Fault signal processing module and method, processor, electronic equipment and vehicle

Abstract

The invention discloses a fault signal processing module and method, a processor, electronic equipment and a vehicle, and the module comprises a first signal capturing circuit which is used for obtaining a first fault signal; the enabling register is used for storing a pre-configured enabling signal for enabling the processing fault signal; and the first fault processing circuit is respectively connected with the first signal capturing circuit and the enable register and is used for determining an enable processing fault signal in the first fault signal according to the enable signal and generating a fault response signal according to the enable processing fault signal. According to the module and the method, the fault signals needing to be processed can be rapidly determined, effective control and identification of the fault signals are achieved, and therefore the fault processing speed and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the field of semiconductor technology, and in particular to a fault signal processing module, a processor, an electronic device, a vehicle and a fault signal processing method. Background Art

[0002] In single-chip microcomputers, chips or SOC systems, various fault signals often need to be processed. The existing fault signal processing methods cannot quickly determine the fault signals that need to be processed, resulting in low fault signal recognition efficiency and slow response speed, and thus unable to take effective measures in time. In addition, due to the large number of fault signals involved, the existing fault signal processing module is prone to misjudgment or omission during processing, resulting in low processing accuracy. Summary of the invention

[0003] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, one object of the present invention is to provide a fault signal processing module, which can quickly determine the fault signal to be processed, realize effective control and identification of the fault, and thus improve the speed and accuracy of fault processing.

[0004] The second objective of the present invention is to provide a processor.

[0005] The third objective of the present invention is to provide an electronic device.

[0006] A fourth objective of the present invention is to provide a vehicle.

[0007] A fifth objective of the present invention is to provide a fault signal processing method.

[0008] In order to achieve the above-mentioned purpose, the fault signal processing module of the first aspect of the embodiment of the present invention includes: a first signal capture circuit, used to obtain a first fault signal; an enable register, used to store a pre-configured enable signal for enabling processing of a fault signal; a first fault processing circuit, wherein the first fault processing circuit is respectively connected to the first signal capture circuit and the enable register, and is used to determine an enable processing fault signal in the first fault signal according to the enable signal, and generate a fault response signal according to the enable processing fault signal.

[0009] According to the fault signal processing module of the embodiment of the present invention, the first fault processing circuit closely cooperates with the first signal capture circuit and the enable register, and by matching with the enable signal that enables the processing of the fault signal, it can quickly determine which fault signals need to be processed, thereby achieving effective control and identification of the fault signal. Once the fault signal that can be processed by enabling the processing of the fault signal is determined, the first fault processing circuit can quickly generate a corresponding fault response signal, ensuring that the module can respond quickly when faced with various faults, effectively improving the speed and accuracy of fault processing, thereby improving the stability and reliability of the entire system.

[0010] In some embodiments, the first fault processing circuit includes: a logic gate circuit, a first input end of the logic gate circuit is connected to the first signal capture circuit, and a second input end of the logic gate circuit is connected to the enable register, for determining an enable processing fault signal in the first fault signal according to the enable signal.

[0011] In some embodiments, the first fault processing circuit also includes: a first synchronous processing and combination circuit, the input end of the first synchronous processing and combination circuit is connected to the output end of the logic gate circuit, and is used to synchronize the enable processing fault signal according to the first clock domain signal, and perform a first preset logical combination on the synchronized enable processing fault signal to obtain a first fault logic signal, and generate a fault response signal according to the first fault logic signal.

[0012] In some embodiments, the fault response signal includes at least one of a reset signal and an interrupt signal.

[0013] In some embodiments, the fault signal processing module further includes: a first fault state machine, which is connected to the output end of the first synchronous processing and combination circuit and is used to switch the fault state in response to the fault response signal and output a fault state signal.

[0014] In some embodiments, the fault signal processing module also includes: a time monitoring circuit, which is connected to the first synchronous processing and combination circuit, and is used to record the processing time of the first synchronous processing and combination circuit to enable processing of the fault signal, and output a fault response signal when the processing time reaches a preset window time.

[0015] In some embodiments, the time monitoring circuit includes: an event window register for storing a preset window time; a counter, which is connected to the first synchronous processing and combination circuit, and is used to record the processing time of the first synchronous processing and combination circuit to enable processing of a fault signal, and output a fault response signal when the processing time reaches the preset window time.

[0016] In some embodiments, the counter is further connected to the first fault state machine, and the first fault state machine is further configured to switch the fault state and output a fault state signal in response to a fault response signal of the counter.

[0017] In some embodiments, the fault signal processing module further includes: a status register, which is connected to the output end of the logic gate circuit and is used to record the status of enabling the processing of the fault signal.

[0018] In some embodiments, the first signal capture circuit, the enable register, the logic gate circuit, the first synchronization processing and combination circuit, the first fault state machine, the event window register, the counter and the status register combine to form a main safety unit of the fault signal processing module.

[0019] In some embodiments, the fault signal processing module further includes: a secondary safety unit, wherein the secondary safety unit is used to obtain a second fault signal and generate a fault response signal according to the second fault signal.

[0020] In some embodiments, the secondary safety unit includes: a second signal capture circuit, used to obtain the second fault signal; a second synchronization processing and combination circuit, the second synchronization processing and combination circuit is connected to the second signal capture circuit, and is used to synchronize the second fault signal according to the clock domain signal of the secondary safety unit, and perform a second preset logical combination on the synchronized second fault signal to obtain a second fault logic signal, and generate a fault response signal according to the second fault logic signal.

[0021] In some embodiments, the secondary safety unit further includes: a second fault state machine, the second fault state machine is connected to the second synchronous processing and combination circuit, and is used to switch the fault state in response to the fault response signal and output a fault state signal.

[0022] In some embodiments, the output end of the second signal capture circuit is also connected to the status register, and the status register is also used to record the status of the second fault signal.

[0023] In some embodiments, the fault signal processing module also includes: a first voltage / clock source connected to the main safety unit, used to provide an operating voltage and a clock signal to the main safety unit; a second voltage / clock source connected to the secondary safety unit, used to provide an operating voltage and a clock signal to the secondary safety unit.

[0024] In some embodiments, the fault signal processing module also includes a first fault detection circuit, which is connected to the second voltage / clock source and is used to detect a second voltage / clock fault signal; the main safety unit also includes a first level conversion circuit, which is connected to the first fault detection circuit and the first signal capture circuit and is used to convert the second voltage / clock fault signal into a processing signal of the main safety unit.

[0025] In some embodiments, the first fault signal includes fault signals of various functional circuits of the system where the fault signal processing module is located, fault signals triggered by software programs, and the second voltage / clock fault signal.

[0026] In some embodiments, the fault signal processing module also includes a second fault detection circuit, which is connected to the first voltage / clock source and is used to detect a first voltage / clock fault signal; the secondary safety unit also includes a second level conversion circuit, which is connected to the second fault detection circuit and the second signal capture circuit and is used to convert the first voltage / clock fault signal into a processing signal of the secondary safety unit.

[0027] In some embodiments, the second fault signal includes fault signals of various functional circuits of the system where the fault signal processing module is located, fault signals triggered by software programs, and the first voltage / clock fault signal.

[0028] In some embodiments, the secondary safety unit also includes: a test stimulus generation circuit, which is connected to the second synchronization processing and combination circuit, and is used to generate a test fault signal of the second fault signal; the second synchronization processing and combination circuit is also used to synchronize the test fault signal according to the clock domain signal of the secondary safety unit, and perform a second preset logical combination on the synchronized test fault signal to obtain a test fault logic signal, and generate a test fault response signal according to the test fault logic signal; the second fault state machine is also used to switch the fault state in response to the test fault response signal, so as to identify the functional fault of the secondary safety unit according to the fault state.

[0029] In some embodiments, the status register is further used to store the test fault signal so that the system where the fault signal processing module is located can identify whether the fault signal is a real fault signal or a test fault signal.

[0030] In order to achieve the above object, the processor of the second embodiment of the present invention includes the fault signal processing module described in the above embodiment.

[0031] According to the processor of the embodiment of the present invention, by adopting the fault signal processing module described in the above embodiment, the first fault processing circuit closely cooperates with the first signal capture circuit and the enable register, and by matching with the enable signal that enables the processing of the fault signal, it can quickly determine which fault signals need to be processed, thereby achieving effective control and identification of fault signals. Once a processable fault signal is determined, the first fault processing circuit can quickly generate a corresponding fault response signal, ensuring that the module can respond quickly when faced with various faults, effectively improving the speed and accuracy of fault processing, thereby improving the stability and reliability of the entire system.

[0032] In some embodiments, the processor further includes: a safety event logic signal selection circuit, connected to the fault signal processing module, for identifying a first fault signal and a second fault signal of the processor.

[0033] In some embodiments, the processor further includes: a reset circuit connected to the output end of the fault signal processing module, and configured to control the processor to reset in response to the reset signal when the fault response signal output by the fault signal processing module is a reset signal.

[0034] In some embodiments, the processor further includes: an interrupt control circuit connected to the output end of the fault signal processing module, for controlling the processor to interrupt in response to the interrupt signal when the fault response signal output by the fault signal processing module is an interrupt signal.

[0035] In some embodiments, the processor further includes: a fault protocol output circuit connected to the output end of the fault signal processing module, and configured to output a corresponding fault indication signal in response to the fault status signal.

[0036] In some embodiments, the processor includes one of a single-chip microcomputer, a microcontroller chip, and a system on a chip.

