Cross-fault-domain zero-trust security arbitration system for non-deterministic controller and hierarchical response method based on effect verification

Abstract

The application discloses a cross-fault-domain zero-trust security arbitration system for a non-deterministic controller and a hierarchical response method based on effect verification, and relates to the technical field of non-deterministic controller security arbitration. The control unit is used for running a non-deterministic control strategy to generate a control instruction. The residual energy accumulation module is arranged in the security unit, and the deviation between the control instruction and the actual execution effect is accumulated as a residual energy accumulation metric Σe(t) in a sliding time window. When Σe(t) exceeds a dynamic threshold, a hierarchical response is triggered. The security unit is used for calculating a risk degree and combining the residual energy accumulation metric. When the risk degree or the residual energy accumulation metric exceeds a corresponding dynamic threshold, a corresponding hierarchical response is triggered, the security unit outputs an enable signal of failure, and a lock trigger signal is outputted. No matter what state the control instruction is in, when the enable signal is in a failure state, a lock state signal outputted by an interlocking reset module is received, or in the case of energy loss, a blocking state is entered, and the system security lock response time τ_lock is satisfied.

Description

Technical Field

[0001] This application relates to the field of security arbitration technology for embodied intelligent systems and industrial automation applications, and more specifically, to a cross-fault domain zero-trust security arbitration system for nondeterministic controllers and a hierarchical response method based on effect verification. Background Technology

[0002] Currently, there are several methods that can be used to make the controller operate more safely; however, the methods currently used may have common cause failures or execution failures.

[0003] Existing functional safety standards (such as IEC 61800-5-2, IEC 61508, ISO 13849) and their implementations are based on the following implicit assumptions: the behavior of the controller is deterministic and predictable, which is ineffective for AI / learning controllers; the failure modes are enumerable and predefined, which are not enumerable for anti-attack / distributed drift; in safety logic, sharing resources with control logic is acceptable, but sharing resources will lead to common cause failures; in terms of triggering mechanisms, fixed thresholds can cover all operating conditions, however, load / temperature drift / aging can lead to false triggering and missed triggering.

[0004] In addition, in embodied intelligent systems (such as industrial robots, collaborative robots, autonomous vehicles, etc.), controllers typically employ AI, learning, or nonlinear control strategies. These controllers exhibit non-deterministic characteristics in engineering: inference delay jitter, model iteration, sensor noise, distribution drift, and abnormal inputs can all lead to unpredictable control outputs.

[0005] Meanwhile, the actuators (motors, hydraulic cylinders, etc.) and power links are deterministic physical systems and must meet the "worst-case constraint" of functional safety: the system must be able to safely enter a protection state when the controller output is abnormal. In existing technologies, such as existing solution 1: a peer-to-peer dual-channel redundancy architecture, existing functional safety systems often adopt a peer-to-peer dual-channel redundancy architecture, with a typical structure as follows: two identical control / safety channels operate in parallel, and the outputs of the two channels are checked for consistency by a comparator; a safety response is triggered when inconsistency is detected. The two control channels obtain input from the same sensor, process it themselves, and then perform consistency checks at the comparator. However, the two channels typically share the same power supply, clock, and ground plane, forming a single fault domain.

[0006] For example, existing technical solution 2: software watchdog and fixed threshold protection. Traditional servo drives and safety PLCs often use a software watchdog and fixed threshold protection mechanism: the software periodically feeds the watchdog, triggering a reset if the timeout is exceeded, and sets fixed current / speed / position thresholds; if the thresholds are exceeded, the software triggers protection.

[0007] The existing technology has a drawback 1: coupling with the same fault domain. Specifically, the control logic and security logic share power, clock, ground, or the same SoC / operating system resources. Peerless dual channels share the same fault domain, and a single point of failure (such as power ripple, clock glitches, or ground bounce) can simultaneously affect both channels. This allows the security logic to be simultaneously compromised by faults or malicious attacks within the same domain, leading to common-cause failure.

[0008] Defect 2: The arbitration point is not located at the physical boundary. Specifically, the security judgment cannot be directly translated into a forced disconnection of the power link, as intermediate links may fail. Consequently, situations arise where "the judgment is correct but the execution is invalid," rendering the security function ineffective.

[0009] Defect 3: Rigid fixed threshold. Specifically, the reasonable value of the safety threshold varies under different loads and operating conditions. A fixed threshold setting during configuration fails to adapt to dynamic conditions such as load changes, friction variations, temperature drift, aging, and communication jitter. Therefore, setting the threshold too high leads to untimely protection (missed triggers), while setting it too low leads to frequent false triggers, making it difficult to achieve a balance.

[0010] Defect 4: Lack of timing verification. Specifically, a safety response must be completed before the fault propagates and causes harm. The lack of a device-level timing budget model makes it impossible to quantify whether the safety response time is faster than the fault propagation time. This makes it difficult to pass type testing or be recognized by safety certification bodies, and fails to provide a measurable verification chain. Summary of the Invention

[0011] This application proposes a cross-fault domain zero-trust security arbitration system for nondeterministic controllers and a hierarchical response method based on effect verification.

[0012] In a first aspect, embodiments of this application provide a cross-fault domain zero-trust security arbitration system for nondeterministic controllers, comprising: a control unit, a security unit, a cross-fault domain boundary arbitrator, a residual energy accumulation module for binding triggering and execution effects with Σe(t), and an interlocked reset module. The cross-fault domain boundary arbitrator is connected to both the control unit and the security unit. The security unit is also connected to both the residual energy accumulation module and the interlocked reset module. The security unit and the control unit are physically isolated in at least one dimension: power supply, clock, or ground plane. The control unit is used to run a nondeterministic control strategy and generate control commands. The residual energy accumulation module is located within the security unit and accumulates the deviation between the control commands and the actual execution effects within a sliding time window as a residual energy accumulation metric Σe(t). When Σe(t)... A graded response is triggered when the dynamic threshold is exceeded; the safety unit is used to calculate the risk level and combine it with the residual energy accumulation metric. When the risk level or the residual energy accumulation metric Σe(t) exceeds its corresponding dynamic threshold, the corresponding graded response is triggered. The residual energy accumulation metric is implemented by analog integration, digital accumulation, or sliding window accumulation, driving the safety unit to output a failure enable signal and a lock trigger signal. The risk level is a weighted aggregation of multi-dimensional risk inputs, used to characterize the current overall risk level of the system. The safety unit does not rely on any state information of the control unit to verify safety. The cross-fault domain boundary arbitrator has a power-off tripping topology and is located at the physical boundary between the power link of the control unit and the execution unit. The enable signal is disabled by default. The cross-fault domain boundary arbiter is configured to perform asymmetric arbitration: regardless of the state of the control command, when the enable signal is in a disabled state, a locked state signal is received from the interlock reset module, or when power is lacking, the output is forced into a blocking state to cut off the power link to the execution unit. The safety unit has a one-way veto right over the output of the control unit, and the control unit cannot bypass the veto of the safety unit, nor can it bypass the blocking state. The interlock reset module is used to respond to the lock trigger signal, enter a locked state that cannot be released by the control unit itself, and output a locked state signal. The locked state can only be released independently of the reset confirmation signal of the control unit. The system safety lock response time τ_lock satisfies... T_control is the control cycle.

[0013] Secondly, embodiments of this application provide a graded response method based on effect verification for a cross-fault domain zero-trust safety arbitration system for nondeterministic controllers, applied to the cross-fault domain zero-trust safety arbitration system for nondeterministic controllers described in the first aspect. The method includes: calculating the execution deviation of the control command e(t) = |y_cmd(t) - y_actual(t)| through a safety unit physically isolated from the control unit; accumulating the residual energy accumulation metric Σe(t) within a sliding time window; calculating the risk level, where the risk level is a weighted aggregation of multi-dimensional risk inputs, used to characterize the current overall risk level of the system; driving L0-L3 to trigger graded responses based on the risk level and the residual energy accumulation metric; and executing a power-off trip through a cross-fault domain boundary arbiter, wherein the system safety lockout response time τ_lock satisfies... T_control is the control cycle.

[0014] The cross-fault domain zero-trust security arbitration system and effect verification-based hierarchical response method for nondeterministic controllers provided in this application achieve physical isolation between the control unit and the security unit in the power, clock, and ground plane dimensions, so that the trust of the security unit does not depend on any shared resources or state information of the control unit; the enable signal of the security unit directly acts on the enable terminal of the power link of the execution unit without going through software or complex instruction chains, and the power is blocked when there is no power; by dynamically integrating the execution residual, the triggering condition is bound to the execution effect, rather than a fixed threshold, to achieve adaptive management of dynamic operating conditions, making the controller operation safer.

[0015] Other features and advantages of the embodiments of this application will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the embodiments of this application. The objects and other advantages of the embodiments of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A block diagram of a peer-to-peer dual-channel redundant architecture is shown; Figure 2 This paper shows a structural block diagram of a cross-fault domain zero-trust security arbitration system for nondeterministic controllers provided in an embodiment of this application. Figure 3 A schematic diagram of the security lock response time in an embodiment of this application is shown; Figure 4 A schematic diagram of the state transitions of the hierarchical response state machine provided in an embodiment of this application is shown; Figure 5 This paper shows a structural block diagram of a cross-fault domain zero-trust security arbitration system for nondeterministic controllers in an embodiment of this application. Figure 6 A connection diagram of the depletion-type field-effect transistor in an embodiment of this application is shown; Figure 7 A connection diagram of the constant current source circuit in an embodiment of this application is shown; Figure 8 This diagram illustrates the connection of a two-transistor constant current source circuit provided in an embodiment of this application. Figure 9 A schematic diagram of the analog integrator circuit in an embodiment of this application is shown; Figure 10 A schematic diagram of a precision full-wave rectifier circuit in an embodiment of this application is shown; Figure 11 A schematic diagram of the reset circuit in an embodiment of this application is shown; Figure 12 A schematic diagram of the window comparator and threshold triggering circuit in an embodiment of this application is shown; Figure 13 A schematic diagram of the tripping topology provided in an embodiment of this application is shown; Figure 14 A schematic diagram showing the comparison between the cross-fault domain zero-trust security arbitration system for nondeterministic controllers provided in this application embodiment and the prior art is illustrated. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, and not all of them. The components of the embodiments of the present application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the present application. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without inventive effort are within the scope of protection of the present application.

