Security diagnosis communication circuit, target chip, security diagnosis communication system and method

Abstract

The invention discloses a safety diagnosis communication circuit, a target chip, a safety diagnosis communication system and a safety diagnosis communication method. The safety diagnosis communication circuit comprises a first register, a first check circuit and a second register, under the condition that a target chip belongs to a monitored chip and the safety diagnosis communication circuit is in a first working mode, a first register is used for registering original function safety abnormal information of the monitored chip; the first check circuit is used for calculating a first check code corresponding to the original function security exception information, and generating target function security exception information based on the original function security exception information and the first check code; and the second register is used for outputting the target function security exception information, so that the target function security exception information is transmitted from the monitored chip to the monitoring chip. According to the embodiment of the invention, the fault information of the monitored chip can be accurately notified to the monitoring chip, and the stability and reliability of the intelligent driving system can be improved.

Description

Technical Field

[0001] The present disclosure relates to driving technology, and in particular to a safety diagnosis communication circuit, a target chip, a safety diagnosis communication system, and a method. Background Art

[0002] In the field of driving technology, if a chip in an intelligent driving system fails, the relevant fault information needs to be transmitted to a chip with a higher security level so that the higher-security chip can take appropriate protective measures. How to accurately transmit fault information to the higher-security chip is a technical issue that deserves attention from those skilled in the art. Summary of the Invention

[0003] In order to solve the above technical problems, the present disclosure provides a secure diagnostic communication circuit, a target chip, a secure diagnostic communication system and a method.

[0004] According to one aspect of an embodiment of the present disclosure, there is provided a safety diagnostic communication circuit, which is applied to a target chip and includes: a first register, a first verification circuit, and a second register; When the target chip is a monitored chip and the safety diagnosis communication circuit is placed in the first working mode, then: The first register is used to store the original functional safety exception information of the monitored chip; The first verification circuit is used to calculate a first verification code corresponding to the original functional safety exception information, and generate target functional safety exception information based on the original functional safety exception information and the first verification code; The second register is used to output the target function safety exception information, so that the target function safety exception information is transmitted from the monitored chip to the monitoring chip.

[0005] In some optional examples, when the target chip is a monitoring chip and the safety diagnostic communication circuit is placed in the second working mode, then: The second register is used to receive target function safety abnormality information transmitted from the monitored chip to the monitoring chip; The first verification circuit is configured to obtain, based on the target functional safety abnormality information, original functional safety abnormality information of the monitored chip and a first verification code corresponding to the original functional safety abnormality information, and verify the original functional safety abnormality information based on the first verification code to obtain a verification result; In response to the verification result indicating that the verification of the original functional safety exception information is passed, the first register is used to store the original functional safety exception information.

[0006] According to another aspect of the embodiments of the present disclosure, a target chip is provided, comprising the above-mentioned secure diagnostic communication circuit.

[0007] According to another aspect of the embodiments of the present disclosure, a safety diagnostic communication system is provided, comprising: Monitored chip and monitoring chip; In which, the monitored chip includes the above-mentioned safety diagnostic communication circuit placed in the first working mode, the monitoring chip includes the above-mentioned safety diagnostic communication circuit placed in the second working mode, and the monitoring chip is used to perform preset safety protection operations for the monitored chip based on the original functional safety exception information stored in the first register in the included safety diagnostic communication circuit.

[0008] According to another aspect of the embodiments of the present disclosure, a safety diagnostic communication method is provided, which is applied to the above-mentioned safety diagnostic communication circuit. When the target chip to which the safety diagnostic communication circuit is applied is a monitored chip and the safety diagnostic communication circuit is placed in a first operating mode, the safety diagnostic communication method includes: Storing original functional safety exception information of the monitored chip through a first register; Calculating a first check code corresponding to the original functional safety exception information through a first check circuit, and generating target functional safety exception information based on the original functional safety exception information and the first check code; The target function safety abnormality information is outputted through the second register, so that the target function safety abnormality information is transmitted from the monitored chip to the monitoring chip.

[0009] According to another aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and the computer program is executed by a processor to perform the above-mentioned safety diagnostic communication method.

[0010] According to another aspect of the embodiments of the present disclosure, an electronic device is provided, the electronic device including: processor; a memory for storing instructions executable by the processor; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the above-mentioned safety diagnostic communication method.

[0011] According to another aspect of the embodiments of the present disclosure, a computer program product is provided. When instructions in the computer program product are executed by a processor, the above-mentioned security diagnostic communication method is performed.

[0012] Based on the safety diagnostic communication circuit, target chip, safety diagnostic communication system, method, storage medium, electronic device and program product provided by the above-mentioned embodiments of the present disclosure, when the target chip to which the safety diagnostic communication circuit is applied belongs to the monitored chip and the safety diagnostic communication circuit is placed in the first working mode, the target function safety anomaly information can be transmitted from the monitored chip to the monitoring chip through the coordinated work of the first register, the first verification circuit and the second register. Since the target function safety anomaly information is generated based on the original function safety anomaly information of the monitored chip and the first verification code corresponding to the original function safety anomaly information, the target function safety anomaly information can carry both the fault information of the monitored chip and the verification information. Based on the verification information, the monitoring chip can verify the fault information so as to determine whether an error occurs in the fault information during the transmission process based on the verification result, thereby screening out accurate fault information. Therefore, the embodiments of the present disclosure can accurately notify the monitoring chip of the fault information of the monitored chip, which is conducive to improving the stability and reliability of the intelligent driving system. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a system architecture diagram applicable to some exemplary embodiments of the present disclosure.

[0014] Figure 2 This is one of the structural diagrams of the safety diagnostic communication circuit provided by some exemplary embodiments of the present disclosure.

[0015] Figure 3-1 This is the second structural diagram of the safety diagnostic communication circuit provided by some exemplary embodiments of the present disclosure.

[0016] Figure 3-2 This is the third structural diagram of the safety diagnostic communication circuit provided by some exemplary embodiments of the present disclosure.

[0017] Figure 4-1 This is the fourth structural diagram of the safety diagnostic communication circuit provided by some exemplary embodiments of the present disclosure.

[0018] Figure 4-2 This is the fifth structural diagram of the safety diagnostic communication circuit provided by some exemplary embodiments of the present disclosure.

[0019] Figure 5 This is the sixth structural diagram of the safety diagnostic communication circuit provided by some exemplary embodiments of the present disclosure.

[0020] Figure 6 This is the seventh structural diagram of the safety diagnostic communication circuit provided by some exemplary embodiments of the present disclosure.

[0021] Figure 7-1This is one of the structural diagrams of the safety diagnostic communication system provided by some exemplary embodiments of the present disclosure.

[0022] Figure 7-2 This is the second structural diagram of the safety diagnostic communication system provided by some exemplary embodiments of the present disclosure.

[0023] Figure 8 This is one of the flowcharts of the secure diagnostic communication method provided by some exemplary embodiments of the present disclosure.

[0024] Figure 9 This is the second flowchart of the secure diagnostic communication method provided by some exemplary embodiments of the present disclosure.

[0025] Figure 10 This is the third flowchart of the secure diagnostic communication method provided by some exemplary embodiments of the present disclosure.

[0026] Figure 11 This is the fourth flowchart of the secure diagnostic communication method provided by some exemplary embodiments of the present disclosure.

[0027] Figure 12 This is the fifth flowchart of the secure diagnostic communication method provided by some exemplary embodiments of the present disclosure.

[0028] Figure 13 This is the sixth flowchart of the secure diagnostic communication method provided by some exemplary embodiments of the present disclosure.

[0029] Figure 14-1 This is the seventh flowchart of the secure diagnostic communication method provided by some exemplary embodiments of the present disclosure.

[0030] Figure 14-2 This is the eighth flowchart of the secure diagnostic communication method provided by some exemplary embodiments of the present disclosure.

[0031] Figure 15-1 This is the ninth flowchart of the secure diagnostic communication method provided by some exemplary embodiments of the present disclosure.

[0032] Figure 15-2 This is the tenth flowchart of the secure diagnostic communication method provided by some exemplary embodiments of the present disclosure.

[0033] Figure 16 is a schematic structural diagram of an electronic device provided by some exemplary embodiments of the present disclosure. DETAILED DESCRIPTION

[0034] To explain the present disclosure, example embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. It should be understood that the present disclosure is not limited to the example embodiments.

