A clock control circuit, method and system

Abstract

Embodiments of the present application disclose a clock control circuit, method and system. The clock switching module is connected with a first clock source and a second clock source to obtain a first clock signal and a second clock signal, and one of the first clock signal and the second clock signal is selected as a system clock signal output by default. The clock detection module generates a fault signal according to the first clock signal and the second clock signal. The fault processing module sends a control signal to the clock switching module according to the fault signal to control the clock switching module to select the other one of the first clock signal and the second clock signal as the system clock signal output. Thus, the dependence of the region on a single clock source can be broken, the problem of system downtime caused by local clock failure can be reduced, the fault tolerance and operation continuity of the system can be enhanced, and the requirements of automatic driving on high reliability and functional safety can be met.

Description

Technical Field

[0001] This invention relates to the field of power electronics technology, and in particular to a clock control circuit, method, and system. Background Technology

[0002] As the core computing unit of intelligent vehicles, the functional safety of autonomous driving chips is related to the driving safety of vehicles. Therefore, ensuring the continuous and stable operation of key modules inside the chip is of great importance.

[0003] In the prior art, in order to ensure functional safety, the chip is usually divided into a safety island and a SoC (System on Chip) area, and independent clock sources are used as reference clocks to achieve functional isolation between the two.

[0004] However, when the independent clock source of a certain area is missing or the signal is faulty, that area will stop working directly due to the loss of timing reference, which can easily lead to functional degradation or even system crash, making it difficult to meet the high reliability and fault tolerance requirements of high-level autonomous driving systems. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a clock control circuit, method and system that can break the dependence of a region on a single clock source, reduce the occurrence of system downtime caused by local clock failures, enhance the fault tolerance and operational continuity of the system, and meet the requirements of autonomous driving for high reliability and functional safety.

[0006] In a first aspect, embodiments of the present invention provide a clock control circuit, the clock control circuit comprising: A clock switching module is connected to a first clock source and a second clock source, wherein the first clock source is used to output a first clock signal and the second clock source is used to output a second clock signal. A clock detection module, connected to the first clock source and the second clock source, is used to generate a fault signal based on the first clock signal and the second clock signal. The fault handling module is connected to the clock detection module and is used to send a control signal to the clock switching module after receiving the fault signal. The clock switching module is configured to select one of the first clock signal and the second clock signal as the system clock signal output by default, and to select the other of the first clock signal and the second clock signal as the system clock signal output in response to receiving the control signal.

[0007] In some embodiments, the clock detection module is configured to obtain a first feature value corresponding to each fault type of the first clock signal, obtain a second feature value corresponding to each fault type of the second clock signal, obtain a difference value based on the first feature value and the second feature value, compare the difference value with a predetermined threshold, and generate the fault signal in response to the difference value being greater than or equal to the predetermined threshold.

[0008] In some embodiments, the fault signal includes one or more of fault type, confidence level, and domain identifier, wherein the fault type includes one or more of edge stability, clock skew, and clock loss.

[0009] In some embodiments, the clock control circuit further includes: A passive oscillator is used to provide a reference clock signal for the fault handling module.

[0010] In some embodiments, the fault handling module is configured to, in response to receiving the fault signal, determine a fault clock signal based on the fault signal and the reference clock signal, and, in response to the fault clock signal being the default selected clock signal, generate the control signal and send it to the clock switching module.

[0011] In some embodiments, the clock control circuit further includes: The gating module is connected between the clock switching module and the function module.

[0012] In some embodiments, the clock control circuit further includes: A phase-locked loop is connected between the clock switching module and the gating module.

[0013] In some embodiments, the fault handling module is configured to generate an interrupt signal and send it to the gating module in response to the fault clock signal being the default selected clock signal, so as to control the gating module to shut down; generate a control signal and send it to the clock switching module to control the clock switching module to switch the system clock signal; and generate a recovery signal and send it to the gating module in response to detecting the phase-locked loop locked state, so as to control the gating module to turn on.

[0014] In some embodiments, the fault handling module is further configured to record clock switching information, which includes one or more of the following: fault occurrence timestamp, fault domain, switching time, and clock stability indicators after switching.

[0015] Secondly, embodiments of the present invention provide a clock control method, the clock control method comprising: Acquire the first clock signal and the second clock signal; By default, one of the first clock signal and the second clock signal is selected as the system clock signal output. A fault signal is generated based on the first clock signal and the second clock signal; A control signal is generated to select the other of the first clock signal and the second clock signal as the system clock signal output.