[0019] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0020] Currently, several methods exist to make controllers operate more safely; however, these methods may suffer from common-cause failures or execution failures. How to reduce common-cause failures and execution failures to make controllers operate more safely is a problem that urgently needs to be solved.

[0021] Currently, functional safety systems often employ a peer-to-peer dual-channel redundancy architecture, with a typical structure as follows: Figure 1 As shown. Please refer to [the original text]. Figure 1 , Figure 1 A block diagram of a peer-to-peer dual-channel redundant architecture is shown. Figure 1 In this configuration, a peer-to-peer dual-channel architecture 110 is connected to a shared resource 120, which includes a shared power supply 121, a shared clock 122, and a shared ground plane 123. Figure 1 In this process, the two control channels obtain input from the same sensor, process it themselves, and then perform consistency verification at the comparator.

[0022] For example, a software watchdog timer and fixed threshold protection mechanism can also be used. This is controlled by software, triggering a reset upon timeout. Specifically, fixed current / speed / position thresholds can be set; if these thresholds are exceeded, software triggers protection. The watchdog timer is maintained by software, the thresholds are fixed during system configuration, and the protection action is executed by software logic within the same processor.

[0023] However, the inventors discovered during their research that, as Figure 1 The illustrated peer-to-peer dual-channel redundant architecture typically shares the same power supply, clock, and ground plane, forming a single fault domain and leading to common-cause failure. Furthermore, with software watchdog and fixed-threshold protection mechanisms, safety judgments cannot be directly translated into forced disconnection of the power link; intermediate links may fail, resulting in correct judgments but ineffective execution, rendering the safety function practically useless.

[0024] Therefore, in order to solve or partially solve the above problems, this application provides a cross-fault domain zero-trust security arbitration system for nondeterministic controllers and a hierarchical response method based on effect verification.

[0025] Please see Figure 2 , Figure 2This paper illustrates a structural block diagram of a cross-fault domain zero-trust security arbitration system for nondeterministic controllers, provided by an embodiment of this application. The cross-fault domain security arbitration system 200 includes a control unit 210, a security unit 220, a cross-fault domain boundary arbitrator 230, a residual energy accumulation module 240 for Σe(t) binding triggering and execution effects, and an interlocked reset module 250. The cross-fault domain boundary arbitrator is connected to both the control unit and the security unit. The security unit is also connected to both the residual energy accumulation module and the interlocked reset module. The security unit and the control unit are physically isolated in at least one dimension: power supply, clock, or ground plane.

[0026] It should be noted that the embodiments in this application are applied to nondeterministic controllers, which is fundamentally different from the deterministic control systems of the IEC standard.

[0027] The safety unit is physically isolated from the control unit in at least one dimension, such as power, clock, or ground plane, which allows cross-domain signals to be electrically isolated and common-mode interference to be blocked.

[0028] Through physical isolation, this solution can achieve the effects shown in Table 1 below, compared to traditional systems.

[0029] Table 1 Quantitative Comparison Table It is evident that physical isolation can reduce the attack surface by 90%+, the path length by 50%+, and the bypass probability by orders of magnitude.

[0030] For example, the output of the control unit can be connected to the first input of the cross-fault domain boundary arbiter; the enable output of the safety unit can be connected to the second input of the cross-fault domain boundary arbiter; the output of the cross-fault domain boundary arbiter can be connected to the enable input of the power link of the execution unit 260; the lockout status signal output of the safety unit can be connected to the interlock reset module; and the reset confirmation input of the interlock reset module can be connected to an independent reset signal source.

[0031] The control unit is used to run a nondeterministic control strategy and generate control commands. The residual energy accumulation module, located within the safety unit, accumulates the deviation between the control commands and the actual execution effect within a sliding time window as a residual energy accumulation metric Σe(t). When Σe(t) exceeds a dynamic threshold, a graded response is triggered. The safety unit calculates the risk level and combines it with the residual energy accumulation metric. When either the risk level or the residual energy accumulation metric Σe(t) exceeds its corresponding dynamic threshold, a corresponding graded response is triggered. The residual energy accumulation metric is implemented using analog integration, digital accumulation, or sliding window accumulation. This drives the safety unit to output a failure enable signal and a lockout trigger signal. The risk level is a weighted aggregation of multi-dimensional risk inputs, used to characterize the overall current risk level of the system. The safety unit does not rely on any state information from the control unit to verify safety. The cross-fault domain boundary arbitrator has a power-off tripping topology and is located at the physical boundary between the power link of the control unit and the execution unit. The enable signal is disabled by default. The cross-fault domain boundary arbiter is configured to perform asymmetric arbitration: regardless of the state of the control command, when the enable signal is in a disabled state, a locked state signal is received from the interlock reset module, or when power is lacking, the output is forced into a blocking state to cut off the power link to the execution unit. The safety unit has a one-way veto right over the output of the control unit, and the control unit cannot bypass the veto of the safety unit, nor can it bypass the blocking state. The interlock reset module is used to respond to the lock trigger signal, enter a locked state that cannot be released by the control unit itself, and output a locked state signal. The locked state can only be released independently of the reset confirmation signal of the control unit. The system safety lock response time τ_lock satisfies... T_control is the control cycle.

[0032] Among them, the control unit can be a control domain, and the safety unit can be a safety domain.

[0033] In some implementations, control commands can be characterized by CMD_A(t); risk level can be characterized by D(t); residual energy accumulation measure can be characterized by Σe(t); enable signal can be characterized by EN_B; and output signal can be characterized by OUT(t).

[0034] The cross-fault domain boundary arbiter can be connected to the execution unit, so that the output signal of the cross-fault domain boundary arbiter is input to the execution unit to control the execution unit to enter the blocking state when the enable signal is in a specified state. It should be noted that being in a specified state can also be referred to as energy deficiency, that is, being in an open circuit, high impedance, or voltage below a threshold state.

[0035] In some implementations, regardless of the state of the control command, when the enable signal is in a disabled state, when a locked state signal is received from the interlock reset module, or when there is a lack of energy, the cross-fault domain boundary arbitrator forces the output to enter a blocking state to cut off the power link to the execution unit. Therefore, the output of the cross-fault domain boundary arbitrator satisfies the following logical relationship, specifically shown in the following formula: OUT(t) = CMD_A(t) ∧ EN_B(t) ∧ (¬LOCKED).

[0036] Wherein, OUT(t) is used to characterize the enable signal output by the cross-fault domain boundary arbiter to the power link; CMD_A(t) is used to characterize the gating / enable signal generated by the control unit; EN_B(t) is used to characterize the enable signal generated by the safety unit, which may be a default low level / disabled state; LOCKED is used to characterize the lockout status flag, which may be a high level indicating that it is locked.

[0037] Therefore, in the cross-fault domain zero-trust security arbitration system and the hierarchical response method based on effect verification for nondeterministic controllers provided in the embodiments of this application, the security unit has a one-way veto right and can independently veto the output of the control unit (EN_B=0 means blocking), while the control unit cannot bypass the veto of the security unit.

[0038] In the cross-fault domain zero-trust security arbitration system and the hierarchical response method based on effect verification for nondeterministic controllers provided in this application embodiment, the enable signal EN_B is disabled by default (default low level). Energy loss is used to characterize conditions such as open circuit, high impedance, or voltage below a threshold. When energy is lost, the output signal generated by the cross-fault domain boundary arbitrator is forced into a blocking state. This blocking state can be locked, and the locking is maintained independently of programmable processor instruction execution.

[0039] In some implementations, the enable signal may employ complementary dual-track coding; the complementary dual-track coding is used to perform a consistency check, determining that the enable signal is invalid if there is coding distortion in either track or if the dual-track coding is not complementary.

[0040] It is understandable that the control commands issued by the control unit can be received by the execution unit, which can then control the power link to perform corresponding actions. However, there may be a certain error between the standard action corresponding to the control command and the corresponding action performed by the execution unit controlling the power link. The accumulation of this error can be regarded as the residual energy accumulation metric. For example, if the control unit issues a deceleration control command, but the execution unit fails to decelerate effectively, the residual energy accumulation metric will continue to increase, indicating that there is an execution anomaly.

[0041] The safety lock response time can be used to characterize the worst-case time from when the safety unit detects that the condition requiring incapacity has been met, to when the cross-fault domain boundary arbiter actually switches the execution unit to the incapacitated state via an output signal. In some implementations, the safety lock response time can be characterized by τ_lock.

[0042] Understandably, the safety response needs to be faster than the control command path to ensure that the safety unit has already vetoed the erroneous command output by the control unit before it propagates to the execution unit and causes harm. Therefore, the system safety lock response time τ_lock satisfies... T_control represents the control cycle. In some implementations, the ratio of the system security lock response time τ_lock to T_control is k, where k is less than a preset threshold. This is used to characterize that τ_lock is much smaller than T_control.

[0043] For some implementations, the security lock response time can be determined by the following formula: τ_lock = t_iso + t_logic + τ_RC + t_margin.

[0044] Among them, t_iso is used to characterize the upper bound of the isolator propagation delay; t_logic is used to characterize the upper bound of the gating or comparator delay; τ_RC is used to characterize the RC discharge time of the EN node, where the EN node is the node between the pin that outputs the enable signal of the safety unit and the pin that receives the enable signal of the cross-fault domain boundary arbiter; t_margin is used to characterize the process, temperature drift, aging, and electromagnetic interference margins.

[0045] For example, t_iso can be determined by t_pd_max in the isolator datasheet; the upper bound of the gate or comparator delay can be determined by the logic device datasheet; τ_RC can be determined by τ_RC = R_bias × C_par; and t_margin can be determined by taking 20-50% of the total delay.

[0046] Please see Figure 3 , Figure 3 A schematic diagram illustrating the security lock response time is shown. Figure 3 The security lockout response time shown includes the time period from the moment the level of the security unit processor EN_B pin begins to change, through the digital isolator, arbitration logic, EN node RC, until the moment the level change of the cross-fault domain boundary arbitrator output OUT is completed.