[0035] It should be noted that the relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless specifically stated otherwise.

[0036] Application Overview If some chips in the intelligent driving system fail, the relevant fault information needs to be passed to chips with higher safety levels so that the chips with higher safety levels can take corresponding protection measures.

[0037] During the implementation of this disclosure, the inventors discovered that if fault information cannot be accurately communicated to chips with higher security levels, the intelligent driving system could face a crash risk. Therefore, whether fault information can be accurately communicated to chips with higher security levels significantly impacts the stability and reliability of the intelligent driving system. Accurately communicating fault information to chips with higher security levels is a technical issue worthy of attention for those skilled in the art.

[0038] Exemplary Overview Figure 1 1 is a system architecture diagram applicable to some exemplary embodiments of the present disclosure, including a monitored chip 110 and a monitoring chip 120 . The monitoring chip 120 can be electrically connected to the monitored chip 110 .

[0039] The monitored chip 110 may be a chip that needs to report fault information, and may include, but is not limited to, an intelligent driving chip, an image transmission chip, a positioning chip, etc. Optionally, the intelligent driving chip may be an Advanced Driver Assistance Systems System on Chip (ADASSOC).

[0040] The monitoring chip 120 may be a chip with a higher security level than the monitored chip 110 and used to collect fault information of the monitored chip 110 , for example, a system microcontroller chip. Optionally, the system microcontroller chip may also be called a system microcontroller unit (SMU).

[0041] In embodiments of the present disclosure, a safety diagnostic communication circuit may be provided in each of the monitored chip 110 and the monitoring chip 120. Optionally, the safety diagnostic communication circuit may also be referred to as a safety diagnostic communicator (SDCU). Based on the safety diagnostic communication circuits provided in each of the monitored chip 110 and the monitoring chip 120, the monitored chip 110 can accurately notify the monitoring chip 120 of fault information, and the monitoring chip 120 can then take appropriate protective measures, thereby achieving functional safety protection for the monitored chip 110.

[0042] Exemplary Circuits and Chips Some exemplary embodiments of the present disclosure provide a safety diagnostic communication circuit. The safety diagnostic communication circuit can be applied to a target chip. The target chip can be in two situations: (1) the target chip is a monitored chip, for example, the target chip can be an intelligent driving chip, an image transmission chip, a positioning chip, etc.; (2) the target chip is a monitoring chip, for example, the target chip can be a system microcontroller chip.

[0043] like Figure 2 As shown, the safety diagnostic communication circuit may include: a first register 22, a first verification circuit 24 and a second register 26; When the target chip is a monitored chip and the security diagnosis communication circuit is placed in the first working mode, then: The first register 22 is used to store the original functional safety abnormality information of the monitored chip; The first verification circuit 24 is used to calculate a first verification code corresponding to the original functional safety abnormality information, and generate target functional safety abnormality information based on the original functional safety abnormality information and the first verification code; The second register 26 is used to output target function safety abnormality information, so that the target function safety abnormality information is transmitted from the monitored chip to the monitoring chip.

[0044] Optionally, the first register 22 and the second register 26 may both be high-speed storage units for temporarily storing data, instructions, addresses, and the like.

[0045] Optionally, the first check circuit 24 may be a hardware circuit for implementing data verification. In one example, the first check circuit 24 may be a hardware circuit for implementing a cyclic redundancy check (CRC), and the first check circuit 24 may also be referred to as a CRC engine. In another example, the first check circuit 24 may be a hardware circuit for implementing a parity check.

[0046] It should be noted that the safety diagnostic communication circuit can be configured to include at least a first operating mode, which can be understood as an operating mode for supporting fault information reporting. If the target chip is a monitored chip, the safety diagnostic communication circuit can be placed in the first operating mode. The following describes how the safety diagnostic communication circuit operates in the first operating mode.

[0047] The monitored chip may be equipped with a fault diagnosis circuit that can perform fault diagnosis on the monitored chip using any feasible method to obtain raw functional safety anomaly information about the monitored chip. This raw functional safety diagnosis information may include, but is not limited to, fault source information and fault type. The fault source information may indicate the hardware circuit within the monitored chip that has failed. Fault types may include, but are not limited to, clock faults and power supply faults. This raw functional safety diagnosis information may be stored in the first register 22.

[0048] The first verification circuit 24 can be electrically connected to the first register 22, so that the first verification circuit 24 can obtain the original functional safety diagnostic information in the first register 22. The first verification circuit 24 can calculate a first verification code corresponding to the original functional safety diagnostic information. For example, the first verification circuit 24 can be a CRC engine, which can use a preset CRC polynomial to perform a CRC calculation on the original functional safety diagnostic information to obtain a corresponding CRC verification code. The obtained CRC verification code can be used as the first verification code. The first verification circuit 24 can encapsulate the original functional safety exception information and the first verification code to generate target functional safety exception information. In this case, the target functional safety exception information can be considered to be the original functional safety exception information with the verification information added. Subsequently, the target functional safety exception information can be decapsulated to obtain the original functional safety exception information and the first verification code.

[0049] Of course, the method for generating the target functional safety exception information is not limited to this. For example, the first verification circuit 24 can encapsulate the original functional safety exception information and the first verification code to generate encapsulated information, then encrypt the encapsulated information to obtain encrypted encapsulated information, and use the encrypted encapsulated information as the target functional safety exception information. In this case, the target functional safety exception information can be considered to be the encryption result of the original functional safety exception information with the verification information added. Subsequently, the target functional safety exception information is sequentially decrypted and unpacked to obtain the original functional safety exception information and the first verification code.

[0050] The second register 26 can be electrically connected to the first verification circuit 24, so that the second register 26 can obtain the target function safety exception information generated by the first verification circuit 24. The second register 26 can output the target function safety exception information. The monitored chip can include a transmitting pin and a receiving pin, and the monitoring chip can also include a transmitting pin and a receiving pin. The transmitting pin of the monitored chip can be electrically connected to the receiving pin of the monitoring chip through the first data bus. After the second register 26 outputs the target function safety exception information, the target function safety exception information can first reach the transmitting pin of the monitored chip, and then be transmitted to the receiving pin of the monitoring chip via the first data bus between the transmitting pin of the monitored chip and the receiving pin of the monitoring chip, so that the monitoring chip receives the target function exception information through the receiving pin. Here, the transmitting pin can also be called the Transmit pin or Tx pin, and the receiving pin can also be called the Receive pin or Rx pin.

[0051] In an embodiment of the present disclosure, when the target chip to which the safety diagnostic communication circuit is applied belongs to the monitored chip and the safety diagnostic communication circuit is placed in the first working mode, the target functional safety anomaly information can be transmitted from the monitored chip to the monitoring chip through the coordinated work of the first register 22, the first verification circuit 24 and the second register 26. Since the target functional safety anomaly information is generated based on the original functional safety anomaly information of the monitored chip and the first verification code corresponding to the original functional safety anomaly information, the target functional safety anomaly information can carry both the fault information of the monitored chip and the verification information. Based on the verification information, the monitoring chip can verify the fault information so as to determine whether an error occurred in the transmission process of the fault information based on the verification result, thereby screening out accurate fault information. Therefore, the embodiment of the present disclosure can accurately notify the monitoring chip of the fault information of the monitored chip, which is conducive to improving the stability and reliability of the intelligent driving system.

[0052] In some optional examples, such as Figure 3-1 As shown, the safety diagnosis communication circuit may further include: a first buffer 34; When the safety diagnostic communication circuit is placed in the first working mode, then: The first buffer 34 is used to buffer the target function safety abnormality information generated by the first verification circuit 24; The second register 26 is used to output target function safety abnormality information so that the target function safety abnormality information is transmitted from the monitored chip to the monitoring chip, including: The second register 26 is used to output the target functional safety abnormality information buffered by the first buffer 34 bit by bit to the transmitting pin of the monitored chip, so that each bit of data output to the transmitting pin is transmitted to the receiving pin of the monitoring chip via the first data bus.

[0053] Optionally, the first buffer 34 may be a device that provides a temporary storage space for data transfer, and is generally used to coordinate data transmission between devices with different speeds or timings.

[0054] Optionally, the second register 26 may be a shift register. It is understood that a shift register is a digital circuit that sequentially stores and shifts binary data (e.g., bit by bit to the left or right), and is widely used in scenarios such as data serial-to-parallel conversion, timing control, and signal delay.