[0037] In order to achieve the above object, an electronic device according to an embodiment of the third aspect of the present invention includes the processor described in the above embodiment.

[0038] According to the electronic device of the embodiment of the present invention, by adopting the processor described in the above embodiment, the fault signal processing module in the processor can quickly determine the fault signal that needs to be processed, thereby realizing effective control and identification of the fault signal. Once the processable fault signal is determined, the first fault processing circuit can quickly generate a corresponding fault response signal, ensuring that the module can respond quickly when facing various faults, effectively improving the speed and accuracy of fault processing, thereby improving the stability and reliability of the entire system.

[0039] In order to achieve the above-mentioned objectives, a vehicle according to an embodiment of the fourth aspect of the present invention comprises the processor described in the above embodiment.

[0040] According to the vehicle of the embodiment of the present invention, by adopting the processor described in the above embodiment, the fault signal processing module in the processor can quickly determine the fault signal that needs to be processed, thereby realizing effective control and identification of the fault signal, and the processor can quickly generate a corresponding fault response signal, effectively improving the speed and accuracy of fault processing, thereby improving the stability and reliability of the vehicle.

[0041] In order to achieve the above-mentioned purpose, the fault signal processing method of the fifth aspect of the embodiment of the present invention includes: obtaining a first fault signal and a pre-configured enable signal for enabling fault processing; determining an enabled fault processing signal in the first fault signal according to the enable signal; and generating a fault response signal according to the enabled fault processing signal.

[0042] According to the fault signal processing method of the embodiment of the present invention, through the pre-configured enable signal for enabling the processing of the fault signal, the enabled processing fault signal in the first fault signal can be quickly determined, thereby achieving effective control and identification of the fault signal, and quickly generating a fault response signal based on the enabled processing fault signal. This rapid response mechanism effectively improves the speed and accuracy of fault processing, ensures that the system can respond quickly when faced with various faults, thereby improving the stability and reliability of the entire system.

[0043] In some embodiments, a fault response signal is generated according to the enable processing fault signal, including: synchronizing the enable processing fault signal according to the first clock domain signal of the main safety unit; performing a first preset logical combination on the synchronized enable processing fault signal to obtain a first fault logic signal; and generating a fault response signal according to the first fault logic signal, wherein the fault response signal includes at least one of a reset signal and an interrupt signal.

[0044] In some embodiments, the fault signal processing method further includes: recording the processing time of enabling the processing of the fault signal; and outputting the fault response signal when the processing time reaches a preset window time.

[0045] In some embodiments, the fault signal processing method also includes: acquiring the second fault signal; synchronizing the second fault signal according to the clock domain signal of the secondary safety unit; performing a second preset logical combination on the synchronized second fault signal to obtain a second fault logic signal; and generating a fault response signal according to the second fault logic signal, wherein the fault response signal includes at least one of a reset signal and an interrupt signal.

[0046] In some embodiments, the fault signal processing method also includes: monitoring the first voltage / clock fault signal of the main safety unit through the secondary safety unit, and monitoring the second voltage / clock fault signal of the secondary safety unit through the main safety unit; when the secondary safety unit and the main safety unit are both normal, outputting a fault response signal generated according to the second fault logic signal and the first fault logic signal; or, when the main safety unit is determined to be faulty according to the first voltage / clock fault signal, outputting a fault response signal generated according to the second fault logic signal.

[0047] In some embodiments, the fault signal processing method further includes: in response to the fault response signal, switching the fault state of the fault state machine, and outputting the fault state to trigger the fault protocol output circuit to output a fault indication signal corresponding to the fault state.

[0048] In some embodiments, the fault signal processing method also includes: generating a test fault signal of the second fault signal; synchronizing the test fault signal according to the clock domain signal of the secondary safety unit, and performing a second preset logical combination on the synchronized test fault signal to obtain a test fault logic signal, and generating a test fault response signal according to the test fault logic signal; switching the fault state in response to the test fault response signal to identify the functional fault of the secondary safety unit according to the fault state.

[0049] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0051] Figure 1 is a structural schematic diagram of a fault signal processing module according to an embodiment of the present invention;

[0052] Figure 2 is a schematic diagram of a processor according to an embodiment of the present invention;

[0053] Figure 3 is a block diagram of an electronic device according to an embodiment of the present invention;

[0054] Figure 4 is a block diagram of a vehicle according to one embodiment of the present invention;

[0055] Figure 5 is a flowchart of a fault signal processing method according to an embodiment of the present invention;

[0056] Figure 6 is a schematic diagram of output of a fault indication signal according to an embodiment of the present invention;

[0057] Figure 7 is an overall flow chart of a fault signal processing method according to an embodiment of the present invention;

[0058] Figure 8 is an overall flow chart of a secondary safety unit self-test according to an embodiment of the present invention.

[0059] Reference numerals:

[0060] Vehicle 100;

[0061] Electronic device 200;

[0062] Processor 1;

[0063] Fault signal processing module 10; safety event logic signal selection circuit 20; reset circuit 30; interrupt control circuit 40; fault protocol output circuit 50; main safety unit 60; secondary safety unit 70;

[0064] first signal capture circuit 11; enable register 12; first fault processing circuit 13; first fault state machine 14; time monitoring circuit 15; state register 16; first fault detection circuit 17; second fault detection circuit 18; first voltage / clock source 61; first level conversion circuit 62; second signal capture circuit 71; second synchronization processing and combination circuit 72; second fault state machine 73; second voltage / clock source 74; second level conversion circuit 75; test stimulus generation circuit 76; clock domain signal 77 of secondary safety unit;

[0065] Logic gate circuit 131; first synchronization processing and combination circuit 132; first clock domain signal 133; event window register 151; counter 152. DETAILED DESCRIPTION

[0066] Embodiments of the present invention are described in detail below. The embodiments described with reference to the accompanying drawings are exemplary. Embodiments of the present invention are described in detail below.

[0067] Reference below Figure 1 A fault signal processing module according to an embodiment of the present invention is described.

[0068] Figure 1 FIG. 1 is a schematic diagram of a fault signal processing module according to an embodiment of the present invention. Figure 1 As shown, the fault signal processing module 10 includes a first signal capturing circuit 11 , an enabling register 12 and a first fault processing circuit 13 .

[0069] The first signal capture circuit 11 can be used to obtain the first fault signal. In an embodiment, the first fault signal can be a fault signal of each functional circuit of the MCU (Microcontroller Unit) (such as circuit component failure, voltage abnormality) or a fault signal triggered by a software program (such as program error, logic error), etc.

[0070] In some embodiments, the first signal capture circuit 11 can play the role of signal reception and transmission. Specifically, the first signal capture circuit 11 may include a sensor, an interface circuit or a software module, which is responsible for receiving various fault signals from inside or outside the system. Once the first signal capture circuit 11 receives the first fault signal, it can pass these signals to other parts of the fault signal processing module 10, such as the enable register 12 and the first fault processing circuit 13. This can usually be achieved through an internal bus, a communication interface or other signal transmission methods.

[0071] In addition, before passing the first fault signal to the first fault processing circuit 13, the first signal capture circuit 11 can perform a certain degree of processing on the received first fault signal, for example, filtering, amplifying, denoising and other operations on the signal to ensure that the signal transmitted to the first fault processing circuit 13 is of high quality, which helps to improve the accuracy of subsequent processing.

[0072] In some embodiments, the enable register 12 may refer to a register for storing a preconfigured enable signal for enabling the processing of a fault signal. The function of the enable register 12 may be to allow a system administrator or user to preconfigure which fault signals need to be processed when the system is running. By setting corresponding bits (usually binary bits), the user may decide which specific fault signals are processed by the system and which are ignored.

[0073] Therefore, the existence of the enable register 12 can avoid processing the fault signals that do not need to be processed, so that the system can focus on processing key faults, thereby reducing the calculation and processing burden of the system and improving the response speed of fault signal processing.

[0074] In some embodiments, the first fault processing circuit 13 may be a circuit module that generates a fault response signal based on an enable processing fault signal. Specifically, the first signal capture circuit 11 receives the first fault signal and transmits it to the enable register 12 and the first fault processing circuit 13 respectively. The enable register 12 determines which fault signals need to be processed according to pre-configured rules. If a fault signal is marked as processable in the enable register 12, the enable register 12 may be in an enabled state for this enable processing fault signal and send an enable signal to the first fault processing circuit 13. The first fault processing circuit 13 receives the enable signal and determines the enable processing fault signal in the first fault signal based on this signal. Then, it generates a corresponding fault response signal and takes appropriate measures to deal with the fault situation.

[0075] For those fault signals marked as not requiring processing in the enable register 12, the enable register 12 will be in a disabled state (ie, a disabled state), and the first fault processing circuit 13 will not respond to the captured fault signals, nor perform any fault processing operations.

[0076] According to the fault signal processing module 10 of the embodiment of the present invention, the first fault processing circuit 13 closely cooperates with the first signal capture circuit 11 and the enable register 12. By matching with the enable signal that enables the processing of the fault signal, it is possible to quickly determine which fault signals need to be processed, thereby achieving effective control and identification of the fault signal. Once a processable fault signal is determined, the first fault processing circuit 13 can quickly generate a corresponding fault response signal, ensuring that the module can respond quickly when faced with various faults, effectively improving the speed and accuracy of fault processing, thereby improving the stability and reliability of the entire system.

