-diagnosis of multiple safety mechanism circuits can be performed simultaneously, which helps to reduce the self-diagnosis time of the safety mechanism of the entire system.

[0054] Combination Figure 4 Optionally, the safety mechanism self-diagnosis control module 110 further includes a fault location recording unit 40. The fault location recording unit 40 is connected to the self-diagnosis result judgment unit 30 and the user task module 200, and is used to receive the fault information sent by the self-diagnosis result judgment unit 30, and record the test result of the safety mechanism circuit corresponding to the target functional circuit according to the fault information, so as to facilitate the query of the user task module.

[0055] Here, after the self-diagnosis result judgment unit 30 determines that there is a fault in the safety mechanism circuit of the target functional circuit, the fault information of the safety mechanism circuit will be sent to the fault location recording unit 40. The fault location recording unit 40 records the test results such as the fault location, fault event or fault type based on the fault information. In this way, the fault location recording unit 40 can refine the fault information such as the fault location and provide effective information for the operation control of the user software. After the user task module 200 receives the notification signal of the end of the test, the corresponding fault processing is performed by querying the recorded fault location and other information. Such as module reset, function downgrade operation, etc. In this way, the user can perform refined processing when handling the fault in the later stage, so that the functional availability of the chip is enhanced.

[0056] Optionally, the safety mechanism self-diagnosis control module 110 further includes a self-diagnosis result timeout monitoring unit 70. The self-diagnosis result timeout monitoring unit 70 is connected to the self-diagnosis test trigger unit 20, the self-diagnosis result judgment unit 30 and the self-diagnosis control state machine 10. When the self-diagnosis test trigger unit 20 triggers the timing trigger condition, the timing is started; if the timing duration is greater than the duration threshold, a timeout signal is sent to the self-diagnosis control state machine 10 to control the termination of this self-diagnosis and issue a timeout fault prompt.

[0057] Here, in order to avoid the failure of the safety mechanism self-diagnosis control module, which may cause the chip to get stuck during startup or affect the normal execution of the software, a self-diagnosis timeout care mechanism is set. That is, a self-diagnosis result timeout monitoring module is set to time the diagnosis time of the safety mechanism circuit during the self-diagnosis process of the safety mechanism circuit. If the self-diagnosis is not completed within the specified time threshold, a timeout signal value self-diagnosis control state machine is sent. The self-diagnosis control state machine controls the safety mechanism circuit to terminate this self-diagnosis test and outputs a timeout fault prompt to the user task module.

[0058] Wherein, the self-diagnosis result timeout monitoring unit 70 is connected with the self-diagnosis test trigger unit 20 and the self-diagnosis result judgment unit 30 to trigger the timing start and timing end of the self-diagnosis result timeout monitoring module. Specifically, the self-diagnosis test trigger unit 20 starts timing when the timing trigger condition is triggered. When the self-diagnosis result judgment unit 30 triggers the timing end condition, the timing is stopped. In this way, the self-diagnosis duration can be obtained. In addition, it is understandable that when the self-diagnosis duration is greater than the duration threshold, it indicates that the self-diagnosis has not ended, that is, the self-diagnosis result judgment unit 30 has not yet triggered the timing end condition within the duration threshold. In this way, the monitoring of the self-diagnosis duration is achieved through the trigger condition.

[0059] Optionally, the timing trigger condition of the self-diagnosis result timeout monitoring unit 70 includes: detecting that the self-diagnosis test trigger unit 20 outputs a fault injection enable control signal.

[0060] Here, a counter is provided in the self-diagnosis result timeout monitoring unit 70. When the self-diagnosis result timeout monitoring unit detects that the self-diagnosis test trigger unit 20 outputs a fault injection enable control signal, the timer starts timing. In this way, the self-diagnosis duration of the safety mechanism circuit is monitored.

[0061] Optionally, the self-diagnosis result timeout monitoring unit 70 is also used to: if the timing duration is less than or equal to the duration threshold, stop the timing when the self-diagnosis result judgment unit 30 triggers the timing end condition; wherein the timing end condition includes the self-diagnosis result judgment unit 30 completing the fault judgment.