[0055] The first buffer 34 can be electrically connected to the first verification circuit 24 so that the first buffer 34 can obtain the target function safety anomaly information generated by the first verification circuit 24 and can cache the target function safety anomaly information. The second register 26 can be electrically connected to the first buffer 34 so that the second register 26 can obtain the target function safety anomaly information cached by the first buffer 34. The second register 26 can output the target function safety anomaly information bit by bit to the transmit pin of the monitored chip. For example, if the target function safety anomaly information includes 16 bits of data, the second register 26 can sequentially output the 16 bits of data to the transmit pin of the monitored chip by shifting them bit by bit left or right. The 16 bits of data can then be sequentially transmitted to the receive pin of the monitoring chip via the first data bus.

[0056] Generally speaking, the target functional safety anomaly information, which carries both fault information and verification information of the monitored chip, includes multiple bits of data. However, a single data bus can only transmit one bit of data at a time. Therefore, the target functional safety anomaly information needs to be transmitted multiple times. In view of this, in the embodiments of the present disclosure, the target functional safety anomaly information including multiple bits of data can be cached by the first buffer 34, and the target functional safety anomaly information cached by the first buffer 34 can be output bit by bit via the second register 26. This is consistent with the operating characteristic of the data bus that can only transmit one bit of data at a time, allowing the target functional safety anomaly information to be fully transmitted to the monitoring chip.

[0057] In some optional examples, such as Figure 3-2 As shown, the safety diagnostic communication circuit may further include: a second verification circuit 32 and a first buffer 34; When the safety diagnostic communication circuit is placed in the first working mode, then: The second verification circuit 32 is used to calculate the second verification code corresponding to the target function safety abnormality information generated by the first verification circuit 24, and write the target function safety abnormality information and the second verification code into the first buffer 34; The second verification circuit 32 is further configured to read the first buffer 34 , and perform verification and error correction on the read target function safety abnormality information based on the read second verification code to obtain the target function safety abnormality information for input into the second register 26 .

[0058] Optionally, the second check circuit 32 may be a hardware circuit for implementing data check and error correction. In one example, the second check circuit 32 may be a hardware circuit for implementing Error Checking and Correction (ECC), and the second check circuit 32 may also be referred to as an ECC engine.

[0059] Optionally, the first buffer 34 may be a device that provides a temporary storage space for data transfer, and is generally used to coordinate data transmission between devices with different speeds or timings.

[0060] The second verification circuit 32 can be electrically connected to the first verification circuit 24 so that the second verification circuit 32 can obtain the target functional safety anomaly information generated by the first verification circuit 24. The second verification circuit 32 can calculate a second verification code corresponding to the target functional safety anomaly information. For example, the second verification circuit 32 can be an ECC engine that can perform ECC calculations on the target functional safety anomaly information to obtain a corresponding ECC verification code, which can be used as the second verification code. The second verification circuit 32 can also be electrically connected to the first buffer 34 so that the second verification circuit 32 can send a write instruction carrying the target functional safety anomaly information and the second verification code to the first buffer 34, causing the first buffer 34 to store the target functional safety anomaly information and the second verification code in response to the received write instruction. The second verification circuit 32 can periodically read the target functional safety anomaly information and the second verification code from the first buffer 34, or the second verification circuit 32 can read the target functional safety anomaly information and the second verification code from the first buffer 34 upon receiving a read trigger signal from the second register 26. The second verification circuit 32 can verify and correct the read target function safety anomaly information based on the read second verification code. The verification and error correction principles herein can be referred to the relevant knowledge of ECC verification in the related art and will not be repeated here. Through this verification and error correction, accurate target function safety anomaly information can be obtained. The second register 26 can be electrically connected to the second verification circuit 32. In this way, the accurate target function safety anomaly information obtained by the second verification circuit 32 can be input into the second register 26, so that the second register 26 outputs the accurate target function safety anomaly information bit by bit. This allows the accurate target function safety anomaly information to be transmitted from the monitored chip to the monitoring chip, thereby more accurately notifying the monitoring chip of the fault information of the monitored chip.

[0061] In some optional examples, when the target chip is a monitoring chip and the safety diagnostic communication circuit is placed in the second working mode, then: The second register 26 is used to receive target function safety abnormality information transmitted from the monitored chip to the monitoring chip; The first verification circuit 24 is used to obtain the original functional safety abnormality information of the monitored chip and a first verification code corresponding to the original functional safety abnormality information based on the target functional safety abnormality information, and verify the original functional safety abnormality information based on the first verification code to obtain a verification result; In response to the verification result indicating that the verification of the original functional safety abnormality information is passed, the first register 22 is used to store the original functional safety abnormality information.

[0062] It should be noted that in addition to the first operating mode, the safety diagnostic communication circuit can also be configured to include a second operating mode, which can be understood as an operating mode for supporting fault information collection. If the target chip is a monitoring chip, the safety diagnostic communication circuit can be placed in the second operating mode. The following describes how the safety diagnostic communication circuit operates in the second operating mode.

[0063] The second register 26 can be electrically connected to the receiving pin of the monitoring chip, so that the second register 26 can obtain the target function safety abnormality information transmitted from the monitored chip to the receiving pin of the monitoring chip, and the target function safety abnormality information can be stored in the second register 26.

[0064] The first verification circuit 24 can decapsulate (or decrypt and decapsulate in sequence) the target functional safety exception information to obtain the original functional safety exception information of the monitored chip and a first verification code corresponding to the original functional safety exception information. The first verification circuit 24 can verify the original functional safety exception information based on the first verification code to obtain a verification result. For example, the first verification circuit 24 can be a CRC engine that can perform a CRC calculation on the original functional safety exception information using a preset CRC polynomial to obtain a corresponding CRC verification code. The obtained CRC verification code is then compared with the CRC verification code serving as the first verification code. If the comparison determines that the two CRC verification codes are identical, the verification result can be used to indicate that verification of the original functional safety exception information has passed. If the comparison determines that the two CRC verification codes are different, the verification result can be used to indicate that verification of the original functional safety exception information has failed.

[0065] The first verification circuit 24 can be electrically connected to the first register 22. If the verification result indicates that the original functional safety exception information has passed verification, indicating that no errors occurred during the transmission of the original functional safety exception information, then the first register 22 can obtain the original functional safety exception information from the first verification circuit 24 and store it. The monitoring chip can then take appropriate protective measures based on the original functional safety exception information stored in the first register 22. If the verification result indicates that the original functional safety exception information has passed verification, indicating that an error occurred during the transmission of the original functional safety exception information, the first register 22 may not store the original functional safety exception information and may discard it.

[0066] In the embodiment of the present disclosure, the target chip to which the safety diagnostic communication circuit is applied is a monitoring chip. The safety diagnostic communication circuit is placed in a second operating mode. Through the coordinated operation of the first register 22, the first verification circuit 24, and the second register 26, the second register 26 can store accurate and original functional safety anomaly information. The monitoring chip can then take appropriate protective measures based on this information to effectively implement functional safety protection for the monitored chip, thereby improving the stability and safety of the intelligent driving system. It can be seen that in the embodiment of the present disclosure, the safety diagnostic communication circuit can be applied not only to monitored chips but also to monitoring chips. It is only necessary to adapt the operating mode of the safety diagnostic communication circuit. Therefore, the safety diagnostic communication circuit has good versatility.

[0067] In some optional examples, such as Figure 4-1 As shown, the safety diagnosis communication circuit may further include: a second buffer 44; When the safety diagnostic communication circuit is placed in the second working mode, then: The second register 26 is used to receive target function safety abnormality information transmitted from the monitored chip to the monitoring chip, including: The second register 26 is used to receive target function safety abnormality information transmitted from the transmitting pin of the monitored chip to the receiving pin of the monitoring chip via the first data bus bit by bit; The second buffer 44 is used to buffer each bit of data received by the second register 26 until all target function safety exception information is buffered; The first verification circuit 24 is used to obtain the original functional safety abnormality information of the monitored chip and the first verification code corresponding to the original functional safety abnormality information based on the target functional safety abnormality information, including: The first verification circuit 24 is configured to obtain original functional safety abnormality information and a first verification code based on all target functional safety abnormality information cached in the second buffer 44 .

[0068] Optionally, the second buffer 44 may be a device that provides a temporary storage space for data transfer, and is generally used to coordinate data transmission between devices with different speeds or timings.

