A method and apparatus for detecting random hardware failures in an eFlash controller

Abstract

This invention relates to a method and apparatus for detecting random hardware failures in an eFlash controller. The method includes an eFlash control module that backs up the write and erase control signals for the eFlash memory interface; an eFlash monitoring module that monitors for anomalies in the eFlash memory; and an eFlash monitor whose functions include write and erase timeout detection, consistency detection between eFlash controller operation commands and eFlash memory operation modes, and monitoring for abnormal failures of eFlash controller operation commands. The eFlash monitor detects clock inconsistencies between its monitoring clock and the functional clock of the eFlash control module to detect abnormal write or erase operations caused by functional clock failure. The eFlash monitoring module can be enabled or disabled by software. This invention, through a built-in hardware and software combined real-time functional safety mechanism, can effectively extend the lifespan of the eFlash memory.

Description

Technical Field

[0001] This invention belongs to the field of failure detection technology, and particularly relates to a method and apparatus for detecting random hardware failures in an eFlash controller. Background Technology

[0002] The eFlash (embedded flash memory) controller is a key module in embedded chips, responsible for managing the read / write, erase, data protection, and error correction of on-chip flash memory. Its main applications include: storing embedded system firmware, operating system (RTOS), and application code; supporting XIP (Execute-In-Place) technology, allowing the CPU to directly read instructions from the flash for execution; saving system configuration parameters, user data, and log information, typically using non-volatile storage to ensure data retention even when power is lost; in security chips (such as smart cards and TPMs), eFlash stores encryption keys and boot code to ensure trusted system execution; in the Internet of Things (IoT) and AutoSAR (AutoSAR) systems, the eFlash controller manages firmware and application updates, supporting dual-bank switching for non-disruptive upgrades; and in AIoT edge computing devices, eFlash can serve as a low-power cache, working in conjunction with SRAM / DRAM to optimize data access efficiency. The lifespan of eFlash (embedded flash) is an important reference indicator for chip selection, characterized by the number of write / erase (P / E) cycles. The essence of eFlash programming / erasing is injecting / releasing charge into the floating gate, which requires applying pressure to the floating gate. This pressure application affects the physical structure of the floating gate and thus its lifespan. The P / E cycles provided in the eFlash datasheet are based on industry-standard reliability testing procedures, requiring users to ensure that the timing control of the eFlash interface meets the datasheet's definitions during use. Flash memory cells rely on the floating gate to store charge; after long-term use, charge leakage may occur, leading to data errors. Flash P / E cycles are limited (typically 100,000 to 1,000,000 cycles), and excessive writing and erasing can damage memory cells. Radiation (such as cosmic rays and alpha particles) may cause abnormal charge in memory cells, triggering soft errors. Flash writing / erasing requires high voltage (~10V), and long-term use may cause charge pump degradation. eFlash controller failure can be caused by hardware malfunctions, environmental factors, and design flaws. Address decoding errors caused by eFlash controller failure may lead to data being written to the wrong location or erased from the wrong address. eFlash controller failure, clock jitter, or clock loss may cause read / write timing errors.

[0003] In embedded systems, the reliability of the eFlash (embedded flash memory) controller directly affects data integrity and system stability. Due to the various factors mentioned above, embedded chips may experience random failures due to the eFlash itself and its control module; this is unacceptable for scenarios with high security requirements, such as automotive chips. Random hardware failure refers to failure occurring unexpectedly during the lifecycle of an automotive chip. At the error detection coding level, a hierarchical protection system is formed by combining ECC error correction codes, CRC cyclic redundancy check, and parity check technologies—ECC can correct single-bit errors, CRC ensures data transmission integrity, and parity check provides fast single-bit error detection. However, the above detection methods are based on independent redundant hardware or independent software detection methods; the former has double the hardware overhead, while the latter cannot cope with real-time random failures.

[0004] On the one hand, random hardware failures typically follow a probability distribution and can be predicted within a reasonable range of accuracy. Software aspects such as the operating system can provide guidance for detecting random hardware failures at the hardware level. On the other hand, early detection at the command level is necessary to integrate with storage devices and their control systems to detect random hardware failures and perform timely compensation. Therefore, to identify and prevent these failures, a built-in real-time functional safety mechanism combining software and hardware becomes crucial. This mechanism helps detect and prevent random hardware failures, thereby improving the reliability and safety of automotive chips. Based on the above issues, this invention, through a built-in real-time functional safety mechanism combining software and hardware, prevents accidental writing or erasing of eFlash due to random hardware failures. In the event of a hardware failure, it can promptly clear the writing / erasing mode of the eFlash interface and perform compensation processing to prevent excessive writing / erasing time from reducing the eFlash's lifespan. Summary of the Invention

