Function safety monitoring system, vehicle controller and vehicle

Abstract

The invention provides a function safety monitoring system, a vehicle controller and a vehicle, the system comprises a system basic chip and a microcontroller, the microcontroller is provided with an error detection pin and software, the system basic chip is provided with a clock monitoring pin, a safety state output pin and a reset output pin, and the clock monitoring pin is connected with the microcontroller. The clock monitoring pin is used for collecting a pulse width modulation signal output by the error detection pin; the software is configured to actively inhibit a post-processing response function of a pull-down reset output signal of a system basic chip and then actively pull down the level of an error detection pin when a function safety fault is monitored; and the system basic chip is used for lowering the level of the safe state output pin when monitoring that the frequency of the pulse width modulation signal output by the error detection pin exceeds a normal range and the post-processing response function of lowering the reset output signal is inhibited. According to the invention, under the condition that the FTTI time is ensured, the fault data cannot be cleared, so that the fault data can be recorded.

Description

Technical Field

[0001] The present invention relates to the field of vehicle control technology, and in particular to a functional safety monitoring system, a vehicle controller and a vehicle. Background Art

[0002] System Basis Chip (SBC) is a type of chip that integrates power management functions and functional safety monitoring functions. Among them, the functional safety monitoring function mainly includes two parts: clock monitoring and watchdog monitoring. There is a type of system basis chip on the market, such as TLF35585 chip. The chip's clock monitoring and post-processing response of watchdog monitoring will pull down the safe state output signal on the one hand, and the reset output signal on the other hand.

[0003] This post-processing response method will lead to the following problems: In order to meet the functional safety goals of the system, the software needs to put the entire system into a safe state after monitoring some faults. The software will actively pull down the level of the error detection pin ErrPin of the microcontroller (MCU), and then pull down the safe state output signal through the system base chip to put the entire system into a safe state. However, due to the characteristics of this type of system basis chip SBC, the system base chip will pull down the level of the reset output pin ROT (pull down the reset output signal) while pulling down the safe state output signal (pull down the level of the safe state output pin DN), causing the microcontroller to be reset. In this case, the fault data will be cleared and difficult to record, making it difficult to troubleshoot after-sales problems.

[0004] In order to ensure the storage of fault data, after a related fault occurs, the fault information can be stored by first writing it into EEPROM (Electrically Erasable Programmable Read-Only Memory), and then the software actively pulls down the level of the microcontroller's error detection pin ErrPin to put the entire system into a safe state. However, this method may cause the post-fault processing response time to be too long, affecting the fault FTTI (Faulttolerant time interval) time.

[0005] It should be noted that the information disclosed in the background technology section of the invention is only intended to deepen the understanding of the general background technology of the invention, and should not be regarded as an admission or suggestion in any form that the information constitutes prior art already known to those skilled in the art. Summary of the invention

[0006] The object of the present invention is to provide a functional safety monitoring system, a vehicle controller and a vehicle. When the software itself monitors a fault, the system basic chip is first actively suppressed by the software for the post-processing response function of pulling down the reset output signal. Then, the level of the error detection pin of the microcontroller is actively pulled down by the software, so that the system basic chip will only pull down the safety state output signal but not the reset output signal, thereby not causing the microcontroller to be reset. Furthermore, while ensuring the FTTI time, the fault data will not be cleared, so that the fault data can be recorded.

[0007] To achieve the above-mentioned object, the present invention provides a functional safety monitoring system, the functional safety monitoring system comprising a connected system basis chip and a microcontroller, the microcontroller having an error detection pin and software installed on the microcontroller, the system basis chip having a clock monitoring pin, a safety state output pin and a reset output pin, the clock monitoring pin being connected to the error detection pin, the clock monitoring pin being used to collect a pulse width modulation signal output by the error detection pin to monitor the frequency of the pulse width modulation signal output by the error detection pin;

[0008] The software is configured to, when a functional safety fault is monitored, first actively suppress the post-processing response function of the system basis chip that pulls down the reset output signal, and then actively pull down the level of the error detection pin, so that the frequency of the pulse width modulation signal output by the error detection pin exceeds a normal range;

[0009] The system basis chip is used to pull down the level of the safe state output pin when it is monitored that the frequency of the pulse width modulation signal output by the error detection pin exceeds the normal range and its post-processing response function of pulling down the reset output signal is suppressed.

[0010] Optionally, the microcontroller further has a functional safety hardware module, and the functional safety hardware module is used to actively pull down the level of the error detection pin when a functional safety fault is monitored, so that the frequency of the pulse width modulation signal output by the error detection pin exceeds a normal range;

[0011] The software is further configured to configure a clock monitoring post-processing response delay time to delay a post-processing response time of the system basis chip;

[0012] The microcontroller further has a reset inhibition port, the system basis chip further has an inhibit reset post-processing response pin, and the reset inhibition port is connected to the inhibit reset post-processing response pin;

[0013] The functional safety hardware module is also used to trigger the microcontroller to reset when a functional safety fault is monitored, so as to pull up the level of the reset inhibition port, thereby inhibiting the post-processing response function of the system basis chip to pull down the reset output signal.

[0014] Optionally, the system base chip is also used to pull down the levels of the safe state output pin and the reset output pin when the external environment causes the level of the clock monitoring pin to be pulled down, thereby causing the frequency of the pulse width modulation signal input to the clock monitoring pin to exceed the normal range.

[0015] Optionally, the system base chip also has a watchdog monitoring module, which is used to monitor the operating logic and operating timing of the microcontroller. The system base chip is also used to lower the level of the safe state output pin and the level of the reset output pin when the number of errors in the operating logic and / or operating timing of the microcontroller is greater than the corresponding preset threshold.