[0016] Thirdly, embodiments of the present invention provide a clock control system, the clock control system comprising: The first clock source is used to output the first clock signal; The second clock source is used to output the second clock signal; At least one primary functional module; At least one second functional module; A first clock control circuit, connected to the first clock source and the second clock source, is used to select the first clock signal as the system clock signal by default and output it to the first functional module. In response to detecting a fault in the first clock signal, it selects the second clock signal as the system clock signal and outputs it to the first functional module. The second clock control circuit is connected to the first clock source and the second clock source. It is used to select the second clock signal as the system clock signal by default and output it to the second functional module. In response to detecting a fault in the second clock signal, it selects the first clock signal as the system clock signal and outputs it to the second functional module.

[0017] Fourthly, embodiments of the present invention provide a clock control device, the clock control device comprising: A signal acquisition unit is used to acquire a first clock signal and a second clock signal; The first selection unit is used to select one of the first clock signal and the second clock signal as the system clock signal output by default. A fault signal acquisition unit is used to generate a fault signal based on the first clock signal and the second clock signal; The second selection unit is used to generate a control signal to select the other of the first clock signal and the second clock signal as the system clock signal output.

[0018] Fifthly, embodiments of the present invention provide an electronic device, including a memory and a processor, wherein the memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method as described in the second aspect.

[0019] In a sixth aspect, embodiments of the present invention provide a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the method described in the second aspect.

[0020] The technical solution of this invention connects a clock switching module to a first clock source and a second clock source to obtain a first clock signal and a second clock signal. By default, one of the first clock signal and the second clock signal is selected as the system clock signal output. A clock detection module generates a fault signal based on the first clock signal and the second clock signal. A fault handling module sends a control signal to the clock switching module based on the fault signal to control the clock switching module to select the other of the first clock signal and the second clock signal as the system clock signal output. This breaks the regional dependence on a single clock source, reduces system downtime caused by local clock failures, enhances the system's fault tolerance and operational continuity, and meets the high reliability and functional safety requirements of autonomous driving. Attached Figure Description

[0021] The above and other objects, features and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings, in which: Figure 1 This is a schematic diagram of a clock control system according to an embodiment of the present invention; Figure 2 This is a circuit diagram of the clock control circuit according to an embodiment of the present invention; Figure 3 This is a flowchart of the clock control method according to an embodiment of the present invention; Figure 4 This is a schematic diagram of a clock control device according to an embodiment of the present invention; Figure 5 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0022] The present application is described below based on embodiments, but it is not limited to these embodiments. In the detailed description of the present application below, certain specific details are described in detail. Those skilled in the art can fully understand the present application without these details. To avoid obscuring the substance of the present application, well-known methods, processes, flows, elements, and circuits are not described in detail.

[0023] Furthermore, those skilled in the art should understand that the accompanying drawings provided herein are for illustrative purposes only and are not necessarily drawn to scale.

[0024] Furthermore, it should be understood that in the following description, "circuit" refers to a conductive loop consisting of at least one element or sub-circuit connected by electrical or electromagnetic connections. When an element or circuit is said to be "connected" to another element or "connected" between two nodes, it can be directly coupled or connected to another element, or there may be intermediate elements. The connection between elements can be physical, logical, or a combination thereof. Conversely, when an element is said to be "directly coupled to" or "directly connected" to another element, it means that there are no intermediate elements between them.

[0025] Unless the context explicitly requires it, words such as "including" or "contains" throughout the application should be interpreted as including rather than exclusive or exhaustive; that is, meaning "including but not limited to".

[0026] In the description of this application, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0027] The solutions described in this specification and embodiments, if involving the processing of personal information, will be processed only on the premise of having a legal basis (such as obtaining the consent of the personal information subject, or being necessary for the performance of a contract), and will only be processed within the scope stipulated or agreed upon. A user's refusal to process personal information beyond what is necessary for basic functions will not affect the user's use of basic functions.