[0005] To address the aforementioned problems in the prior art, this invention proposes a method and apparatus for detecting random hardware failures in an eFlash controller, the apparatus comprising:

[0006] The eFlash monitoring module and the eFlash control module; the eFlash control module parses the received operation commands to obtain operation command data; it includes one or more eFlash interface signal backup modules, each corresponding to a set of memory interface signals, used to back up the eFlash interface signals containing operation command data, and send them to the eFlash storage module and the eFlash monitoring module.

[0007] The eFlash monitoring module performs anomaly monitoring on the eFlash storage module; it connects to the bus via a register interface; it also includes a timeout detection module, a mode detection module, a consistency detection module, a command detection and decoding module, and an operation command backup module; the bus writes operation commands to the operation command backup module of the eFlash monitoring module at the same time as writing operation commands to the command register of the eFlash control module;

[0008] The timeout detection module responds to the triggering of the mode detection module by detecting whether the writing and erasing time exceeds the preset duration. If so, a timeout event is triggered.

[0009] The mode detection module monitors the eFlash memory interface in real time. When the operation mode is writing or erasing, it triggers the timeout detection module and the consistency detection module.

[0010] The consistency detection module detects transient failures of the eFlash controller and determines whether the actual operation command parsed by the eFlash control module is consistent with the intended operation command from the command detection and decoding module; if they are inconsistent, an operation anomaly event is triggered.

[0011] The command detection and decoding module decodes the operation command backup in the operation command backup module to obtain the intent operation command and sends it to the consistency detection module. It also detects in real time whether the contents of the operation command register and the operation command backup module match. If they do not match, it is an operation command abnormal event, and the correct operation command is determined by prior confidence.

[0012] The operation command backup module backs up the operation commands of the eFlash controller through the register interface.

[0013] Furthermore, the consistency detection module checks whether the operation command type of the actual operation command determined by the eFlash controller is consistent with the operation command type of the intention operation command from the command detection and decoding module.

[0014] Furthermore, the register interface module is equipped with a priori confidence bit; the operating system periodically sets this priori confidence bit based on priori data; specifically: the operating system sends the operation command to the eFlash control module and the eFlash monitoring module via the bus; the operating system synchronously updates the priori data sequence, adding the operation command identifier to the end of the priori data sequence; after an abnormal event occurs, the abnormal event identifier is written into the status register; the operating system periodically reads the abnormal event identifier in the status register and updates the operation command identifier corresponding to the abnormal event in the priori data sequence to the type identifier of the abnormal event; when the operation command ends normally, the operation command identifier that ends normally in the priori data sequence is updated to the type identifier of the normal event; a priori data sequence is constructed based on the abnormal event identifier, the priori data sequence is analyzed to obtain the priori confidence, the analysis is performed based on the occurrence frequency of each event type, and the obtained priori confidence is written into the priori confidence bit of the command detection and decoding module.

[0015] Furthermore, the analysis based on the occurrence frequency of each event type specifically involves: obtaining the proportion of occurrence frequency of each event type in the prior data sequence to form a proportion combination, and querying the prior confidence level corresponding to the proportion combination as the analysis result; it is necessary to pre-construct a correspondence table between the proportion combination and the prior confidence level; during the query, the prior confidence level corresponding to the most similar proportion combination is found as the analysis result.

[0016] Furthermore, an external monitoring clock is used to time the duration of the eFlash programming / erasing operation.

[0017] Furthermore, the monitoring clock used by the timeout detection module and the functional clock used by the eFlash control module are from different sources.

[0018] Furthermore, when a timeout event occurs, the status register records the timeout event, resets the eFlash controller, and resets the eFlash monitoring module, causing the eFlash to exit the erase / write mode.

[0019] A method for detecting random hardware failures in an eFlash controller, wherein the method is based on the eFlash controller random hardware failure detection device for failure detection.

[0020] A random hardware failure detection chip for an eFlash controller, the eFlash controller random hardware failure detection chip comprising the aforementioned eFlash controller random hardware failure detection device.

[0021] A random hardware failure detection circuit for an eFlash controller, the eFlash controller random hardware failure detection circuit including the above-mentioned eFlash controller random hardware failure detection device.