[0069] Alternatively, the second register 26 may be a shift register.

[0070] As introduced above, the monitored chip can transmit the target function safety exception information to the monitoring chip bit by bit via the first data bus. Accordingly, the receiving pin of the monitoring chip can receive the target function safety exception information bit by bit. The target function safety exception information can also be transmitted bit by bit by the receiving pin of the monitoring chip to the second register 26. Then, the second register 26 can receive the target function safety exception information bit by bit.

[0071] The second buffer 44 can be electrically connected to the second register 26. After receiving each bit of data, the second register 26 can transfer this bit of data to the second buffer 44 for caching. Thus, after a period of time, the second buffer 44 will cache all bits of data included in the target function safety anomaly information. In other words, the second buffer 44 will cache all the target function safety anomaly information. The first verification circuit 24 can be electrically connected to the second buffer 44. Thus, the first verification circuit 24 can obtain all the target function safety anomaly information cached in the second buffer 44. The first verification circuit 24 can decapsulate and subsequently process all the target function safety anomaly information cached in the second buffer 44. For details, please refer to the relevant description above and will not be repeated here.

[0072] Generally speaking, the target functional safety anomaly information that carries both the fault information and verification information of the monitored chip includes multiple bits of data, and a single data bus can only transmit one bit of data at a time. Therefore, the target functional safety anomaly information needs to be transmitted multiple times. In view of this, in the embodiment of the present disclosure, the target functional safety anomaly information can be received bit by bit through the second register 26, and each bit of data received by the second register 26 can be cached through the second buffer 44 until all the target functional safety anomaly information is cached, so that the first verification circuit 24 can decapsulate and perform subsequent processing based on all the target functional safety anomaly information cached by the second buffer 44. This is consistent with the working characteristic that the data bus can only transmit one bit of data at a time, so that the monitoring chip can obtain complete and accurate original functional safety anomaly information. On this basis, the functional safety protection of the monitored chip can be effectively achieved.

[0073] In some optional examples, such as Figure 4-2 As shown, the safety diagnosis communication circuit may further include: a third verification circuit 42 and a second buffer 44; wherein, When the safety diagnostic communication circuit is placed in the second working mode, then: The third check circuit 42 is used to calculate the third check code corresponding to the target function safety abnormality information received by the second register 26, and write the target function safety abnormality information and the third check code into the second buffer 44; The third verification circuit 42 is further used to read the second buffer 44 , and based on the read third verification code, verify and correct the read target function safety abnormality information to obtain the target function safety abnormality information for input into the first verification circuit 24 .

[0074] Optionally, the third check circuit 42 may be a hardware circuit for implementing data check and error correction. In one example, the third check circuit 42 may be a hardware circuit for implementing ECC check, and the third check circuit 42 may also be referred to as an ECC engine.

[0075] Optionally, the second buffer 44 may be a device that provides a temporary storage space for data transfer, and is generally used to coordinate data transmission between devices with different speeds or timings.

[0076] The third verification circuit 42 can be electrically connected to the second register 26 so that it can obtain the target functional safety anomaly information received by the second register 26. The third verification circuit 42 can calculate a third verification code corresponding to the target functional safety anomaly information. For example, the third verification circuit 42 can be an ECC engine that performs ECC calculations on the target functional safety anomaly information to obtain a corresponding ECC verification code, which can be used as the third verification code. The third verification circuit 42 can also be electrically connected to the second buffer 44 so that the third verification circuit 42 can send a write instruction carrying the target functional safety anomaly information and the third verification code to the second buffer 44, causing the second buffer 44 to store the target functional safety anomaly information and the third verification code in response to the received write instruction. The third verification circuit 42 can be electrically connected to the first verification circuit 24. The third verification circuit 42 can periodically read the target functional safety anomaly information and the third verification code from the second buffer 44, or the third verification circuit 42 can read the target functional safety anomaly information and the third verification code from the second buffer 44 upon receiving a read trigger signal from the first verification circuit 24. The third check circuit 42 can check and correct the read target function safety anomaly information based on the read third check code. The check and error correction principle here can refer to the relevant knowledge of ECC check in the relevant technology, which will not be repeated here. Through the check and error correction here, accurate target function safety anomaly information can be obtained. The accurate target function safety anomaly information obtained by the third check circuit 42 can be input into the first check circuit 24. At this time, the first check circuit 24 can decapsulate and subsequently process the accurate target function safety anomaly information. Please refer to the relevant introduction above for details, which will not be repeated here. In this way, through the setting of the third check circuit 42 and the second buffer 44, the accuracy of the target function safety anomaly information input into the first check circuit 24 can be improved. On this basis, it is beneficial to improve the accuracy of the original functional safety anomaly information subsequently stored in the first register 22, thereby helping to improve the accuracy of the fault information referenced by the monitoring chip when executing protection measures.

[0077] In some optional examples, such as Figure 5 As shown, the safety diagnostic communication circuit may further include: a configuration circuit 52; The configuration circuit 52 is used to obtain mode configuration information, determine the target operating mode of the safety diagnostic communication circuit based on the mode configuration information, and configure at least the first register 22, the first verification circuit 24 and the second register 26 based on the target operating mode; wherein the target operating mode is one of the first operating mode and the second operating mode.

[0078] Optionally, the mode configuration information can be used to indicate whether the safety diagnostic communication circuit is placed in the first operating mode or the second operating mode. For example, if the mode configuration information is "master," this indicates that the target chip functions as the master chip, and the safety diagnostic communication circuit requires assistance in fault information collection. In this case, the target operating mode can be the first operating mode. For another example, if the mode configuration information is "slave," this indicates that the target chip functions as a slave chip, and the safety diagnostic communication circuit requires assistance in fault information reporting. In this case, the target operating mode can be the second operating mode.

[0079] Alternatively, the configuration circuit 52 may be a circuit for performing basic configuration of the safety diagnostic communication circuit.

[0080] The configuration circuit 52 can be electrically connected to the first register 22, the first verification circuit 24, and the second register 26, respectively. Thus, the configuration circuit 52 can configure the first register 22, the first verification circuit 24, and the second register 26 based on the target operating mode. For example, configuration parameters can be written into the first register 22, the first verification circuit 24, and the second register 26 to cause the first register 22, the first verification circuit 24, and the second register 26 to operate in the target operating mode. The operating logic of the first register 22, the first verification circuit 24, and the second register 26 in the first operating mode and the second operating mode can be referred to above and will not be further described here.

[0081] In some optional examples, such as Figure 5 As shown, the safety diagnostic communication circuit may further include: a configuration circuit 52; The configuration circuit 52 is used to obtain algorithm configuration information, determine the target verification algorithm type to be used by the first verification circuit 24 based on the algorithm configuration information, and configure the first verification circuit 24 based on the target verification algorithm type.

[0082] Optionally, the algorithm configuration information may be used to indicate the target check algorithm to be used. For example, if the configuration parameter in the algorithm configuration information is 16, it indicates that the target check algorithm to be used is CRC16; if the configuration parameter in the algorithm configuration information is 32, it indicates that the target check algorithm to be used is CRC32.

[0083] Alternatively, the configuration circuit 52 may be a circuit for performing basic configuration of the safety diagnostic communication circuit.

[0084] The configuration circuit 52 can be electrically connected to the first verification circuit 24. Thus, the configuration circuit 52 can configure the first verification circuit 24 according to the target verification algorithm type. For example, the configuration parameters in the algorithm configuration information can be written into the first verification circuit 24 so that the first verification circuit 24 uses the target verification algorithm type when operating. Thus, when the first verification circuit 24 calculates the second verification code corresponding to the target functional safety anomaly information, if the target verification algorithm is CRC16, the second verification code can be a 2-byte CRC check code; if the target verification algorithm is CRC32, the second verification code can be a 4-byte CRC check code. Thus, by configuring the configuration circuit 52, the verification algorithm type used by the first verification circuit 24 during operation can be flexibly set according to actual needs.

[0085] In some optional examples, the safety diagnostic communication circuit can be configured to include a first operating mode and a second operating mode, such as Figure 6 As shown, the safety diagnostic communication circuit may include a first register 22 , a first verification circuit 24 , a second register 26 , a second verification circuit 32 , a first buffer 34 , a third verification circuit 42 , a second buffer 44 and a configuration circuit 52 .