[0016] Optionally, the software is also configured to perform a latent failure check on the safety shutdown path of the system base chip after the system base chip and the microcontroller are powered on, and when the latent failure check on the safety shutdown path fails, actively lower the level of the error detection pin so that the frequency of the pulse width modulation signal output by the error detection pin exceeds the normal range, thereby placing the safety shutdown path in a closed state.

[0017] Optionally, the software is further configured to suppress a post-processing response function of the system basis chip for pulling down a reset output signal before performing a latent failure check on the safety shutdown path of the system basis chip.

[0018] Optionally, the software is further configured to re-enable a post-processing response function of pulling down a reset output signal of the system basis chip when the latent failure check of the safety shutdown path succeeds.

[0019] Optionally, the software is configured to perform a latent failure check of a safety shutdown path on the system basis chip through the following process:

[0020] Check whether the safety shutdown path of the system basis chip can be shut down correctly by actively pulling down the level of the error detection pin and feeding the error watchdog;

[0021] Check whether the safety shutdown path can be correctly released by controlling the error detection pin to output a pulse width modulation signal with a frequency within a normal range and correctly feeding the watchdog;

[0022] If the safety shutdown path can be correctly shut down and can be correctly released, it is determined that the latent failure check of the safety shutdown path is successful.

[0023] In order to achieve the above object, the present invention also provides a vehicle controller, which includes the functional safety monitoring system described in any one of the above items.

[0024] In order to achieve the above object, the present invention also provides a vehicle, which includes the vehicle controller described above.

[0025] Compared with the prior art, the functional safety monitoring system, vehicle controller and vehicle provided by the present invention have the following beneficial effects:

[0026] The functional safety monitoring system provided by the present invention configures the software deployed on the microcontroller to first actively suppress the post-processing response function of the system basic chip of pulling down the reset output signal when a functional safety fault is monitored, and then actively pull down the level of the error detection pin, so that the frequency of the pulse width modulation signal output by the error detection pin exceeds the normal range, so that when the system basic chip monitors that the frequency of the pulse width modulation signal output by the error detection pin exceeds the normal range, only the level of the safe state output pin DN is pulled down (that is, only the safe state output signal is pulled down) but the reset output signal is not pulled down, and the microcontroller MCU will not be reset, so that the fault data will not be cleared while ensuring the FTTI (Fault tolerant time interval) time, so that the fault data can be recorded.

[0027] Since the vehicle controller and the vehicle provided by the present invention and the functional safety monitoring system provided by the present invention belong to the same inventive concept, the vehicle controller and the vehicle provided by the present invention at least have all the advantages of the functional safety monitoring system provided by the present invention. Therefore, for the beneficial effects of the vehicle controller and the vehicle provided by the present invention, reference can be made to the relevant content above regarding the beneficial effects of the functional safety monitoring system provided by the present invention, and they will not be elaborated one by one here. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A schematic diagram of the connection relationship between the system basic chip and the microcontroller;

[0029] Figure 2a A schematic diagram of the post-processing response of the system basis chip when the clock frequency output by the microcontroller is lower than the normal range;

[0030] Figure 2b A schematic diagram of the post-processing response of the system basis chip when the clock frequency output by the microcontroller is higher than the normal range;

[0031] Figure 3 It is a schematic diagram of the watchdog monitoring logic;

[0032] Figure 4 A structural block diagram of a functional safety monitoring system provided by one embodiment of the present invention;

[0033] Figure 5 A monitoring flow chart of a functional safety monitoring system provided in one embodiment of the present invention.

[0034] The reference numerals are as follows:

[0035] System basis chip-SBC; clock monitoring pin-ErrMon; reset output pin-ROT; safe state output pin-DN; watchdog monitoring module-WDM; window dog-WWD; question and answer dog-FWD; window dog error counter-WWO; question and answer dog error counter-FWO; inhibit reset post-processing response pin-MPS;

[0036] Microcontroller - MCU; error detection pin - ErrPin; reset pin - PORST; emergency stop pin - EmergencyStop; functional safety hardware module - SMU; reset inhibition port - PORT. DETAILED DESCRIPTION

[0037] The functional safety monitoring system, vehicle controller and vehicle proposed in the present invention are further described in detail below in combination with the accompanying drawings and specific embodiments. According to the following description, the advantages and features of the present invention will be clearer. It should be noted that the drawings are in a very simplified form and use non-precise proportions, which are only used to conveniently and clearly assist in explaining the purpose provided by the present invention. In order to make the purposes, features and advantages of the present invention more obvious and easy to understand, please refer to the accompanying drawings. It should be noted that the structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification for people familiar with this technology to understand and read, and are not used to limit the limiting conditions for the implementation of the present invention. Any structural modification, change in proportional relationship or adjustment of size, under the same or similar conditions as the effects that can be produced by the present invention and the purposes that can be achieved, should still fall within the scope of the technical content disclosed by the present invention.

[0038] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements. The singular forms "a", "an" and "the" include plural objects, the term "or" is generally used in a sense including "and / or", the term "several" is generally used in a sense including "at least one", and the term "at least two" is generally used in a sense including "two or more". In addition, the terms "first", "second" and "third" are used for descriptive purposes only and are not to be understood as indicating or suggesting relative importance or implicitly indicating the number of the indicated technical features.

[0039] In addition, it should be noted that, in the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0040] For ease of understanding, the functional safety monitoring function of the system basis chip SBC is first explained. Figure 1 , which is a schematic diagram of the connection relationship between the system basic chip and the microcontroller. Figure 1As shown, clock monitoring mainly refers to the system basic chip SBC collecting the PWM (Pulse width modulation) signal output by the error detection pin Err Pin of the microcontroller MCU through the clock monitoring pin ErrMon, and then monitoring the frequency of the PWM signal output by the microcontroller MCU. The clock monitoring pin ErrMon of the system basic chip SBC is connected to the error detection pin ErrPin of the microcontroller MCU. The reset output pin ROT of the system basic chip SBC is connected to the reset pin PORST of the microcontroller MCU, so that the system basic chip SBC has the ability to reset the microcontroller MCU. The safety status output pin DN of the system basic chip SBC is connected to the emergency stop pin Emergency Stop of the microcontroller MCU. Generally speaking, during use, the error detection pin Err Pin of the microcontroller MCU will output a fixed frequency PWM signal, and the system basic chip SBC is used as an external monitoring source to monitor the signal, thereby ensuring that the clock frequency output by the microcontroller MCU is always within the normal range during the normal operation of the system.