[0022] The beneficial effects of this invention include:

[0023] (1) The built-in real-time functional safety mechanism that combines software and hardware performs early detection at the operation command level. During the monitoring process, it can provide information guidance for the discovery of random hardware failures at the hardware level from the software level such as the operating system. It can also detect random hardware failures in real time by integrating with the storage device and its control device, and perform timely compensation processing. By preventing the burning / erasing time from being too long and reducing the lifespan of eFlash, it can identify and prevent the occurrence of random hardware failures.

[0024] (2) Timely supplementation processing is carried out through prior confidence to determine the correct operation command and avoid incorrect burning / erasing due to eFlash controller failure; furthermore, the analysis capability of the operating system is used to extend the length of prior data analysis to find different abnormal distributions that the eFlash memory and its eFlash control module may exhibit at different stages of use. By making the most of prior information to determine the correct operation command, the damage to eFlash data caused by random hardware implementation can be effectively prevented.

[0025] (3) It has strong compatibility and scalability. Without changing the original storage control mode, it can perform real-time monitoring by setting up an independent monitoring module, which has strong scalability of eFlash storage array. Attached Figure Description

[0026] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to unduly limit the invention. In the drawings:

[0027] Figure 1 This is a schematic diagram of the random hardware failure detection device for the eFlash controller provided by the present invention.

[0028] Figure 2 This is a schematic diagram of the random hardware failure detection method for the eFlash controller provided by the present invention.

[0029] Figure 3 This is a schematic diagram of a random hardware failure detection device for an scalable eFlash controller provided in an embodiment of the present invention. Detailed Implementation

[0030] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. The illustrative embodiments and descriptions are only used to explain the present invention and are not intended to limit the present invention.

[0031] This invention proposes a method and apparatus for detecting random hardware failures in an eFlash controller, as shown in the appendix. Figure 1As shown, the device includes: an eFlash monitoring module and an eFlash control module; the eFlash monitoring module is located between the eFlash control module and the eFlash memory communication link to detect random hardware failures.

[0032] The eFlash control module is used to control access to one or more eFlash memories and to parse the received operation commands to obtain operation command data. The operation command data includes the operation command type and / or eFlash memory read / write timing, etc., to burn and erase eFlash memory data.

[0033] Preferably, the operation command data includes operation command type, operation object, physical address and / or eFlash memory read / write timing, etc.; the operation command type is programming and erasing, etc.

[0034] The eFlash control module is equipped with one or more eFlash interface signal backup modules; each eFlash interface signal backup module corresponds to a set of memory interface signals; it is also equipped with a function to back up the eFlash interface signals containing operation command data and perform triple modal redundancy (TMR) voting, and the TMR voting output is then sent to the eFlash memory and the eFlash monitoring module.

[0035] Furthermore, each eFlash interface signal backup module corresponds to a set of interface signals; the eFlash interface signal backup module is used to back up the eFlash interface signals containing operation command data; the backed-up eFlash interface signals are sent to the eFlash memory for storage control, and are synchronously sent to the eFlash monitoring module for random hardware failure detection.

[0036] Preferably, a set of eFlash interface signals can control multiple eFlash memories in parallel by extending the data bit width. An eFlash controller can have multiple sets of eFlash interface signals, for example, for updating programs or firmware on dual banks, realizing uninterrupted updates of management firmware and applications. Each set of interface signals corresponds to an eFlash interface signal backup module. Furthermore, when a set of interface signals connects to multiple eFlash memories, the output interface signals (based on timing) are synchronously sent to the parallel-controlled memories and the corresponding monitoring modules based on the target of the operation command.

[0037] Preferably, the eFlash control module is used to receive operation commands for the eFlash memory from the bus, and obtain operation command data by parsing the operation commands to control the eFlash memory; the parsed operation command data contains the object targeted by the operation command; furthermore, the operation commands from the operating system also contain the eFlash address, and the eFlash controller obtains the object targeted by the operation command by parsing the address.

[0038] The eFlash monitoring module is used to monitor the eFlash memory for anomalies. The eFlash monitoring module has a register interface and is connected to the bus via this interface. When an operation command is issued, the bus writes the operation command to the command register in the eFlash control module and simultaneously writes it to the operation command backup register in the eFlash monitoring module. At the end of the operation command, both the command register and the operation command backup register are cleared. A dual-modal redundancy (DMR) comparison mechanism is used for the operation commands; the bus writes the operation command to the command register in the eFlash control module and simultaneously backs it up in the eFlash monitoring module. The command detection and decoding module compares the operation command and the backup command in real time to ensure consistency. Operation command failure during execution triggers an operation command anomaly event. The decoding result of the backup operation command is provided to the consistency detection module.