[0086] If the target chip to which the safety diagnostic communication circuit is applied is a monitored chip, the configuration circuit 52 can configure the first register 22, the first verification circuit 24, the second register 26, the second verification circuit 32, the first buffer 34, the third verification circuit 42, the second buffer 44, etc. to place the entire safety diagnostic communication circuit in a first operating mode. In the first operating mode, the first register 22 can store the original functional safety exception information of the monitored chip; the first verification circuit 24 can calculate a first verification code corresponding to the original functional safety exception information and generate target functional safety exception information based on the original functional safety exception information and the first verification code; the second verification circuit 32 and the first buffer 34 can work together to enable the first buffer 34 to input accurate target functional safety exception information to the second register 26; and the second register 26 can output the target functional safety exception information, so that the target functional safety exception information is transmitted from the monitored chip to the monitoring chip.

[0087] If the target chip used by the safety diagnostic communication circuit is a monitoring chip, the configuration circuit 52 can configure the first register 22, the first verification circuit 24, the second register 26, the second verification circuit 32, the first buffer 34, the third verification circuit 42, the second buffer 44, and so on, to place the entire safety diagnostic communication circuit in a second operating mode. In the second operating mode, the second register 26 can receive target function safety anomaly information transmitted from the monitored chip to the monitoring chip; the third verification circuit 42 and the second buffer 44 can work together to enable the second buffer 44 to input accurate target function safety anomaly information to the first verification circuit 24; the first verification circuit 24 can obtain accurate original functional safety anomaly information based on the accurate target function safety anomaly information; and the first register 22 can store accurate original functional safety anomaly information.

[0088] In some embodiments, when the target chip to which the safety diagnostic communication circuit is applied is a monitored chip, the safety diagnostic communication circuit can be configured to include only the first operating mode; when the target chip to which the safety diagnostic communication circuit is applied is a monitoring chip, the safety diagnostic communication circuit can be configured to include only the second operating mode.

[0089] In summary, the embodiments of the present disclosure can accurately notify the monitoring chip of the fault information of the monitored chip, so that the monitoring chip can take corresponding protection measures in a timely manner, thereby effectively achieving functional safety protection of the monitored chip, thereby improving the stability and safety of the intelligent driving system.

[0090] The present disclosure also provides a target chip including the safety diagnostic communication circuit of any of the aforementioned embodiments. The implementation of the safety diagnostic communication circuit can be found in the relevant description above and will not be further elaborated here. Since the safety diagnostic communication circuit has the aforementioned technical effects, the target chip including the safety diagnostic communication circuit also has the corresponding technical effects and will not be further elaborated here.

[0091] Exemplary Systems Figure 7-1 : is a schematic diagram of the structure of a security diagnostic communication system provided by some exemplary embodiments of the present disclosure, including: A monitored chip 110 and a monitoring chip 120; Among them, the monitored chip 110 includes the above-mentioned safety diagnostic communication circuit placed in the first working mode, and the monitoring chip 120 includes the above-mentioned safety diagnostic communication circuit placed in the second working mode. The monitoring chip 120 is used to perform preset safety protection operations for the monitored chip 110 based on the original functional safety exception information stored in the first register 22 in the included safety diagnostic communication circuit.

[0092] Optionally, the specific implementations of the safety diagnostic communication circuits respectively included in the monitored chip 110 and the monitoring chip 120 may refer to the relevant introduction above and will not be repeated here.

[0093] Optionally, the monitoring chip 120 is configured to perform a preset safety protection operation on the monitored chip 110 based on the original functional safety abnormality information stored in the first register 22 in the included safety diagnostic communication circuit, which may include: The monitoring chip 120 is configured to control a reset or power-off of any circuit in the monitored chip 110 in response to the original functional safety abnormality information stored in the first register 22 in the included safety diagnostic communication circuit indicating that an error has occurred in the circuit; or, The monitoring chip 120 is configured to control the entire monitored chip 110 to reset or power off in response to the original functional safety abnormality information stored in the first register 22 of the included safety diagnostic communication circuit indicating that an error has occurred in any circuit of the monitored chip 110 .

[0094] In an embodiment of the present disclosure, based on the safety diagnostic communication circuits respectively provided in the monitored chip 110 and the monitoring chip 120, the monitored chip 110 can accurately notify the monitoring chip 120 of fault information, and the monitoring chip 120 can take corresponding protection measures, such as controlling the reset or power-off of the monitored chip 110, etc., which is conducive to achieving functional safety protection of the monitored chip 110, thereby improving the stability and safety of the intelligent driving system.

[0095] In some optional examples, such as Figure 7-2 As shown, the monitoring chip 120 is configured to determine a target monitored chip from the plurality of monitored chips 110 in response to a plurality of monitored chips 110, and output a selection signal from a first selection pin of the monitoring chip 120 corresponding to the target monitored chip, so that the selection signal is transmitted to a second selection pin of the target monitored chip via a second data bus; The target monitored chip is configured to control the second register 26 in the safety diagnosis and communication circuit included in the target monitored chip to output target function safety abnormality information in response to receiving a selection signal from the second selection pin.

[0096] Optionally, the multiple monitored chips 110 can be three monitored chips 110, one of which can be an intelligent driving chip, another monitored chip 110 can be an image transmission chip, and another monitored chip 110 can be a positioning chip. Here, the intelligent driving chip, the image transmission chip, and the positioning chip can be arranged in the intelligent driving system of the same vehicle. The image transmission chip can transmit the environmental image outside the vehicle to the intelligent driving chip, and the positioning chip can transmit the positioning information of the vehicle to the intelligent driving chip. The intelligent driving chip can perform environmental perception based on the environmental image and positioning information, and control the driving of the vehicle based on the environmental perception results. Of course, the multiple monitored chips 110 can also be two monitored chips 110, four monitored chips 110, or a larger number of monitored chips 110, which are not listed one by one here.

[0097] Optionally, the monitoring chip 120 may select a monitored chip 110 as a target monitored chip from the multiple monitored chips 110 according to a preset selection rule. For example, the monitoring chip 120 may collect fault information of the multiple monitored chips 110 in turn. Here, the monitoring chip 120 may first collect fault information of the intelligent driving chip, then collect fault information of the image transmission chip, then collect fault information of the positioning chip, and then collect fault information of the intelligent driving chip, and so on. Accordingly, the monitoring chip 120 may first use the intelligent driving chip as the target monitored chip, and after collecting the fault information of the intelligent driving chip, the image transmission chip may be used as the target monitored chip, and after collecting the fault information of the image transmission chip, the positioning chip may be used as the target monitored chip, and after collecting the fault information of the positioning chip, the intelligent driving chip may be used as the target monitored chip again, and so on.

[0098] In an embodiment of the present disclosure, the monitoring chip 120 may include a receiving pin and a plurality of first selection pins corresponding one-to-one to the plurality of monitored chips 110. Each of the plurality of monitored chips 110 may include a second selection pin and a transmitting pin. The transmitting pin of each monitored chip 110 may be electrically connected to the receiving pin of the monitoring chip 120 via a first data bus, and the second selection pin of each monitored chip 110 may be electrically connected to the first selection pin corresponding to the second selection pin of the monitoring chip 120 via a second data bus. Optionally, the first selection pin and the second selection pin may be referred to as Chip Select pins or CS pins; the first data bus may be, for example, referred to as a CS pin. Figure 7-1 The data bus from the Tx pin to the Rx pin; the second data bus can be seen, for example Figure 7-1 A data bus that points from one CS pin to another CS pin.

[0099] If the monitoring chip 120 needs to collect fault information of a monitored chip 110 among multiple monitored chips 110, the monitoring chip 120 can determine the monitored chip 110 as a target monitored chip, and output a selection signal from a first selection pin corresponding to the target monitored chip among multiple first selection pins included in the monitoring chip 120. The selection signal is a signal used to indicate that the target monitored chip is selected. The selection signal can be, for example, a high-level signal. The selection signal can be transmitted to the second selection pin of the target monitored chip via a second data bus between the first selection pin and the second selection pin of the target monitored chip.

[0100] In response to receiving a selection signal through the second selection pin of the target monitored chip, the target monitored chip can determine that it needs to report fault information. Therefore, the second register 26 in the safety diagnostic communication circuit included in the target monitored chip can output the target function safety exception information, such as outputting the target function safety exception information bit by bit, thereby enabling the target function safety exception information to be transmitted to the monitoring chip 120 via the corresponding first data bus, thereby enabling the monitoring chip 120 to collect the fault information of the target monitored chip.