[0077] like Figure 1 As shown, the first fault processing circuit 13 includes a logic gate circuit 131. The logic gate circuit 131 can be a basic digital circuit component for performing logic operations. The function of the logic gate circuit 131 can be to perform a logic operation on the first fault signal captured by the first signal capture circuit 11 and the corresponding enable signal in the enable register 12. In an embodiment, the output of the logic gate circuit 131 is determined according to the type of the logic gate and the state of the input signal (high level or low level). Among them, the type of the logic gate may include AND (AND gate) and OR (OR gate) and the like. The first input end of the logic gate circuit 131 is connected to the first signal capture circuit 11, and is used to introduce the captured first fault signal into the logic operation. The second input end of the logic gate circuit 131 is connected to the enable register 12, and is used to determine the enable processing fault signal in the first fault signal according to the enable signal.

[0078] In some embodiments, different types of logic gate circuits 131 can be selected as needed. For example, if the logic gate is an AND gate, only when the first input terminal and the second input terminal are both at a high level, the signal at the first input terminal can match the enable signal, and the output of the logic gate circuit 131 is at a high level, indicating that the fault signal needs to be processed. The result of this logic operation determines which fault signals will be processed.

[0079] In some embodiments, the first fault processing circuit 13 further includes a first synchronous processing and combining circuit 132. The first synchronous processing and combining circuit 132 can ensure that multiple enable processing fault signals are in the same clock domain, making the processing process more stable and reliable.

[0080] Specifically, the input end of the first synchronous processing and combination circuit 132 is connected to the output end of the logic gate circuit 131. The output of the logic gate circuit 131 indicates which fault signals need to be processed. These signals are transmitted to the first synchronous processing and combination circuit 132, and the enabled processing fault signals are synchronously processed according to the first clock domain signal 133. The synchronous processing is to ensure that all signals run under the same clock signal to avoid errors caused by timing problems.

[0081] Further, after synchronization processing, these enable processing fault signals are sent to a first preset logic combination circuit. Here, different logic gates (AND, OR, etc.) can be used for logic combination operations. This combination process can be customized according to system requirements to generate an output signal, i.e., a first fault logic signal, from multiple input signals.

[0082] Further, based on the first fault logic signal, the first fault processing circuit 13 generates a fault response signal, and the generated fault response signal is determined according to a specific logic combination condition and system design, ensuring an accurate response to the fault. Therefore, this design ensures that when processing fault signals, all signals are in the same clock domain, avoiding the uncertainty that may be caused by timing problems. At the same time, through logical operations and synchronous processing, the system can accurately determine which fault signals need to be processed, thereby improving the accuracy and efficiency of processing.

[0083] In some embodiments, the fault response signal includes at least one of a reset signal and an interrupt signal. The reset signal can be a mandatory measure. When the system faces a serious fault or an irreversible error, it may be necessary to restore the entire system to an initial state to avoid further damage to the system. The generation of the reset signal is usually implemented through a specific circuit or logic gate, which can quickly shut down all functions of the system and restore the system state to a safe level.

[0084] An interrupt signal may be a signal used to interrupt a program or processor task being executed and to execute a specific interrupt handler instead. In the fault signal processing module 10, an interrupt signal may be generated if a fault condition requiring emergency processing occurs. This interrupt signal may notify the processor or other parts of the system that the current task needs to be stopped immediately and switched to a specific fault handler to deal with the fault.

[0085] Therefore, this flexible fault response design ensures that the system can select the appropriate processing method under different fault conditions, thereby ensuring the stability and reliability of the system.

[0086] like Figure 1 As shown, the fault signal processing module 10 also includes a first fault state machine 14. The first fault state machine 14 can be a logic circuit or program module for realizing state conversion. In the fault signal processing module 10, the first fault state machine 14 is connected to the output end of the first synchronous processing and combination circuit 132, which means that the first fault state machine 14 can receive the fault response signal after synchronous processing and logical combination, and, by responding to the fault response signal, switch the working state of the system according to the predefined state conversion rule. This switching can be from a normal state to a fault state, and output a corresponding fault state signal. This signal can be used to indicate the current state of the system for further processing or recording by the system.

[0087] like Figure 1 As shown, the fault signal processing module 10 also includes a time monitoring circuit 15. The time monitoring circuit 15 is connected to the first synchronous processing and combination circuit 132, and is used to record the processing time of the first synchronous processing and combination circuit 132 to process the enabled processing fault signal, and output a fault response signal when the processing time reaches a preset window time. Among them, this preset window time can be a system parameter, which determines the maximum time for processing to enable the processing of the fault signal. In practical applications, this preset window time can be pre-set according to the needs of the system. For example, if the system requires a fault response within 100 milliseconds, the window time can be set to a time value of 100 milliseconds.

[0088] If the processing time reaches or exceeds the preset window time, even if the first synchronous processing and combination circuit 132 has not yet completed processing the enable processing fault signal, it will directly force the trigger output fault response signal. This design can ensure that the fault signal is responded to in a timely manner to deal with safety issues that may be caused by too long processing time.

[0089] In some embodiments, the time monitoring circuit 15 includes: an event window register 151 and a counter 152. The event window register 151 can be a module for storing a preset window time. When the fault signal processing module 10 is started, the system developer can set the desired processing time range to the event window register 151. This preset window time determines the maximum time for the system to process the fault signal to ensure safety. The system can determine whether it is necessary to forcibly trigger the fault response signal based on this preset window time.

[0090] The counter 152 is connected to the first synchronous processing and combination circuit 132, and is used to record the processing time of the first synchronous processing and combination circuit processing the enabled processing fault signal. The counter 152 can continue to count during the fault signal processing process. When the processing time recorded by the counter 152 reaches the window time preset in the event window register 151, the first synchronous processing and combination circuit 132 will force the output of the fault response signal. This design ensures that the system responds to the fault signal within a specific time (determined by the window time), thereby avoiding potential safety problems.

[0091] like Figure 1 As shown, the counter 152 is also connected to the first fault state machine 14, and is used to transmit the recorded processing time information to the first fault state machine 14. When the processing time recorded by the counter 152 reaches the preset window time, the first synchronous processing and combination circuit 132 outputs a fault response signal to the first fault state machine 14. After receiving the fault response signal, the first fault state machine 14 switches the working state of the system from the normal state to the fault state according to the predefined state transition rule, and outputs the corresponding fault state signal. In the fault state, the system can take predetermined safety measures, such as reset or interruption, to ensure the safety and reliability of the system.

[0092] In some embodiments, the fault signal processing module 10 also includes a status register 16. The status register 16 is connected to the output end of the logic gate circuit 131, and is used to store the output result of the logic gate circuit 131, that is, to record the state of enabling the processing of the fault signal. Among them, the state of enabling the processing of the fault signal is divided into two types: "occurrence" and "non-occurrence". Specifically, when the logic gate circuit 131 determines that a certain fault signal needs to be processed, it passes the corresponding information to the status register 16, and the status register 16 records the state of the fault signal as "occurrence". This means that the system has confirmed that the fault has occurred and needs to take corresponding processing measures. If the logic gate circuit 131 determines that a certain fault signal does not need to be processed, the status register 16 records the state of the fault signal as "non-occurrence". This means that the system has confirmed that the fault has not occurred and no further processing measures are required.

[0093] This design ensures that the system can accurately record the occurrence of each fault signal, providing reliable monitoring and recording for the system's operating status, facilitating subsequent fault analysis and processing.

[0094] In some embodiments, the first signal capture circuit 11, the enable register 12, the logic gate circuit 131, the first synchronization processing and combination circuit 132, the first fault state machine 14, the event window register 151, the counter 152 and the status register 16 work together to form the main safety unit 60 of the fault signal processing module 10, which is used to process various fault signals in the system to ensure the stability and reliability of the system.

[0095] like Figure 1 As shown, the fault signal processing module 10 also includes a secondary safety unit 70. The secondary safety unit 70 can be used to obtain the second fault signal and generate a fault response signal according to the second fault signal. This fault response signal can also include at least one of a reset signal and an interrupt signal. Different response measures can be triggered according to the severity and nature of the fault.

[0096] Therefore, the existence of the secondary safety unit 70 enhances the safety of the system. By processing the second fault signal, which includes identification, analysis, and corresponding treatment measures, the system can take measures when a problem occurs to avoid further damage or system crash. This safety design ensures that the system can handle various faults in a targeted manner, thereby improving the reliability and stability of the entire system.

[0097] like Figure 1 As shown, the secondary safety unit 70 includes a second signal capture circuit 71 and a second synchronous processing and combination circuit 72. The second signal capture circuit 71 can also play the role of signal reception and transmission. Specifically, the second signal capture circuit 71 can also include a sensor, an interface circuit or a software module, which is responsible for receiving various fault signals from inside or outside the system. Once the second signal capture circuit 71 receives the second fault signal, it can pass these signals to the status register 16 and the second synchronous processing and combination circuit 72, which can usually be achieved through an internal bus, a communication interface or other signal transmission methods.

[0098] The second synchronization processing and combination circuit 72 is connected to the second signal capture circuit 71, and is used to synchronize the second fault signal according to the clock domain signal 77 of the secondary safety unit. In this step, the second fault signal can be synchronized to the clock domain of the secondary safety unit 70 to ensure that subsequent processing is performed under the same time reference. Then the synchronized second fault signal is subjected to a second preset logic combination to obtain a second fault logic signal. This logic combination can include logic operations such as AND and OR. The specific combination method depends on the design requirements of the system. According to the second fault logic signal, the secondary safety unit 70 generates a corresponding fault response signal, which can include a reset signal, an interrupt signal, etc. of the system.