[0028] With the rapid development of artificial intelligence technology and the evolution of automotive electronic and electrical architecture, autonomous driving has become a core driving force for the transformation of the modern transportation industry. In autonomous driving systems, the System-on-a-Chip (SoC) serves as the computing center, undertaking critical tasks such as environmental perception, decision-making and planning, and vehicle control. To ensure vehicle safety, the functional safety standard ISO 26262 has been introduced into the automotive electronic design process, which imposes stringent requirements on the Safety Integrity Level (ASIL) of the system. To meet the requirements of high safety levels such as ASIL-D, autonomous driving chips typically adopt a safety island architecture design. As a hardware module independent of the main SoC area, the safety island is responsible for detecting system status, executing safety policies, and taking over vehicle control in the event of a failure in the main system, serving as the last line of defense for the safe operation of the autonomous driving system.

[0029] However, the design of clock systems in existing autonomous driving chip technologies faces significant challenges. Currently, to ensure functional independence, the industry typically configures the safety island and the SoC region to use different clock sources as reference clocks. While this design achieves logical isolation to some extent, it reveals significant limitations in practical applications. Specifically, due to the physical separation of clock sources, when a region (such as the SoC region or safety island) experiences clock signal loss, excessive jitter, or clock skew, that region will lose its timing reference, leading to its inability to continue normal operation.

[0030] This strong dependence on a single clock source and the isolation strategy between regions result in deficiencies in fault tolerance and system reliability in existing technologies. If the main SoC region fails due to a clock fault, and the security island fails to detect it in a timely and accurate manner or is also affected by the clock anomaly, the security of the entire system will face enormous risks.

[0031] To address the problems existing in the prior art, embodiments of the present invention provide a clock control circuit, method, and system to break the dependence of a region on a single clock source, reduce the occurrence of system downtime caused by local clock failures, enhance the fault tolerance and operational continuity of the system, and meet the requirements of autonomous driving for high reliability and functional safety.

[0032] Figure 1 This is a schematic diagram of a clock control system according to an embodiment of the present invention. Figure 1 As shown, the clock control system of this embodiment of the invention is an autonomous driving chip, including a main computing domain A and a safety island B.

[0033] The main computing domain A is the core computing hub of the autonomous driving chip, also known as the SoC domain. It typically employs a heterogeneous computing architecture, integrating modules such as a CPU (Central Processing Unit), GPU (Graphics Processing Unit), NPU (Neural Processing Unit), and high-speed I / O interfaces. The main computing domain is responsible for handling massive amounts of computationally intensive and complex tasks. It receives data from multiple sensor sources and runs a large stack of autonomous driving software algorithms, specifically undertaking high-order tasks such as environmental perception, multi-source data fusion, behavior prediction, and decision planning. The main computing domain possesses a high level of computing power and serves as a bridge connecting the lower-level perception and upper-level decision-making, determining the capability level of the autonomous driving system.

[0034] Safety Island B is an independent subsystem within the chip dedicated to implementing safety-related functions, including dedicated computing units, storage units, power supply modules, and communication buses. Like an independent fortress built for safety tasks, the safety island's core advantages lie in its physical isolation and functional independence. It has its own independent power domain, avoiding power supply crosstalk with non-safety modules (such as the main computing domain). The safety island is equipped with a high-priority interrupt mechanism to ensure that safety-related tasks are executed first. Its internal modules are strictly physically isolated from non-safety areas to prevent fault propagation. The safety island is responsible for handling perception data verification, fault diagnosis, and safety state switching. When the main computing domain fails, the safety island can take over control and perform stable control. It continuously monitors the system's operating status and manages diagnostics, independently performing safety recovery operations. The safety island is the cornerstone of ensuring the safety of autonomous driving and vehicle systems.

[0035] The main computing domain A includes a first clock source 1, a first clock control circuit 2, and at least one first functional module 3. The security island B includes a second clock source 4, a second clock control circuit 5, and at least one second functional module 6. Figure 1 In the illustrated embodiment, the example is given that there are three first functional modules 3 and three second functional modules 6.

[0036] The first clock source 1 is used to output the first clock signal REF_SOC, and the second clock source 4 is used to output the second clock signal REF_FSI.

[0037] The first clock control circuit 2 is connected to the output terminals of the first clock source 1 and the second clock source 4, and is used to select the first clock signal REF_SOC as the system clock signal to be output to the first functional module 3 by default. At the same time, in response to detecting a fault in the first clock signal REF_SOC, the second clock signal REF_FSI is selected as the system clock signal to be output to the first functional module 3.

[0038] The second clock control circuit 5 is connected to the first clock source 1 and the second clock source 4, and is used to select the second clock signal REF_FSI as the system clock signal by default and output it to the second functional module 6. In response to detecting a fault in the second clock signal REF_FSI, it selects the first clock signal REF_SOC as the system clock signal and outputs it to the second functional module 6.