[0039] Preferably, the end of the operation command includes normal end or abnormal end; the abnormal end corresponds to the abnormal event type.

[0040] Preferably, the eFlash monitoring module is connected to a register enable signal and a monitoring clock; the register enable signal controls the opening and closing of the eFlash monitoring module; when the eFlash monitoring module is turned on, timing monitoring is performed based on an external monitoring clock signal.

[0041] The eFlash monitoring module also includes an eFlash writing and erasing timeout detection module (hereinafter referred to as the timeout detection module), an eFlash operation mode detection module (hereinafter referred to as the mode detection module), an eFlash operation mode and operation command consistency detection module (hereinafter referred to as the consistency detection module), an operation command detection and decoding module (hereinafter referred to as the command detection and decoding module), and an operation command backup module;

[0042] The timeout detection module responds to the triggering of the mode detection module and is used to detect whether the writing and erasing time exceeds a preset duration. If so, a timeout event occurs. Under the control of the timing control signal from the register interface, the timeout detection module uses a monitoring clock and operation start / stop signals from the mode detection module (the operation start / stop signals are composite signals including a clock signal) to time within the writing / erasing cycle identified by the mode detection module to determine whether a timeout event has occurred. An external monitoring clock is used to time the duration of the eFlash writing / erasing operation, that is, to time the duration between the operation start / stop signals. Specifically, the timeout detection module uses an internal timer that continuously counts during eFlash memory writing and erasing to detect whether the writing and erasing time exceeds a preset duration. If so, a timeout event is triggered. The clock source of this internal timer is an external monitoring clock, which is inconsistent with the clock source of the eFlash control module, effectively detecting timeouts caused by control module clock failure.

[0043] Preferably, the preset duration is the maximum duration defined in the eFlash operation data manual; the operation start signal serves as a trigger signal to enable the timeout detection module to work; the monitoring clock and the eFlash controller functional clock are from different sources, which can effectively detect eFlash timeout burning / erasing caused by functional clock failure;

[0044] Preferred: The frequency of the monitoring clock used by the timeout detection module is configured by the operating system according to the actual situation; one of the possible implementation methods for timing is: the timer clock uses the monitoring clock, which requires the operating system to configure the maximum timing value; the other method is: the timing clock uses a fixed frequency clock, which is obtained by dividing the monitoring clock, and the operating system configures the division coefficient according to the actual needs; the timing is reset when the operation command ends normally or abnormally.

[0045] Preferably, the monitoring clock used by the timeout detection module and the functional clock of the eFlash control module are from different sources, thus enabling the detection of writing / erasing timeouts caused by functional clock failure.

[0046] The eFlash mode detection module monitors the eFlash memory interface in real time. When the operation mode is a write / erase operation, it triggers the timeout detection module and the consistency detection module. Specifically, the mode detection module receives the eFlash interface signal from the eFlash interface signal backup module in the eFlash control module and detects the operation mode of the eFlash interface signal. When the operation mode is a write or erase operation, it triggers the timeout detection module and the consistency detection module.

[0047] The timeout detection module performs timing based on the timing control signal from the register interface. When the writing or erasing operation ends, the timeout detection module stops timing based on the operation stop signal (this operation stop signal is a composite signal based on the clock signal, that is, a composite signal that can indicate the conditions for stopping the timing, namely, no longer being in writing / erasing operation mode, and the count value exceeding the preset duration). If the timing stops after exceeding the preset duration, a timeout event is triggered. The consistency detection module is used to compare whether the actual operation command of eFlash is consistent with the operation intended by the operation command. If they are inconsistent, an operation abnormality event is triggered.

[0048] Preferred: The timeout detection module resets the counter before starting the timing.

[0049] Preferred configuration: When a timeout event occurs, the status register records the timeout event, resets the eFlash controller, and resets the eFlash monitoring module, causing the eFlash to exit the erase / write mode, thus avoiding damage to the device due to excessively long high voltage application time;

[0050] Furthermore, when a timeout event occurs, the status register records the timeout event for prior confidence analysis;

[0051] Preferably, after a timeout event occurs, the timeout event is written into the status register;

[0052] Preferably, the status register is a register shared by the eFlash monitoring module and the operating system; it is either built into the eFlash monitoring module or located in the operating system's storage space.

[0053] Preferred: When the status register is full, the operating system is triggered to read and write to the status register; Optional: The operating system reads the status register periodically.

[0054] Preferred configuration: The timer is configured based on the actual frequency of the monitoring clock; the timer is built into the timeout detection module.