[0041] Please continue to refer to Figure 2a and Figure 2b ,in, Figure 2a A schematic diagram of the post-processing response of the system basis chip when the clock frequency output by the microcontroller is lower than the normal range; Figure 2b Figure 1 is a schematic diagram of the post-processing response of the system basis chip when the clock frequency output by the microcontroller is higher than the normal range. Figure 2a and Figure 2b As shown, when the system basis chip SBC monitors that the frequency of the PWM signal output by the error detection pin Err Pin of the microcontroller MCU is out of the normal range, the system basis chip SBC will actively pull down the safety state output signal of the safety state output pin DN and the reset signal of the reset output pin ROT.

[0042] Watchdog monitoring mainly refers to a chip monitoring mechanism in which the watchdog module of the system basis chip SBC checks the operating logic and operating timing of the microcontroller MCU through SPI (Serial Peripheral Interface) communication. Generally speaking, the watchdog module of the system basis chip SBC consists of two parts: the window dog WWD and the question-and-answer dog FWD. The window dog WWD monitors whether the timing of the microcontroller MCU is normal. It requires the microcontroller MCU to feed the dog in the correct window opening cycle; the question-and-answer dog FWD monitors whether the control logic of the microcontroller MCU is normal. It requires the microcontroller MCU to calculate the correct answer based on the question sent by the question-and-answer dog FWD, and send the calculated answer to the system basis chip SBC through SPI communication. Please refer to Figure 3 , which is a schematic diagram of the watchdog monitoring logic. Figure 3 As shown, when the window dog WWD monitors that the microcontroller MCU sends a dog feeding instruction within the wrong dog feeding time window (window closing cycle), or the microcontroller MCU does not send a dog feeding instruction within the correct dog feeding time window (window opening cycle), the error count of the window dog error counter WWO will increase. When the microcontroller MCU does not send the correct answer within the heartbeat time range of the question and answer dog FWD, or sends an incorrect answer within the heartbeat time range, the error count of the question and answer dog error counter FWO will increase. When the error count of any error counter reaches the corresponding error count threshold, the corresponding fault post-processing response will be triggered.

[0043] Furthermore, the system basis chip SBC generally also provides a function of suppressing the post-processing response of the system basis chip SBC to pull down the reset output signal, which will affect the post-processing response of the watchdog monitoring or clock monitoring. If the post-processing response of the system basis chip SBC to pull down the reset output signal is suppressed, when the watchdog monitoring and clock monitoring modules detect an abnormality, the post-processing response of the system basis chip SBC is to only pull down the safe state output signal (only pull down the level of the safe state output pin DN). If the post-processing response of the system basis chip SBC to pull down the reset output signal is not suppressed, after the watchdog monitoring and clock monitoring modules detect an abnormality, the post-processing response of the system basis chip SBC is to pull down the safe state output signal (pull down the level of the safe state output pin DN) and pull down the reset output signal (pull down the level of the reset output pin ROT).

[0044] If the clock monitoring module detects that the clock frequency output by the microcontroller MCU is abnormal (that is, the frequency of the PWM signal output by the error detection pin ErrPin is out of the normal range), the system basic chip SBC will pull down the reset output signal and the safe state output signal. This post-processing response method will cause the following problems:

[0045] 1. In order to meet the functional safety goals of the system, the software (specifically the monitoring module in the software) needs to put the entire system into a safe state after detecting some faults. The software will actively pull down the level of the error detection pin ErrPin of the microcontroller MCU, and then pull down the safe state output signal through the system base chip SBC, so that the entire system enters a safe state. However, due to the characteristics of this type of system base chip SBC, the system base chip SBC will pull down the level of the reset output pin ROT while pulling down the safe state output signal, causing the microcontroller MCU to be reset. In this case, the fault data will be cleared and difficult to record, making it difficult to troubleshoot after-sales problems.

[0046] 2. If, in order to ensure the storage of fault data, after a related fault occurs, the fault information is stored by first writing to the EEPROM, and then the software actively lowers the level of the error detection pin Err Pin of the microcontroller MCU to put the entire system into a safe state, it may cause the post-fault processing response time to be too long, affecting the FTTI time of the fault.

[0047] Based on this, the core idea of ​​the present invention is to provide a functional safety monitoring system, a vehicle controller and a vehicle. When the software monitoring module monitors an abnormality, the reset response output function of the system basic chip is first actively suppressed by the software, and then the level of the error detection pin of the microcontroller is lowered by the software, so that the system basic chip pulls down the safety state output signal, and the entire system enters a safe state. Since the microcontroller is not reset, the fault data can be recorded while ensuring the FTTI time.

[0048] It should be noted that the functional safety monitoring system provided by the present invention can be applied to the vehicle controller provided by the present invention, wherein the vehicle controller can be a hardware device with various operating systems, and the vehicle controller can be, but not limited to, an engine controller, a motor controller, a brake system controller, a suspension system controller, a steering system controller, a safety system controller, a body control system controller, a powertrain system controller, etc. The vehicle controller provided by the present invention can be applied to the vehicle provided by the present invention, and the vehicle can be, but not limited to, a passenger vehicle including a sports utility vehicle (SUV), a bus, a truck, and various commercial vehicles, and includes hybrid vehicles, electric vehicles, plug-in hybrid electric vehicles, fuel cell vehicles, and other alternative fuel vehicles (e.g., fuels obtained from resources other than petroleum).