[0039] In other words, the first clock source 1 is the clock source for the main computing domain A, used to provide clock signals to the first functional module 3 of the main computing domain A to realize the functions of the main computing domain A; the second clock source 4 is the clock source for the security island B, used to provide clock signals to the second functional module 6 of the security island B to realize the functions of the security island B. The main computing domain A and the security island B use different clock sources as reference clocks to ensure the functional independence of the security island.

[0040] Under normal circumstances, the first clock control circuit 2 provides the first clock signal REF_SOC output from the first clock source 1 to the first functional module 3. Simultaneously, the first clock control circuit 2 detects whether the first clock signal REF_SOC is faulty. If a fault is detected, it switches to the second clock signal REF_FSI as the system clock signal output to the first functional module 3. This ensures that the main computing domain A can still operate normally even if the first clock source fails, improving system stability.

[0041] Similarly, under normal circumstances, the second clock control circuit 5 provides the second clock signal REF_FSI output from the second clock source 4 to the second functional module 6. Simultaneously, the second clock control circuit 5 detects whether the second clock signal REF_FSI is faulty. If a fault is detected, the first clock signal REF_SOC is switched to be output as the system clock signal to the second functional module 6. This ensures that even if the second clock source fails, the safety island B can still operate normally, improving system stability.

[0042] The first functional module is the functional module in the main computing domain A, such as CPU, NPU, GPU, DSP (digital signal processor), etc.

[0043] The second functional module is the functional module in the security island, such as an independent security processor core, redundant memory and interfaces, dedicated I / O controller, and hardware encryption engine.

[0044] In this embodiment of the invention, a first clock control circuit defaults to selecting a first clock signal as the system clock signal for output to a first functional module. In response to a detected fault in the first clock signal, a second clock signal is selected as the system clock signal for output to the first functional module. Similarly, a second clock control circuit defaults to selecting a second clock signal as the system clock signal for output to a second functional module. In response to a detected fault in the second clock signal, the first clock signal is selected as the system clock signal for output to the second functional module. This breaks the regional dependence on a single clock source, reduces system downtime caused by local clock failures, enhances the system's fault tolerance and operational continuity, and meets the high reliability and functional safety requirements of autonomous driving.

[0045] In this embodiment of the invention, the first clock control circuit and the second clock control circuit can be implemented using the same circuit structure.

[0046] Specifically, Figure 2 This is a circuit diagram of the clock control circuit according to an embodiment of the present invention. Figure 2The clock control circuit shown is either a first clock control circuit or a second clock control circuit, including a clock switching module 71, a clock detection module 72, a fault handling module 73, a passive oscillator 74, a phase-locked loop 75, and at least one gating module 76.

[0047] The clock detection module 72 is connected to the first clock source and the second clock source, and is used to receive the first clock signal REF_SOC and the second clock signal REF_FSI, and generate a fault signal based on the first clock signal REF_SOC and the second clock signal REF_FSI.

[0048] Further, the clock detection module 72 is used to obtain the first feature value corresponding to each fault type of the first clock signal REF_SOC, obtain the second feature value corresponding to each fault type of the second clock signal REF_FSI, obtain the difference value according to the first feature value and the second feature value, compare the difference value with a predetermined threshold, and generate the fault signal in response to the difference value being greater than or equal to the predetermined threshold.

[0049] Specifically, various fault types are pre-defined, such as one or more of edge instability, clock skew, and clock loss.

[0050] The edge stability of a clock signal refers to its transient behavior during high-low level transitions. It describes the deterministic position of the rising or falling edge of the clock signal and is primarily affected by clock jitter and skew. Ideally, the edges should be steep and sharp, but in practical circuits, even small timing deviations can cause waveform distortion. Poor edge stability can compress the data sampling window and cause setup or hold time violations, leading to abnormal system function.

[0051] Clock skew refers to the difference in time it takes for a signal from the same clock source to reach different parts of a digital circuit. This phenomenon is mainly caused by physical factors such as different interconnect path lengths, uneven load capacitance, and temperature variations. Excessive clock skew can cause timing violations, limit the system's operating frequency, and in severe cases, lead to data loss or logic errors.

[0052] Clock loss refers to the phenomenon of interruption or complete loss of clock signal. This fault is usually caused by underlying reasons such as damage to hardware modules.