[0101] In an embodiment of the present disclosure, when there are multiple monitored chips 110, the monitoring chip 120 can independently select a target monitored chip from them, and by sending a selection signal to the target monitored chip, it can prompt the target monitored chip to report fault information, thereby enabling the monitoring chip 120 to efficiently and reliably collect fault information of the target monitored chip.

[0102] In some optional examples, the monitoring chip 120 is configured to output a query request from a first request pin of the monitoring chip 120 , so that the query request is transmitted to a second request pin of the monitored chip 110 via the third data bus; The monitored chip 110 is configured to, in response to receiving the query request from the second request pin, output preparation completion notification information from the first preparation pin of the monitored chip 110 after buffering the target function safety abnormality information in the first buffer in the safety diagnostic communication circuit included in the monitored chip 110, so that the preparation completion notification information is transmitted to the second preparation pin of the monitoring chip 120 via the fourth data bus; The monitoring chip 120 is configured to receive target function safety abnormality information from the monitored chip 110 through a receiving pin of the monitoring chip 120 in response to receiving the preparation completion notification information from the second preparation pin.

[0103] Optionally, the monitoring chip 120 may include a first request pin and a second ready pin, and the monitored chip 110 may include a second request pin and a first ready pin. The second request pin of the monitored chip 110 may be electrically connected to the first request pin of the monitoring chip 120 via a third data bus, and the first ready pin of the monitored chip 110 may be electrically connected to the second ready pin of the monitoring chip 120 via a fourth data bus. Here, the first request pin and the second request pin may both be referred to as request pins or REQ pins; the first ready pin and the second ready pin may be referred to as ready pins or RDY pins; the third data bus may be, for example, referred to as Figure 7-2 A data bus from one REQ pin to another REQ pin; for example, the fourth data bus can be seen in Figure 7-2 A data bus that points from one RDY pin to another RDY pin.

[0104] If the monitoring chip 120 needs to collect fault information of the monitored chip 110, the monitoring chip 120 can generate a query request, which can be a request for querying fault information. The monitoring chip 120 can output the query request from the first request pin, so that the query request can be transmitted to the second request pin of the monitored chip 110 via the third data bus.

[0105] In response to the second request pin of the monitored chip 110 receiving the query request, the monitored chip 110 may prepare fault information. For example, through the coordinated operation of the first register 22, the first verification circuit 24, the first buffer 34, and the like in the safety diagnostic communication circuit included in the monitored chip 110, the first buffer 34 may cache the target functional safety anomaly information. At this point, the monitored chip 110 may generate preparation completion notification information indicating that preparation of the fault information has been completed. The monitored chip 110 may output the preparation completion notification information from the first preparation pin. In this way, the preparation completion notification information may be transmitted to the second preparation pin of the monitoring chip 120 via the fourth data bus. In addition, the second register 26 in the safety diagnostic communication circuit included in the monitored chip 10 may output the target functional safety anomaly information cached in the first buffer 34.

[0106] In response to receiving the preparation completion notification information from the second preparation pin, the monitoring chip 120 can determine that the monitored chip 110 is ready for the fault information to be reported. Then, the monitoring chip 120 can receive the target functional safety exception information from the monitored chip 110 through the receiving pin, that is, the monitoring chip 120 can successfully collect the fault information of the monitored chip 110.

[0107] In an embodiment of the present disclosure, the monitoring chip 120 can trigger the monitored chip 110 to prepare fault information by sending a query request to the monitored chip 110. Upon receiving the preparation completion notification information from the monitored chip 110, the monitoring chip 120 receives the information through the receiving pin, thereby effectively collecting the fault information of the monitored chip 110.

[0108] In some optional examples, the monitored chip 110 is configured to output abnormality notification information from the first ready pin of the monitored chip 110 in response to a functional safety abnormality of the monitored chip 110, so that the abnormality notification information is transmitted to the second ready pin of the monitoring chip 120 via the fourth data bus; The monitoring chip 120 is configured to output a query request from the first request pin of the monitoring chip 120 in response to receiving the abnormality notification information from the second preparation pin, so that the query request is transmitted to the second request pin of the monitored chip 110 via the third data bus; The monitored chip 110 is configured to control the second register 26 in the safety diagnosis and communication circuit included in the monitored chip 110 to output target function safety abnormality information in response to receiving the query request from the second request pin.

[0109] Optionally, the monitoring chip 120 may include a first request pin and a second preparation pin, the monitored chip 110 may include a second request pin and a first preparation pin, the second request pin of the monitored chip 110 may be electrically connected to the first request pin of the monitoring chip 120 via a third data bus, and the first preparation pin of the monitored chip 110 may be electrically connected to the second preparation pin of the monitoring chip 120 via a fourth data bus.

[0110] As described above, the monitored chip 110 may be provided with a fault diagnosis circuit. Based on the operation of the fault diagnosis circuit, the monitored chip 110 can determine whether the monitored chip 110 has a functional safety anomaly (i.e., whether it has a fault). If the monitored chip 110 has a functional safety anomaly, the monitored chip 110 can generate anomaly notification information indicating the presence of the functional safety anomaly and output the anomaly notification information from the first ready pin. This anomaly notification information can then be transmitted via the fourth data bus to the second ready pin of the monitoring chip 120.

[0111] In response to the second preparation pin of the monitoring chip 120 receiving the abnormal notification information, the monitoring chip 120 can determine that there is a fault in the monitored chip 110, and therefore needs to collect the fault information of the monitored chip 110. In view of this, the monitoring chip 120 can generate a query request and output the query request from the first request pin. In this way, the query request can be transmitted to the second request pin of the monitored chip 110 via the third data bus.

[0112] In response to receiving a query request from the second request pin, the monitored chip 110 can control the second register 26 in the safety diagnostic communication circuit included in the monitored chip 110 to read the target function safety exception information from the first buffer 34, and output the target function safety exception information bit by bit. In this way, the monitoring chip 120 can receive the target function safety exception information from the monitored chip 110 through the receiving pin, that is, the monitoring chip 120 can successfully collect the fault information of the monitored chip 110.

[0113] In the embodiment of the present disclosure, the monitored chip 110 can proactively notify the monitoring chip 120 when a functional safety anomaly occurs. The monitoring chip 120 can trigger the monitored chip 110 to report fault information by sending a query request to the monitored chip 110 .

[0114] In some optional examples, the monitoring chip 120 is configured to output a clock signal from a first clock pin of the monitoring chip 120 , so that the clock signal is transmitted to a second clock pin of the monitored chip 110 via the fifth data bus; The monitored chip 110 is configured to, in response to receiving a clock signal from the second clock pin, determine the received clock signal as an operating clock signal of a safety diagnosis and communication circuit included in the monitored chip 110 .

[0115] Optionally, the monitoring chip 120 may include a first clock pin, and the monitored chip 110 may include a second clock pin. The first clock pin of the monitoring chip 120 may be electrically connected to the second clock pin of the monitored chip 110 via a fifth data bus. Here, the first clock pin and the second clock pin may be referred to as Clock pins or CLK pins; the fifth data bus may be, for example, Figure 7-2 A data bus that points from one CLK pin to another CLK pin.

[0116] In an embodiment of the present disclosure, the monitoring chip 120 can output a clock signal from a first clock pin. The clock signal output by the monitoring chip 120 can be, for example, a clock signal generated by a clock source in the monitoring chip 120. The clock signal output by the monitoring chip 120 can be transmitted to a second clock pin of the monitored chip 110 via a fifth data bus. The monitored chip 110 can determine the received clock signal as an operating clock signal for a safety diagnostic communication circuit included in the monitored chip 110. For example, the monitored chip 110 can distribute the received clock signal to the first register 22, the first verification circuit 24, the second register 26, the second verification circuit 32, the first buffer 34, and the configuration circuit 52 in the safety diagnostic communication circuit included in the monitored chip 110, so that the first register 22, the first verification circuit 24, the second register 26, the second verification circuit 32, the first buffer 34, and the configuration circuit 52 in the safety diagnostic communication circuit included in the monitored chip 110 all operate according to the clock signal.