[0049] To realize the above idea, the present invention provides a functional safety monitoring system, please refer to Figure 4 , which is a structural block diagram of a functional safety monitoring system provided by an embodiment of the present invention. Figure 4As shown, the functional safety monitoring system provided by the present invention includes a connected system basis chip SBC and a microcontroller MCU, the microcontroller MCU has an error detection pin ErrPin and software is installed on the microcontroller MCU, the system basis chip SBC has a clock monitoring pin ErrMon, a safety state output pin DN and a reset output pin ROT, the clock monitoring pin ErrMon is connected to the error detection pin ErrPin, the clock monitoring pin ErrMon is used to collect the pulse width modulation signal output by the error detection pin to output the pulse width modulation signal of the error detection pin ErrPin The frequency of the pulse width modulation signal is monitored; the software is configured to, when a functional safety fault is monitored, first actively suppress the post-processing response function of the system basis chip SBC for pulling down the reset output signal, and then actively pull down the level of the error detection pin ErrPin, so that the frequency of the pulse width modulation signal output by the error detection pin ErrPin exceeds the normal range; the system basis chip SBC is used to pull down the level of the safety status output pin DN when it is monitored that the frequency of the pulse width modulation signal output by the error detection pin ErrPin exceeds the normal range and its post-processing response function for pulling down the reset output signal is suppressed.

[0050] Therefore, the functional safety monitoring system provided by the present invention configures the software deployed on the microcontroller MCU to first actively suppress the post-processing response function of the system basic chip SBC of pulling down the reset output signal when a functional safety fault is monitored, and then actively pull down the level of the error detection pin Err Pin, so that the frequency of the pulse width modulation signal output by the error detection pin ErrPin exceeds the normal range, so that when the system basic chip monitors that the frequency of the pulse width modulation signal output by the error detection pin exceeds the normal range, only the level of the safe state output pin DN is pulled down (that is, only the safe state output signal is pulled down) but the reset output signal is not pulled down, and the microcontroller MCU will not be reset, so that the fault data will not be cleared while ensuring the FTTI (Fault tolerant time interval) time, so that the fault data can be recorded.

[0051] It should be noted that, as can be understood by those skilled in the art, the "expected clock monitoring anomaly" referred to herein means that after the software monitors a functional safety fault, by actively pulling down the level of the error detection pin ErrPin of the microcontroller MCU, the system base chip SBC monitors the abnormal clock frequency output by the microcontroller MCU (that is, the frequency of the pulse width modulation signal output by the error detection pin ErrPin of the microcontroller MCU exceeds the normal range). The "unexpected clock monitoring anomaly" referred to below means that after the functional safety hardware module SMU in the microcontroller MCU monitors a functional safety fault, by actively pulling down the level of the error detection pin Err Pin of the microcontroller MCU, the system base chip SBC monitors the abnormal clock frequency output by the microcontroller MCU (that is, the frequency of the pulse width modulation signal output by the error detection pin ErrPin of the microcontroller MCU exceeds the normal range); the "clock monitoring anomaly caused by the external environment" referred to below means that the external environment causes the level of the clock monitoring pin to be pulled down, causing the system base chip SBC to monitor the abnormal clock frequency. It should also be noted that, as those skilled in the art can understand, since the fault data of the functional safety fault monitored by the software is stored in the volatile memory of the microcontroller MCU, the fault data of this type of functional safety fault will be cleared with the reset of the microcontroller MCU. In addition, it should be noted that, as those skilled in the art can understand, the "functional safety fault" referred to in the present invention refers to a fault that requires the system to enter a safe state. In addition, it should be noted that, as those skilled in the art can understand, when the software monitors a fault (i.e., a functional safety fault) that requires the system to enter a safe state, it can actively suppress the post-processing response function of the system base chip SBC to pull down the reset output signal through an external pin or by sending an SPI instruction configuration register, and then actively pull down the level of the error detection pin ErrPin, so that the level of the safety output status pin of the system base chip SBC is pulled down, and then the system enters a safe state.

[0052] Please continue to refer to Figure 4 ,like Figure 4As shown, the microcontroller MCU also has an emergency stop pin Emergency Stop and a reset pin PORST, the emergency stop pin Emergency Stop is connected to the safety state output pin DN, and the reset pin PORST is connected to the reset output pin ROT. Thus, by connecting the reset pin PORST of the microcontroller MCU to the reset output pin ROT of the system basis chip SBC, the system basis chip SBC can have the function of resetting the microcontroller MCU; by connecting the emergency stop pin Emergency Stop of the microcontroller MCU to the safety state output pin DN of the system basis chip SBC, the system basis chip SBC can control the port (port) state of the microcontroller MCU. It should be noted that, as those skilled in the art can understand, the safety status output pin DN of the system basis chip SBC is connected to the emergency stop pin Emergency Stop of the microcontroller MCU as well as the enable pins of some peripheral chips. When the level of the safety status output pin DN is pulled low, the level of the enable pins of the peripheral chips connected thereto is also pulled low, thereby further ensuring the safety of the entire vehicle control system (such as braking system, suspension system, steering system, safety system, body control system, powertrain system, etc.) when a functional safety failure occurs.

[0053] Please continue to refer to Figure 4 ,like Figure 4 As shown, in some exemplary embodiments, the microcontroller MCU also has a functional safety hardware module SMU, and the functional safety hardware module SMU is used to actively pull down the level of the error detection pin ErrPin when a functional safety fault is monitored, and reset the microcontroller MCU at the same time. The microcontroller MCU also has a reset inhibition port PORT, and the system base chip also has a reset inhibition post-processing response pin MPS, and the reset inhibition port PORT is connected to the reset inhibition post-processing response pin MPS, thereby controlling the reset inhibition function of the system base chip SBC; the software is also configured to configure the clock monitoring post-processing response delay time of the system base chip SBC to delay the post-processing response time of the system base chip SBC; when the functional safety hardware module SMU monitors a functional safety fault, it triggers the microcontroller MCU to reset and pulls down the level of the error detection pin ErrPin at the same time. After the microcontroller MCU is reset, the state of the reset inhibition port PORT is controlled by the peripheral hardware to a high level state, so the post-processing response function of the system base chip SBC to pull down the reset output signal will be suppressed.