[0099] Through this process, the secondary safety unit 70 can efficiently process the second fault signal and take appropriate response measures to ensure that the system can respond quickly and accurately when facing various faults, thereby improving the safety of the system.

[0100] like Figure 1 As shown, the secondary safety unit 70 also includes a second fault state machine 73, which has the same function as the first fault state machine 14 and is also a logic circuit or program module for realizing state conversion. In the fault signal processing module 10, the second fault state machine 73 is connected to the second synchronization processing and combination circuit 72, which means that the second fault state machine 73 can receive the fault response signal after synchronization processing and logic combination, and, in response to the input of the fault response signal, according to the predefined state conversion rule, switch the working state of the system, that is, switch from the normal state to the fault state, and output the corresponding fault state signal.

[0101] Through the function of the second fault state machine 73, the system can respond quickly after detecting a fault signal, ensuring that the system can quickly switch to a fault state when a fault occurs, thereby preventing the fault from further expanding and improving the reliability and safety of the entire system.

[0102] In some embodiments, the output end of the second signal capture circuit 71 is also connected to the status register 16, and the status register 16 is also used to record the status of the second fault signal. The purpose of this connection is to pass the status information of the second fault signal to the status register 16 so as to record and monitor the status of the fault signal.

[0103] In some embodiments, the status register 16 may be an electronic component for storing binary states (e.g., 0 and 1). In the secondary safety unit 70, the status register 16 stores the state of the second fault signal, for example, "1" indicates that a fault has occurred, and "0" indicates that a fault has not occurred. By connecting the second signal capture circuit 71 and the status register 16, the system can track the state of the second fault signal in real time. This real-time monitoring can help the system respond more promptly, thereby ensuring that necessary measures are taken when a fault occurs, thereby improving the reliability and safety of the system.

[0104] like Figure 1 As shown, the fault signal processing module 10 also includes: a first voltage / clock source 61 and a second voltage / clock source 74. The first voltage / clock source 61 and the second voltage / clock source 74 can be two independent circuit modules, which provide the required working voltage and clock signal for different parts of the system. Among them, the first voltage / clock source 61 is connected to the main safety unit 60, and is used to provide the main safety unit 60 with a working voltage and a clock signal. The second voltage / clock source 74 is connected to the secondary safety unit 70, and is used to provide the secondary safety unit 70 with a working voltage and a clock signal.

[0105] Therefore, the design purpose of these two voltage / clock source modules can be to meet the voltage and clock frequency requirements of different components or units, ensuring that each part of the system can operate normally with appropriate working parameters. In complex electronic devices, different components may require different voltages and clock signals, so independent voltage / clock source modules can provide appropriate power and timing support according to the requirements of each unit.

[0106] In some embodiments, the fault signal processing module 10 further includes a first fault detection circuit 17. The first fault detection circuit 17 is connected to the second voltage / clock source 74 to detect the second voltage / clock fault signal, thereby identifying the state of the second voltage / clock source 74, including a normal state or a fault state. In practical applications, the first fault detection circuit 17 can check whether the voltage level is within an acceptable range, whether the frequency of the clock signal is stable, etc. If the first fault detection circuit 17 detects a fault in the second voltage / clock source 74, it will generate a corresponding fault signal.

[0107] In some embodiments, the master safety unit 60 further includes a first level conversion circuit 62. The first level conversion circuit 62 is connected to the first fault detection circuit 17 and the first signal capture circuit 11. When the first fault detection circuit 17 detects the second voltage / clock fault signal, it transmits the signal to the first level conversion circuit 62. The first level conversion circuit 62 can convert the second voltage / clock fault signal into a processing signal of the master safety unit 60.

[0108] In some embodiments, the first level conversion circuit 62 may involve conversions in multiple aspects, such as level conversion, signal format conversion, frequency / time conversion, data analysis, communication protocol conversion, etc. Among them, for level conversion, the fault signal may be a signal of different levels, for example, it may be an analog signal (continuous voltage waveform) or a digital signal (discrete high and low levels). The conversion circuit may convert these signals of different levels into standard levels that the main safety unit 60 can process.

[0109] For signal format conversion, the fault signal may be represented in various forms, such as pulse, continuous level, frequency, etc. The conversion circuit can convert these different signal formats into a specific signal format that the main safety unit 60 can recognize and process, such as a combination of high and low levels of a digital signal to represent different types of faults.

[0110] For frequency / time conversion, the first level conversion circuit 62 can convert the frequency into a frequency range that the master security unit 60 can process, or convert the time parameter into a specific clock cycle so that the master security unit 60 can synchronously process these signals.

[0111] Regarding data analysis, if the fault signal carries a specific type of data, such as a fault code, a sensor value, etc., the first level conversion circuit 62 may need to parse the data and convert it into a data format that the main safety unit 60 can understand.

[0112] As for the communication protocol conversion, if the fault signal needs to be transmitted to the main safety unit 60 through a specific communication protocol, the first level conversion circuit 62 may also need to convert the communication protocol to ensure that the signal can be accurately transmitted.

[0113] In some embodiments, the first fault signal includes a fault signal of each functional circuit of the system where the fault signal processing module 10 is located, a fault signal triggered by a software program, and a second voltage / clock fault signal.

[0114] Among them, the fault signals of each functional circuit of the system may refer to the fault signals that may be generated by different functional modules or circuits in the system. These functional circuits may include processors, memories, sensors, actuators, etc. When any of the functional modules fails (such as external watchdog overflow, processor lockstep exception, storage data verification error, bus failure, etc.), it may generate a specific fault signal that needs to be processed in time to ensure the stability and reliability of the system.

[0115] The fault signal triggered by the software program may refer to a specific fault signal generated by the software program when the control system is working. These signals are usually triggered by software algorithm logic, such as program errors or deadlocks.

[0116] The second voltage / clock fault signal may refer to a specific fault signal generated when providing the operating voltage and clock signal to the secondary safety unit 70. If the second voltage / clock source 74 exceeds the safety range or experiences unstable fluctuations, timely processing is required to avoid system failure.

[0117] like Figure 1 As shown, the fault signal processing module 10 also includes a second fault detection circuit 18. The second fault detection circuit 18 is connected to the first voltage / clock source 61, and is used to detect the first voltage / clock fault signal, thereby identifying the state of the first voltage / clock source 61, including a normal state or a fault state. In practical applications, the first fault detection circuit 17 can check whether the voltage level of the first voltage / clock source 61 is within an acceptable range, whether the frequency of the clock signal is stable, etc. If the second fault detection circuit 18 detects a fault in the first voltage / clock source 61, it will generate a corresponding fault signal.

[0118] In some embodiments, the secondary safety unit 70 further includes a second level conversion circuit 75, which is connected to the second fault detection circuit 18 and the second signal capture circuit 71, and is used to convert the first voltage / clock fault signal into a processing signal of the secondary safety unit 70, so as to ensure that the system can respond to and handle these fault conditions in a timely manner, thereby improving the reliability and safety of the system. In addition, similar to the first level conversion circuit 62, the second level conversion circuit 75 can also involve conversions in multiple aspects such as level conversion, signal format conversion, frequency / time conversion, data analysis, and communication protocol conversion, which will not be described in detail here.

[0119] In some embodiments, the second fault signal includes the fault signal (hardware error) of each functional circuit of the system where the fault signal processing module 10 is located, the fault signal triggered by the software program (code error, logic error, etc.) and the first voltage / clock fault signal. In addition, since the secondary safety unit 70 does not have an enable register 12 and does not support the fault signal configuration enable, the non-shielded faults of key applications can be connected to the secondary safety unit 70. For example, CAN (Controller Area Network) module communication failure, PWM (Pulse Width Modulation) counting failure, DMA (Direct Memory Access) data access failure. When these faults occur, they can also be processed as the second fault signal through the second signal capture circuit 71, the second synchronization processing and combination circuit 72, and the second fault state machine 73, thereby improving the safety of the system.

[0120] like Figure 1As shown, the secondary safety unit 70 also includes a test stimulus generating circuit 76. The test stimulus generating circuit 76 is connected to the second synchronization processing and combining circuit 72, and is used to generate a test fault signal of the second fault signal. It should be noted that the test fault signal here is not a real hardware or software fault, but a specific signal emitted by the test stimulus generating circuit 76 to simulate the occurrence of a fault. Specifically, a specific voltage, clock or signal pulse can be generated by the test stimulus generating circuit 76, so that the secondary safety unit 70 believes that a certain fault has occurred in the system. This fault can be a fault condition that the secondary safety unit 70 can handle.

[0121] Furthermore, the second synchronization processing and combination circuit 72 can be used to synchronize the test fault signal according to the clock domain signal 77 of the secondary safety unit to ensure the timing consistency of the test signal. Then, the synchronized test fault signal is subjected to a second preset logic combination, which means that it combines the synchronized test fault signal with a predefined logic rule to generate a test fault logic signal, and generates a test fault response signal according to the test fault logic signal.

[0122] Furthermore, the second synchronous processing and combination circuit 72 transmits the test fault response signal to the second fault state machine 73. The second fault state machine 73 responds to the test fault response signal and switches the working state of the system from the normal state to the fault state according to the predefined state transition rule, so as to identify the functional fault of the secondary safety unit 70 according to the fault state. In this way, it is possible to test whether the secondary safety unit 70 can correctly identify, process and respond to these virtual fault conditions, thereby ensuring the correctness of the secondary safety unit 70.