[0055] The consistency detection module is used to detect transient failures of the eFlash controller, i.e., operational anomaly events. Specifically, the consistency detection module receives a trigger signal from the mode detection module and the eFlash operation mode parsed by the eFlash control module, and confirms whether it is consistent with the decoding result of the backup operation command. If they are inconsistent, an operational anomaly event is triggered. When an operational anomaly event occurs, the eFlash control module and its eFlash interface signal backup module are reset to prevent erroneous eFlash operations from damaging data. Furthermore, the consistency detection module detects whether the operation command type of the actual operation command determined by the eFlash controller is consistent with the operation command type of the intended operation command from the command detection and decoding module.

[0056] Preferably, the status register records the operational anomaly event after it occurs;

[0057] The determination of whether the two are consistent specifically involves: determining whether the operation command types targeted by the operation commands are consistent; if there is a discrepancy, it is determined that the two are inconsistent; otherwise, it is determined that the two are consistent; the situations where the operation command types are inconsistent include, but are not limited to: the eFlash interface is in erase mode, but the operation command is not an erase command; the eFlash interface is in programming mode, but the operation command is not a programming command; the eFlash interface is in chip erase mode, but the operation command is sector erase.

[0058] Further: Determine whether the operation command type, operation object, and eFlash physical address are consistent; if any of these are inconsistent, determine that they are inconsistent.

[0059] The command detection and decoding module decodes the operation command backups stored in the operation command backup module and sends the decoded intent operation command to the consistency detection module. It also checks in real-time whether the operation command register of the eFlash control module matches the operation command backup in the operation command backup module. If they do not match, an operation command exception event occurs. Upon receiving the enable signal from the register interface, the command detection and decoding module compares the operation command from the eFlash control module with the operation command backup in the operation command backup module. If they do not match, an operation command exception event is triggered. After an operation command exception event occurs, the eFlash control module and its eFlash interface signal backup module are reset to prevent erroneous Flash operations from damaging data. Therefore, the command detection and decoding module needs to first compare the command with the backup command. If the operation command register fails, an exception event will be triggered immediately, and no further decoding or execution will occur.

[0060] The process of determining the correct operation command based on prior confidence is as follows: the correct operation command is determined based on the actual operation command from the operation command register, the intended operation command from the operation command backup module, and the prior confidence. Further, when the prior confidence is 01, the actual operation command from the operation command register is determined to be the correct operation command; when the prior confidence is 10, the intended operation command from the operation command backup module is determined to be the correct operation command; otherwise, an operation command exception event is triggered.

[0061] Preferably, the register interface module is provided with a priori confidence bit; the operating system periodically sets the priori confidence bit based on priori data; specifically, after an abnormal event occurs, the abnormal event identifier is written into the status register; the operating system periodically reads the abnormal event identifier in the status register; a priori data sequence is constructed based on the abnormal event identifier, the priori data sequence is analyzed to obtain the priori confidence; and the priori confidence is written into the priori confidence bit of the command detection and decoding module.

[0062] Preferably: the prior data sequence is set in the operating system, while the prior confidence bit is set in the operation command backup module; the size of the prior data sequence is larger than the size of the status register;

[0063] Preferably, the operation commands received by the command detection and decoding module from the eFlash control module are operation commands from the operation command register of the eFlash control module forwarded by the operation command backup module;

[0064] Preferably, after an operation command exception event occurs, the operation command exception event is written into the status register;

[0065] The operation command backup module is used to back up the operation commands (operation commands from the register interface) in the eFlash controller; after the operation command is executed, the operation command register and the operation command backup are cleared synchronously.

[0066] As attached Figure 2 As shown, based on the same inventive concept, the present invention also provides a method for detecting random hardware failures in an eFlash controller, wherein the method performs failure detection based on the above-mentioned random hardware failure detection device for an eFlash controller.

[0067] Specifically, the steps include the following:

[0068] Step S1: The operating system receives the access request for the eFlash memory and generates operation commands for the eFlash memory based on the access request;

[0069] Step S2: The operating system sends the operation command to the eFlash control module and the eFlash monitoring module via the bus; the operating system synchronously updates the prior data sequence and adds the operation command identifier to the end of the prior data sequence; the operating system periodically reads the abnormal events in the status register and updates the operation command identifier corresponding to the abnormal event in the prior data sequence to the type identifier of the abnormal event; the operating system periodically analyzes the prior data sequence to obtain the prior confidence level; and writes the prior confidence level into the eFlash monitoring module.