[0062] Here, if there is no fault in the safety mechanism self-diagnosis control module, the self-diagnosis will be completed within the duration threshold. That is, the self-diagnosis result judgment unit will trigger the timing end condition within the duration threshold and stop timing. The timing end condition is that the self-diagnosis result judgment unit receives an alarm signal fed back by the safety mechanism circuit, and the timing ends when the self-diagnosis result judgment of the safety mechanism circuit is completed. In this way, whether the timing ends is controlled by whether the self-diagnosis result judgment is completed.

[0063] Optionally, the self-diagnosis control state machine 10 is further used to update the test status according to the progress of the self-diagnosis test; and control the process of the self-diagnosis test according to the test status.

[0064] Here, the self-diagnosis control state machine is not only used to control the start and end of self-diagnosis, but also used to update the test status and control the test process. As an example, during the self-diagnosis test process, if the safety mechanism circuit corresponding to a certain target functional circuit has been tested, the test status of the target functional circuit is updated. For example, the test status is updated from being tested to being tested. As another example, if a test failure occurs in the safety mechanism circuit corresponding to a certain target functional circuit during the test, the test status is updated to a test failure. At the same time, the safety mechanism circuit that controls the test failure stops the process of the self-diagnosis test. In this way, the process of self-diagnosis can be controlled based on the test status. Avoid causing the test process to stagnate and affect the normal startup of the chip.

[0065] Optionally, the safety mechanism self-diagnosis control module further includes a self-diagnosis test status recording unit 60 .

[0066] The self-diagnosis test status recording unit 60 is connected to the self-diagnosis control state machine 10, and is used to receive the test status signal output by the self-diagnosis control state machine 10 to record the test status; and, when the test status is that the test has been completed, output a test completion prompt according to the test status notification method.

[0067] It is understandable that the self-diagnosis control state machine 10 generally does not have a storage function. In order to record the test status of the self-diagnosis test, a self-diagnosis test status recording unit 60 is provided. The self-diagnosis test status recording unit 60 is connected to the self-diagnosis state control machine 10, and receives the test status signal output by the self-diagnosis control state machine 10, so as to record the current test process. That is, based on the test status signal, the test status is updated. At the same time, when the updated test status is that the test has been completed, the test completion prompt is output according to the test status notification method in the configuration information. As an example, the test status notification method is a flag bit method to prompt the end of the test. When the field corresponding to the flag bit is the target field, it represents the test result.

[0068] Optionally, the safety mechanism self-diagnosis control module further includes a register configuration unit 50. The register configuration unit 50 is connected to the self-diagnosis control state machine 10 and the user task module 200. The register configuration unit 50 is used to receive read and write access from the user task module 200, save configuration information sent by the user task module 200, and send the user configuration information to the self-diagnosis control state machine 10.

[0069] Here, the register configuration unit 50 provides a register access interface for the user task module 200 to read and write, and configures the safety mechanism self-diagnosis control module to meet the test requirements, that is, selects the target functional circuit to be tested and sets relevant configuration parameters. Then, the register configuration unit sends the configuration information to the self-diagnosis control state machine so that the self-diagnosis control state machine performs safety mechanism self-diagnosis based on the user configuration information. In this way, it is ensured that the self-diagnosis can be performed correctly.

[0070] Combination Figure 5 Optionally, the safety mechanism self-diagnosis control system further includes a plurality of alarm status recording modules 500. The alarm status recording modules 500 are connected to the output end of the corresponding safety mechanism circuit 400 and the output end of the safety mechanism self-diagnosis control module 110 through logic gates to shield the alarm signal during the safety mechanism self-diagnosis test process.

[0071] Here, in the process of self-diagnosis test of the safety mechanism circuit corresponding to the target functional circuit, in order to avoid the alarm signal generated by the safety mechanism circuit failure to be sent to the alarm status recording module 500, the alarm status recording module 500 feeds back the alarm information to the chip, thereby triggering the situation where the chip fails to operate normally due to the influence of the chip failure. The alarm signal sent to the chip by the safety mechanism circuit corresponding to the target functional circuit is shielded. That is, in step 2) of the working principle of the aforementioned safety mechanism self-diagnosis control module, the alarm signal sent to the chip is synchronously shielded.

