Function safety design method of MIPI DSI sending controller

Abstract

The invention provides a function safety mechanism and a circuit structure of an MIPI DSI (Mobile Industry Processor Interface) sending controller, so that the application condition of the MIPI DSI sending controller on an automobile is met. The sending controller is compatible with a DPI parallel interface, a DBI parallel interface and a DCS command set, takes D-PHY as a physical layer, and adopts an APB bus to carry out register configuration. In order to meet the requirement of a vehicle chip, the invention provides a function safety design method of an MIPI DSI (Mobile Industry Processor Interface) sending controller, which comprises the following steps of: (1) adding an overtime monitoring mechanism: defining five overtime monitors, the method comprises the following steps of: sending high-speed sending timeout, low-power-consumption receiving timeout, peripheral response timeout and external hypotheses in a controller; receiving high-speed receiving timeout and low-power-consumption sending timeout in the controller; (2) an end-to-end protection mechanism: performing ECC (Error Correction Code) and CRC (Cyclic Redundancy Check) on the DSI packet, and adding a message counter; defining a confirmation and error report mechanism; (3) adding an ECC (Error Correction Code) protection function and an up-down overflow detection function to the FIFO memory; (4) an internal error monitoring mechanism: monitoring the decoding process of the application layer, monitoring the state of a configuration register, and monitoring the packing and unpacking process of the protocol layer; and (5) performing dual-core lock-step redundancy processing on the important module.

Description

Technical Field

[0001] The present invention relates to the field of functional safety of automotive chips, and in particular to a circuit structure of a MIPIDSI sending controller and a set of functional safety mechanisms. Background Art

[0002] Mobile electronic devices such as smartphones, cars, and laptops are developing rapidly, and their functions are emerging in an endless stream. In most mobile devices, display functions are indispensable. As consumers' demand for display resolution increases, mobile display technology has developed from standard definition and high definition to full high definition and ultra-high definition. The resolution of transmitted pictures continues to increase, and the performance requirements for video display modules and mobile processor physical interfaces are getting higher and higher. The Mobile Industry Processor Interface (MIPI) Alliance has proposed four display specifications for the display function part: Display Command Set (DCS), Display Bus Interface (DBI), Display Pixel Interface (DPI), and Display Serial Interface (DSI). DSI is one of the most famous specifications provided by MIPI. It is a multi-functional high-speed serial interface with good compatibility. DSI can be divided into four layers: application layer, protocol layer, channel management layer, and physical layer. The physical layer is proposed by the physical layer working group. The most widely used physical layer of DSI is D-PHY, and the single-channel data rate can reach 1.5Gbps in version 2.0. The interface specifications developed by the MIPI Alliance are also widely used in the automotive field.

[0003] In the automotive field, the particularity of automobiles determines that once an automotive chip fails during use, it will pose a certain degree of threat to personal safety and property safety, and even cause loss of life. Automotive functional safety refers to avoiding unacceptable risks caused by system functional failures, and is the top priority of automotive chip design. Functional safety focuses on the behavior after a system failure, rather than the original function or performance of the system. The International Electrotechnical Commission (IEC) proposed the international standard IEC 61508 on the functional safety of electronic, electrical and programmable electronic systems (E / E / PE). However, it is not completely used in automobiles, so the International Organization for Standardization (ISO) has specially formulated a functional safety standard specifically for automotive electronic and electrical systems, namely ISO 26262 "Functional Safety of Road Vehicles". ISO 26262 proposes a risk-based analysis method specifically for automobiles to determine the Automotive Safety Integrity Level (ASIL). Based on a specific chip module, adding protection that meets the ASIL level of the module: functional safety protection of chip logic circuits, functional safety protection of storage units, functional safety protection of registers, and functional safety protection of on-chip buses, etc., is to add a design that meets a specific ASIL level in the chip design.