[0047] In a specific example, a typical value of t_iso may be 10-50ns; a typical value of t_logic may be 5-20ns; a typical value of τ_RC may be 100-500ns; a typical value of t_margin may be 50-200ns. Thus, for example, it is possible to design τ_lock = 50ns + 20ns + 500ns + 200ns = 770ns ≈ 1μs.

[0048] In addition, the safety lock response time can also be constrained by the control period of the system. The core is to make the safety lock response time much shorter than the control period. For some implementations, a timing asymmetry ratio k = τ_lock / T_control may be defined. In a specific example, the timing asymmetry ratio k may be ≤ 0.01, that is, the safety lock response time does not exceed 1% of the control period.

[0049] For a specific example, for a control frequency of 1kHz, the control period T_control = 1ms, and at this time the safety lock response time τ_lock may be set to 1μs.

[0050] In Figure 2 , the safety lock response time may be set by a timing constraint unit 270. The timing constraint unit 270 is connected to the control unit 210.

[0051] In some implementations, the method for measuring and verifying the safety lock response time may be as follows: first, the measurement start point is defined as the moment when the level of the EN_B pin of the processor in the safety unit starts to change; the measurement end point is defined as the moment when the change of the output level of the arbiter OUT across the fault domain boundary is completed. Then the judgment criterion is defined: the time taken for the level to change from a high level (>V_IH) to a low level (<V_IL).

[0052] Thus, the safety lock response time can be obtained by oscilloscope capture and calculation. An oscilloscope with a sampling rate ≥100MS / s, a probe bandwidth ≥100MHz, and a number of measurement channels ≥2 is used to capture the EN_B and OUT points simultaneously. The test is performed under relatively harsh operating conditions, for example, high temperature, large C_par, and large interference. Specifically, N consecutive measurements (N≥1000) may be performed, and the τ_lock value of each time is recorded. Then the maximum value, average value, and standard deviation are counted, so that the maximum value must be less than the design target τ_lock_target.

[0053] The following section details how to calculate the residual energy accumulation metric. First, the instantaneous execution residual can be defined by the following formula: e(t) = |y_cmd(t) - y_actual(t)|; where e(t) represents the instantaneous execution residual; y_cmd(t) represents the standard action corresponding to the control command issued by the control unit, such as standard position, speed, or torque; and y_actual(t) represents the actual value of the corresponding action measured by sensors and controlled by the power link of the execution unit.

[0054] Furthermore, time windows can be divided to calculate the cumulative residual energy within the time window. This involves converting the continuous Σe(t) = ∫[t-T_w, t] e(τ) dτ into a discrete implementation: Σe[k] = Σe[k-1] + e[k]×Δt - e[kM] × Δt. Here, Σe[k] represents the discrete form of the cumulative residual energy Σe(t); T_w represents the integration time window, typically 10-30 ms; and M represents the number of sampling points within the window, for example, M = T_w / Δt. The discrete form of Σe[k] can also be approximated as the cumulative residual energy metric.

[0055] Among them, the risk level is a weighted aggregation of multi-dimensional risk inputs, used to characterize the current overall risk level of the system. In other words, the risk level can be used to characterize the comprehensive risk level of the system. In some implementations, the risk level can be characterized by the weighted aggregation of multi-dimensional risk parameters.

[0056] The following section details how to calculate the risk level. First, multidimensional risk parameters can be collected; for example, x1, x2, x3, and x4 can be used to characterize the risk parameters of each dimension.

[0057] It's important to note that the risk parameters used to determine the risk level in each dimension are essentially risk parameters that do not match the reference parameters corresponding to the control instructions. Understandably, for each control instruction, there are corresponding reference parameters. If a parameter in a certain dimension does not match the corresponding reference parameter, then that dimension's parameter can be considered a risk parameter and subsequently used to calculate the risk level. This mismatch can be significant, for example, a difference greater than a certain threshold.

[0058] For example, x1 can be used to characterize the normalized thermal energy index, specifically E_thermal; x2 can be used to characterize the velocity deviation index, specifically calculated by |v_cmd - v_actual| / v_rated; x3 can be used to characterize the position deviation index, specifically calculated by |p_cmd - p_actual| / p_tolerance; and x4 can be used to characterize the communication status index, specifically calculated by timeout count / timeout threshold.

[0059] Furthermore, the risk parameters across each dimension are then normalized. For example, this can be achieved through... = clamp(x_i, 0, 1) is used to limit the risk parameters of each dimension to the range [0,1]. That is, it includes x1, x2, x3 and x4.

[0060] Then, the risk level is calculated using a weighted average. Specifically, this can be expressed as D(t) = Σ w_i × The result is obtained by calculating (t), where D(t) is used to characterize the risk level; w_i is the weight coefficient of each dimension, satisfying Σw_i = 1.

[0061] The sensitivity calibration method for the weight coefficients can be as follows: First, prepare a calibration dataset containing N sets of typical working condition data; then calculate the sensitivity for the risk level of each dimension: S_i = (1 / N) × Σ|D(x + Δx_i × e_i) - D(x)| / Δx_i; then normalize the sensitivity corresponding to the risk level of each dimension to obtain the corresponding weight coefficient: w_i = S_i / Σ S_j.

[0062] Optionally, to avoid non-differentiability or instability caused by a certain maximum value operator, a smoothed LogSumExp can be used to obtain a continuously differentiable version of D(t): D(t) = (1 / β) · log(Σ exp(β · w_i · )), where β is the smoothing coefficient, which degenerates into the max operator when β approaches ∞, making it easier to calibrate and analyze.

[0063] Additionally, the risk level can also include a current signal dimension, which can be characterized by the square of the current. The initial current signal of the execution unit can be acquired through an independent analog-to-digital conversion channel. The sampling rate of the analog-to-digital conversion channel can be greater than or equal to 10kHz, for example, a typical value can be 100kHz; the resolution of the analog-to-digital conversion channel can be greater than or equal to 12 bits; and the number of sampling channels of the analog-to-digital conversion channel can be greater than or equal to two phase currents.

[0064] Furthermore, zero-point correction and range conversion can be performed on the acquired initial current signal to obtain the actual current value. For example, the actual current value can be calculated using the following formula: I_actual[k] = (ADC_raw[k] - ADC_offset) × Scale_factor.

[0065] Then, the squared value of the current at the current sampling point can be calculated. Specifically, it can be calculated using the following formula: I_squared[k] = I_actual[k] × I_actual[k].

[0066] Alternatively, the normalized thermal energy index can be determined by accumulating values ​​through a sliding window. Specifically, the window length can be determined to be N sampling points, for example, a typical value is N=100, corresponding to a sampling rate of 10ms@10kHz; thus, a sliding window array can be maintained: I_squared_window[0..N-1].

[0067] Then, the accumulated value of the sliding window can be updated through window movement operations. Subtract the oldest sample from the accumulated value: Sum = Sum - I_squared_window[N-1]; then add the new sample to the accumulated value: Sum = Sum + I_squared[k]; then shift the window array one position to the right and place the new sample at the beginning of the window.

[0068] Finally, calculate the normalized thermal energy index: E_thermal = Sum / N_normalize.

[0069] In some implementations, the safety unit includes a hierarchical response state machine, which can be used to determine the enable signal corresponding to the hierarchical response based on a dynamic threshold by measuring the risk level and residual energy accumulation.

[0070] For example, the hierarchical response state machine can have multiple states, as shown in Table 2 below.

[0071] Table 2 Definitions of each state in a hierarchical response state machine In addition, the enabling signal corresponding to the graded response is determined based on the risk level and residual energy accumulation metric, combined with the dynamic threshold, as shown in Table 3 below.

[0072] Table 3 Enable signals corresponding to graded responses It can be seen that in Table 2, the risk degree D(t) is compared with the corresponding dynamic threshold Th_D1; the residual energy cumulative metric Σe(t) is compared with the corresponding dynamic thresholds Th_E1 and Th_E2, so as to determine to switch to the level L0, L1, L2 or L3 respectively. Herein, EN_B is an enable signal.

[0073] Herein, the dynamic thresholds Th_D1, Th_E1 and Th_E2 are dynamically and flexibly adjusted, rather than fixed.

[0074] Optionally, in some implementations, more detailed state transition conditions may be passed through Figure 4 to be represented. Reference is made to Figure 4 , Figure 4 which shows a schematic diagram of state transitions of the hierarchical response state machine provided in the embodiments of the present application.

[0075] Transition from S0 to S1: D(t)>Th_D1 Transition from S1 to S0: D(t)<Th_D1 and v_actual<v_safe_threshold Transition from S1 to S2: Σe(t)>Th_E2 (residual integral over-limit is executed) Transition from S2 to S3: automatic transition, and an execution confirmation timeout timer is started Transition from S3 to S5: a valid execution confirmation is received (consecutive N sampling results are consistent) Transition from S3 to S4: execution confirmation timeout (ack_timer>T_ack) Transition from S4 to S5: automatic transition, and cross-fault-domain boundary arbiter locking is triggered Transition from S5 to S0: the external reset confirmation signal is valid.

[0076] For some implementations, the output logic of the hierarchical response state machine may be described through the following Table 4: Table 4 Output Logic of Hierarchical Response State Machine Reference is made to Figure 5 , Figure 5 which shows a structural block diagram of the cross-fault-domain zero-trust security arbitration system oriented to non-deterministic controllers. Herein, Figure 5 the connection relationships of the respective modules, components and the like included in the system 500 shown in Figure 2 will not be repeated herein.

[0077] Through Figure 5This demonstrates the core logic of the closed-loop verification of the Σe(t) effect. Specifically, the control unit issues a control command y_cmd, and then the execution unit generates the actual state y_actual after the response; the safety unit further calculates the deviation e(t) = |y_cmd - y_actual|, and generates the residual energy accumulation metric Σe(t) based on the sliding window integral; then it is compared with the dynamic threshold to drive the hierarchical response state machine; the state machine outputs an enable signal EN_B to the cross-fault domain boundary arbiter.

[0078] Therefore, in the cross-fault domain zero-trust security arbitration system for nondeterministic controllers and the hierarchical response method based on effect verification provided in the embodiments of this application, the triggering condition (Σe(t) exceeding the limit) is bound to the execution effect (y_actual deviates from y_cmd) to achieve "trigger-execution" closed-loop verification.