[0123] In some embodiments, the status register 16 can also be used to store a test fault signal so that the system where the fault signal processing module 10 is located can identify whether the fault signal is a real fault signal or a test fault signal, thereby ensuring that the system can correctly identify and respond to actual fault conditions.

[0124] Specifically, when the fault signal processing module 10 receives a signal, the state register 16 will save the source information of the signal. If the signal comes from the test stimulus generation circuit 76, the state register 16 will mark the signal as a test fault signal. If the signal comes from the functional circuit of the actual system, the state register 16 will mark the signal as a real fault signal.

[0125] In some embodiments, the test fault signal sent by the test stimulus generation circuit 76 may have a special mark or include information for identifying the test fault signal in the data packet. The system can determine whether the fault signal comes from the test stimulus generation circuit 76 or a real functional circuit fault based on these marks or information.

[0126] By distinguishing between real fault signals and test fault signals, the system can take appropriate measures according to the actual situation. For real fault signals, the system may need to trigger a reset or interrupt or other safety protection measures. For test fault signals, the system can continue to operate while recording and analyzing these signals for future maintenance and improvement.

[0127] Reference below Figure 2 A processor according to an embodiment of the present invention is described.

[0128] Figure 2 is a schematic diagram of a processor according to an embodiment of the present invention, such as Figure 2 As shown, the processor 1 includes the fault signal processing module 10 described in the above embodiment.

[0129] According to the processor 1 of the embodiment of the present invention, by adopting the fault signal processing module 10 described in the above embodiment, the first fault processing circuit 13 closely cooperates with the first signal capture circuit 11 and the enable register 12, and by matching with the enable signal that enables the processing of the fault signal, it is possible to quickly determine which fault signals need to be processed, thereby achieving effective control and identification of the fault signal. Once a processable fault signal is determined, the first fault processing circuit 13 can quickly generate a corresponding fault response signal, ensuring that the module can respond quickly when faced with various faults, effectively improving the speed and accuracy of fault processing, thereby improving the stability and reliability of the entire system.

[0130] like Figure 2 As shown, the processor 1 further includes a safety event logic signal selection circuit 20. The safety event logic signal selection circuit 20 is connected to the fault signal processing module 10 and is used to identify the first fault signal and the second fault signal of the processor 1.

[0131] Specifically, in the system, there may be multiple sources of fault signals, which may include various functional circuits, signals triggered by software programs, voltage / clock fault signals, and unshielded faults of critical applications. The task of the safety event logic signal selection circuit 20 may be to classify and select these signals so that the system can take corresponding countermeasures according to different fault types. The safety event logic signal selection circuit 20 may process the received fault signal according to predefined logic rules. These rules may include determining the source of the fault signal, determining the severity of the signal, determining whether multiple signals occur at the same time, etc. According to these rules, the safety event logic signal selection circuit 20 can classify the fault signals to ensure that the system can accurately identify and handle various fault conditions.

[0132] Further, according to the result of the logic processing, the safety event logic signal selection circuit 20 can output classified fault signals (e.g., a first fault signal and a second fault signal). These signals can be further transmitted to other parts of the system, such as transmitting the first fault signal to the main safety unit 60 and transmitting the second fault signal to the secondary safety unit 70.

[0133] In some embodiments, Figure 2 As shown, the processor 1 also includes a reset circuit 30. The reset circuit 30 can be used to reset the entire processor 1 when the fault response signal output by the fault signal processing module 10 is a reset signal. When a serious fault occurs in the system or it needs to be quickly restored to an initial state, the reset circuit 30 can play a role to ensure that the system restarts, thereby avoiding potential problems or faults affecting the stability of the system.

[0134] The reset circuit 30 is connected to the output end of the fault signal processing module 10, and can obtain the fault response signal in time. It can also be connected to various components of the processor 1, including the central processing unit, storage unit, peripherals, etc., to achieve the reset of the entire system.

[0135] In some embodiments, the reset circuit 30 usually needs to be configured with specific trigger conditions. When the fault response signal output by the fault signal processing module 10 meets these conditions, the reset circuit 30 will take effect immediately. The trigger conditions can be set according to the needs of the system, for example, a specific fault mode, the urgency of the fault signal, etc. Therefore, when the reset circuit 30 receives the fault response signal and meets the trigger conditions, it can send a reset signal to all components inside the processor 1. This reset signal can return all components to the initial state and the system restarts. After the system restarts, the processor 1 can reinitialize each component to ensure that the system starts running from a stable state.

[0136] like Figure 2 As shown, the processor 1 also includes an interrupt control circuit 40 and a fault protocol output circuit 50. The interrupt control circuit 40 is connected to the output end of the fault signal processing module 10, and is used to control the processor 1 to interrupt in response to the interrupt signal when the fault response signal output by the fault signal processing module 10 is an interrupt signal.

[0137] In some embodiments, the interrupt control circuit 40 can trigger an interrupt according to specific conditions of the fault response signal output by the fault signal processing module 10. These conditions are usually predefined, such as specific types of faults, emergencies, etc. When the fault response signal output by the fault signal processing module 10 meets these conditions, the interrupt control circuit 40 will trigger an interrupt.

[0138] Specifically, when the fault response signal output by the fault signal processing module 10 is identified as needing to trigger an interrupt, the interrupt control circuit 40 can generate an interrupt signal. This interrupt signal can be transmitted to the interrupt control unit of the processor 1 to trigger the execution of the interrupt service program. The interrupt service program is a predefined processing program used to suspend the currently executed program and perform specific processing operations when a specific event (such as a fault signal) occurs. The interrupt operation allows the system to respond quickly when handling emergency events, improving the real-time performance and reliability of the system.

[0139] Therefore, the existence of the interrupt control circuit 40 enables the system to interrupt the current task in time when handling a fault or emergency, and to perform corresponding fault handling operations instead. In this way, the system can respond to various abnormal situations more flexibly, ensuring the stability and reliability of the system.

[0140] In some embodiments, the fault protocol output circuit 50 is connected to the output end of the fault signal processing module 10 and is used to output a corresponding fault indication signal in response to the fault status signal.

[0141] Specifically, when the state of the fault state machine switches, that is, switches from a normal state to a fault state, the fault protocol output circuit 50 can receive a corresponding fault state signal, and generate a corresponding fault indication signal in response to the fault state signal. This fault indication signal can be output by the fault protocol output circuit 50, and is usually used to communicate with an external system or device. This signal can be a digital signal, an analog signal, or other types of signals, depending on the interface requirements of the external system or device. After receiving the fault indication signal, the external system or device can perform corresponding processing according to a predetermined protocol, for example, triggering a backup system, recording a fault log, notifying an operator, etc.

[0142] In some embodiments, the design of the fault protocol output circuit 50 generally takes into account compatibility with external systems, including communication speed, data format, electrical characteristics, etc. In this way, when a fault occurs inside the processor 1 and the processing time reaches a preset window time, the fault protocol output circuit 50 can quickly and accurately transmit the fault indication signal to the external system, so that the external system can take corresponding measures in time to ensure the safety and stability of the system.

[0143] In some embodiments, the processor 1 includes one of a single-chip microcomputer, a microcontroller chip, and a system on chip. Among them, the single-chip microcomputer can be a microcomputer system that integrates a central processing unit, a memory, and an input / output device. The single-chip microcomputer can have a compact structure and is suitable for some simple control tasks. The single-chip microcomputer usually integrates various peripherals, such as communication interfaces, timers, and GPIO (general input / output) pins, so that it can easily communicate with other hardware components.

[0144] A microcontroller chip may refer to a dedicated integrated circuit with a highly integrated feature. It integrates a central processing unit, memory, input / output interface, timer, analog input / output and other functions on one chip. Microcontroller chips are widely used in embedded systems, such as home appliance control, automotive electronic systems, etc. In the fault signal processing module 10, the microcontroller chip can be used to process various fault signals and generate corresponding fault response signals as needed.

[0145] The system on chip can be a highly integrated chip that integrates multiple functional modules such as processor core, memory, graphics processing unit (GPU), communication interface, accelerator, etc. The system on chip is usually used in scenarios that require high-performance computing and multimedia processing, such as mobile devices, smart phones, and tablet computers. In the fault signal processing module 10, the system on chip can be used to process complex fault signal processing algorithms while supporting high-performance computing and multimedia processing requirements.

[0146] Reference below Figure 3 An electronic device according to an embodiment of the present invention is described.

[0147] Figure 3 is a block diagram of an electronic device according to an embodiment of the present invention, such as Figure 3 As shown, the electronic device 200 includes the processor 1 described in the above embodiment.

[0148] In some embodiments, the electronic device 200 can be applied to various fields, such as computers, automotive electronic systems, communication equipment, industrial automation systems, etc.

[0149] According to the electronic device 200 of the embodiment of the present invention, by adopting the processor 1 described in the above embodiment, the fault signal processing module 10 in the processor 1 can quickly determine the fault signal that needs to be processed, thereby realizing effective control and identification of the fault signal. Once the processable fault signal is determined, the first fault processing circuit 13 can quickly generate a corresponding fault response signal, ensuring that the module can respond quickly when facing various faults, effectively improving the speed and accuracy of fault processing, thereby improving the stability and reliability of the entire system.

[0150] Reference below Figure 4 A vehicle according to an embodiment of the present invention is described.

[0151] Figure 4 is a block diagram of a vehicle according to an embodiment of the present invention, Figure 4 As shown, the vehicle 100 includes the processor 1 described in the above embodiment.