[0054] Therefore, by configuring the clock monitoring post-processing response delay time of the system basic chip SBC by software, the system basic chip SBC can not immediately pull down the level of the safety state output pin DN and the reset output pin ROT when monitoring the abnormal frequency (outside the normal range) of the pulse width modulation signal output from the error detection pin ErrPin (that is, the pulse width modulation signal input to the clock monitoring pin ErrMon), but after the configured delay time, the system basic chip SBC will pull down the level of the safety state output pin DN and the reset output pin ROT. By connecting a port (that is, the reset inhibition port PORT) on the microcontroller MCU to the inhibit reset post-processing response pin MPS on the system basic chip SBC, the level of the inhibit reset post-processing response pin MPS can be pulled high after the microcontroller MCU actively resets, and then the post-processing response function of the system basic chip SBC to pull down the reset output signal will be suppressed, thereby ensuring that when the functional safety hardware module SMU monitors a functional safety fault, the fault information stored in the register of the microcontroller MCU will not be cleared. Specifically, when the functional safety hardware module SMU monitors a functional safety fault, the functional safety hardware module SMU will trigger the reset of the microcontroller MCU and pull down the level of the error detection pin ErrPin. Since the software has configured the clock monitoring post-processing response delay time of the system basis chip SBC, the system basis chip SBC will not immediately pull down the level of the safety status output pin DN and the reset output pin ROT, and the reset post-processing function of the microcontroller MCU is executed. When the microcontroller MCU is reset, the port of the microcontroller MCU is no longer controlled by the software, but by the microcontroller MCU hardware and peripheral circuits. The level of the reset inhibition port PORT of the microcontroller MCU will be pulled high, so that the level of the reset inhibition post-processing response pin MPS on the system base chip SBC will also be pulled high, and the reset inhibition post-processing response function of the system base chip SBC will be activated (that is, the post-processing response function of the system base chip SBC that pulls down the reset output signal is inhibited). At this time, the post-processing response measures of the clock monitoring and watchdog monitoring of the system base chip SBC are only to pull down the level of the safety state output pin DN. When the clock monitoring post-processing response delay time is reached, the system base chip SBC only pulls down the level of the safety state output pin DN, and does not pull down the level of the reset output pin ROT. Therefore, the register information related to the functional safety hardware module SMU in the microcontroller MCU will be retained, so that the fault data will not be cleared, so that the fault data can be recorded. It should be noted that, as can be understood by those skilled in the art, the reset actively triggered by the microcontroller MCU will not clear the register information related to the functional safety hardware module SMU in the microcontroller MCU.

[0055] In some exemplary embodiments, the system basis chip SBC is further used to pull down the level of the safety state output pin DN and the level of the reset output pin ROT when the external environment causes the level of the clock monitoring pin Err Mon to be pulled down, thereby causing the frequency of the pulse width modulation signal input to the clock monitoring pin Err Mon to exceed the normal range. Since the system basis chip SBC pulls down the level of the safety state output pin DN and the level of the reset output pin ROT when the external environment causes the level of the clock monitoring pin Err Mon to be pulled down, thereby causing the frequency of the pulse width modulation signal input to the clock monitoring pin Err Mon to exceed the normal range, it can not only ensure that the vehicle control system (such as the braking system, suspension system, steering system, safety system, body control system, power transmission system, etc.) can smoothly enter the safe state (limp state), but also reset the microcontroller MCU, so that the microcontroller MCU can smoothly perform related functions after resetting.

[0056] It should be noted that, as those skilled in the art can understand, the situation in which the level of the clock monitoring pin Err Mon is pulled low due to the external environment includes but is not limited to the error detection pin ErrPin on the microcontroller MCU being shorted to ground by a tin bead on the PCB (printed circuit board).

[0057] Please continue to refer to Figure 4 ,like Figure 4 As shown, in some exemplary embodiments, the system basis chip SBC also has a watchdog monitoring module WDM, and the watchdog monitoring module WDM is used to monitor the operation logic and operation timing of the microcontroller MCU. The system basis chip SBC is also used to pull down the level of the safety state output pin DN and the level of the reset output pin ROT when the number of errors in the operation logic and / or operation timing of the microcontroller MCU is greater than the corresponding preset threshold. Therefore, by using the system basis chip SBC to pull down the level of the safety state output pin DN and the level of the reset output pin ROT when the number of errors in the operation logic and / or operation timing of the microcontroller MCU is greater than the corresponding preset threshold, not only can the vehicle control system (such as the braking system, suspension system, steering system, safety system, body control system, power transmission system, etc.) be ensured to enter the safe state (limp state) smoothly, but also the microcontroller MCU can be reset, so that the microcontroller MCU can smoothly perform related functions after resetting.

[0058] Specifically, the system basis chip SBC is used to pull down the level of the safety state output pin DN and the level of the reset output pin ROT when the number of errors in the operation logic of the microcontroller MCU is greater than a first preset threshold; or the number of errors in the operation timing of the microcontroller MCU is greater than a second preset threshold, or the sum of the number of errors in the operation logic of the microcontroller MCU and the number of errors in the operation timing of the microcontroller MCU is greater than a third threshold. It should be noted that, as can be understood by those skilled in the art, the specific values ​​of the first preset threshold, the second preset threshold and the third preset threshold can be set according to actual conditions, and the present invention does not limit this.