[0004] With the vigorous development of new energy vehicles in China and people's increasing attention to driving safety, automotive functional safety chips, as the core components for achieving functional safety, have also received more and more attention. However, due to the high threshold of automotive-grade chips, the world's leading semiconductor suppliers dominate the automotive chip market, and domestic manufacturers lack strong competitiveness in the industrial chain. They are generally at the middle and low end in the global industrial division of labor. Since the release of MIPIDSI, many companies and universities have carried out a lot of research, but it is mainly in enterprises. Companies such as Synopsys have mature IPs, while there is a certain gap between domestic related companies. Most display driver manufacturers purchase IPs from foreign companies. Therefore, it is very meaningful to design an automotive-grade MIPIDSI transmitter controller. Summary of the invention

[0005] In view of this, the present invention provides a functional safety design method for a MIPI DSI transmitting controller, thereby meeting the application conditions of the MIPI DSI transmitting controller in automobiles.

[0006] To achieve the above-mentioned purpose, the present invention provides a functional safety mechanism and circuit structure of a MIPIDSI sending controller. This sending controller is compatible with two parallel interfaces, DPI and DBI, and the DCS command set, uses D-PHY as the physical layer, and adopts the APB bus for register configuration. This sending controller includes: an application layer, a protocol layer, and a channel management layer. Among them, the application layer includes a DPI interface processing module, a DBI interface processing module, and an APB interface processing module; the protocol layer includes a header processing module, a payload processing module, a packaging module, and an unpacking module; the channel management layer includes a PHY interface control state machine module, a channel management module, a high-speed sending module, a low-power sending module, and a low-power receiving module; and an interrupt processing module.

[0007] Based on the infrastructure of the DSI sending controller, a functional safety mechanism is added. According to the description in Part 11 of ISO26262, the failure modes of digital components can be transformed into:

[0008] (1) Function omission: Function is not performed when required;

[0009] (2) Function mis-activation: Function execution when it is not needed;

[0010] (3) Functional timing: Function execution timing error;

[0011] (4) Function value: The function provides incorrect output.

[0012] Therefore, the functional safety mechanism of the DSI sending controller is:

[0013] For (1) the requested data transfer did not occur:

[0014] Define a timeout monitoring mechanism to monitor high-speed transmission timeout, low-power transmission timeout and low-power reception timeout, and the receiving end monitors high-speed reception timeout and low-power transmission timeout;

[0015] For (2) no request was made, but data transfer occurred:

[0016] Define an end-to-end protection mechanism, using a message counter or message ID to detect whether it is a previous message;

[0017] For (3) data transmission too early / too late:

[0018] If data transmission is triggered before a correct request is made, this situation is equivalent to (2) and can be solved by the safety mechanism in (2); if the transmission is too early or too late after a correct request is made, it can be solved by timeout monitoring and end-to-end protection;

[0019] For (4) error output:

[0020] For erroneous output data, end-to-end protection mechanisms such as ECC and CRC are used at the peripheral end to report errors to the host (confirmation and error reporting mechanism) when data errors occur.

[0021] At the submodule level:

[0022] For each asynchronous FIFO, the overflow situation of the FIFO is monitored using the safety mechanism of upper and lower overflow detection;

[0023] For the DPI interface processing module, a dual-core lock-step safety mechanism is used to perform redundant processing on the DPI pixel width conversion part; DPI commands and payloads are stored in the asynchronous FIFO after ECC encoding;

[0024] For the DBI interface processing module, a dual-core lock-step safety mechanism is used to perform redundant processing on the DBI send and receive payload conversion parts; an error detection signal is added to detect illegal commands for the DCS commands input by the DBI; the DBI write commands and write payloads are processed by ECC encoding and stored in the asynchronous FIFO;

[0025] For the APB interface processing module, the upper computer periodically reads the configuration register data to determine whether the configuration register is wrong; the update of the video-related configuration register must be updated when the configuration register of the update signal is enabled; an error detection signal is added to detect illegal commands for the APB input commands; the GEN write command and write payload are stored in the asynchronous FIFO after ECC encoding;