[0070] Preferred: When an operation command ends normally, the identifier of the normally ended operation command in the prior data sequence is updated to the type identifier of the normal event;

[0071] Preferred approach: Construct the same or different prior data sequences for different eFlash memories; manage them uniformly or separately.

[0072] Preferably, the prior data sequence stores the operation command identifier or its event type identifier in the chronological order of the operation command occurrence; the event type identifier includes normal event types and various abnormal event types; that is, before the operation command ends, the operation command identifier is stored in the prior data sequence, and after the command ends, the event type is stored in the prior sequence; it is evident that the normal event type and each abnormal event type need to be uniquely and consistently encoded.

[0073] The periodic analysis of the prior data sequence to obtain the prior confidence level involves: when the length of a prior data sequence meets the length threshold and all operation command identifiers in it are updated to event type identifiers; acquiring the prior data sequence for analysis; and determining the prior confidence level based on the analysis results.

[0074] The process of obtaining and analyzing the prior data sequence specifically involves analyzing the occurrence frequency and / or order of each event type.

[0075] The analysis based on the occurrence frequency of each event type specifically involves: obtaining the proportion of occurrence frequency of each event type in the prior data sequence to form a proportion combination, and querying the prior confidence level corresponding to the proportion combination as the analysis result; it is necessary to pre-construct a correspondence table between the proportion combination and the prior confidence level; during the query, the prior confidence level corresponding to the most similar proportion combination is found as the analysis result.

[0076] Preferred method: Determine similarity by calculating the Euclidean distance between the proportion combinations and the proportion combinations in the corresponding relationship table;

[0077] The step of pre-constructing a correspondence table between percentage combinations and prior confidence levels involves: analyzing historical operation command data; statistically analyzing the event type proportions of the preceding operation commands and their corresponding first and third percentage combinations when the operation command register is correct and the operation command backup module is correct; and storing the first and third percentage combinations and their corresponding prior confidence levels.

[0078] Furthermore, the prior confidence bit is 2 bits; a prior confidence of 00 indicates no prior knowledge, and 11 indicates that neither of them is a correct operation command; when the prior confidence is 01, it indicates that the operation command from the operation command register is correct; when the prior confidence is 10, it indicates that the operation command from the operation command backup module is correct; of course, a prior confidence of 00 can also be used as an extended information bit.

[0079] When the first and third proportion combinations are similar and the total proportion of abnormal event types is less than the abnormal proportion threshold, the prior confidence level corresponding to the first and third proportion combinations is set to 00; when the first and third proportion combinations are similar and the total proportion of abnormal event types is greater than or equal to the abnormal proportion threshold, the prior confidence level corresponding to the first and third proportion combinations is set to 11; when the first and third proportion combinations are not similar, the first proportion combination and the prior confidence level are associated with 01, and the third proportion combination and the prior confidence level are associated with 10.

[0080] Preferably, the historical operation command data comes from operation command data of the same eFlash memory type and eFlash control module type;

[0081] Preferably, the historical operation command data is the most recent operation command data.

[0082] Alternative: The pre-constructed correspondence table between the proportion combination and the prior confidence level specifically involves: analyzing historical operation command data information from two historical prior data sequences of different lengths to set up the correspondence table; specifically including the following steps:

[0083] Step SX1: Obtain historical operation command data information of first length and second length respectively: wherein: the first length is greater than the second length, and the historical operation command data of the first length contains the historical operation command data of the second length;

[0084] Step SX2: When the statistical operation command register is correct, the event type ratio of its preceding operation commands and the first ratio combination corresponding to the first length, and the second ratio combination corresponding to the second length; when the statistical operation command backup module is correct, the event type ratio of its preceding operation commands and the third ratio combination corresponding to the first length, and the fourth ratio combination corresponding to the second length.

[0085] Step SX3: When the first and second proportion combinations are similar to the third and fourth proportion combinations and the total proportion of abnormal events is less than the abnormal proportion threshold, set the prior confidence level of the first and second proportion combinations to 00, corresponding to the third and fourth proportion combinations; when the first and second proportion combinations are similar to the third and fourth proportion combinations and the total proportion of abnormal events is greater than or equal to the abnormal proportion threshold, set the prior confidence level of the first and second proportion combinations to 11, corresponding to the third and fourth proportion combinations; otherwise, proceed to the next step.