[0072] Specifically, a logic gate is set between the alarm signal output terminal of the safety mechanism circuit and the input terminal of the alarm status recording module. The logic gate includes an AND gate and a NOT gate, the input terminal of the NOT gate is connected to the fault injection enable control signal, and the output terminal is connected to an input terminal of the AND gate. The other input terminal of the AND gate is connected to the alarm signal output terminal of the safety mechanism circuit, and the output terminal of the AND gate is connected to the input terminal of the alarm status recording module. In the embodiment of the present disclosure, when the fault injection enable control signal is set to a high level, the safety mechanism circuit is tested. After passing through the NOT gate and the AND gate, a low level is output. Regardless of the signal of the alarm signal, the alarm status recording module only receives a low level. The alarm signal is thus shielded so that the alarm signal will not be output to the chip. In this way, the chip fault will not be triggered, and the normal function of the chip is guaranteed.

[0073] In addition, it should be noted that the logic gate is set based on the control signal and is not limited to the embodiment of the present disclosure.

[0074] Based on the above safety mechanism self-diagnosis control system, combined with Figure 6 The present disclosure embodiment discloses a safety mechanism self-diagnosis control method, including:

[0075] S101, when power is turned on and initialized, a user software module of a safety mechanism self-diagnosis control system (hereinafter referred to as the system) configures information of safety mechanism self-diagnosis to output configuration information and enable a self-diagnosis control circuit.

[0076] S102, the safety mechanism self-diagnosis control module of the system controls the fault injection enablement of the safety mechanism circuit corresponding to the target functional circuit according to the configuration information, so as to perform a self-diagnosis test on the safety mechanism circuit.

[0077] S103, the safety mechanism self-diagnosis control module of the system determines whether there is a fault in the safety mechanism circuit corresponding to the alarm signal according to the received alarm signal; wherein the alarm signal is sent by the safety mechanism circuit.

[0078] Here, after the chip is powered on, the system software module configures information for the safety mechanism self-diagnosis test based on the test requirements. The configuration information is sent down and the safety mechanism self-diagnosis function is enabled, that is, the self-diagnosis control circuit is enabled. The safety mechanism self-diagnosis control module receives the configuration information, and based on the configuration information, outputs a fault injection enable control signal to the safety mechanism circuit corresponding to the target functional circuit, thereby enabling the safety mechanism circuit to start the self-diagnosis test. The safety mechanism circuit feeds back the result of the self-diagnosis test, i.e., an alarm signal, to the safety mechanism self-diagnosis control module. The safety mechanism self-diagnosis control module determines whether there is a fault in the safety mechanism circuit corresponding to the alarm signal. In this way, the safety mechanism circuit corresponding to the target functional circuit module is self-tested during the power-on initialization period, thereby discovering the safety mechanism circuit with a fault.

[0079] Optionally, in step S103, after the safety mechanism self-diagnosis control module of the system determines whether there is a fault in the safety mechanism circuit corresponding to the alarm signal, the method further includes:

[0080] When it is determined that the safety mechanism circuit corresponding to the alarm signal has a fault, the safety mechanism self-diagnosis control module of the system records the fault information; and controls the fault injection of the safety mechanism circuit to be disabled.

[0081] Here, when the safety mechanism self-diagnosis control module determines that the corresponding safety mechanism circuit has a fault, the fault information is recorded, that is, the fault location and other information are recorded. Then the fault injection of the safety mechanism circuit is controlled not to be enabled, that is, the fault injection control interface of the safety mechanism circuit is controlled to be closed. In this way, by recording the fault location, the user software module can accurately locate the functional module with the safety mechanism fault, so as to carry out a refined post-processing strategy.

[0082] In addition, it should be noted that after the safety mechanism self-diagnosis control module determines that the corresponding safety mechanism circuit does not have a fault, it is also necessary to control the fault injection of the safety mechanism circuit to be disabled. That is, after the safety mechanism circuit completes the self-diagnosis test, the fault injection is turned off.

[0083] Optionally, in step S103, after the safety mechanism self-diagnosis control module of the system determines whether there is a fault in the safety mechanism circuit corresponding to the alarm signal, the method further includes:

[0084] The user software module of the system queries the fault information for fault processing after a preset time or receiving a self-diagnosis test end signal; wherein the fault information includes fault location information.