[0026] For the payload processing module, an error detection signal is added to detect the situation where the reading of the payloads of DPI, DBI, and GEN is enabled at the same time;

[0027] For the packaging module, dual-core lock-step is used for redundant processing;

[0028] For the unpacking module, perform redundancy processing on the unpacking module; perform ECC decoding on the header of the received packet and perform single-bit error correction and double-bit error detection; perform CRC decoding on the effective load and perform single-bit error detection; add an error detection signal to monitor the error of the effective load length of the received packet; add an error detection signal to monitor the error of not receiving the eotp packet when enabling the reception of the eotp packet;

[0029] For the PHY interface control state machine module, add additional logic to the state machine to ensure that it can be safely reset to a known safe state when an illegal state is detected;

[0030] For the channel management module, a dual-core lock-step safety mechanism is used for redundant processing.

[0031] As described above, the present invention is a functional safety design method for a MIPIDSI sending controller, which has the following beneficial effects: the DSI interface is compatible with the DPI and DBI standards, so that a display module can be used on motherboards that support different interfaces, increasing flexibility and versatility; a design structure of a DSI sending controller and a corresponding set of functional safety mechanisms are proposed, providing a solution for the use of MIPIDSI chips in the automotive field. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 Design diagram of the MIPIDSI sending controller. DETAILED DESCRIPTION

[0033] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods. The exemplary implementation methods of the present invention and their descriptions are only used to explain the present invention and are not intended to limit the present invention.

[0034] See also Figure 1 The present invention provides a technical solution: a functional safety design method for a MIPIDSI sending controller, and its specific solution includes the following points:

[0035] (1) Add a timeout monitoring mechanism:

[0036] In this embodiment, a submodule is added, in which three timeout monitorings are defined, namely, high-speed transmission timeout hstx_to, low-power reception timeout lprx_to, and peripheral response timeout presp_to.

[0037] For high-speed transmission timeout, if the transmission is not completed within the specified time from the start of transmitting the packet to PHY, a high-speed transmission timeout occurs, and the hstxto_err signal is defined and transmitted to the interrupt processing module;

[0038] For low power reception timeout, if the transmission is not completed within the specified time from the time when PHY starts to receive the packet, a low power reception timeout occurs, and the lprxto_err signal is defined and transmitted to the interrupt processing module.

[0039] For peripheral response timeout, define the response time for high-speed transmission, low-power transmission, low-power reception, and PHY direction conversion. Due to the limitations of the design architecture, the peripheral may not be able to respond immediately to certain data packets or requests received, and it may take some time to respond correctly.

[0040] For the DSI sending controller as SEooC, the assumptions about the external safety mechanism are as follows: In the DSI receiving controller, two timeout monitorings are added, namely the high-speed receiving timeout hsrx_to and the low-power sending timeout lptx_to (specified by the protocol).

[0041] Table 1 Error report bit definition

[0042] Bit describe 0 SOT Error 1 SOT Sync Error 2 EOT sync error 3 Escape mode entry command error 4 Low power transmission synchronization error 5 Peripheral timeout error 6 Error control error 7 Contention detected 8 ECC single bit error 9 ECC multi-bit errors 10 Payload checksum error (CRC) 11 Unrecognized DSl data type 12 DSI virtual channel error 13 Transmission data length error 14 reserve 15 DSI protocol error

[0043] (2) End-to-end protection mechanism:

[0044] In this embodiment, ECC and CRC protection functions are added to the packaging module, and the headers of short and long packets are ECC-encoded, and the payload of long packets is CRC-encoded. The ECC code is stored in the fourth byte of the short packet or the header, and a two-byte CRC code is added after the payload as the packet tail;

[0045] Add message counter, ECC decoding module, CRC decoding module in the unpacking module. Define id_err, eccsgl_err, eccmlt_err, crc_err signals and transmit them to the interrupt processing module;

[0046] Acknowledgement and error reporting mechanism, in a bidirectional link, the peripheral monitors the transmission from the host processor using the specified detection functions and timers. Error information related to the transmission should be stored in the peripheral. Errors from multiple transmissions should be stored and accumulated until there is a low-power reception, and the peripheral reports the error to the host processor. Support error reporting as shown in Table 1, define the ackwitherr signal and transmit it to the interrupt processing module.