[0079] In some implementations, the safety unit and the control unit are physically isolated in terms of power supply, which can be achieved through independent power modules. That is, the control unit is powered by power module PS_A, outputting voltage VCC_A; the safety unit is powered by an independent power module PS_B, outputting voltage VCC_B. PS_A and PS_B are not electrically connected and each has its own independent input rectification, filtering, and voltage regulation circuits.

[0080] The inputs of PS_A and PS_B can share the main power supply, but their outputs must be electrically isolated. PS_B can employ a wide input range design to ensure normal operation even in the event of a PS_A failure. The isolation voltage between the two power modules should meet system safety requirements, such as a 2500V AC withstand voltage.

[0081] In some implementations, the security unit and the control unit are physically isolated in the clock dimension, which can be achieved using independent crystal oscillators. That is, the control unit uses crystal oscillator OSC_A to provide clock CLK_A; the security unit uses independent crystal oscillator OSC_B to provide clock CLK_B. OSC_A and OSC_B are two physically isolated oscillators with no phase-locked relationship.

[0082] The clock frequency of the safety unit can be more than 10 times higher than the sampling frequency of the control unit to ensure that the safety unit can complete multiple sampling and calculations within the control cycle. No synchronization is required between the two clocks; cross-domain signals are processed by a dedicated cross-clock domain synchronization circuit (CDC).

[0083] In some implementations, the safety unit and the control unit are physically isolated in the ground plane dimension, which can be achieved through separate ground planes. Specifically, the control unit ground plane GND_A and the safety unit ground plane GND_B can be physically separated. Cross-domain signals are electrically isolated and coupled through digital isolators, optocouplers, or isolation transformers. Digital isolators are suitable for high-speed signal transmission; optocouplers are suitable for medium- and low-speed signal transmission; and isolation transformers are suitable for applications requiring energy transmission.

[0084] Optionally, in the cross-fault domain zero-trust security arbitration system and effect verification-based hierarchical response method for nondeterministic controllers provided in this application embodiment, the control unit and the security unit can be divided into independent physical partitions on the PCB. An isolation strip is set between the two partitions. The width of the isolation strip meets the creepage distance requirements under the rated voltage, and no traces are arranged within the isolation strip. The isolation effect can be enhanced by slotting or opening, and the number of cross-domain traces is minimized, limited to necessary signal and enable lines. In addition, cross-domain traces must cross the isolation strip perpendicularly and not run parallel within the isolation strip.

[0085] The design parameters for the isolation zone can be found in Table 5 below.

[0086] Table 5 Design parameters of the isolation zone Optionally, the pin for the safety unit's output enable signal can be configured as an open-drain output, and the node between the pin for the safety unit's output enable signal and the pin for the cross-fault domain boundary arbiter receiving the enable signal is connected to ground via an external power loss blocking element. Optionally, the pin for the safety unit's output enable signal can also be configured as an open-collector output, thereby enabling the formation of a power failure tripping topology.

[0087] The energy loss blocking element can include a precision resistor, a depletion-mode FET, or a constant current source circuit. A depletion-mode FET is in a conducting state when its gate is unbiased and can serve as an equivalent pull-down impedance; a constant current source circuit can provide a stable pull-down sink current over a wide voltage range.

[0088] Specifically, in the normal enabled state, the processor in the safety unit turns off the internal MOSFET of the EN_B pin. The EN node is pulled high through an external pull-up or a gating circuit input pull-up, indicating that execution is allowed. In the disabled state, the safety unit processor turns on the internal MOSFET of the EN_B pin, and the EN node is pulled low, indicating that execution is prohibited. In the fault state, i.e., when there is a lack of power, when the safety unit loses power, the processor resets, or the EN_B pin enters a high-impedance state, the EN node is only affected by the power shortage blocking element and is pulled low, defaulting to the disabled state. This is the circuit implementation of the power shortage blocking principle; that is, the system needs to actively output energy to drive the enable high level in order to allow execution, and automatically blocks when the energy is lost.

[0089] In some implementations, the energy shortage blocking element needs to satisfy R_bias ≥ V_supply / I_OL_max. That is, when the EN_B node outputs a low level, i.e., the internal MOSFET is turned on, sufficient current needs to be injected to pull the EN node low. Here, V_supply represents the system's supply voltage, which can also be considered as the EN node's power supply voltage (V); I_OL_max represents the maximum sink current of the open-drain output; and R_bias represents the resistance value of the energy shortage blocking element. The constraint on R_bias is the lower limit constraint of the open-drain drive capability.

[0090] In addition, the energy shortage blocking element must also satisfy R_bias ≤ V_IL_max / (I_leak + I_inj). That is, when the EN_B node outputs a high-impedance state, it must be ensured that the EN node can be reliably pulled low to a logic low level by the energy shortage blocking element. Here, V_IL_max represents the maximum low-level threshold for the input of the subsequent arbitrator, in volts (V); I_leak represents the leakage current of the open-drain output, in amperes (A); and I_inj represents the externally injected interference current, in amperes (A). The constraint on R_bias is the upper limit constraint for leakage / input current.

[0091] It is understandable that the EN node has a parasitic capacitance C_par. When EN_B switches from a high level to a high impedance state, the EN node can discharge through R_bias and C_par. The discharge time constant must satisfy the safety response time requirement τ_RC = R_bias × C_par ≤ τ_lock_target. Here, τ_RC characterizes the RC discharge time constant in seconds; C_par characterizes the parasitic capacitance of the EN node, specifically including PCB trace capacitance, pin capacitance, arbitrator input capacitance, etc., in fractional capacitors (F); and τ_lock_target characterizes the target value for the safety lockout response time in seconds. The constraint on R_bias is an RC discharge speed constraint.

[0092] Optionally, to minimize static power consumption, R_bias can be set to a larger value, provided that the energy shortage blocking element meets the above constraints. Static power consumption can be characterized as P_static = V_supply 2 / R_bias. The constraint on R_bias mentioned above is a power consumption trade-off constraint.

[0093] An example of the design of relevant parameters for an energy shortage blocking element can be found in Table 6 below.

[0094] Table 6. Design Examples of Relevant Parameters for Energy Delay Blocking Elements Based on the relevant parameters in Table 5, we can calculate that: R_bias ≥ 3.3V / 20mA = 165Ω; R_bias ≤ 0.8V / 11μA ≈ 72.7kΩ; R_bias ≤ 1μs / 50pF = 20kΩ. Therefore, we can comprehensively select R_bias = 10kΩ to satisfy all constraints and balance response speed and power consumption.

[0095] As can be seen from the foregoing introduction, the energy loss blocking element can be a depletion-type field-effect transistor; the depletion-type field-effect transistor is used to realize the zero-bias constant conduction pull-down configuration with Vgs=0, that is, it is used to present the conduction state when the gate is unbiased, as an equivalent pull-down impedance element.

[0096] For example, the depletion-type field-effect transistor is an N-channel depletion-type field-effect transistor, with its source connected to the node of the cross-fault domain boundary arbiter that receives the enable signal, and both its gate and drain grounded, forming a constant-conduction pull-down configuration with zero gate-source voltage.

[0097] Please see Figure 6 , Figure 6 A connection diagram of a depletion-type field-effect transistor in an embodiment of this application is shown. Figure 6 In this context, the depletion-type field-effect transistor 601 is an N-channel depletion-type field-effect transistor. Its source is connected to the node EN between the pin of the cross-fault domain boundary arbiter that receives the enable signal, and its gate and drain are both grounded to GND_B.

[0098] In a depletion-mode field-effect transistor (FET), the gate is in an on-state when unbiased. The equivalent pull-down impedance is determined by the device's RDS(on), typically ranging from 1 to 10 kΩ. This means that when the safety cell loses power, the FET's gate is naturally at zero bias, and the EN node is pulled low. Using a depletion-mode FET as an energy loss blocking element provides higher immunity to interference injection compared to a precision resistor. Specifically, this can be an N-channel depletion-mode FET.

[0099] The design constraints for this depletion-type field-effect transistor may include RDS(on)_max ≤ V_IL_max / (I_leak + I_inj); and RDS(on)_min ≥ V_supply / I_D_max.

[0100] In some implementations, the energy loss blocking element is a constant current source circuit; the constant current source circuit is used to provide a constant pull-down sink current within a reference voltage range. For example, the constant current source circuit can be configured as a JFET constant current diode.

[0101] For example, one end of the constant current source circuit is connected to the node between the pin that outputs the enable signal of the safety unit and the pin that receives the enable signal of the cross-fault domain boundary arbiter, and the other end of the constant current source is grounded.

[0102] Please see Figure 7 , Figure 7 A schematic diagram of the connection of the constant current source circuit in an embodiment of this application is shown. Figure 7 In the constant current source circuit 701, one end is connected to the EN node between the pin EN_B of the safety unit output enable signal and the pin of the cross-fault domain boundary arbiter that receives the enable signal, and the other end of the constant current source is grounded to GND_B.

[0103] The constant current source circuit can provide a stable pull-down current over a wide voltage range, resulting in stronger resistance to power supply ripple and noise interference, and a more certain discharge speed.

[0104] For example, the discharge time can be calculated using the following formula: τ_discharge = C_par × ΔV / I_sink. Taking C_par = 50Pf; ΔV = 3.3V; and I_sink = 0.5Ma as an example, the calculated τ_discharge = 330ns.

[0105] Alternatively, a constant current source circuit can be configured using two BJT transistors Q1 / Q2 and a set resistor R_set. Here, I_sink ≈ V_BE / R_set ≈ 0.6V / R_set. This provides a constant pull-down sink current over a wide voltage range and offers strong resistance to power supply ripple. Specifically, a two-transistor constant current source configuration can be used. The design formula is: I_sink ≈ V_BE / R_set ≈ 0.6V / R_set. For example, τ_discharge = C_par × ΔV / I_sink = 50pF × 3.3V / 0.5mA = 330ns.

[0106] Please see Figure 8 , Figure 8 This diagram illustrates the connection of a two-transistor constant current source circuit according to an embodiment of this application. The specific connection method is as follows: Figure 8 As shown. In some embodiments, the interlock reset module may include a lock trigger; wherein the lock trigger is used to send a lock status signal to the cross-fault domain boundary arbiter to control the blocking state to remain locked; in addition, the lock trigger is also used to send an unlock signal to the cross-fault domain boundary arbiter upon receiving a reset confirmation signal independent of the control unit.