[0152] According to the vehicle 100 of the embodiment of the present invention, by adopting the processor 1 described in the above embodiment, the fault signal processing module 10 in the processor 1 can quickly determine the fault signal that needs to be processed, thereby realizing effective control and identification of the fault signal, and the processor can quickly generate a corresponding fault response signal, effectively improving the speed and accuracy of fault processing, thereby improving the stability and reliability of the vehicle 100.

[0153] Reference below Figure 5 A fault signal processing method according to an embodiment of the present invention is described.

[0154] Figure 5 is a flow chart of a fault signal processing method according to an embodiment of the present invention. Figure 5 As shown, the fault signal processing method at least includes the following steps S1-S3.

[0155] S1, obtaining a first fault signal and a pre-configured enable signal for enabling processing of the fault signal.

[0156] Specifically, when the chip is working normally at a certain moment, if any one or more fault signals are generated, the rising edge of the signal is captured and locked by the first signal capture circuit to obtain the first fault signal. The first fault signal can be a fault signal of each functional circuit (such as external watchdog overflow, processor lockstep exception, storage data verification error, bus failure), a fault signal triggered by a software program, and a second voltage / clock fault signal (i.e., a drive fault event of a secondary safety unit).

[0157] Furthermore, when the chip is started and initialized, the software program configures the enable register in the main safety unit according to the preset configuration to store the pre-configured enable signal for enabling the processing of the fault signal. The enable signal determines which specific types of faults will be processed and which will be ignored or recorded for subsequent analysis. In an embodiment, the external watchdog overflow signal, the processor lockstep exception signal, the storage data verification error signal, the bus fault and the second voltage / clock fault signal of the secondary safety unit are set to enable to support safety processing.

[0158] S2, determining an enable processing fault signal in the first fault signal according to the enable signal.

[0159] Specifically, the first signal capture circuit can pass the first fault signal to the enable register and perform a logic operation with the enable signal of the pre-configured enable register, that is, it can be determined which fault signals need to be processed according to the enable signal. If a fault signal is marked as processable in the enable register, the enable register can be in an enabled state for this enabled processing fault signal. For those fault signals marked as not needing to be processed in the enable register, the enable register will be in a disabled state.

[0160] S3, generating a fault response signal according to the enable processing fault signal.

[0161] Specifically, once the enable processing fault signal is determined, the enable processing fault signal can be transmitted to the status register. The number of states and the corresponding relationship in the status register are consistent with the enable processing fault signal. Each fault signal corresponds to a state bit and is recorded.

[0162] Furthermore, the system can generate corresponding fault response signals based on these signals. This response signal can be a digital signal, an analog signal, or a signal in other forms to ensure that the system can make an appropriate response when a fault occurs, thereby ensuring the safety and stability of the system.

[0163] In some embodiments, a fault response signal is generated based on an enable processing fault signal, including: synchronizing the enable processing fault signal according to a first clock domain signal of a main safety unit, performing a first preset logical combination on the synchronized enable processing fault signal to obtain a first fault logic signal, and generating a fault response signal based on the first fault logic signal.

[0164] Specifically, by transmitting the enable processing fault signal to the first synchronization processing and combination circuit, the first synchronization processing and combination circuit can synchronize the enable processing fault signal according to the first clock domain signal of the main safety unit. The synchronization processing is to ensure that all signals run under the same clock signal to avoid errors caused by timing problems.

[0165] Further, after synchronization processing, these enable processing fault signals are sent to a first preset logic combination circuit. Here, different logic gates (AND, OR, etc.) can be used for logic combination operations. This combination process can be customized according to system requirements to generate an output signal, i.e., a first fault logic signal, from multiple input signals.

[0166] Further, based on the first fault logic signal, the first fault processing circuit can generate a fault response signal. The fault response signal may include at least one of a reset signal and an interrupt signal. The reset signal is usually used to restore the system to an initial state. In an embodiment, an external watchdog overflow, a processor lockstep exception, and a bus fault can be set to trigger a reset signal. The interrupt signal is used to suspend the current execution process and execute the fault handling program instead. In an embodiment, a storage body data check error can be set to trigger an interrupt signal. Therefore, when the corresponding security event described above occurs, the corresponding trigger signal is output to the interrupt control circuit or the reset circuit to maximize the stability and security of the system.

[0167] In some embodiments, the fault signal processing method further includes: recording a processing time for enabling processing of the fault signal, and outputting a fault response signal when the processing time reaches a preset window time.

[0168] Specifically, the counter may record a timestamp that enables the processing of a fault signal entering the system, and the purpose of recording the timestamp is to track the moment when the fault signal enters the system.

[0169] Furthermore, the counter can continue to count during the fault signal processing process, and when the processing time recorded by the counter reaches the window time preset in the event window register, the system will output a fault response signal. This signal can be a reset signal, an interrupt signal or other types of signals, which are used to notify other modules or external devices in the system that a fault has occurred. Among them, the preset window time can be a time interval pre-configured in the system design to limit the response time for processing the fault signal.

[0170] In some embodiments, the preset window time can be dynamically adjusted according to the actual needs of the system. For example, in a system with high security requirements, the preset window time may be relatively short to ensure that faults are responded to in a timely manner. In some systems with less high real-time requirements, the preset window time can be relatively long so that the system has more time to handle faults, and may choose to accumulate fault information over a long period of time for subsequent system optimization and improvement. In this way, the system can flexibly set the preset window time according to specific application scenarios and performance requirements to balance the security, stability and real-time performance of the system.

[0171] In some embodiments, the fault signal processing method also includes: obtaining a second fault signal, synchronizing the second fault signal according to the clock domain signal of the secondary safety unit, performing a second preset logical combination on the synchronized second fault signal to obtain a second fault logic signal, and generating a fault response signal according to the second fault logic signal, wherein the fault response signal includes at least one of a reset signal and an interrupt signal.

[0172] Specifically, when the chip is working normally at a certain moment, if the first voltage / clock source of the main safety unit fails, the main safety unit can no longer process the fault signal, so these fault signals will be directly sent to the second level conversion circuit of the secondary safety unit. This is because the signal level of the main safety module needs to be converted into a voltage domain consistent with the secondary safety unit through the second level conversion circuit in order to be processed correctly.

[0173] Furthermore, the rising edge of the signal is captured and locked by the second signal capture circuit to obtain a second fault signal. The second fault signal can be a fault signal of each functional circuit (such as external watchdog overflow, processor lockstep exception, storage data verification error, bus fault), a fault signal triggered by a software program, a first voltage / clock fault signal (i.e., a drive fault event of the main safety unit), or a non-shieldable fault of a critical application (such as a CAN module communication fault, a PWM count fault, a DMA data access fault).

[0174] Furthermore, the second fault signal is transmitted to a second synchronization processing and combination circuit, and the second synchronization processing and combination circuit can synchronize the second fault signal according to the clock domain signal of the secondary safety unit, so that the second fault signal is synchronized with the secondary safety unit clock, thereby achieving that the second fault signal can be correctly identified and processed by the secondary safety unit.

[0175] Further, the synchronized second fault signal is subjected to a second preset logic combination to obtain a second fault logic signal. Here, different logic gates (AND, OR, etc.) can be used to perform the logic combination operation. This combination process can be customized according to the needs of the system so as to generate an output signal, i.e., the second fault logic signal, from multiple input signals. A fault response signal can be generated according to the second fault logic signal.

[0176] In some embodiments, the fault signal processing method further includes: monitoring the first voltage / clock fault signal of the main safety unit by the secondary safety unit, and monitoring the second voltage / clock fault signal of the secondary safety unit by the main safety unit. This means that the main safety unit and the secondary safety unit can monitor each other's working status. This mutual monitoring mechanism improves the reliability and safety of the system.

[0177] If both the secondary safety unit and the primary safety unit are normal, the second synchronous processing and combination circuit can output a fault response signal according to the second fault logic signal, and the first synchronous processing and combination circuit can output a fault response signal according to the first fault logic signal. This can include a reset signal, an interrupt signal, or other types of signals. This signal is used to notify other parts of the system or external devices that a hardware fault has occurred in the functional circuits within the system or an error has occurred in the software program.

[0178] If the primary safety unit fails as determined by the first voltage / clock fault signal, in this case, the system may rely on the secondary safety unit to continue operating, and the second synchronous processing and combination circuit will output a fault response signal according to the second fault logic signal. Similarly, if the secondary safety unit fails as determined by the second voltage / clock fault signal, in this case, the first synchronous processing and combination circuit will output a fault response signal according to the first fault logic signal.

[0179] Therefore, the system adopts a redundant design, that is, a redundant relationship is established between the main safety unit and the secondary safety unit to ensure that the system can be taken over by the other party when one party fails, and a fault response signal is output in time, so that users can quickly understand the working status of the main safety unit and the secondary safety unit, which helps users to carry out subsequent processing and improves the safety and availability of the system.

[0180] In some embodiments, the fault signal processing method further includes: in response to the fault response signal, according to a predefined state transition rule, switching the fault state machine from a normal state to a corresponding fault state, and outputting the fault state to trigger the fault protocol output circuit to output a fault indication signal corresponding to the fault state. This signal can be a digital signal, an analog signal, or other types of signals, and the specific format and content may vary depending on the design of the protocol. This fault indication signal is usually sent to an external system for further processing and response, such as triggering a backup system, recording a fault log, notifying an operator, etc.