[0047] (3) Add ECC protection and overflow detection functions to the FIFO memory:

[0048] In this embodiment, the ECC function module can calculate the ECC check bit for each word written into the FIFO memory, and the calculated ECC check bit is stored together with the data being written into the FIFO. When reading data from the FIFO memory, the ECC check bit is recalculated using the ECC function module. The recalculated ECC check bit is compared with the read ECC check bit.

[0049] Add monitoring signals to detect FIFO overflow and overflow.

[0050] There are eight asynchronous FIFOs in DSI, including DPI command write and write payload FIFO, DBI command write FIFO, DBI write / read payload FIFO, GEN command write FIFO, and GEN payload write / read FIFO.

[0051] Corresponding to eight single-bit errors {dpiwrcmdfifo_sglerr, dpiwrpldfifo_sglerr, dbiwrcmdfifo_sglerr, dbiwrpldfifo_sglerr, dbirdpldfifo_sglerr, genwrcmdfifo_sglerr, genwrpldfifo_sglerr, genrdpldfifo_sglerr};

[0052] Corresponding to eight multi-bit errors {dpiwrcmdfifo_mlterr, dpiwrpldfifo_mlterr, dbiwrcmdfifo_mlterr, dbiwrpldfifo_mlterr, dbirdpldfifo_mlterr, genwrcmdfifo_mlterr, genwrpldfifo_mlterr, genrdpldfifo_mlterr};

[0053] Corresponding to eight overflows {dpiwrcmdfifo_wrerr, dpiwrpldfifo_wrerr, dbiwrcmdfifo_wrerr, dbiwrpldfifo_wrerr, dbirdpldfifo_wrerr, genwrcmdfifo_wrerr, genwrpldfifo_wrerr, genrdpldfifo_wrerr};

[0054] Corresponding to eight underflows {dpiwrcmdfifo_rderr, dpiwrpldfifo_rderr, dbiwrcmdfifo_rderr, dbiwrpldfifo_rderr, dbirdpldfifo_rderr, genwrcmdfifo_rderr, genwrpldfifo_rderr, genrdpldfifo_rderr}.

[0055] (4) Internal error monitoring mechanism:

[0056] In this embodiment, in the DCS command set decoding module, a submodule of the DBI interface processing module, the DCS command set command decoding process is monitored, an error DCS command signal dbidec_illegalcmd is defined and transmitted to the interrupt processing module;

[0057] In the APB interface processing module, monitor the GEN write command, define the GEN command error signal gen_illegalcmd and transmit it to the interrupt processing module; Configuration register monitoring: periodically read the configuration register data through the host computer to determine whether the configuration register is wrong;

[0058] In the depacketization module, the effective load length of the received long packet is monitored, and the effective load length error signal pktsize_err is defined and transmitted to the interrupt processing module;

[0059] In the unpacking module, monitor that when the eotp packet is enabled, if no eotp packet is received, define the eotp packet reception error signal rxeotp_err and transmit it to the interrupt processing module.