[0107] For example, the lock trigger signal (LOCK_TRIG) can be output from the processor in the security unit to the set terminal (S terminal) of the lock trigger; while the reset confirmation signal (RESET_CONFIRM) is output from a separate signal source, such as a physical button or a separate reset circuit, to the reset terminal (R terminal) of the lock trigger. The output (Q terminal) of the lock trigger is a lock status signal, with a high level indicating that it is locked; the lock status output is connected to the cross-fault domain boundary arbiter and logically combined with the EN_B signal. The lock trigger signal is used to control the blocking state to remain locked; the reset confirmation signal is used to unlock the blocking state.

[0108] The locking logic of this locking trigger can be described by the following formulas: EN_effective = EN_B ∧¬LOCKED; and OUT = CMD_A ∧ EN_effective.

[0109] In other words, once the system enters the locked state (LOCKED=1), even if the safety unit re-outputs EN_B=1, the cross-fault domain boundary arbiter remains disabled until an external reset confirmation signal is valid. This prevents the safety disabled state from being bypassed by automatic software restart, and locks the disabled state when a high-level response state is reached.

[0110] Understandably, the residual energy accumulation module is located within the safety unit, accumulating the deviation between the control command and the actual execution effect within a sliding time window as a residual energy accumulation metric Σe(t); when Σe(t) exceeds a dynamic threshold, a graded response is triggered. The sampling period can vary depending on the specific components used to implement the residual energy accumulation module.

[0111] Optionally, the residual energy accumulation module can be implemented using an analog integrator circuit, which includes capacitors, resistors, and operational amplifiers. This analog integrator circuit is suitable for ultra-low latency, continuous-time systems. The output voltage is proportional to the integral of the deviation time.

[0112] Specifically, the residual energy accumulation module may include an analog integrator circuit, which includes a capacitor, a resistor, and an operational amplifier. One end of the resistor is connected to the safety domain and is used to receive the execution deviation of the control command in each sampling period. The other end of the resistor is connected to one end of the capacitor and the input terminal of the operational amplifier. The other end of the capacitor and the output terminal of the operational amplifier are connected to the safety domain together as the output terminal for outputting the residual energy accumulation metric.

[0113] For example, please refer to Figure 9 , Figure 9 A schematic diagram of an analog integrator circuit in an embodiment of this application is shown. The analog integrator circuit 800 includes a capacitor 801, a resistor 802, and an operational amplifier 803. One end of the resistor 802 is connected to the safety domain and is used to receive the execution deviation e(t) of the control command for each sampling period. The other end of the resistor 802 is connected to one end of the capacitor 801 and the input terminal of the operational amplifier 803. The other end of the capacitor 801 and the output terminal of the operational amplifier 803 are both connected to the safety domain, serving as the output terminal for outputting the residual energy accumulation metric Σe.

[0114] Please see Figure 10 , Figure 10 A schematic diagram of a precision full-wave rectifier circuit in an embodiment of this application is shown. Since e(t) = y_cmd - y_actual can be positive or negative, its absolute value needs to be taken before being fed into the integrator. Figure 10 The circuit consists of an operational amplifier OPA1, two Schottky diodes D1 / D2, and resistors R1 / R2. R1 = R2 = 10kΩ, and D1 / D2 are low forward voltage drop Schottky diodes such as BAT54.

[0115] Please see Figure 11 , Figure 11A schematic diagram of the reset circuit in an embodiment of this application is shown. When the hierarchical response state machine recovers from an abnormal state to a normal state, the integrating capacitor needs to be discharged to zero. A reset switch SW is connected in parallel across the integrating capacitor C_int, controlled by the safety domain state machine. When the reset switch SW is closed, the integrating capacitor C_int discharges, and V_sigma is reset to 0V.

[0116] Please see Figure 12 , Figure 12 A schematic diagram of the window comparator and threshold trigger circuit in an embodiment of this application is shown. The integral output of Σe is compared with the two-stage thresholds L1 / L2 to output a graded trigger signal. The two comparators correspond to the reference voltages Th_E1 and Th_E2, respectively. The threshold voltage setting formula is: Th_E1 = 0.5V × (Σe_L1_target / Σe_full_scale) - Th_E2 = 0.5V × (Σe_L2_target / Σe_full_scale).

[0117] For some implementations, the selection of parameters for resistors, capacitors, and operational amplifiers can be determined by Table 7 below.

[0118] Table 7 Parameter Selection Optionally, the residual energy accumulation module can be implemented using a digital accumulator or a sliding window accumulator. The digital accumulator or sliding window accumulator is suitable for general-purpose digital systems and is easy to tune.

[0119] Specifically, the residual energy accumulation module includes a digital accumulator or a sliding window accumulator. The input terminals of the digital accumulator and the sliding window accumulator are connected to the security domain to receive the execution deviation of the control command for each sampling period. The output terminals of the digital accumulator and the sliding window accumulator are connected to the security domain to output the residual energy accumulation metric.

[0120] The implementation can be chosen from digital accumulators, sliding window accumulators, or analog integrator circuits, depending on the specific application scenario. A comparison of the analog and digital implementations is shown in Table 8 below.

[0121] Table 8 Comparison of Simulation and Data Implementation Optionally, the residual energy accumulation module includes a field-programmable gate array (FPGA). The input of the FPGA is connected to the security domain to receive the execution deviation of the control command for each sampling period. The output of the FPGA is also connected to the security domain to output the residual energy accumulation metric. The FPGA uses a sliding window to accumulate data, maintaining a circular buffer of N sampling points and updating the accumulated sum of the residual energy metric in real time. The FPGA is suitable for scenarios with high determinism and high sampling rates.

[0122] Optionally, the residual energy accumulation module adopts the current square time integral form, where the accumulation metric is the time integral of the current square. This current square time integral form is suitable for applications compatible with thermal protection.

[0123] It should be noted that, regardless of the method used to achieve residual energy accumulation, the accumulation process must meet the monotonicity or equivalent threshold triggering conditions, and the calculation process must be completed independently within the safety unit without relying on the control unit.

[0124] As described above, cross-domain signals are processed by a dedicated cross-clock domain synchronization circuit (CDC). Therefore, in some embodiments, the cross-fault domain zero-trust security arbitration system and the hierarchical response method based on effect verification for nondeterministic controllers provided in this application may further include a cross-domain clock synchronization circuit to prevent signal errors caused by metastable signals between the control unit and the security unit. The cross-clock domain synchronization circuit is connected to both the control unit and the security unit, and is implemented using a dual-flip-flop chain, handshake protocol, or asynchronous first-in-first-out (FIFO) architecture. The cross-clock domain synchronization circuit is used to enable signal communication between the control unit and the security unit.

[0125] In some implementations, a cross-clock domain synchronization circuit can be implemented using a dual-flip-flop chain synchronizer to synchronize a single-bit signal from the source clock domain to the target clock domain. The source clock domain can be a security unit or a control unit, and the target clock domain can be a domain within the security unit or control unit other than the source clock domain.

[0126] The specific control process can be as follows: First, the source clock domain generates a signal sig_src; then, the first-stage flip-flop in the target clock domain samples sig_src at the rising edge of the target clock, at which point it may enter a metastable state; thus, the second-stage flip-flop in the target clock domain samples the output of the first-stage flip-flop at the next rising edge of the target clock, and after one clock cycle, the first-stage flip-flop has stabilized; finally, the output of the second-stage flip-flop is output as the synchronized signal sig_dst.

[0127] It should be noted that the flip-flops in this example require the use of dedicated synchronous flip-flop units, meaning that the two flip-flops should be physically placed adjacent to each other to reduce wiring delay. For example, a 2-3 stage flip-flop chain can be used; the more stages, the longer the metastable MTBF.

[0128] Optionally, the cross-clock domain synchronization circuit may also include a pulse stretcher to ensure that it is captured by the target clock domain.

[0129] The specific control flow can be as follows: First, detect the rising edge of the input pulse pulse_in; when the rising edge is detected, load the widening counter to the preset value STRETCH_CYCLES and set the output pulse_out high; in each clock cycle, if the counter > 0, decrement by 1 and keep the output high, if the counter = 0, set the output low; the widened pulse width = STRETCH_CYCLES × T_clk.

[0130] In addition, cross-clock domain synchronization circuits may also include handshake protocol synchronizers to transmit requests, acknowledgments, and other transactions between security units and control units.

[0131] The specific control flow can be as follows: In the source domain, when a request to be sent is detected, check the busy status flag; if it is not busy, set the request register req_reg to 1; set the busy status busy=1; then wait for the acknowledgment signal ack_sync to return; after detecting ack_sync=1, clear req_reg to 0; finally clear the busy status busy=0.

[0132] In the target domain, the synchronized signal req_dst of req_reg is detected by the synchronizer; if a rising edge of req_dst is detected, it indicates that a new request has been received; then the request is processed, the acknowledgment register ack_reg is set to 1; after waiting for req_dst to go low, ack_reg is cleared to 0.

[0133] Optionally, the cross-clock domain synchronization circuit may also include a first-in-first-out protocol synchronizer, similar to a handshake protocol synchronizer, which will not be described in detail here.

[0134] Optionally, in order to prevent backfeeding energy from the execution unit side through the enable signal interface, the cross-fault domain zero-trust security arbitration system and the hierarchical response method based on effect verification for nondeterministic controllers provided in this application embodiment can also set backfeeding protection at the output of the cross-fault domain boundary arbitrator.

[0135] For example, a back-to-back MOSFET configuration can be used, that is, two back-to-back body diodes are set between the output of the cross-fault domain boundary arbiter and the execution unit. The two body diodes are connected in reverse and grounded at the point where the two body diodes are connected.

[0136] Alternatively, isolation can be achieved directly through a diode, with the anode of the diode connected to the output of the cross-fault domain boundary arbitrator.

[0137] In addition, the power failure tripping topology is described in detail, in conjunction with reverse flow protection. Please refer to [link / reference]. Figure 13 , Figure 13 A schematic diagram of the tripping topology provided in an embodiment of this application is shown.