[0053] Simultaneously, characteristic values ​​are set for each fault type. For example, the characteristic value for edge stability can be one or more of duty cycle, blanking window time, and edge slope. The blanking window time is a time threshold used at the hardware level to filter out false flips. The characteristic value corresponding to clock skew can be the cumulative value of the time interval error over N cycles. The characteristic value corresponding to clock loss can be the number of valid pulses within a specific time window.

[0054] Set a predetermined threshold for each fault type. For example, assuming the characteristic value of edge stability is the blanking window time, its predetermined threshold can be set to 100 ns (nanoseconds); the characteristic value of clock skew is the cumulative value of the time interval error over N cycles, and its predetermined threshold can be set to 5%. The characteristic value corresponding to clock loss is the number of valid pulses within a specific time window, and its predetermined threshold can be a value M, such as 3.

[0055] After receiving the first clock signal REF_SOC and the second clock signal REF_FSI, the clock detection module 72 extracts the first feature value corresponding to each fault type of the first clock signal REF_SOC and extracts the second feature value corresponding to each fault type of the second clock signal REF_FSI.

[0056] The difference between the first and second characteristic values ​​corresponding to the same fault type is taken, and the absolute value of the difference is taken as the difference value.

[0057] The difference value is compared with a corresponding predetermined threshold. In response to the difference value being greater than or equal to the predetermined threshold, a fault signal is generated, indicating that one of the first clock signal REF_SOC and the second clock signal REF_FSI has failed.

[0058] The fault signal can be implemented using fault codes. The fault signal includes one or more of the following: fault type, confidence level, and domain identifier. The fault type characterizes at least one of edge stability, clock skew, and clock loss. The confidence level characterizes the degree of certainty of the fault occurrence; a larger difference value indicates a higher confidence level. The domain identifier characterizes a region. If the current clock control circuit is the first clock control circuit in the master computing domain A, then the domain identifier is the domain identifier of the master computing domain A. If the current clock control circuit is the second clock control circuit in the safety island B, then the domain identifier is the domain identifier of the safety island B.

[0059] In some embodiments, the fault signal further includes a first characteristic value and a second characteristic value.

[0060] Then, the generated fault signal is sent to the fault processing module 73.

[0061] In some embodiments, the clock detection module 72 can send the fault signal to the fault handling module 73 via a triple-modulus redundancy circuit. The triple-modulus redundancy circuit replicates the same module three times, allowing these three modules to receive the same input (fault signal) in parallel and execute operations independently. A majority voter is introduced at the outputs of these three modules. The voter decides based on the principle of majority rule; that is, when two or more of the three outputs are consistent, it is taken as the final correct output of the system. This mechanism allows the system to automatically shield against faults caused by external interference or soft errors in individual modules. As long as the extremely low probability event of multiple modules failing simultaneously does not occur, the system can achieve real-time error correction without interrupting operation.

[0062] The passive oscillator 74 provides a reference clock signal to the fault handling module 73, enabling the fault handling module 73 to perform its corresponding functions. The passive oscillator 74 can be an RC type passive oscillator. This allows the fault handling module to operate independently with its built-in passive oscillator, without relying on an external reference clock, and to continue functioning normally even if the external clock fails.

[0063] The fault handling module 73 is connected to the clock detection module 72 and is used to send a control signal to the clock switching module 71 after receiving the fault signal, so as to realize clock switching.

[0064] Furthermore, the fault handling module 73 is configured to, in response to receiving the fault signal, determine a fault clock signal based on the fault signal and the reference clock signal, and, in response to the fault clock signal being the default selected clock signal, generate the control signal and send it to the clock switching module.

[0065] Specifically, when the fault handling module 73 receives the fault signal, it indicates that one of the first clock signal REF_SOC and the second clock signal REF_FSI has failed. In this case, if the fault is in its own clock signal, it needs to switch to the other's clock signal; if the fault is in the other's clock signal, no switching is required. Therefore, after receiving the fault signal, the fault handling module 72 needs to determine the clock signal that has failed.

[0066] The fault processing module 73 determines a fault clock signal based on the fault signal and the reference clock source. As described above, the fault signal includes information such as fault type, confidence level, domain identifier, first feature value, and second feature value. Therefore, the fault processing module 73 obtains the first and second feature values ​​from the fault signal. Simultaneously, it obtains a third feature value based on the reference signal provided by the passive oscillator 74. The third feature value is compared with the first and second feature values ​​respectively to obtain the fault clock signal from the first and second clock signals, i.e., the fault clock signal. The method of obtaining the third feature value is similar to that of obtaining the first and second feature values, and will not be described again in this embodiment.