[0060] (5) Dual-core lock-step redundant processing for important modules:

[0061] In this embodiment, dual-core lock-step processing is performed on the module for effective load conversion, and the outputs of the two modules are compared;

[0062] In the DPI interface processing module, the bit width conversion processing part of the DPI input pixel data is dual-core locked, and the DPI conversion error signal dpicov_err is defined and transmitted to the interrupt processing module;

[0063] In the DBI interface processing module, the DBI sending and receiving payload conversion parts are dual-core locked, and the DBI sending data conversion error signal dbitxcov_err and the DBI receiving data conversion error signal dbirxcov_err are defined and transmitted to the interrupt processing module;

[0064] Perform dual-core lock-stepping on the packaging module, define the packaging error signal pb_err and transmit it to the interrupt processing module;

[0065] Perform dual-core lock-stepping on the unpacking module, define the packing error signal pa_err and transmit it to the interrupt processing module;

[0066] Perform dual-core lock-stepping on the channel management module, define the channel management allocation error signal lm_err and transmit it to the interrupt processing module.

[0067] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A functional safety design method for a MIPIDSI transmitting controller, characterized in that: The following steps are involved: (1) Add timeout monitoring mechanism: define five timeout monitoring, namely high-speed transmission timeout, low-power reception timeout and peripheral response timeout in the transmission controller and external assumptions: high-speed reception timeout and low-power transmission timeout in the reception controller (protocol specified); (2) End-to-end protection mechanism: perform ECC and CRC check on DSI packets, add message counters; define confirmation and error reporting mechanisms; (3) Add ECC protection function and overflow detection function in FIFO memory; (4) Internal error monitoring mechanism: monitor the decoding process of the application layer, monitor the configuration register status, and monitor the packaging and unpacking process of the protocol layer; (5) Dual-core lock-step redundant processing of important modules.

2. A functional safety design method for a MIPIDSI transmitting controller according to claim 1, characterized in that: In the step (1), DSI has five timeout monitorings: high-speed transmission timeout, low-power reception timeout and peripheral response timeout in the transmission controller and assumptions about the reception controller: monitoring of high-speed reception timeout and low-power transmission timeout.

3. A functional safety design method for a MIPIDSI sending controller according to claim 1, characterized in that: In the step (2), DSI performs ECC processing on the headers of short packets and long packets, performs CRC processing on the effective load of long packets, and defines a confirmation and error reporting mechanism to report errors.

4. The functional safety design method of a MIPIDSI sending controller according to claim 1, characterized in that: In the step (3), each input of the asynchronous FIFO is subjected to ECC processing and the check code is stored in the FIFO together, and ECC decoding is performed when reading.

5. The functional safety design method of a MIPIDSI sending controller according to claim 1, characterized in that: In the step (3), the overflow and overflow of each asynchronous FIFO are detected.

6. A functional safety design method for a MIPIDSI transmitting controller according to claim 1, characterized in that: In the step (4), possible erroneous commands in the APB and DBI input decoding process are monitored.

7. The functional safety design method of a MIPIDSI sending controller according to claim 1, characterized in that: In the step (4), the host computer needs to periodically read the configuration register data for comparison.

8. The functional safety design method of a MIPIDSI sending controller according to claim 1, characterized in that: In the step (4), the unpacking module detects the actual length of the effective load and compares it with the word length data in the packet header.

9. A functional safety design method for a MIPIDSI transmitting controller according to claim 1, characterized in that: In the step (4), the unpacking module detects that no eotp packet is received after receiving the packet when the eotp packet is enabled.

10. A functional safety design method for a MIPIDSI sending controller according to claim 1, characterized in that: In the step (5), the bit width conversion processing part of the dpi input pixel data is performed by dual-core lock-stepping.

11. A functional safety design method for a MIPIDSI transmission controller according to claim 1, characterized in that: In the step (5), dual-core lock-stepping is performed on the DBI sending and receiving payload conversion parts.

12. The functional safety design method of a MIPIDSI sending controller according to claim 1, characterized in that: In the step (5), dual-core lock-stepping is performed on the packaging module.

13. The functional safety design method of a MIPIDSI sending controller according to claim 1, characterized in that: In the step (5), dual-core lock-stepping is performed on the unpacking module.

14. The functional safety design method of a MIPIDSI sending controller according to claim 1, characterized in that: In the step (5), dual-core lock-stepping is performed on the channel management module.

Images