[0086] Step SX4: Associate the first and second proportion combinations with a priori confidence level of 0-1, and the third and fourth proportion combinations with a priori confidence level of 10. At this point, each record in the corresponding relationship table contains two units: the first unit contains the first and second proportion combinations, or the third and fourth proportion combinations; the second unit is the priori confidence level. During a query, if the proportion information used for the query is similar to any combination in the first unit, the query is considered successful. By utilizing the operating system's analytical capabilities to extend the analysis length, different abnormal distributions of the eFlash memory and its eFlash control module may be observed at different stages of use. By utilizing prior information as much as possible to determine the correct operation command, the system avoids erasing / writing to the wrong address due to transient failures of interface signals, effectively preventing damage to Flash data from random hardware implementations. Simultaneously, it avoids complete failure caused by repeatedly resetting the same operation command.

[0087] The analysis is based on the order of occurrence of each event type; specifically, it involves obtaining a prior data sequence of a third length and inputting it into a pre-trained prior confidence analysis model to obtain the corresponding prior confidence. This prior confidence analysis model is an artificial intelligence model. The third length is much larger than the first length. Obviously, such a confidence setting requires a large amount of computation and hardware overhead. However, the pre-trained prior confidence model can be provided by the automotive chip provider or the eFlash memory provider.

[0088] Step S3: The eFlash control module saves the operation command in the operation command register; and parses the operation command to obtain the operation command data; after parsing, the operation command data of the operation command is obtained; the eFlash interface signal backup module constructs the eFlash interface signal timing based on the operation command data, and synchronously sends the eFlash interface signals to the operation mode monitoring module of the eFlash memory and the eFlash monitoring module in the timing sequence; the eFlash monitoring module receives the operation command through the register interface and further sends it to the operation command backup module for storage;

[0089] The eFlash monitoring module backs up eFlash interface signals and operation commands from the bus, performing mode detection, consistency detection, and timeout detection on the operation commands and their completion status. It generates corresponding exception events when a detection fails and writes these events to the status register. When an operation command exception event occurs, it determines the correct operation command based on prior confidence. Based on the correct operation command, it checks whether the data in the physical address of the target object is correct to determine whether to re-execute. For example, if a write timeout exception event occurs, the data at the destination physical address has already been written. If the eFlash controller state machine fails, causing the operation command type to change midway and the data at the destination physical address not being successfully written (or erased), then after checking and finding it incorrect, it needs to be erased and re-written (or re-erased).

[0090] Preferably, the eFlash controller random hardware failure detection system is used in automotive chips to increase transient failure detection coverage and meet reliability requirements.

[0091] As attached Figure 3 As shown, the controller random hardware failure detection device provided by this invention is scalable. For multiple eFlash memories, the interface signal controls the eFlash and is simultaneously sent to the monitoring module. When the operation command ends, the command register and the operation command backup register are reset at the same time. Only the interface of the eFlash control module needs to be expanded without destroying the original eFlash control module structure. Therefore, it can be adapted to different models of eFlash from different chip manufacturers. Regardless of the number of eFlash memories, only one scalable eFlash monitoring module needs to be set up for parallel monitoring.

[0092] The alternative and scalable approach is that, for a multi-Bank eFlash control module, each Bank corresponds to a set of interface signals, each set of interface signals controls one or more eFlash memories in parallel, and each set of interface signals is connected to one of the aforementioned eFlash monitoring modules, without changing the structure of the original eFlash control module.

[0093] Preferred: When the writing and erasing execution times of multiple eFlash Banks do not overlap, multiple eFlash interfaces can share a single eFlash monitoring module.

[0094] The provided controller random hardware failure detection device does not damage the original controller structure. It performs triple-modulus redundancy backup on the original eFlash interface signal drive register. The triple-modulus redundancy (TMR) voting output of the backup signal is used as the new interface signal. Specifically, the original eFlash interface signal is backed up with triple-modulus redundancy, and the triple-modulus redundancy (TMR) voting output of the backup signal is used as the new interface signal. Its advantage is that a single point failure of the redundant signal will not change the eFlash interface operation mode. It is also reflected in the fact that the eFlash monitoring module is connected to the original eFlash interface signal and does not affect the eFlash controller's operation of the eFlash memory.

[0095] Preferred option: An adjustable operating mode detection module within the eFlash monitoring module to adapt to different models of eFlash from different chip manufacturers;

[0096] A computer program (also referred to as a program, software, software application, script, or code) can be written in any form of programming language, including assembly or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but does not necessarily, correspond to a file in a file system. A program can be stored as part of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to said program, or in multiple co-located files (e.g., a file storing one or more modules, subroutines, or code portions). A computer program can be deployed to execute on a single computer or on multiple computers located at a single site or distributed across multiple sites and interconnected by a communications network.