[0067] It should be noted that the embodiments of the present invention are illustrated using the scenario where the reference clock signal provided by the passive oscillator 74 does not fail and at most one of the first clock signal and the second clock signal fails. For other special scenarios (such as the reference clock signal failing, or the first clock signal and the second clock signal failing simultaneously), the basic scheme of the embodiments of the present invention can be extended, and the embodiments of the present invention will not be elaborated here.

[0068] In response to the fault clock signal being the default selected clock signal, the fault handling module 73 generates the control signal and sends it to the clock switching module 71.

[0069] Specifically, if the clock control circuit where the fault handling module 73 is located is a first clock control circuit, and the fault clock signal is a first clock signal, then the control signal is generated and sent to the clock switching module 71; or, if the clock control circuit where the fault handling module 73 is located is a second clock control circuit, and the fault clock signal is a second clock signal, then the control signal is generated and sent to the clock switching module 71.

[0070] In this embodiment, the gating module 76 is connected between the clock switching module 71 and the functional modules. At this time, the clock switching module 71 is connected to the functional modules through the gating module 76. When the gating module 76 is turned on, the clock switching module 71 directly provides the selected clock signal to the functional modules, which can directly use the clock signal provided by the clock source.

[0071] In some embodiments, the clock control circuit further includes a phase-locked loop (PLL) 75 connected between the clock switching module 71 and the gating module 76. In this case, the clock switching module 71 is connected to the functional modules via the PLL and the gating module 76. When the gating module 76 is turned on, the clock signal received by these functional modules is a signal processed by the PLL. The connection method can be specifically configured according to the needs of the functional modules.

[0072] The clock switching module 71 is configured to select one of the first clock signal and the second clock signal as the system clock signal output by default, and to select the other of the first clock signal and the second clock signal as the system clock signal output in response to receiving the control signal.

[0073] Specifically, during the initialization phase, the clock switching module 71 selects its own clock signal as the system clock signal output. That is, when the clock switching module 71 belongs to the first clock control circuit, it selects the first clock signal as the system clock signal output; when the clock switching module 71 belongs to the second clock control circuit, it selects the second clock signal as the system clock signal output. Afterwards, upon receiving a control signal from the fault handling module 73, the clock switching module 71 selects the other of the first and second clock signals as the system clock signal output. That is, when the clock switching module 71 belongs to the first clock control circuit, if it receives a control signal, it selects the second clock signal as the system clock signal output; when the clock switching module 71 belongs to the second clock control circuit, if it receives a control signal, it selects the first clock signal as the system clock signal output.

[0074] Specifically, the fault handling module 73, in response to the fault clock signal being the default selected clock signal, generates an interrupt signal and sends it to the gating module 76 to control the gating module 76 to turn off; it generates a control signal and sends it to the clock switching module 71 to control the clock switching module 71 to switch the system clock signal; and in response to detecting the phase-locked loop (PLL) locked state, it generates a recovery signal and sends it to the gating module 76 to control the gating module to turn on. After testing, under a 38.4MHz clock signal, the switching time is approximately 200ns, the PLL locking time is approximately 50μs, and the recovery time of 10ms meets the ASIL-D requirement.

[0075] In some embodiments, the fault handling module 73 is further configured to record clock switching information, which includes one or more of the following: fault occurrence timestamp, fault domain, switching time, and clock stability indicators after switching. Other devices (such as vehicle infotainment systems) can read the clock switching information via the JTAG system bus.

[0076] In this embodiment of the invention, a clock switching module is connected to a first clock source and a second clock source to obtain a first clock signal and a second clock signal. By default, one of the first clock signal and the second clock signal is selected as the system clock signal output. A clock detection module generates a fault signal based on the first clock signal and the second clock signal. A fault handling module sends a control signal to the clock switching module based on the fault signal to control the clock switching module to select the other of the first clock signal and the second clock signal as the system clock signal output. This breaks the regional dependence on a single clock source, reduces the occurrence of system downtime due to local clock failures, enhances the system's fault tolerance and operational continuity, and meets the high reliability and functional safety requirements of autonomous driving.

[0077] Figure 3 This is a flowchart of a clock control method according to an embodiment of the present invention. Figure 3 As shown, the clock control method of this invention includes the following steps: Step S100: Obtain the first clock signal and the second clock signal.