[0059] In some exemplary embodiments, the software is further configured to perform a latent failure check of the safety shutdown path on the system basis chip SBC after the system basis chip SBC and the microcontroller MCU are powered on, and when the latent failure check of the safety shutdown path fails, actively pull down the level of the error detection pin ErrPin so that the frequency of the pulse width modulation signal output by the error detection pin Err Pin exceeds the normal range, and then the safety shutdown path is in a closed state. Therefore, by first performing a latent failure check of the safety shutdown path on the system basis chip SBC after the system basis chip SBC and the microcontroller MCU are powered on, it is possible to effectively detect whether the functional safety monitoring function of the system basis chip SBC is normal, so as to ensure that the system basis chip SBC can accurately monitor the abnormality of the microcontroller MCU when a fault occurs in the vehicle control system, and can correctly execute the functional safety post-processing response. In addition, by configuring the software to actively lower the level of the error detection pin ErrPin when the latent failure check of the safety shutdown path fails, so that the frequency of the pulse width modulation signal output by the error detection pin ErrPin exceeds the normal range, the system basis chip SBC can lower the level of the safety state output pin DN when the latent failure check of the safety shutdown path fails, thereby ensuring that the vehicle control system can smoothly enter the safe state.

[0060] In some exemplary embodiments, the software is configured to inhibit a post-processing response function of pulling down a reset output signal of the system basis chip SBC before performing a latent failure check of a safety shutdown path on the system basis chip SBC.

[0061] Therefore, before performing a latent failure check on the safety shutdown path of the system base chip SBC, the post-processing response function of pulling down the reset output signal of the system base chip SBC is suppressed by the software deployed on the microcontroller MCU. When the system base chip SBC monitors that an abnormality has occurred in the microcontroller MCU, it will only pull down the level of the safety status output pin DN, but will not pull down the level of the reset output pin ROT, thereby not resetting the microcontroller MCU. This can ensure that the software deployed on the microcontroller MCU will not be frequently restarted, and the system base chip SBC can be smoothly checked for latent failures in the safety shutdown path.

[0062] In some exemplary embodiments, the software is configured to perform a latent failure check of a safety shutdown path on the system basis chip SBC through the following process:

[0063] A post-processing response function that suppresses the pull-down reset output signal of the system basis chip SBC;

[0064] Check whether the safety shutdown path of the system basis chip SBC can be shut down correctly by actively pulling down the level of the error detection pin Err Pin and feeding the wrong watchdog;

[0065] Check whether the safety shutdown path can be correctly released by controlling the error detection pin Err Pin to output a pulse width modulation signal with a frequency within a normal range and feeding the watchdog correctly;

[0066] If the safety shutdown path can be correctly shut down and can be correctly released, it is determined that the latent failure check of the safety shutdown path is successful.

[0067] Therefore, by actively pulling down the level of the error detection pin Err Pin and feeding the wrong watchdog to check whether the safety shutdown path of the system basis chip SBC can be correctly shut down, and by controlling the error detection pin Err Pin to output a pulse width modulation signal with a frequency within a normal range and correctly feeding the watchdog to check whether the safety shutdown path can be correctly released, it is possible to accurately detect whether the clock monitoring function and the watchdog monitoring function of the system basis chip SBC are normal, thereby further effectively ensuring that the system basis chip SBC can accurately monitor the abnormality of the microcontroller MCU when a failure occurs in the vehicle control system, and can correctly execute the functional safety post-processing response.

[0068] It should be noted that, as can be understood by those skilled in the art, "feeding the wrong watchdog" means that the microcontroller MCU sends the dog feeding instruction within the wrong dog feeding time window, or the microcontroller MCU does not send the dog feeding instruction within the correct dog feeding time window, or the microcontroller MCU does not send the correct answer within the heartbeat time range of the question and answer dog FWD, or the microcontroller MCU sends the wrong answer within the heartbeat time range of the question and answer dog FWD. It should also be noted that, as can be understood by those skilled in the art, if the level of the error detection pin Err Pin is actively pulled down (that is, the frequency of the pulse width modulation signal output by the error detection pin Err Pin exceeds the normal range) and the microcontroller MCU feeds the watchdog incorrectly, the system basis chip SBC can successfully pull down the level of the safety status output pin DN, then it is determined that the safety shutdown path of the system basis chip SBC can be correctly shut down; if the frequency of the pulse width modulation signal output by the error detection pin Err Pin is within the normal range and the microcontroller MCU feeds the watchdog correctly, the system basis chip SBC can successfully restore the level of the safety status output pin DN to a normal value, then it is determined that the safety shutdown path of the system basis chip SBC can be correctly released.

[0069] In some exemplary embodiments, the software is further configured to re-enable the post-processing response function of the system basis chip SBC to pull down the reset output signal when the latent failure check of the safety shutdown path succeeds. Thus, by configuring the software to re-enable the post-processing response function of the system basis chip SBC to pull down the reset output signal when the latent failure check of the safety shutdown path succeeds, the system basis chip SBC can smoothly pull down the level of the reset output pin ROT when monitoring unexpected clock monitoring anomalies and abnormalities in the operating logic and / or operating timing of the microcontroller MCU, thereby successfully resetting the microcontroller MCU.

[0070] In some exemplary implementations, the software is configured to actively pull down the level of the error detection pin ErrPin by calling a unified interface when a fault is detected. Thus, by configuring the software to actively pull down the level of the error detection pin ErrPin by calling a unified interface when a fault is detected, code redundancy can be eliminated, the readability and maintainability of the code can be improved, and the scalability and flexibility of the software can be enhanced.