[0181] In some embodiments, when the first fault state machine is in a normal state, the first fault state machine can output a signal alternating between 0 and 1, indicating that the current system state is normal. When the first fault state machine is in a fault state, the first fault state machine can generate a low level greater than 100 main safety unit clock units, indicating that the current system has a fault. The fault state information will be sent to the fault protocol output circuit, and according to Figure 6 The output signal timing protocol is output.

[0182] like Figure 6 As shown in the figure, when the system is in the initialization process and each function is not started, the system is considered to be in an abnormal state, and the fault protocol output circuit generates a low-level signal of all 0s (FIO[0:1]=00). When the system is initialized, but the fault signal processing module is not activated, FIO[0:1] outputs a high-level signal of all 1s (FIO[0:1]=11) and notifies the external system that the module is not started. When FIO[0:1] outputs alternating signals of 0 and 1, it indicates that the system is working normally and no fault has occurred.

[0183] When FIO[0:1] outputs a low-level signal greater than 100 main safety unit clock units, it indicates that the system has a fault and the external system needs to identify and take action. At this time, the fault valid signal triggers the counter to start counting. The counter can be an 8-bit counter with a maximum count of 256 main safety unit drive clocks. If the counter exceeds 256 drive clocks and still does not receive the fault state signal output by the first fault state machine, the main safety unit itself is judged to be faulty. The system will directly issue an MCU reset operation and force the activation of the fault protocol output circuit to output the corresponding fault indication signal.

[0184] In addition, for the second fault state machine of the secondary safety unit, after the fault state machine is switched to the fault state, the output signal timing protocol adopted by the fault protocol output circuit is consistent with the above process, which will not be described in detail here.

[0185] In some embodiments, the main safety unit can respond not only to hardware fault signals, but also to fault signals triggered by software programs, which allows the software program to trigger fault signals when necessary and trigger corresponding safety responses.

[0186] Specifically, the software program can selectively enable software-triggered fault signals by configuring the software fault trigger register. This register allows the software program to specify which fault signals should be processed and tells the main safety unit how to respond to them. As with hardware-triggered fault signals, once a fault signal triggered by a software program occurs, the main safety unit will capture the fault signal and start the corresponding processing flow. This includes synchronous processing of signals, triggering the fault state machine to transition to a fault state, triggering an MCU reset or interrupt, and outputting the corresponding fault indication signal through the fault protocol output circuit.

[0187] In some embodiments, the fault signal processing method further includes: generating a test fault signal of a second fault signal. The test fault signal is not a real hardware or software fault, but a specific voltage, clock or signal pulse emitted by a test stimulus generation circuit to simulate the occurrence of a fault. The test fault signal is synchronized according to the clock domain signal of the secondary safety unit to ensure the timing consistency of the test signal. The synchronized test fault signal is then subjected to a second preset logic combination to obtain a test fault logic signal, and the states of multiple test fault signals are combined into a logic signal through the operation of logic gates. This logic signal describes the functional fault condition inside the system.

[0188] Furthermore, a test fault response signal is generated according to the test fault logic signal, and this signal can be a reset signal, an interrupt signal, or a combination of the two. The reset signal is used to restore the system to an initial state, and the interrupt signal is used to immediately stop the current task and switch to a specific fault handling program to deal with the fault.

[0189] Further, in response to the test fault response signal, the fault state of the second fault state machine is switched and the fault state is output. The state switching of the second fault state machine is used to trigger the fault protocol output circuit to output a fault indication signal corresponding to the fault state. In this way, the system can identify the functional fault of the secondary safety unit and take corresponding measures.

[0190] Figure 7 is an overall flow chart of a fault signal processing method according to an embodiment of the present invention. Figure 7As shown, the overall process of the fault signal processing method includes at least the following steps S10-S27.

[0191] S10, a first voltage / clock source provides a working voltage and a clock signal for the primary safety unit, and a second voltage / clock source provides a working voltage and a clock signal for the secondary safety unit.

[0192] S11, determine whether the first voltage / clock source fails, if not, proceed to step S12, if yes, proceed to step S21.

[0193] S12, capturing a first fault signal through a first signal capturing circuit.

[0194] S13, filtering out the enable processing fault signal in the first fault signal by using the enable signal pre-configured in the enable register.

[0195] S14, for the screened enable processing fault signal, a trigger status register is set to record the status of the enable processing fault signal.

[0196] S15, transmitting the enable processing fault signal to the first synchronization processing and combination circuit, and performing synchronization processing on the enable processing fault signal according to the first clock domain signal, thereby achieving clock domain synchronization with the main safety unit.

[0197] S16, performing a first preset logic combination on the synchronized enable processing fault signal to obtain a unified first fault logic signal.

[0198] S17, the first fault logic signal triggers the counter to start counting, which is used to record the processing time of enabling the processing of the fault signal.

[0199] S18, when the processing time reaches the preset window time, a fault response signal is output, that is, the MCU reset circuit or interrupt circuit is triggered to work to generate a reset signal or an interrupt signal.

[0200] S19, the fault response signal triggers the first fault state machine to switch from a normal state to a fault state.

[0201] S20, after the state change of the first fault state machine is completed, a fault state signal is output, and the fault protocol output circuit is triggered to output a corresponding fault indication signal.

[0202] S21, enabling the processing of fault signals does not require synchronization processing, is not synchronized with the main safety unit clock domain, and directly performs logical combination.

[0203] S22, transmitting the logically combined enable processing fault signal to the second level conversion circuit, and converting the signal into a voltage domain consistent with the secondary safety unit through the second level conversion circuit.

[0204] S23, transmitting the converted enable processing fault signal to the second synchronization processing and combination circuit, and performing synchronization processing on the enable processing fault signal according to the second clock domain signal, thereby achieving clock domain synchronization with the secondary safety unit.

[0205] S24, performing a second preset logic combination on the synchronized enable processing fault signal to obtain a unified second fault logic signal.

[0206] S25, generating a fault response signal according to the second fault logic signal, that is, triggering the MCU reset circuit or interrupt circuit to operate to generate a reset signal or an interrupt signal.

[0207] S26, the fault response signal triggers the second fault state machine to switch from the normal state to the fault state.

[0208] S27, after the state change of the second fault state machine is completed, a fault state signal is output, and the fault protocol output circuit is triggered to output a corresponding fault indication signal.

[0209] Figure 8 is an overall flow chart of the secondary safety unit self-test according to an embodiment of the present invention, such as Figure 8 As shown, the overall process of the secondary safety unit self-test includes at least the following steps S100-S114.

[0210] S100: A second voltage / clock source provides a working voltage and a clock signal to a secondary safety unit.

[0211] S101, determine whether the secondary safety unit supports fault signal configuration enablement, if yes, proceed to step S102, if no, proceed to step S108

[0212] S102, activating a test stimulus generating circuit, generating a test fault signal of a second fault signal, and simulating fault transmission.

[0213] S103, transmitting the test fault signal to the second synchronization processing and combination circuit, and performing synchronization processing on the test fault signal according to the clock domain signal of the less secure unit, thereby achieving synchronization with the clock domain of the less secure unit.

[0214] S104, performing a second preset logic combination on the synchronized test fault signal to obtain a test fault logic signal.

[0215] S105, generating a test fault response signal according to the test fault logic signal.

[0216] S106, the test fault response signal triggers the second fault state machine to switch from a normal state to a fault state.

[0217] S107, after the state change of the second fault state machine is completed, a fault state signal is output, and the fault protocol output circuit is triggered to output expected fault sequence information to identify the functional fault of the secondary safety unit.

[0218] S108, capturing a second fault signal through a second signal capturing circuit.

[0219] S109, for the second fault signal, triggering a status register to be set to record the status of the second fault signal.

[0220] S110, transmitting the second fault signal to the second synchronization processing and combination circuit, performing synchronization processing on the second fault signal according to the second clock domain signal, thereby achieving clock domain synchronization with the secondary safety unit.

[0221] S111, performing a second preset logic combination on the synchronized second fault signals to obtain a unified second fault logic signal.

[0222] S112, generating a fault response signal according to the second fault logic signal, that is, triggering the MCU reset circuit or interrupt circuit to operate to generate a reset signal or an interrupt signal.

[0223] S113, the fault response signal triggers the second fault state machine to switch from a normal state to a fault state.

[0224] S114, after the state change of the second fault state machine is completed, a fault state signal is output, and the fault protocol output circuit is triggered to output a corresponding fault indication signal.

[0225] In summary, through the mutual monitoring between the main safety unit and the secondary safety unit, the system achieves a high degree of redundancy and functional safety. Even if one of the units fails or fails, the other unit can still continue to work, ensuring the availability and safety of the system. In addition, the secondary safety unit has a self-test function. The secondary safety unit includes a test stimulus generation circuit that can be triggered by a program to generate a specified test stimulus signal to simulate the occurrence of a fault to test the effectiveness and correctness of the secondary safety unit, thereby improving the stability and reliability of the system.

[0226] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example.

[0227] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims

1. A fault signal processing module, characterized in that: include: A first signal capture circuit, used for acquiring a first fault signal; An enable register, used to store a pre-configured enable signal for enabling processing of a fault signal; A first fault processing circuit, wherein the first fault processing circuit is connected to the first signal capture circuit and the enable register respectively, and is used to determine an enable processing fault signal in the first fault signal according to the enable signal, and generate a fault response signal according to the enable processing fault signal.