[0078] Step S200: By default, one of the first clock signal and the second clock signal is selected as the system clock signal output.

[0079] Step S300: Generate a fault signal based on the first clock signal and the second clock signal.

[0080] Step S400: Generate a control signal to select the other of the first clock signal and the second clock signal as the system clock signal output.

[0081] In this embodiment of the invention, a clock switching module is connected to a first clock source and a second clock source to obtain a first clock signal and a second clock signal. By default, one of the first clock signal and the second clock signal is selected as the system clock signal output. A clock detection module generates a fault signal based on the first clock signal and the second clock signal. A fault handling module sends a control signal to the clock switching module based on the fault signal to control the clock switching module to select the other of the first clock signal and the second clock signal as the system clock signal output. This breaks the regional dependence on a single clock source, reduces the occurrence of system downtime due to local clock failures, enhances the system's fault tolerance and operational continuity, and meets the high reliability and functional safety requirements of autonomous driving.

[0082] Figure 4 This is a schematic diagram of a clock control device according to an embodiment of the present invention. Figure 4As shown, the clock control device of this embodiment includes a signal acquisition unit 81, a first selection unit 82, a fault signal acquisition unit 83, and a second selection unit 84. The signal acquisition unit 81 acquires a first clock signal and a second clock signal. The first selection unit 82 defaults to selecting one of the first clock signal and the second clock signal as the system clock signal output. The fault signal acquisition unit 83 generates a fault signal based on the first clock signal and the second clock signal. The second selection unit 84 generates a control signal to select the other of the first clock signal and the second clock signal as the system clock signal output.

[0083] In this embodiment of the invention, a clock switching module is connected to a first clock source and a second clock source to obtain a first clock signal and a second clock signal. By default, one of the first clock signal and the second clock signal is selected as the system clock signal output. A clock detection module generates a fault signal based on the first clock signal and the second clock signal. A fault handling module sends a control signal to the clock switching module based on the fault signal to control the clock switching module to select the other of the first clock signal and the second clock signal as the system clock signal output. This breaks the regional dependence on a single clock source, reduces the occurrence of system downtime due to local clock failures, enhances the system's fault tolerance and operational continuity, and meets the high reliability and functional safety requirements of autonomous driving.

[0084] Figure 5 This is a schematic diagram of an electronic device according to an embodiment of the present invention. In this embodiment, the electronic device 9 includes a server, a terminal, etc. Figure 5 As shown, the electronic device 9 includes at least one processor 91; a memory 92 communicatively connected to at least one processor 91; and a communication component 93 communicatively connected to a scanning device, the communication component 93 receiving and transmitting data under the control of the processor 91; wherein the memory 92 stores instructions executable by at least one processor 91, the instructions being executed by at least one processor 91 to implement the above-described clock control method.

[0085] Specifically, the electronic device includes: one or more processors 91 and a memory 92. Figure 5 Taking a processor 91 as an example, the processor 91 and the memory 92 can be connected via a bus or other means. Figure 5 Taking a bus connection as an example, memory 92, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Processor 91 executes various functional applications and data processing of the device by running the non-volatile software programs, instructions, and modules stored in memory 92, thereby implementing the aforementioned clock control method.

[0086] The memory 92 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; the data storage area may store an option list, etc. Furthermore, the memory 92 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 92 may optionally include memory remotely located relative to the processor 91, and these remote memories may be connected to external devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0087] One or more modules are stored in memory 92, and when executed by one or more processors 91, they execute the clock control method in any of the above method embodiments.

[0088] The above-mentioned products can perform the methods provided in the embodiments of this application, and have the corresponding functional modules and beneficial effects of performing the methods. For technical details not described in detail in this embodiment, please refer to the methods provided in the embodiments of this application.

[0089] In this embodiment of the invention, a clock switching module is connected to a first clock source and a second clock source to obtain a first clock signal and a second clock signal. By default, one of the first clock signal and the second clock signal is selected as the system clock signal output. A clock detection module generates a fault signal based on the first clock signal and the second clock signal. A fault handling module sends a control signal to the clock switching module based on the fault signal to control the clock switching module to select the other of the first clock signal and the second clock signal as the system clock signal output. This breaks the regional dependence on a single clock source, reduces the occurrence of system downtime due to local clock failures, enhances the system's fault tolerance and operational continuity, and meets the high reliability and functional safety requirements of autonomous driving.