[0117] In an embodiment of the present disclosure, the monitoring chip 120 can provide a clock signal to the monitored chip 110 so that each device and each circuit in the safety diagnostic communication circuit included in the monitored chip 110 operates according to the clock signal, that is, each device and each circuit in the safety diagnostic communication circuit can operate according to the same timing reference, and therefore, the safety diagnostic communication circuit can operate normally and reliably.

[0118] Exemplary Methods Some exemplary embodiments of the present disclosure provide a secure diagnostic communication method. The secure diagnostic communication method can be applied to a secure diagnostic communication circuit. The specific implementation of the secure diagnostic communication circuit can be referred to the relevant introduction above and will not be repeated here.

[0119] When the target chip to which the safety diagnosis communication circuit is applied is a monitored chip and the safety diagnosis communication circuit is placed in the first working mode, such as Figure 8 As shown, the safety diagnostic communication method may include: Step 810: storing original functional safety exception information of the monitored chip in a first register; Step 820: Calculate a first verification code corresponding to the original functional safety exception information through a first verification circuit, and generate target functional safety exception information based on the original functional safety exception information and the first verification code; Step 830: Output the target function safety abnormality information through the second register, so that the target function safety abnormality information is transmitted from the monitored chip to the monitoring chip.

[0120] In some optional examples, such as Figure 9As shown, when the safety diagnostic communication circuit is placed in the first working mode, the method provided by the embodiment of the present disclosure further includes: Step 910: Calculate, by a second verification circuit, a second verification code corresponding to the target function safety abnormality information generated by the first verification circuit, and write the target function safety abnormality information and the second verification code into a first buffer; Step 920 , reading the first buffer through the second verification circuit, and performing verification and error correction on the read target function safety exception information based on the read second verification code to obtain the target function safety exception information for inputting into the second register.

[0121] In some optional examples, such as Figure 10 As shown, when the safety diagnostic communication circuit is placed in the first working mode, the method provided by the embodiment of the present disclosure further includes: Step 1010: Buffering target function safety exception information generated by a first verification circuit in a first buffer; Step 830 includes: Step 1020: Output the target functional safety exception information cached in the first buffer bit by bit to the transmitting pin of the monitored chip through the second register, so that each bit of data output to the transmitting pin is transmitted to the receiving pin of the monitoring chip via the first data bus.

[0122] In some optional examples, when the target chip is a monitored chip and the security diagnosis communication circuit is placed in the first working mode, such as Figure 11 As shown, the method provided by the embodiment of the present disclosure also includes: Step 1110: receiving target function safety abnormality information transmitted from the monitored chip to the monitoring chip through the second register; Step 1120: Obtaining, by a first verification circuit, original functional safety exception information of the monitored chip and a first verification code corresponding to the original functional safety exception information based on the target functional safety exception information, and verifying the original functional safety exception information based on the first verification code to obtain a verification result. Step 1130 : In response to the verification result indicating that the verification of the original functional safety exception information is passed, the original functional safety exception information is stored in a first register.

[0123] In some optional examples, such as Figure 12 As shown, when the safety diagnostic communication circuit is placed in the second working mode, the method provided by the embodiment of the present disclosure further includes: Step 1210: Calculate, by a third verification circuit, a third verification code corresponding to the target function safety exception information received by the second register, and write the target function safety exception information and the third verification code into the second buffer; Step 1220 , reading the second buffer through the third verification circuit, and verifying and correcting the read target function safety abnormality information based on the read third verification code to obtain the target function safety abnormality information for input into the first verification circuit.

[0124] In some optional examples, such as Figure 13 As shown, when the safety diagnostic communication circuit is placed in the second working mode, then: Step 1110 includes: Step 1310: Receive target function safety exception information transmitted from a transmitting pin of the monitored chip to a receiving pin of the monitoring chip via a first data bus bit by bit through a second register; Step 1320 , buffering each bit of data received by the second register in the second buffer until all target function safety exception information is buffered; Step 1120 includes: Step 1330 : Obtain original functional safety exception information and a first verification code based on all target functional safety exception information cached in the second buffer by the first verification circuit.

[0125] In some optional examples, such as Figure 14-1 As shown, the method provided by the embodiment of the present disclosure also includes: Step 1410, obtaining mode configuration information; Step 1420 , determining a target operating mode of the safety diagnostic communication circuit based on the mode configuration information; Step 1430 : Based on a target operating mode, configure at least a first register, a first verification circuit, and a second register; wherein the target operating mode is one of the first operating mode and the second operating mode.

[0126] In some optional examples, such as Figure 14-2 As shown, the method provided by the embodiment of the present disclosure also includes: Step 1440, obtaining algorithm configuration information; Step 1450 , determining a target verification algorithm type to be used by the first verification circuit based on the algorithm configuration information; Step 1460: Configure the first verification circuit based on the target verification algorithm type.

[0127] In some optional examples, the monitored chip may be an intelligent driving chip, and the monitoring chip may be a system microcontroller chip. Figure 15-1As shown, if the intelligent driving chip fails, the diagnostic information of the intelligent driving chip (the diagnostic information is equivalent to the original functional safety exception information mentioned above) can be stored in the first register; the original functional safety exception information can be calculated by the CRC engine to obtain a CRC check code; then the diagnostic information with the CRC check code can be cached by the first buffer (the diagnostic information with the CRC check code is equivalent to the target functional safety exception information mentioned above); then the diagnostic information with the CRC check code cached in the first buffer can be output through the second register, so that the diagnostic information with the CRC check code is transmitted from the intelligent driving chip to the system microcontroller chip; the system microcontroller chip can verify the received diagnostic information based on the received CRC check code.

[0128] It should be noted that Figure 15-1 The embodiment shown introduces the situation where the intelligent driving chip actively reports diagnostic information to the system microcontroller chip. In specific implementation, the system microcontroller chip can also trigger the intelligent driving chip, so that the intelligent driving chip reports fault information under the triggering of the system microcontroller chip. For details, please refer to Figure 15-2 The embodiment shown, Figure 15-2 The embodiment shown is Figure 15-1 The illustrated embodiments have many similarities, which will not be described in detail here.

[0129] In the method disclosed herein, various optional embodiments, optional implementations and optional examples disclosed in the exemplary circuit and chip sections above may be flexibly selected and combined as needed to achieve corresponding functions and effects, and are not listed one by one in this disclosure.

[0130] Exemplary electronic devices Figure 16 16. A block diagram of an electronic device according to an embodiment of the present disclosure is shown. The electronic device 1600 includes one or more processors 1610 and a memory 1620.

[0131] The processor 1610 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 1600 to perform desired functions.

[0132] Memory 1620 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), a hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and processor 1610 may execute one or more computer program instructions to implement the methods of the various embodiments of the present disclosure described above and / or other desired functions.

[0133] In one example, the electronic device 1600 may further include an input device 1630 and an output device 1640 , and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0134] The input device 1630 may also include, for example, a keyboard, a mouse, and the like.

[0135] The output device 1640 can output various information to the outside, and may include, for example, a display, a speaker, a printer, a communication network and its connected remote output device, etc.

[0136] Of course, to simplify, Figure 16 Only some of the components related to the present disclosure in the electronic device 1600 are shown, and components such as buses, input / output interfaces, etc. are omitted. In addition, the electronic device 1600 may further include any other appropriate components according to specific application scenarios.

[0137] Exemplary computer program products and computer-readable storage media In addition to the above-mentioned methods and devices, an embodiment of the present disclosure may also be a computer program product, which includes computer program instructions that, when executed by a processor, enable the processor to perform the steps of the method according to various embodiments of the present disclosure described in the above-mentioned "Exemplary Method" section of this specification.

[0138] The computer program product may be written in any combination of one or more programming languages ​​to implement the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, and conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's computing device, as a stand-alone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0139] In addition, an embodiment of the present disclosure may also be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, causes the processor to execute the steps of the method according to various embodiments of the present disclosure described in the above “Exemplary Method” section of this specification.

[0140] The computer-readable storage medium may be any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may include, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0141] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and non-limiting, and should not be construed as necessarily possessed by each embodiment of the present disclosure. The specific details disclosed above are provided for illustrative purposes and to facilitate understanding, and are not intended to be limiting. The above details do not limit the present disclosure to necessarily being implemented using the above specific details.

[0142] Those skilled in the art may make various changes and modifications to the present disclosure without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present disclosure and their equivalents, the present disclosure is intended to include these modifications and variations.