[0071] Please continue to refer to Figure 5 , which is a monitoring flow chart of a functional safety monitoring system provided by one embodiment of the present invention. Figure 5As shown, after the vehicle controller having the system basis chip SBC and the microcontroller MCU is powered on, the software deployed on the microcontroller MCU will first suppress the post-processing response function of the system basis chip SBC to pull down the reset output signal, so that the functional safety post-processing response of the system basis chip SBC is to pull down the safety state output signal (pull down the level of the safety state output pin DN). Then the software starts to perform a latent failure check of the safety shutdown path (hereinafter referred to as the IPT stage). When performing the latent failure check of the safety shutdown path, the software deployed on the microcontroller MCU will actively pull down the level of the error detection pin Err Pin and feed the wrong watchdog to check whether the safety shutdown path can be correctly shut down. At the same time, the software deployed on the microcontroller MCU will also check whether the safety shutdown path can be correctly released by outputting a pulse width modulation signal of a normal frequency on the error detection pin Err Pin and correctly feeding the watchdog. If the IPT (latent failure check of the safety shutdown path) check fails, the software will actively lower the level of the error detection pin ErrPin, and then the system basis chip SBC will monitor the abnormal clock frequency output by the microcontroller MCU (that is, the frequency of the pulse width modulation signal output by the error detection pin Err Pin of the microcontroller MCU exceeds the normal range), and lower the level of the safety status output pin DN, so that the vehicle control system (such as braking system, suspension system, steering system, safety system, body control system, powertrain system, etc.) enters a safe state.

[0072] If the IPT (latent failure check of the safety shutdown path) check is successful, the software runs to the OPS stage. At this time, the software will re-enable the post-processing response function of the system basis chip SBC to pull down the reset output signal. According to the clock monitoring and watchdog monitoring classification of the system basis chip SBC, according to the different functional safety faults monitored, the system basis chip SBC will take different post-processing responses:

[0073] 1. If an unexpected clock monitoring anomaly occurs in the vehicle control system, the functional safety hardware module SMU will trigger the reset of the microcontroller MCU and pull down the level of the error detection pin ErrPin. After the microcontroller MCU is reset, the level of the reset inhibition port PORT of the microcontroller MCU will be pulled high, and the inhibition reset post-processing response function of the system basic chip SBC will be activated. When the clock monitoring post-processing response delay time is reached, the system basic chip SBC only pulls down the level of the safety state output pin DN, but does not pull down the level of the reset output pin ROT, thereby making the vehicle control system enter a safe state.

[0074] 2. If a dog feeding error is detected in the microcontroller MCU, the watchdog module of the system basis chip SBC will monitor the error and the error count of the error counter will increase. When the error count exceeds the threshold configured by the software, the system basis chip SBC will pull down the safe state output signal (pull down the level of the safe state output pin DN) to put the vehicle control system into a safe state, and pull down the reset output signal (pull down the level of the reset output pin ROT) to reset the microcontroller MCU.

[0075] 3. If the software monitoring module detects an abnormality (fault), the software will first actively suppress the post-processing response function of the microcontroller MCU to pull down the reset output signal, and then pull down the level of the error detection pin ErrPin (expected clock monitoring abnormality) to make the system basic chip SBC pull down the safety status output information (pull down the level of the safety status output pin DN), and then put the vehicle control system into a safe state.

[0076] 4. If the level of the clock monitoring pin ErrMon is pulled low due to the external environment, causing the frequency of the pulse width modulation signal input to the clock monitoring pin ErrMon to exceed the normal range (clock monitoring abnormality caused by the external environment), the system basis chip SBC will pull down the safety state output signal (pull down the level of the safety state output pin DN) to make the vehicle control system enter the safe state, and pull down the reset output signal (pull down the level of the reset output pin ROT) to reset the microcontroller MCU.

[0077] It should be noted that although Figure 5 The example of checking the watchdog monitoring function of the system basic chip first and then checking the clock monitoring function of the system basic chip when the watchdog monitoring function check passes (successfully) is used for illustration. However, as those skilled in the art will appreciate, this does not constitute a limitation of the present invention. In other embodiments, the clock monitoring function of the system basic chip may be checked first, and then the watchdog monitoring function of the system basic chip may be checked when the clock monitoring function check passes (successfully). It should also be noted that, as those skilled in the art will appreciate, as long as any one of the watchdog monitoring function and the clock monitoring function of the system basic chip fails to pass the check, the IPT (latent failure check of the safety shutdown path) check is determined to have failed.

[0078] Based on the same inventive concept, the present invention also provides a vehicle controller, which includes the functional safety monitoring system described above. Since the vehicle controller provided by the present invention and the functional safety monitoring system provided by the present invention belong to the same inventive concept, the vehicle controller provided by the present invention at least has all the beneficial effects of the functional safety monitoring system provided by the present invention. Therefore, the relevant contents about the beneficial effects of the vehicle controller provided by the present invention can refer to the relevant description of the beneficial effects of the functional safety monitoring system provided by the present invention above, and will not be repeated here one by one.

[0079] Based on the same inventive concept, the present invention also provides a vehicle, the vehicle including the vehicle controller described above. Since the vehicle provided by the present invention includes the vehicle controller provided by the present invention, and the vehicle controller provided by the present invention includes the functional safety monitoring system provided by the present invention, the vehicle provided by the present invention also belongs to the same inventive concept as the functional safety monitoring system provided by the present invention, and therefore the vehicle provided by the present invention also has at least all the beneficial effects of the functional safety monitoring system provided by the present invention, so the relevant contents about the beneficial effects of the vehicle provided by the present invention can refer to the relevant description about the beneficial effects of the functional safety monitoring system provided by the present invention in the above text, and will not be repeated here one by one.

[0080] In summary, compared with the prior art, the functional safety monitoring system, vehicle controller and vehicle provided by the present invention have the following beneficial effects:

[0081] (1) When the software deployed on the microcontroller MCU monitors a fault, the present invention first actively suppresses the post-processing response function of the system basis chip SBC of pulling down the reset output signal through the software, and then actively pulls down the level of the error detection pin Err Pin of the microcontroller MCU through the software, so that the system basis chip SBC will only pull down the safe state output signal but not the reset output signal, thereby not causing the microcontroller MCU to be reset. Furthermore, while ensuring the FTTI time, the fault data will not be cleared, so that the fault data can be recorded.