[0090] Another embodiment of the present invention relates to a non-volatile storage medium for storing a computer-readable program for use by a computer to execute some or all of the above-described method embodiments.

[0091] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0092] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A clock control circuit, characterized in that, The clock control circuit includes: A clock switching module is connected to a first clock source and a second clock source, wherein the first clock source is used to output a first clock signal and the second clock source is used to output a second clock signal. A clock detection module, connected to the first clock source and the second clock source, is used to generate a fault signal based on the first clock signal and the second clock signal. The fault handling module is connected to the clock detection module and is used to send a control signal to the clock switching module after receiving the fault signal. The clock switching module is configured to select one of the first clock signal and the second clock signal as the system clock signal output by default, and to select the other of the first clock signal and the second clock signal as the system clock signal output in response to receiving the control signal.

2. The clock control circuit according to claim 1, characterized in that, The clock detection module is used to obtain a first feature value corresponding to each fault type of the first clock signal, obtain a second feature value corresponding to each fault type of the second clock signal, obtain a difference value based on the first feature value and the second feature value, compare the difference value with a predetermined threshold, and generate the fault signal in response to the difference value being greater than or equal to the predetermined threshold.

3. The clock control circuit according to claim 2, characterized in that, The fault signal includes one or more of fault type, confidence level, and domain identifier, wherein the fault type includes one or more of edge stability, clock skew, and clock loss.

4. The clock control circuit according to claim 1, characterized in that, The clock control circuit also includes: A passive oscillator is used to provide a reference clock signal for the fault handling module.

5. The clock control circuit according to claim 4, characterized in that, The fault handling module is used to respond to receiving the fault signal, determine the fault clock signal based on the fault signal and the reference clock signal, and generate the control signal to send to the clock switching module if the fault clock signal is the default selected clock signal.

6. The clock control circuit according to claim 5, characterized in that, The clock control circuit also includes: The gating module is connected between the clock switching module and the function module.

7. The clock control circuit according to claim 6, characterized in that, The clock control circuit also includes: A phase-locked loop is connected between the clock switching module and the gating module.

8. The clock control circuit according to claim 7, characterized in that, The fault handling module is used to generate an interrupt signal and send it to the gate control module in response to the fault clock signal being the default selected clock signal, so as to control the gate control module to shut down. The control signal is generated and sent to the clock switching module to control the clock switching module to switch the system clock signal; in response to detecting the phase-locked loop locked state, a recovery signal is generated and sent to the gating module to control the gating module to turn on.

9. The clock control circuit according to claim 1, characterized in that, The fault handling module is also used to record clock switching information, which includes one or more of the following: fault occurrence timestamp, fault domain, switching time, and clock stability indicators after switching.

10. A clock control method, characterized in that, The clock control method includes: Acquire the first clock signal and the second clock signal; By default, one of the first clock signal and the second clock signal is selected as the system clock signal output. A fault signal is generated based on the first clock signal and the second clock signal; A control signal is generated to select the other of the first clock signal and the second clock signal as the system clock signal output.

11. A clock control system, characterized in that, The clock control system includes: The first clock source is used to output the first clock signal; The second clock source is used to output the second clock signal; At least one primary functional module; At least one second functional module; A first clock control circuit is connected to the first clock source and the second clock source. It is used to select the first clock signal as the system clock signal by default and output it to the first functional module. In response to detecting a fault in the first clock signal, it selects the second clock signal as the system clock signal and outputs it to the first functional module. The second clock control circuit is connected to the first clock source and the second clock source. It is used to select the second clock signal as the system clock signal by default and output it to the second functional module. In response to detecting a fault in the second clock signal, it selects the first clock signal as the system clock signal and outputs it to the second functional module.

12. A clock control device, characterized in that, The clock control device includes: A signal acquisition unit is used to acquire a first clock signal and a second clock signal; The first selection unit is used to select one of the first clock signal and the second clock signal as the system clock signal output by default. A fault signal acquisition unit is used to generate a fault signal based on the first clock signal and the second clock signal; The second selection unit is used to generate a control signal to select the other of the first clock signal and the second clock signal as the system clock signal output.

13. An electronic device comprising a memory and a processor, characterized in that, The memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method as described in claim 10.

14. A computer-readable storage medium storing computer program instructions thereon, characterized in that, The computer program instructions, when executed by a processor, implement the method as described in claim 10.

Images