[0085] Here, after receiving the self-diagnosis test end signal, or after a preset time, the user software module accesses the safety mechanism self-diagnosis control module again to handle the fault of the faulty safety mechanism circuit, thereby avoiding the safety mechanism fault from lurking and ensuring the safety of the system.

[0086] Combination Figure 7 , the specific implementation operation, that is, the control method of the safety mechanism self-diagnosis control system of the disclosed embodiment is described in detail.

[0087] Phase 1: User software configuration phase (the execution subject of this phase is the user software module):

[0088] The user software module accesses and configures the safety mechanism self-diagnosis control module, selects the functional circuit to be tested and sets the configuration information. After completing the safety mechanism self-diagnosis test enable, it runs other functional programs. At the same time, it waits for the test completion prompt signal output by the safety mechanism self-diagnosis control module.

[0089] Phase 2: Safety mechanism self-test execution phase (this phase includes timeout monitoring, and the execution subject is the safety mechanism self-diagnosis control module):

[0090] The safety mechanism self-diagnosis control module outputs a fault injection enable control signal to the safety mechanism circuit corresponding to each target functional circuit according to the received user configuration information, and starts the timer for timeout monitoring. At the same time, it is ready to receive the alarm signal returned by each safety mechanism circuit.

[0091] After completing the alarm signal collection and fault judgment, the fault location and other information are recorded and the user software module is notified that the current self-diagnosis process has ended, and the timer of the timeout monitoring stops working. If the self-diagnosis result is not completed within the time threshold, the current self-diagnosis process is directly stopped, and the user software module is notified of a timeout fault through a flag or interrupt.

[0092] At the same time, during the self-test process, the test status is recorded based on the test progress.

[0093] Phase 3: User software result check phase (the execution subject of this phase is the user software module):

[0094] After waiting for a period of time or receiving a test completion prompt signal, the user software module accesses the safety mechanism self-diagnosis control module again to query the recorded fault information of the fault safety mechanism circuit and the test status record, and then performs post-fault processing operations according to the user's own safety strategy.

[0095] Combine the following Figure 8 and Fig. 9 The application of the safety mechanism self-diagnosis control system is explained based on different failure scenarios.

[0096] Scenario 1: Failure scenario in self-diagnosis design without chip safety mechanism (combined with Figure 8 )

[0097] The safety mechanism circuit in the chip fails. Since there is no self-diagnosis function for the safety mechanism, the user software module cannot sense whether the safety mechanism circuit is working properly. Therefore, when a failure event occurs in the functional circuit, the corresponding safety mechanism cannot detect the failure. This causes the failure to be transmitted and spread to the entire chip system. After the user software module uses the wrong information or command to control the function, it affects the normal operation of the vehicle, thereby causing personal injury.

[0098] Scenario 2: Failure scenario in self-diagnosis design with chip safety mechanism (combined with Fig. 9 )

[0099] The safety mechanism circuit in the chip fails. Since the system has a safety mechanism self-diagnosis function, the user software module performs self-diagnosis tests on the safety mechanism circuit of the key functional circuit during the chip power-on initialization. Thus, the faulty safety mechanism circuit is discovered. The user software module can trigger subsequent fault responses according to the fault handling strategy, such as resetting the safety mechanism circuit, or degrading the vehicle function, and prompting the user to perform maintenance. This avoids the safety mechanism fault from lurking and ensures the safety of the system.

[0100] The above description and the accompanying drawings sufficiently illustrate the embodiments of the present disclosure to enable those skilled in the art to practice them. Other embodiments may include structural and other changes. The embodiments represent only possible variations. Unless explicitly required, individual components and functions are optional, and the order of operations may vary. Portions and features of some embodiments may be included in or replace portions and features of other embodiments. The embodiments of the present disclosure are not limited to the structures described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A safety mechanism self-diagnosis control system, characterized in that: include: User task module, used to perform self-diagnosis configuration of safety mechanism and output configuration information; A plurality of functional circuits and a corresponding plurality of safety mechanism circuits, wherein the safety mechanism circuits are used to perform safety mechanism detection on the functional circuits; The self-diagnosis control circuit includes a safety mechanism self-diagnosis control module, which is connected to the safety mechanism circuit and the user task module; it is used to receive configuration information output by the user task module, and based on the configuration information, perform safety mechanism self-diagnosis on the safety mechanism circuit corresponding to the target functional circuit to determine whether the corresponding safety mechanism circuit is faulty.