[0082] (2) The present invention configures the clock monitoring post-processing response delay time of the system base chip SBC through software, so that when the system base chip SBC monitors that the frequency of the pulse width modulation signal output from the error detection pin Err Pin (that is, the pulse width modulation signal input to the clock monitoring pin ErrMon) is abnormal (outside the normal range), it will not immediately pull down the level of the safety state output pin DN and the reset output pin ROT, but after the configured delay time, the system base chip SBC will pull down the level of the safety state output pin DN and the reset output pin ROT. By connecting a port (that is, the reset inhibition port PORT) on the microcontroller MCU to the inhibit reset post-processing response pin MPS on the system base chip SBC, when the level of the inhibit reset post-processing response pin MPS is pulled high, the post-processing response function of the system base chip SBC to pull down the reset output signal will be suppressed, thereby ensuring that when the functional safety hardware module SMU monitors a functional safety fault, the fault information stored in the register of the microcontroller MCU will not be cleared.

[0083] (3) The present invention distinguishes between expected clock monitoring anomalies, unexpected clock monitoring anomalies and clock monitoring anomalies caused by external environment during the design stage, and the post-processing responses of these three types of clock monitoring anomalies are different. If a clock monitoring anomaly occurs on the client later, it can be quickly located whether the clock monitoring anomaly is expected clock monitoring anomaly, unexpected clock monitoring anomaly or clock monitoring anomaly caused by external environment, thereby improving the efficiency of troubleshooting.

[0084] It should be noted that the above description is only a description of the preferred embodiment of the present invention, and is not any limitation on the scope of the present invention. Any changes and modifications made by a person skilled in the art in the field of the present invention based on the above disclosure are within the scope of protection of the present invention. Obviously, a person skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations fall within the scope of the present invention and its equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A functional safety monitoring system, characterized in that: The functional safety monitoring system comprises a connected system basis chip and a microcontroller, the microcontroller has an error detection pin and software is installed on the microcontroller, the system basis chip has a clock monitoring pin, a safety state output pin and a reset output pin, the clock monitoring pin is connected to the error detection pin, and the clock monitoring pin is used to collect a pulse width modulation signal output by the error detection pin to monitor the frequency of the pulse width modulation signal output by the error detection pin; The software is configured to, when a functional safety fault is monitored, first actively suppress the post-processing response function of the system basis chip that pulls down the reset output signal, and then actively pull down the level of the error detection pin, so that the frequency of the pulse width modulation signal output by the error detection pin exceeds a normal range; The system basis chip is used to pull down the level of the safety state output pin when it is monitored that the frequency of the pulse width modulation signal output by the error detection pin exceeds the normal range and its post-processing response function of pulling down the reset output signal is suppressed.

2. The functional safety monitoring system according to claim 1, characterized in that: The microcontroller also has a functional safety hardware module, and the functional safety hardware module is used to actively pull down the level of the error detection pin when a functional safety fault is monitored, so that the frequency of the pulse width modulation signal output by the error detection pin exceeds a normal range; The software is further configured to configure a clock monitoring post-processing response delay time to delay a post-processing response time of the system basis chip; The microcontroller further has a reset inhibition port, the system basis chip further has an inhibit reset post-processing response pin, and the reset inhibition port is connected to the inhibit reset post-processing response pin; The functional safety hardware module is also used to trigger the microcontroller to reset when a functional safety fault is monitored, so as to pull up the level of the reset inhibition port, thereby inhibiting the post-processing response function of the system basis chip to pull down the reset output signal.

3. The functional safety monitoring system according to claim 1, characterized in that: The system basis chip is also used to pull down the levels of the safe state output pin and the reset output pin when the external environment causes the level of the clock monitoring pin to be pulled down, thereby causing the frequency of the pulse width modulation signal input to the clock monitoring pin to exceed the normal range.

4. The functional safety monitoring system according to claim 1, characterized in that: The system basis chip also has a watchdog monitoring module, which is used to monitor the operating logic and operating timing of the microcontroller. The system basis chip is also used to lower the level of the safety status output pin and the level of the reset output pin when the number of errors in the operating logic and / or operating timing of the microcontroller is greater than the corresponding preset threshold.

5. The functional safety monitoring system according to claim 1, characterized in that: The software is also configured to perform a latent failure check on the safety shutdown path of the system base chip after the system base chip and the microcontroller are powered on, and to actively lower the level of the error detection pin when the latent failure check on the safety shutdown path fails, so that the frequency of the pulse width modulation signal output by the error detection pin exceeds the normal range, thereby placing the safety shutdown path in a closed state.

6. The functional safety monitoring system according to claim 5, characterized in that: The software is further configured to inhibit a post-processing response function of the system basis chip that pulls down a reset output signal before checking the system basis chip for a latent failure of a safe shutdown path.

7. The functional safety monitoring system according to claim 6, characterized in that: The software is also configured to re-enable a post-processing response function of the system basis chip that pulls down a reset output signal when the latent failure check of the safe shutdown path succeeds.

8. The functional safety monitoring system according to claim 5, characterized in that: The software is configured to perform a latent failure check of a safety shutdown path on the system basis chip through the following process: Check whether the safety shutdown path of the system basis chip can be shut down correctly by actively pulling down the level of the error detection pin and feeding the error watchdog; Check whether the safety shutdown path can be correctly released by controlling the error detection pin to output a pulse width modulation signal with a frequency within a normal range and correctly feeding the watchdog; If the safety shutdown path can be correctly shut down and can be correctly released, it is determined that the latent failure check of the safety shutdown path is successful.

9. A vehicle controller, characterized in that: A functional safety monitoring system comprising any one of claims 1 to 8.

10. A vehicle, characterized in that: Includes the vehicle controller as claimed in claim 9.

Images