2. The fault signal processing module according to claim 1, characterized in that: The first fault processing circuit comprises: A logic gate circuit, wherein a first input end of the logic gate circuit is connected to the first signal capture circuit, and a second input end of the logic gate circuit is connected to the enable register, and is used to determine an enable processing fault signal in the first fault signal according to the enable signal.

3. The fault signal processing module according to claim 2, characterized in that: The first fault processing circuit further includes: A first synchronous processing and combination circuit, wherein the input end of the first synchronous processing and combination circuit is connected to the output end of the logic gate circuit, and is used to synchronously process the enable processing fault signal according to the first clock domain signal, and perform a first preset logical combination on the synchronized enable processing fault signal to obtain a first fault logic signal, and generate a fault response signal according to the first fault logic signal.

4. The fault signal processing module according to claim 3, characterized in that: The fault response signal includes at least one of a reset signal and an interrupt signal.

5. The fault signal processing module according to claim 3, characterized in that: The fault signal processing module also includes: A first fault state machine is connected to the output end of the first synchronous processing and combination circuit, and is used for switching the fault state in response to the fault response signal and outputting a fault state signal.

6. The fault signal processing module according to claim 5, characterized in that: The fault signal processing module also includes: A time monitoring circuit is connected to the first synchronous processing and combination circuit, and is used to record the processing time of the first synchronous processing and combination circuit to enable processing of the fault signal, and output a fault response signal when the processing time reaches a preset window time.

7. The fault signal processing module according to claim 6, characterized in that: The time monitoring circuit comprises: An event window register, used to store a preset window time; A counter is connected to the first synchronous processing and combination circuit, and is used to record the processing time of the first synchronous processing and combination circuit to enable processing of the fault signal, and output a fault response signal when the processing time reaches a preset window time.

8. The fault signal processing module according to claim 7, characterized in that: The counter is also connected to the first fault state machine, and the first fault state machine is further used to switch the fault state and output a fault state signal in response to the fault response signal of the counter.

9. The fault signal processing module according to claim 8, characterized in that: The fault signal processing module also includes: A status register is connected to the output end of the logic gate circuit and is used to record the status of enabling the processing of the fault signal.

10. The fault signal processing module according to claim 9, characterized in that: The first signal capture circuit, the enable register, the logic gate circuit, the first synchronization processing and combination circuit, the first fault state machine, the event window register, the counter and the status register form a main safety unit of the fault signal processing module.

11. The fault signal processing module according to claim 10, characterized in that: The fault signal processing module also includes: The secondary safety unit is used to obtain a second fault signal and generate a fault response signal according to the second fault signal.

12. The fault signal processing module according to claim 11, characterized in that: The secondary safety unit comprises: A second signal capturing circuit, used for acquiring the second fault signal; A second synchronization processing and combination circuit, wherein the second synchronization processing and combination circuit is connected to the second signal capture circuit, and is used for synchronously processing the second fault signal according to the clock domain signal of the secondary safety unit, and performing a second preset logical combination on the synchronized second fault signal to obtain a second fault logic signal, and generating a fault response signal according to the second fault logic signal.

13. The fault signal processing module according to claim 12, characterized in that: The secondary safety unit also includes: A second fault state machine, the second fault state machine is connected to the second synchronous processing and combination circuit, and is used to switch the fault state in response to the fault response signal and output a fault state signal.

14. The fault signal processing module according to claim 12, characterized in that: The output end of the second signal capture circuit is also connected to the status register, and the status register is also used to record the status of the second fault signal.

15. The fault signal processing module according to claim 12, characterized in that: The fault signal processing module also includes: A first voltage / clock source, connected to the main safety unit, for providing an operating voltage and a clock signal to the main safety unit; The second voltage / clock source is connected to the secondary safety unit and is used to provide an operating voltage and a clock signal for the secondary safety unit.

16. The fault signal processing module according to claim 15, characterized in that: The fault signal processing module further comprises a first fault detection circuit connected to the second voltage / clock source and configured to detect a second voltage / clock fault signal; The main safety unit further includes a first level conversion circuit, which is connected to the first fault detection circuit and the first signal capture circuit and is used to convert the second voltage / clock fault signal into a processing signal of the main safety unit.

17. The fault signal processing module according to claim 16, characterized in that: The first fault signal includes the fault signals of each functional circuit of the system where the fault signal processing module is located, the fault signal triggered by the software program and the second voltage / clock fault signal.

18. The fault signal processing module according to claim 15, characterized in that: The fault signal processing module further comprises a second fault detection circuit connected to the first voltage / clock source and configured to detect a first voltage / clock fault signal; The secondary safety unit further includes a second level conversion circuit, which is connected to the second fault detection circuit and the second signal capture circuit and is used for converting the first voltage / clock fault signal into a processing signal of the secondary safety unit.

19. The fault signal processing module according to claim 18, characterized in that: The second fault signal includes the fault signals of each functional circuit of the system where the fault signal processing module is located, the fault signal triggered by the software program and the first voltage / clock fault signal.

20. The fault signal processing module according to claim 13, characterized in that: The secondary safety unit also includes: a test stimulus generating circuit, the test stimulus generating circuit being connected to the second synchronization processing and combining circuit, and being used for generating a test fault signal of the second fault signal; The second synchronization processing and combination circuit is further used to synchronize the test fault signal according to the clock domain signal of the secondary safety unit, and perform a second preset logic combination on the synchronized test fault signal to obtain a test fault logic signal, and generate a test fault response signal according to the test fault logic signal; The second fault state machine is further configured to switch a fault state in response to the test fault response signal, so as to identify a functional fault of the secondary safety unit according to the fault state.

21. The fault signal processing module according to claim 20, characterized in that: The status register is further used to store the test fault signal so that the system where the fault signal processing module is located can identify whether the fault signal is a real fault signal or a test fault signal.

22. A processor, characterized in that: It includes the fault signal processing module described in claims 1-21.

23. The processor according to claim 22, characterized in that The processor further comprises: A safety event logic signal selection circuit is connected to the fault signal processing module and is used to identify the first fault signal and the second fault signal of the processor.

24. The processor according to claim 22, characterized in that The processor further comprises: The reset circuit is connected to the output end of the fault signal processing module and is used for controlling the processor to reset in response to the reset signal when the fault response signal output by the fault signal processing module is a reset signal.

25. The processor according to claim 22, characterized in that The processor further comprises: The interrupt control circuit is connected to the output end of the fault signal processing module and is used for controlling the processor to interrupt in response to the interrupt signal when the fault response signal output by the fault signal processing module is an interrupt signal.

26. The processor according to claim 22, characterized in that The processor further comprises: The fault protocol output circuit is connected to the output end of the fault signal processing module and is used to output a corresponding fault indication signal in response to the fault status signal.

27. The processor according to any one of claims 22 to 26, characterized in that: The processor includes one of a single chip microcomputer, a microcontroller chip and a system on chip.

28. An electronic device, characterized in that: A processor comprising any one of claims 22-27.

29. A vehicle, characterized in that: The vehicle comprises a processor as claimed in any one of claims 22-27.

30. A fault signal processing method, characterized in that: include: Acquire a first fault signal and a preconfigured enable signal for enabling processing of the fault signal; Determine an enable processing fault signal in the first fault signal according to the enable signal; A fault response signal is generated according to the enable processing fault signal.

31. The fault signal processing method according to claim 30, characterized in that: Generating a fault response signal according to the enabling processing fault signal includes: Synchronously processing the enable processing fault signal according to the first clock domain signal of the main safety unit; Performing a first preset logic combination on the synchronized enable processing fault signal to obtain a first fault logic signal; A fault response signal is generated according to the first fault logic signal, wherein the fault response signal includes at least one of a reset signal and an interrupt signal.

32. The fault signal processing method according to claim 31, characterized in that: The fault signal processing method further includes: Recording the processing time of the enabling processing fault signal; The fault response signal is output when the processing time reaches a preset window time.

33. The fault signal processing method according to claim 31, characterized in that: The fault signal processing method further includes: obtaining the second fault signal; performing synchronous processing on the second fault signal according to a clock domain signal of the secondary safety unit; Performing a second preset logic combination on the synchronized second fault signal to obtain a second fault logic signal; A fault response signal is generated according to the second fault logic signal, wherein the fault response signal includes at least one of a reset signal and an interrupt signal.

34. The fault signal processing method according to claim 33, characterized in that: The fault signal processing method further includes: Monitoring a first voltage / clock fault signal of the primary safety unit by the secondary safety unit, and monitoring a second voltage / clock fault signal of the secondary safety unit by the primary safety unit; When the secondary safety unit and the primary safety unit are both normal, outputting a fault response signal generated according to the second fault logic signal and the first fault logic signal; Alternatively, when the main safety unit is determined to be faulty according to the first voltage / clock fault signal, a fault response signal is generated according to the second fault logic signal.

35. The fault signal processing method according to claim 34, characterized in that: The fault signal processing method further includes: In response to the fault response signal, the fault state of the fault state machine is switched, and the fault state is output to trigger the fault protocol output circuit to output a fault indication signal corresponding to the fault state.

36. The fault signal processing method according to claim 33, characterized in that: The fault signal processing method further includes: generating a test fault signal of the second fault signal; Synchronously processing the test fault signal according to the clock domain signal of the secondary safety unit, performing a second preset logic combination on the synchronized test fault signal to obtain a test fault logic signal, and generating a test fault response signal according to the test fault logic signal; A fault state is switched in response to the test fault response signal to identify a functional fault of the secondary safety unit according to the fault state.

Images