2. The safety mechanism self-diagnosis control system according to claim 1, wherein the safety mechanism self-diagnosis control module comprises: A self-diagnosis control state machine, connected to the user task module, for receiving configuration information of the user task module, parsing the configuration information and generating a self-diagnosis control instruction according to the parsing result; wherein the configuration information includes a target functional circuit and a test status notification method; A self-diagnosis test trigger unit connected to the self-diagnosis control state machine and the safety mechanism circuit; used to output a fault injection enable control signal to the safety mechanism circuit corresponding to the target functional circuit according to the received self-diagnosis control instruction; The self-diagnosis result judgment unit is connected to the safety mechanism circuit, and is used to receive the alarm signal sent by the safety mechanism circuit, and judge whether the corresponding safety mechanism circuit has a fault according to the alarm signal, and output fault information.

3. The safety mechanism self-diagnosis control system according to claim 2, characterized in that: The safety mechanism self-diagnosis control module also includes: The fault location recording unit is connected to the self-diagnosis result judgment unit and the user task module, and is used to receive the fault information sent by the self-diagnosis result judgment unit and record the test result according to the fault information so that the user task module can query it.

4. The safety mechanism self-diagnosis control system according to claim 2, characterized in that: The safety mechanism self-diagnosis control module also includes: A self-diagnosis result timeout monitoring unit is connected to the self-diagnosis test trigger unit, the self-diagnosis result judgment unit and the self-diagnosis control state machine; it is used to start timing when the self-diagnosis test trigger unit triggers the timing trigger condition; if the timing duration is greater than the duration threshold, a timeout signal is sent to the self-diagnosis control state machine to control the termination of this self-diagnosis test and issue a timeout fault prompt.

5. The safety mechanism self-diagnosis control system according to claim 2, characterized in that: The safety mechanism self-diagnosis control module also includes: The self-diagnosis test status recording unit is connected to the self-diagnosis control state machine and is used to receive the test status signal output by the self-diagnosis control state machine to record the test status; and, when the test status is that the test has been completed, output a test completion prompt according to the test status notification method.

6. The safety mechanism self-diagnosis control system according to claim 2, characterized in that: The safety mechanism self-diagnosis control module also includes: A register configuration unit is connected to the self-diagnosis control state machine and the user task module; it is used to receive read and write access from the user task module, save configuration information sent by the user task module, and send the configuration information to the self-diagnosis control state machine.

7. The safety mechanism self-diagnosis control system according to any one of claims 1 to 6, characterized in that: Also includes: A plurality of alarm status recording modules are connected to the output end of the corresponding safety mechanism circuit and the output end of the safety mechanism self-diagnosis control module through logic gates to shield the alarm signal during the safety mechanism self-diagnosis test process.

8. A safety mechanism self-diagnosis control method, characterized in that: Based on the safety mechanism self-diagnosis control system according to any one of claims 1 to 7; the method comprises: In the case of power-on initialization, configure the self-diagnosis information of the safety mechanism to output the configuration information and enable the self-diagnosis control circuit; According to the configuration information, controlling the fault injection enablement of the safety mechanism circuit corresponding to the target functional circuit to perform a self-diagnosis test on the safety mechanism circuit; According to the received alarm signal, it is determined whether the safety mechanism circuit corresponding to the alarm signal has a fault; wherein the alarm signal is sent by the safety mechanism circuit.

9. The control method according to claim 8, characterized in that: After determining whether the safety mechanism circuit corresponding to the alarm signal has a fault, the method further includes: When it is determined that the safety mechanism circuit corresponding to the alarm signal has a fault, the fault information is recorded; and the fault injection of the safety mechanism circuit is controlled to be disabled.

10. The control method according to claim 8 or 9, after determining whether the safety mechanism circuit corresponding to the alarm signal has a fault, further comprising: After a preset time or receiving a self-diagnosis test end signal, query the fault information to handle the fault; The fault information includes the fault location.

Images