Claims

1. A secure diagnostic communication circuit, applied to a target chip, comprising: a first register, a first verification circuit, and a second register; When the target chip is a monitored chip and the safety diagnosis communication circuit is placed in the first working mode, then: The first register is used to store the original functional safety exception information of the monitored chip; The first verification circuit is used to calculate a first verification code corresponding to the original functional safety exception information, and generate target functional safety exception information based on the original functional safety exception information and the first verification code; The second register is used to output the target function safety exception information, so that the target function safety exception information is transmitted from the monitored chip to the monitoring chip.

2. The safety diagnostic communication circuit according to claim 1, further comprising: a second checking circuit and a first buffer; When the safety diagnostic communication circuit is placed in the first operating mode, then: The second verification circuit is used to calculate a second verification code corresponding to the target function safety abnormality information generated by the first verification circuit, and write the target function safety abnormality information and the second verification code into the first buffer; The second verification circuit is further used to read the first buffer, and based on the read second verification code, verify and correct the read target function safety exception information to obtain the target function safety exception information for input into the second register.

3. The safety diagnostic communication circuit according to claim 1, further comprising: a first buffer; When the safety diagnostic communication circuit is placed in the first operating mode, then: The first buffer is used to cache the target function safety abnormality information generated by the first verification circuit; The second register is used to output the target function safety abnormality information so that the target function safety abnormality information is transmitted from the monitored chip to the monitoring chip, including: The second register is used to output the target functional safety exception information cached by the first buffer bit by bit to the transmitting pin of the monitored chip, so that each bit of data output to the transmitting pin is transmitted to the receiving pin of the monitoring chip via the first data bus.

4. The safety diagnostic communication circuit according to claim 1, wherein: When the target chip is a monitoring chip and the safety diagnostic communication circuit is placed in the second working mode, then: The second register is used to receive target function safety abnormality information transmitted from the monitored chip to the monitoring chip; The first verification circuit is configured to obtain, based on the target functional safety abnormality information, original functional safety abnormality information of the monitored chip and a first verification code corresponding to the original functional safety abnormality information, and verify the original functional safety abnormality information based on the first verification code to obtain a verification result; In response to the verification result indicating that the verification of the original functional safety exception information is passed, the first register is used to store the original functional safety exception information.

5. The safety diagnostic communication circuit according to claim 4, further comprising: The third check circuit and the second buffer; wherein, When the safety diagnostic communication circuit is placed in the second operating mode, then: The third verification circuit is used to calculate a third verification code corresponding to the target function safety abnormality information received by the second register, and write the target function safety abnormality information and the third verification code into the second buffer; The third verification circuit is further used to read the second buffer, and based on the read third verification code, verify and correct the read target function safety abnormality information to obtain the target function safety abnormality information for input into the first verification circuit.

6. The safety diagnostic communication circuit according to claim 4, further comprising: a second buffer; When the safety diagnostic communication circuit is placed in the second operating mode, then: The second register is used to receive target function safety exception information transmitted from the monitored chip to the monitoring chip, including: The second register is used to receive target function safety abnormality information transmitted from the transmitting pin of the monitored chip to the receiving pin of the monitoring chip via the first data bus bit by bit; The second buffer is used to cache each bit data received by the second register until all the target function safety exception information is cached; The first verification circuit is configured to obtain, based on the target functional safety abnormality information, original functional safety abnormality information of the monitored chip and a first verification code corresponding to the original functional safety abnormality information, including: The first verification circuit is configured to obtain the original functional safety exception information and the first verification code based on all the target functional safety exception information cached in the second cache.

7. The safety diagnostic communication circuit according to any one of claims 4 to 6, further comprising: Configuration circuit; The configuration circuit is configured to obtain mode configuration information, determine a target operating mode of the safety diagnostic communication circuit based on the mode configuration information, and configure at least the first register, the first verification circuit, and the second register based on the target operating mode; wherein the target operating mode is one of the first operating mode and the second operating mode; and / or, The configuration circuit is used to obtain algorithm configuration information, determine a target verification algorithm type to be used by the first verification circuit based on the algorithm configuration information, and configure the first verification circuit based on the target verification algorithm type.

8. A target chip comprising the secure diagnostic communication circuit according to any one of claims 1 to 7.

9. A safety diagnostic communication system comprising: Monitored chip and monitoring chip; In which, the monitored chip includes the safety diagnostic communication circuit as described in any one of claims 1-7, the monitoring chip includes the safety diagnostic communication circuit as described in any one of claims 4-7, and the monitoring chip is used to perform preset security protection operations on the monitored chip based on the original functional safety exception information stored in the first register in the included safety diagnostic communication circuit.

10. The safety diagnostic communication system according to claim 9, wherein: The monitoring chip is configured to, in response to a plurality of monitored chips, determine a target monitored chip from the plurality of monitored chips, and output a selection signal from a first selection pin of the monitoring chip corresponding to the target monitored chip, so that the selection signal is transmitted to a second selection pin of the target monitored chip via a second data bus; The target monitored chip is configured to control a second register in the safety diagnosis communication circuit included in the target monitored chip to output target function safety abnormality information in response to receiving the selection signal from the second selection pin.

11. The safety diagnostic communication system according to claim 9, wherein: The monitoring chip is used to output a query request from a first request pin of the monitoring chip, so that the query request is transmitted to a second request pin of the monitored chip via a third data bus; The monitored chip is configured to, in response to receiving the query request from the second request pin, output preparation completion notification information from the first preparation pin of the monitored chip after buffering target function safety abnormality information via the first buffer in the safety diagnostic communication circuit included in the monitored chip, so that the preparation completion notification information is transmitted to the second preparation pin of the monitoring chip via the fourth data bus; The monitoring chip is configured to receive target function safety exception information from the monitored chip through a receiving pin of the monitoring chip in response to receiving the preparation completion notification information from the second preparation pin.

12. The secure diagnostic communication system according to claim 9, wherein: The monitored chip is configured to output abnormality notification information from a first standby pin of the monitored chip in response to a functional safety abnormality of the monitored chip, so that the abnormality notification information is transmitted to a second standby pin of the monitoring chip via a fourth data bus; The monitoring chip is configured to output a query request from the first request pin of the monitoring chip in response to receiving the abnormality notification information from the second preparation pin, so that the query request is transmitted to the second request pin of the monitored chip via the third data bus; The monitored chip is configured to control a second register in the safety diagnosis communication circuit included in the monitored chip to output target function safety abnormality information in response to receiving the query request from the second request pin.

13. The secure diagnostic communication system according to claim 9, wherein: The monitoring chip is configured to output a clock signal from a first clock pin of the monitoring chip, so that the clock signal is transmitted to a second clock pin of the monitored chip via a fifth data bus; The monitored chip is configured to, in response to receiving the clock signal from the second clock pin, determine the received clock signal as an operating clock signal of the safety diagnostic communication circuit included in the monitored chip.

14. A safety diagnostic communication method, applied to the safety diagnostic communication circuit according to any one of claims 1 to 7, wherein the target chip to which the safety diagnostic communication circuit is applied is a monitored chip and the safety diagnostic communication circuit is in a first operating mode, the safety diagnostic communication method comprising: Storing original functional safety exception information of the monitored chip through a first register; Calculating a first check code corresponding to the original functional safety exception information through a first check circuit, and generating target functional safety exception information based on the original functional safety exception information and the first check code; The target function safety abnormality information is outputted through the second register, so that the target function safety abnormality information is transmitted from the monitored chip to the monitoring chip.

15. The safety diagnostic communication method according to claim 14, wherein: When the target chip is a monitoring chip and the safety diagnosis communication circuit is placed in the second working mode, the safety diagnosis communication method includes: receiving, through a second register, target function safety abnormality information transmitted from the monitored chip to the monitoring chip; Obtaining, by a first verification circuit, original functional safety exception information of the monitored chip and a first verification code corresponding to the original functional safety exception information based on the target functional safety exception information, and verifying the original functional safety exception information based on the first verification code to obtain a verification result; In response to the verification result indicating that the verification of the original functional safety exception information is passed, the original functional safety exception information is stored in a first register. 16 . A computer-readable storage medium storing a computer program, wherein the computer program is executed by a processor to execute the secure diagnostic communication method according to claim 14 .

17. An electronic device, comprising: processor; a memory for storing instructions executable by the processor; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the safety diagnostic communication method described in any one of claims 14-15.

Images