[0138] exist Figure 13 In this configuration, the EN_B pin of the processor 901 in the security unit is configured as an open-drain output. The open-drain output 9011 in the processor 901 of the security unit is connected to the EN node 902. An energy loss blocking element R_bias (typically 10kΩ) is connected between the EN node and GND_B. The EN node has a parasitic capacitance C_par (typically 50pF).

[0139] The interlock reset module 903 connects the lock trigger signal 9031 to the S terminal of the lock trigger, the reset confirmation signal 9032 (from an independent signal source) is connected to the R terminal of the lock trigger, and the Q terminal output of the lock trigger indicates the locked state 9033. This lock trigger can be an RS trigger.

[0140] In the cross-fault domain boundary arbitrator 230, the signal of EN node 902 is arbitrated with the inverted signal of the locked state 9033, and EN_effective is output. EN_effective is then arbitrated with CMD_A_ISO, and the final output signal OUT is output. In the cross-domain boundary arbitrator 230, regardless of the state of the control command, when the enable signal is in a disabled state, when a locked state signal is received from the interlock reset module, or when energy is lacking, the output is forced into a blocking state to cut off the power link to the execution unit. The safety unit has a one-way veto right over the output of the control unit, and the control unit cannot bypass the veto of the safety unit, nor can it bypass the blocking state.

[0141] In the reverse-current protection 904, the output OUT signal is connected to the power switch driver 9041 through a back-to-back MOSFET.

[0142] In addition, through experimental research, the specifications of each key parameter in the embodiments of this application are determined as shown in Table 9 below.

[0143] Table 9 Key Parameter Specifications In addition, the selection of key components was determined in this application, as shown in Table 10 below.

[0144] Table 10 Key Component Selection For example, testing and verification can be performed as follows: First, perform τ_lock measurement: measure between the EN_B and OUT disabling edges, with a recommended sampling rate ≥100MS / s, and report the worst-case value and statistical distribution. Then, perform R_bias boundary verification: verify that the EN node does not exceed V_IL_max and τ_RC≤τ_lock under maximum C_par and maximum interference / injection conditions. Next, perform CDC stress testing: verify no leaky pulses / no tearing under asynchronous pulse + multi-bit cross-domain testing; evaluate metastable MTBF. Then, perform isolation testing: verify creepage / gap, withstand voltage, surge, and CMTI according to relevant type standards such as IEC 60664. Finally, perform fault injection: verify fail-closed (default disabling) and lockout interlock semantics under voltage spikes / EMI injection.

[0145] It should be noted that the tripping topology in this application is different from that of traditional safety relays. Specific differences can be found in Table 11 below.

[0146] Table 11 Comparison of differences It is evident that the tripping topology in this application is different from that of traditional safety relays.

[0147] The cross-fault domain zero-trust safety arbitration system and the hierarchical response method based on effect verification provided in this application for nondeterministic controllers achieve scenario differentiation by targeting nondeterministic controllers, which differs from the deterministic assumptions of the IEC standard; by making the safety unit and control unit independent, the safety unit does not rely on any state information of the control unit to verify safety, thereby achieving a zero-trust paradigm, which differs from the traditional trusted controller assumption; by measuring residual energy accumulation, the effect verification closed loop is achieved, which differs from the input monitoring of traditional thermal protection; by using dynamic thresholds to determine the enable signal corresponding to the hierarchical response, the adaptive capability is improved, which differs from fixed thresholds; and by setting the safety lockout response time through control cycles, the timing verifiability is achieved, which differs from the prior art without quantification requirements.

[0148] Optionally, in the cross-fault domain zero-trust security arbitration system and effect verification-based hierarchical response method for nondeterministic controllers provided in the embodiments of this application, the control unit and the security unit can be packaged on the same substrate, wherein the control unit and the security unit can be implemented solely through an on-chip isolation structure within the package. Thus, cross-domain coupling can be achieved without forming an isolation path via PCB traces.

[0149] For example, this can be achieved through SiP / 2.5D packaging, on-chip capacitor / transformer isolation core, and industrial / automotive grade verified withstand voltage and CMTI.

[0150] Optionally, the output switch of the cross-fault domain boundary arbiter can be a normally off wide bandgap device, where the conduction channel physically disappears when the gate is unbiased. Therefore, when the enable signal is invalid, the conduction channel physically disappears due to carrier depletion, and there is no intrinsic reverse conduction path.

[0151] For example, driving and protection can be achieved according to power electronics specifications using 650V-level E-mode GaN / SiC devices.

[0152] Optionally, the driving energy of the cross-fault domain boundary arbiter can be obtained by the output carrier of the safety unit through isolation coupling and rectification; when the carrier stops, the actuator naturally enters the safety state due to energy depletion.

[0153] Specifically, the safety unit generates a carrier with a frequency of f0, which is then isolated and coupled to the cross-fault domain boundary arbiter. The cross-fault domain boundary arbiter resonates, selects the frequency, and rectifies it, serving as the sole power supply for the gate drive of the power switch. When the carrier stops, the gate drive voltage decays to below the threshold, thus the cross-fault domain boundary arbiter naturally enters the safe state. Consequently, the carrier envelope modulates the heartbeat frame (sequence number + check code), and continuous check failures trigger disabling.

[0154] Optionally, the system may also include an event logging module for recording relevant fault event data when a disability event is triggered.

[0155] Furthermore, this application compares the effectiveness of the cross-fault domain zero-trust security arbitration system and the hierarchical response method based on effect verification for nondeterministic controllers provided in the embodiments of this application with existing technologies from multiple dimensions. For details, please refer to... Figure 14 , Figure 14 This illustration shows a comparative effect diagram between the cross-fault domain zero-trust security arbitration system for nondeterministic controllers and the hierarchical response method based on effect verification provided in this application, and existing technologies. Figure 14The diagram shows a seven-dimensional comparison. In this seven-dimensional comparison, curve 1010 is a curve composed of data from each dimension corresponding to the cross-fault domain zero-trust security arbitration system for nondeterministic controllers and the hierarchical response method based on effect verification provided in the embodiments of this application; curve 1020 is a curve composed of data from each dimension corresponding to the system in the prior art.

[0156] The seven dimensions specifically include applicable scenarios, fault assumptions, trust models, isolation levels, triggering conditions, execution mechanisms, and timing verification. Regarding applicable scenarios, the technology is upgraded from deterministic control systems to non-deterministic controllers; regarding fault assumptions, it is upgraded from enumerable faults to arbitrary unknown faults / attacks; regarding trust models, it is upgraded from trusted controllers to zero-trust controllers; regarding isolation levels, it is upgraded from functional isolation to cross-fault domain physical isolation; regarding triggering conditions, it is upgraded from fixed thresholds to Σe(t) dynamic effect verification; regarding execution mechanisms, it is upgraded from software triggering to hardware-forced tripping; and regarding timing verification, it is upgraded from the lack of quantification requirements in existing technologies. Measurable. Therefore, the final result is generated. Figure 14 The seven-dimensional comparison diagram is shown.

[0157] Wherein, it is assumed that D1 is used to characterize physical isolation across fault domains; D2 is used to characterize the power failure trip arbitration topology; D3 is used to characterize the Σe(t) effect verification closed loop; and D4 is used to characterize Timing constraints. Therefore, the combined effect is shown in Table 12 below.

[0158] Table 12 Synergistic Effects Therefore, four-dimensional coupling is not a simple superposition, but produces a synergistic effect of 1+1+1+1>4.

[0159] In addition, this application also provides a hierarchical response method based on effect verification for a cross-fault domain zero-trust security arbitration system for nondeterministic controllers, which is applied to the cross-fault domain zero-trust security arbitration system for nondeterministic controllers described in the above embodiments. The method includes steps S110 to S150.

[0160] Step S110: Calculate the execution deviation of the control command e(t) = |y_cmd(t) - y_actual(t)| through a safety unit that is physically isolated from the control unit.

[0161] Step S120: Accumulate the residual energy accumulation measure Σe(t) within the sliding time window.

[0162] Step S130: Calculate the risk level, wherein the risk level is a weighted aggregation of multidimensional risk inputs, used to characterize the current overall risk level of the system.

[0163] Step S140: Drive L0-L3 to trigger a graded response based on the risk level and residual energy accumulation metric.

[0164] Step S150: Perform power failure tripping via the cross-fault domain boundary arbitrator, wherein the system safety lockout response time τ_lock satisfies T_control is the control cycle.

[0165] The relevant descriptions of the above steps can be found in the descriptions of the various system embodiments, and will not be repeated here.

[0166] The following provides a digital logic reference implementation for the security domain, illustrating one specific implementation method of the above scheme.