[0097] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0099] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0100] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A random hardware failure detection device for an eFlash controller, characterized in that, It includes: an eFlash monitoring module and an eFlash control module; the eFlash control module parses the received operation commands to obtain operation command data; it includes one or more eFlash interface signal backup modules, each corresponding to a set of memory interface signals, used to back up the eFlash interface signals containing operation command data and send them to the eFlash storage module and the eFlash monitoring module; The eFlash monitoring module performs anomaly monitoring on the eFlash storage module; it connects to the bus via a register interface; and it also includes a timeout detection module, a mode detection module, a consistency detection module, a command detection and decoding module, and an operation command backup module. The bus writes operation commands to the command register of the eFlash control module and simultaneously writes them to the operation command backup module of the eFlash monitoring module. The timeout detection module responds to the triggering of the mode detection module by detecting whether the writing and erasing time exceeds the preset duration. If so, a timeout event is triggered. The mode detection module monitors the eFlash memory interface in real time. When the operation mode is writing or erasing, it triggers the timeout detection module and the consistency detection module. The consistency detection module detects transient failures of the eFlash controller and determines whether the actual operation command parsed by the eFlash control module is consistent with the intended operation command from the command detection and decoding module; if they are inconsistent, an operation anomaly event is triggered. The command detection and decoding module decodes the operation command backup in the operation command backup module to obtain the intent operation command and sends it to the consistency detection module. It also detects in real time whether the contents of the operation command register and the operation command backup module match. If they do not match, it is an operation command abnormal event, and the correct operation command is determined by prior confidence. The operation command backup module backs up the operation commands of the eFlash controller through the register interface.

2. The eFlash controller random hardware failure detection device according to claim 1, characterized in that, The consistency detection module checks whether the operation command type of the actual operation command and the operation command type of the intention operation command from the command detection and decoding module are consistent.

3. The eFlash controller random hardware failure detection device according to claim 2, characterized in that, The register interface module is equipped with a priori confidence bit. The operating system periodically sets this priori confidence bit based on priori data. Specifically, the operating system sends the operation command to the eFlash control module and the eFlash monitoring module via the bus; the operating system synchronously updates the priori data sequence and adds the operation command identifier to the end of the priori data sequence; after an abnormal event occurs, the abnormal event identifier is written into the status register; the operating system periodically reads the abnormal event identifier in the status register and updates the operation command identifier corresponding to the abnormal event in the priori data sequence to the type identifier of the abnormal event; when the operation command ends normally, the operation command identifier that ends normally in the priori data sequence is updated to the type identifier of the normal event. A priori data sequence is constructed based on the abnormal event identifier. The priori data sequence is analyzed to obtain the priori confidence. The analysis is performed based on the occurrence frequency of each event type, and the obtained priori confidence is written into the priori confidence bit of the command detection and decoding module.

4. The eFlash controller random hardware failure detection device according to claim 3, characterized in that, The analysis based on the occurrence frequency of each event type specifically involves: obtaining the proportion of occurrence frequency of each event type in the prior data sequence to form a proportion combination, and querying the prior confidence level corresponding to the proportion combination as the analysis result; it is necessary to pre-construct a correspondence table between the proportion combination and the prior confidence level. The prior confidence level corresponding to the most similar proportion combination is used as the analysis result during the query.

5. The eFlash controller random hardware failure detection device according to claim 4, characterized in that, An external monitoring clock measures the duration of the eFlash writing / erasing operation.

6. The eFlash controller random hardware failure detection device according to claim 5, characterized in that, The monitoring clock used by the timeout detection module and the functional clock of the eFlash control module are from different sources.

7. The eFlash controller random hardware failure detection device according to claim 6, characterized in that, When a timeout event occurs, the status register records the timeout event, resets the eFlash controller, and resets the eFlash monitoring module, causing the eFlash to exit erase / write mode.

8. A method for detecting random hardware failures in an eFlash controller, characterized in that, The method performs failure detection based on the eFlash controller random hardware failure detection device described in any one of claims 1-7.

9. A random hardware failure detection chip for an eFlash controller, characterized in that, The eFlash controller random hardware failure detection chip includes the eFlash controller random hardware failure detection device according to any one of claims 1-7.

10. A random hardware failure detection circuit for an eFlash controller, characterized in that, The eFlash controller random hardware failure detection circuit includes the eFlash controller random hardware failure detection device according to any one of claims 1-7.

Images