[0167] cdc_sync.v (Cross-Clock Domain Signal Synchronizer): A chain of two flip-flops with parameterized WIDTH and STAGES. The specific code is as follows: module cdc_sync #( parameter WIDTH = 1, / / Signal bit width parameter STAGES = 2 / / Number of synchronization levels (≥2) ) ( input wire clk_dst, / / Target clock (security domain) Input wire rst_n, / / Asynchronous reset input wire [WIDTH-1:0] sig_src, / / Source signal (control domain) Output wire [WIDTH-1:0] sig_dst / / Synchronized signal (security domain) ); / / Multi-level trigger chain reg [WIDTH-1:0] sync_reg [0:STAGES-1]; integer i; always @(posedge clk_dst or negedge rst_n) begin if (!rst_n) begin for (i = 0; i <STAGES; i = i + 1) sync_reg[i]<= {WIDTH{1'b0}}; end else begin sync_reg[0]<= sig_src; / / First-level sampling (may be metastable) for (i = 1; i <STAGES; i = i + 1) sync_reg[i] <= sync_reg[i-1]; / / Subsequent stages are stable end end assign sig_dst = sync_reg[STAGES-1]; endmodule pulse_stretch.v (pulse stretching module): Stretches narrow pulses to ensure they are captured by a slow clock. The STRETCH_CYCLES parameter is used; the specific code is as follows: module pulse_stretch #( parameter STRETCH_CYCLES = 4 / / Number of stretching cycles ) ( input wire clk, input wire rst_n, input wire pulse_in, output reg pulse_out ); reg [$clog2(STRETCH_CYCLES+1)-1:0] counter; always @(posedge clk or negedge rst_n) begin if (!rst_n) begin counter<= 0; pulse_out <= 1'b0; end else begin if (pulse_in) begin counter <= STRETCH_CYCLES; pulse_out <= 1'b1; end else if (counter>0) begin counter <= counter - 1; pulse_out <= 1'b1; end else begin pulse_out <= 1'b0; end end end endmodule handshake_sync.v (handshake protocol synchronizer): handles cross-clock domain request-confirmation transactions, calling the cdc_sync instance. The specific code is as follows: module handshake_sync ( / / Source clock field (requester) input wire clk_src, input wire rst_src_n, input wire req_pulse, / / Request pulse output reg busy, / / Busy state / / Target clock domain (confirmer) input wire clk_dst, input wire rst_dst_n, Output wire req_sync, / / Request after synchronization input wire ack_pulse / / Acknowledgment pulse ); / / Source field: Request register reg req_reg; wire ack_sync; always @(posedge clk_src or negedge rst_src_n) begin if (!rst_src_n) req_reg<= 1'b0; else if (req_pulse&&!busy) req_reg<= 1'b1; else if (ack_sync) req_reg<= 1'b0; end / / Request signal synchronization to target domain wire req_dst; cdc_sync #(.WIDTH(1), .STAGES(2)) sync_req ( .clk_dst(clk_dst), .rst_n(rst_dst_n), .sig_src(req_reg), .sig_dst(req_dst) ); / / Target domain: edge detection reg req_dst_d; always @(posedge clk_dst or negedge rst_dst_n) begin if (!rst_dst_n) req_dst_d<= 1'b0; else req_dst_d <= req_dst; end assign req_sync = req_dst&&!req_dst_d; / / rising edge / / Target field: Acknowledgment register reg ack_reg; always @(posedge clk_dst or negedge rst_dst_n) begin if (!rst_dst_n) ack_reg<= 1'b0; else if (ack_pulse) ack_reg<= 1'b1; else if (!req_dst) ack_reg<= 1'b0; end / / Confirmation signal synchronized back to source domain cdc_sync #(.WIDTH(1), .STAGES(2)) sync_ack ( .clk_dst(clk_src), .rst_n(rst_src_n), .sig_src(ack_reg), .sig_dst(ack_sync) ); / / Busy status always @(posedge clk_src or negedge rst_src_n) begin if (!rst_src_n) busy<= 1'b0; else busy<= req_reg; end endmodule safety_arbiter.v (main module of the safety arbiter): Includes complete implementations of cross-clock domain synchronization, sliding window thermal energy integration, Σe(t) execution residual integration, execution acknowledgment timeout timer, acknowledgment debouncing, L0-L3 hierarchical response state machine, and output logic. The specific code is as follows: module safety_arbiter ( / / Security Domain Clock and Reset input wire clk_safe, / / Security domain clock 100MHz Input wire rst_n, / / Asynchronous reset (active low) / / Cross-clock domain input (from the control domain, requires synchronization) input wire [15:0] current_adc_async, / / Current ADC value (asynchronous) input wire [31:0] position_enc_async, / / Encoder position (asynchronous) input wire [15:0] velocity_est_async, / / Estimated velocity (asynchronous) Input wire ack_feedback_async, / / Execute confirmation feedback (asynchronously) / / Configuration parameters input wire [15:0] d_threshold_1, / / Level-1 trigger threshold input wire [31:0] sigma_e_threshold, / / Level-2 trigger threshold (cumulative deviation) input wire [15:0] t_ack_cycles, / / Level-3 timeout cycle count / / Output signal output reg enable_out, / / Enable signal (active high, low by default via power shortage blocking components) output reg [2:0] response_level, / / Current response level output reg decel_request, / / Level-1 deceleration request output reg torque_off_cmd / / Level-2 torque off command ); / / ========== Cross-clock domain synchronization ========== wire [15:0] current_adc; wire [31:0] position_enc; wire [15:0] velocity_est; wire ack_feedback; cdc_sync #(.WIDTH(16), .STAGES(2)) sync_current ( .clk_dst(clk_safe), .rst_n(rst_n), .sig_src(current_adc_async), .sig_dst(current_adc) ); / / Encoder position synchronization cdc_sync #(.WIDTH(32), .STAGES(2)) sync_position ( .clk_dst(clk_safe), .rst_n(rst_n), .sig_src(position_enc_async), .sig_dst(position_enc) ); cdc_sync #(.WIDTH(16), .STAGES(2)) sync_velocity ( .clk_dst(clk_safe), .rst_n(rst_n), .sig_src(velocity_est_async), .sig_dst(velocity_est) ); cdc_sync #(.WIDTH(1), .STAGES(3)) sync_ack ( .clk_dst(clk_safe), .rst_n(rst_n), .sig_src(ack_feedback_async), .sig_dst(ack_feedback) ); / / ========== State Definition ========== localparam STATE_NORMAL = 3'b000; localparam STATE_LEVEL1 = 3'b001; localparam STATE_LEVEL2 = 3'b010; localparam STATE_WAIT_ACK = 3'b011; localparam STATE_LEVEL3 = 3'b100; localparam STATE_LOCKOUT = 3'b101; reg [2:0] current_state; reg [2:0] next_state; / / ========== Hazard Calculation (Sliding Window Thermal Energy Integration) ========== reg [31:0] i_squared_sum; reg [31:0] i_squared_window [0:99]; integer i; always @(posedge clk_safe or negedge rst_n) begin if (!rst_n) begin i_squared_sum<= 32'd0; for (i = 0; i<100; i = i + 1) i_squared_window[i]<= 32'd0; end else begin i_squared_sum<= i_squared_sum - i_squared_window

[99] + (current_adc * current_adc); for (i = 99; i>0; i = i - 1) i_squared_window[i]<= i_squared_window[i-1]; i_squared_window[0]<= current_adc * current_adc; end end wire [15:0] danger_index; assign danger_index = i_squared_sum[31:16]; / / ========== Σe(t) performs residual integration (core for effect verification) ========== reg [15:0] v0; reg [31:0] t_since_L1; reg [15:0] v_expected; reg [31:0] sigma_e; localparam A_MAX_PER_CYCLE = 16'd50; always @(posedge clk_safe or negedge rst_n) begin if (!rst_n) begin v0<= 16'd0; t_since_L1<= 32'd0; v_expected<= 16'd0; sigma_e<= 32'd0; end else begin case (current_state) STATE_NORMAL: begin v0<= velocity_est; t_since_L1<= 32'd0; sigma_e<= 32'd0; end STATE_LEVEL1: begin t_since_L1<= t_since_L1 + 1; if (v0>A_MAX_PER_CYCLE * t_since_L1[15:0]) v_expected<= v0 - A_MAX_PER_CYCLE * t_since_L1[15:0]; else v_expected<= 16'd0; / / Σe(t) accumulation: perform residual integration if (velocity_est>v_expected) sigma_e<= sigma_e + (velocity_est - v_expected); else sigma_e<= sigma_e + (v_expected - velocity_est); end default: begin / / Hold end endcase end end / / ========== Implement acknowledgment timeout timer ========== reg [15:0] ack_timer; wire ack_timeout; assign ack_timeout = (ack_timer>= t_ack_cycles); always @(posedge clk_safe or negedge rst_n) begin if (!rst_n) ack_timer<= 16'd0; else if (current_state == STATE_WAIT_ACK) ack_timer<= ack_timer + 1; else ack_timer<= 16'd0; end / / ========== Acknowledge signal debouncing ========== reg [2:0] ack_debounce; wire ack_valid; always @(posedge clk_safe or negedge rst_n) begin if (!rst_n) ack_debounce<= 3'b000; else ack_debounce<= {ack_debounce[1:0], ack_feedback}; end assign ack_valid = (ack_debounce == 3'b111); / / ========== State machine ========== always @(posedge clk_safe or negedge rst_n) begin if (!rst_n) current_state<= STATE_NORMAL; else current_state<= next_state; end always @(*) begin next_state = current_state; case (current_state) STATE_NORMAL: begin if (danger_index>d_threshold_1) next_state = STATE_LEVEL1; end STATE_LEVEL1: begin if (sigma_e>sigma_e_threshold) next_state = STATE_LEVEL2; else if (velocity_est<16'd100&& danger_index<d_threshold_1) next_state = STATE_NORMAL; end STATE_LEVEL2: next_state = STATE_WAIT_ACK; STATE_WAIT_ACK: begin if (ack_valid) next_state = STATE_LOCKOUT; else if (ack_timeout) next_state = STATE_LEVEL3; end STATE_LEVEL3: next_state = STATE_LOCKOUT; STATE_LOCKOUT: next_state = STATE_LOCKOUT; default: next_state = STATE_LOCKOUT; endcase end / / ========== Output logic ========== always @(posedge clk_safe or negedge rst_n) begin if (!rst_n) begin enable_out<= 1'b0; response_level<= 3'd0; decel_request<= 1'b0; torque_off_cmd<= 1'b0; end else begin response_level<= current_state; case (current_state) STATE_NORMAL: begin enable_out<= 1'b1; decel_request<= 1'b0; torque_off_cmd<= 1'b0; end STATE_LEVEL1: begin enable_out<= 1'b1; decel_request<= 1'b1; torque_off_cmd<= 1'b0; end STATE_LEVEL2, STATE_WAIT_ACK: begin enable_out<= 1'b0; decel_request<= 1'b1; torque_off_cmd<= 1'b1; end STATE_LEVEL3: begin enable_out<= 1'b0; decel_request<= 1'b1; torque_off_cmd<= 1'b1; end STATE_LOCKOUT: begin enable_out<= 1'b0; decel_request<= 1'b0; torque_off_cmd<= 1'b0; end default: enable_out<= 1'b0; endcase end end endmodule This application provides a cross-fault domain zero-trust security arbitration system and a hierarchical response method based on effect verification for nondeterministic controllers. The system includes: a control unit, a security unit, a cross-fault domain boundary arbitrator, a residual energy accumulation module that binds Σe(t) to triggering and executing effects, and an interlocked reset module. The cross-fault domain boundary arbitrator is connected to both the control unit and the security unit. The security unit is also connected to both the residual energy accumulation module and the interlocked reset module. The security unit and the control unit are physically isolated in at least one dimension: power, clock, or ground plane. The control unit runs a nondeterministic control strategy and generates control commands. The residual energy accumulation module, located within the security unit, accumulates the deviation between the control commands and the actual execution effect within a sliding time window as a residual energy accumulation metric Σe(t). When Σe(t)... A graded response is triggered when the dynamic threshold is exceeded; the safety unit is used to calculate the risk level and combine it with the residual energy accumulation metric. When the risk level or the residual energy accumulation metric Σe(t) exceeds its corresponding dynamic threshold, the corresponding graded response is triggered. The residual energy accumulation metric is implemented by analog integration, digital accumulation, or sliding window accumulation, driving the safety unit to output a failure enable signal and a lock trigger signal. The risk level is a weighted aggregation of multi-dimensional risk inputs, used to characterize the current overall risk level of the system. The safety unit does not rely on any state information of the control unit to verify safety. The cross-fault domain boundary arbitrator has a power-off tripping topology and is located at the physical boundary between the power link of the control unit and the execution unit. The enable signal is disabled by default. The cross-fault domain boundary arbiter is configured to perform asymmetric arbitration: regardless of the state of the control command, when the enable signal is in a disabled state, a locked state signal is received from the interlock reset module, or when power is lacking, the output is forced into a blocking state to cut off the power link to the execution unit. The safety unit has a one-way veto right over the output of the control unit, and the control unit cannot bypass the veto of the safety unit, nor can it bypass the blocking state. The interlock reset module is used to respond to the lock trigger signal, enter a locked state that cannot be released by the control unit itself, and output a locked state signal. The locked state can only be released independently of the reset confirmation signal of the control unit. The system safety lock response time τ_lock satisfies... T_control represents the control cycle. Physical isolation between the control unit and the safety unit across power, clock, and ground plane dimensions ensures that the safety unit's trust does not depend on any shared resources or status information of the control unit. The safety unit's enable signal directly acts on the enable terminal of the execution unit's power link, bypassing software or complex instruction chains; power loss immediately blocks the process. Dynamic integration of execution residuals binds triggering conditions to execution effects, rather than using fixed thresholds, enabling adaptive management of dynamic operating conditions and making the controller safer to operate.

[0168] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A cross-fault domain zero-trust secure arbitration system for nondeterministic controllers, characterized in that, include: The system comprises a control unit, a safety unit, a cross-fault domain boundary arbiter, a residual energy accumulation module for Σe(t) binding triggering and execution effects, and an interlocked reset module. The cross-fault domain boundary arbiter is connected to the control unit and the safety unit respectively. The safety unit is also connected to the residual energy accumulation module and the interlocked reset module respectively. The safety unit and the control unit are physically isolated in at least one dimension, namely, power, clock or ground plane. The control unit is used to run a nondeterministic control strategy and generate control commands; The residual energy accumulation module is located within the safety unit and accumulates the deviation between the control command and the actual execution effect into a residual energy accumulation metric Σe(t) within a sliding time window; when Σe(t) exceeds the dynamic threshold, a graded response is triggered. The safety unit is used to calculate the risk level and combine it with the residual energy accumulation metric. When the risk level or the residual energy accumulation metric Σe(t) exceeds its corresponding dynamic threshold, a corresponding hierarchical response is triggered. The residual energy accumulation metric is implemented by analog integration, digital accumulation, or sliding window accumulation. It drives the safety unit to output a failure enable signal and a lock trigger signal. The risk level is a weighted aggregation of multi-dimensional risk inputs, used to characterize the current overall risk level of the system. The safety unit does not rely on any state information of the control unit to verify safety. The cross-fault domain boundary arbitrator has a power-off tripping topology and is located at the physical boundary between the power link of the control unit and the execution unit. The enable signal is disabled by default. The cross-fault domain boundary arbitrator is configured to perform asymmetric arbitration: regardless of the state of the control command, when the enable signal is in a disabled state, when a locked state signal is received from the interlock reset module, or when energy is lacking, the output is forced to enter a blocking state to cut off the power link to the execution unit. The safety unit has a one-way veto right over the output of the control unit. The control unit cannot bypass the veto of the safety unit, and the control unit cannot bypass the blocking state. The interlock reset module is used to respond to the lock trigger signal, enter a locked state that cannot be released by the control unit, and output a locked state signal. The locked state can only be released independently of the reset confirmation signal of the control unit. Among them, the system security lock response time τ_lock satisfies T_control is the control cycle.

2. The system according to claim 1, characterized in that, The residual energy accumulation module includes an analog integrator circuit, which includes a capacitor, a resistor, and an operational amplifier. One end of the resistor is connected to the safety unit to receive the execution deviation of the control command in each sampling period. The other end of the resistor is connected to one end of the capacitor and the input terminal of the operational amplifier. The other end of the capacitor and the output terminal of the operational amplifier are connected to the safety unit together as the output terminal for outputting the residual energy accumulation metric.

3. The system according to claim 1, characterized in that, The residual energy accumulation module includes a digital accumulator or a sliding window accumulator. The input terminals of the digital accumulator and the sliding window accumulator are connected to the safety unit to receive the execution deviation of the control command for each sampling period. The output terminals of the digital accumulator and the sliding window accumulator are connected to the safety unit to output the residual energy accumulation metric.

4. The system according to claim 1, characterized in that, The residual energy accumulation module includes a field-programmable gate array (FPGA). The input of the FPGA is connected to the safety unit and is used to receive the execution deviation of the control command for each sampling period. The output of the FPGA is connected to the safety unit and is used to output the residual energy accumulation metric. The FPGA accumulates through a sliding window, maintains a circular buffer of N sampling points, and updates the accumulated sum of the residual energy accumulation metric in real time.

5. The system according to any one of claims 1, 3, and 4, characterized in that, The residual energy accumulation module is used to determine the residual energy accumulation metric by accumulating the execution deviation of the control command in each sampling period.

6. The system according to claim 1, characterized in that, The residual energy accumulation module adopts the current square time integral form, and the residual energy accumulation measure is the current square time integral.

7. The system according to claim 1, characterized in that, The pin that outputs the enable signal of the safety unit is configured with an open-drain output. The node between the pin that outputs the enable signal of the safety unit and the pin that receives the enable signal of the cross-fault domain boundary arbiter is connected to ground through an external power loss blocking element.

8. The system according to claim 7, characterized in that, The energy loss blocking element satisfies: R_bias ≥ V_supply / I_OL_max and R_bias ≤ V_IL_max / (I_leak + I_inj); Where R_bias is used to characterize the resistance value of the energy loss blocking element, V_supply is used to characterize the supply voltage of the system, I_OL_max is the maximum sink current of the open-drain output, V_IL_max is the input low-level threshold, I_leak is the leakage current, and I_inj is the injection current.

9. The system according to claim 7, characterized in that, The energy loss blocking element is a depletion-type field-effect transistor (FET), which is an N-channel depletion-type field-effect transistor. Its source is connected to the node between the pin of the cross-fault domain boundary arbiter that receives the enable signal, and both the gate and drain are grounded, forming a constant conduction pull-down configuration with zero gate-source voltage. The depletion-type field-effect transistor is used to achieve a zero-bias constant-conduction pull-down configuration with Vgs=0, that is, to present a conduction state when the gate is unbiased, as an equivalent pull-down impedance element.

10. The system according to claim 7, characterized in that, The energy loss blocking element is a constant current source circuit. One end of the constant current source circuit is connected to the node between the pin that outputs the enable signal of the safety unit and the pin that receives the enable signal of the cross-fault domain boundary arbiter. The other end of the constant current source is grounded. The constant current source circuit is used to provide a constant pull-down current within the reference voltage range.

11. The system according to claim 1, characterized in that, The interlock reset module includes a lock trigger; The locking trigger is used to send a locking status signal to the cross-fault domain boundary arbiter to control the blocking state to remain locked. The locking trigger is also used to send an unlocking signal to the cross-fault domain boundary arbiter upon receiving a reset confirmation signal independent of the control unit.

12. The system according to claim 1, characterized in that, The system also includes a cross-clock domain synchronization circuit, which is connected to the control unit and the security unit respectively. The cross-clock domain synchronization circuit is implemented using a dual flip-flop chain, a handshake protocol or asynchronous first-in-first-out. The cross-clock domain synchronization circuit is used to enable signal communication between the control unit and the security unit.

13. The system according to claim 1, characterized in that, The security lock response time satisfies: τ_lock = t_iso + t_logic + τ_RC + t_margin; Wherein, τ_lock is used to characterize the safety lock response time, t_iso is used to characterize the upper bound of the isolator propagation delay, t_logic is used to characterize the upper bound of the gating or comparator delay, τ_RC is used to characterize the discharge time of the resistor and capacitor corresponding to the node between the pin that outputs the enable signal of the safety unit and the pin that receives the enable signal of the cross-fault domain boundary arbiter, and t_margin is used to characterize the process, temperature drift, aging, or electromagnetic interference margin.

14. The system according to claim 1, characterized in that, The enabling signal employs complementary dual-track encoding; The complementary dual-track coding is used to perform consistency checks, and if there is coding distortion in either track or the dual-track coding is not complementary, the enable signal is determined to be invalid.

15. The system according to claim 1, characterized in that, The ratio of τ_lock to T_control is k, where k is less than or equal to 0.

01.

16. A hierarchical response method based on effect verification for a cross-fault domain zero-trust security arbitration system for nondeterministic controllers, characterized in that, The method, applied to the cross-fault domain zero-trust security arbitration system for nondeterministic controllers as described in any one of claims 1-13, comprises: The execution deviation of the control command is calculated by a safety unit that is physically isolated from the control unit, e(t) = |y_cmd(t) - y_actual(t)|. The residual energy accumulation measure Σe(t) is obtained by accumulating within the sliding time window; Calculate the risk level, whereby the risk level is a weighted aggregation of multidimensional risk inputs, used to characterize the current overall risk level of the system; The L0-L3 staged response is driven by the risk level and residual energy accumulation metric. Power-off tripping is performed via a cross-fault domain boundary arbitrator, where the system safety lockout response time τ_lock satisfies... T_control is the control cycle.

Images