Fault injection circuit and fault injection system

Abstract

A fault injection circuit (100) comprises setting circuits (10a, 10b), an AND circuit (20), a monitoring circuit (30), and a stop circuit (40), which are configured from hardware. The setting circuits (10a, 10b) each configure the occurrence of the same fault injection. If the occurrence of fault injection is configured in both setting circuits (10a, 10b), the AND circuit (20) outputs a fault injection occurrence condition establishment signal which indicates establishment of a fault injection occurrence condition. The monitoring circuit (30) monitors whether the fault injection occurrence condition establishment signal has been output from the AND circuit (20) in a normal operation mode of a device under a fault injection test. If the fault injection occurrence condition establishment signal has been output from the AND circuit (20) when in the normal operation mode, the stop circuit (40) stops the fault injection into the device subjected to the test.

Description

Fault Injection Circuit and Fault Injection System

[0001] The present disclosure relates to a fault injection circuit and the like for performing a fault injection test.

[0002] Patent Document 1 describes a technique for performing a fault injection test without changing the configuration of existing hardware by using only software.

[0003] International Publication No. 2014 / 196059

[0004] However, the technique disclosed in Patent Document 1 has the following problems.

[0005] There is a possibility that a fault cannot be injected in the same manner as the operation when an actual hardware fault occurs, resulting in low test reliability. When the software for injecting a fault and the software for detecting a fault are processed by the same CPU (Central Processing Unit), the processing timing of each may deviate, making it impossible to perform the intended test. The processing time of the fault injection software increases the duration of the fault injection test, which affects the startup time of the system. Software-based fault injection has lower test coverage than hardware-based fault injection. While hardware-based fault injection can perform multiple fault injections in parallel, software-based fault injection requires processing each of the multiple fault injections sequentially, which takes time.

[0006] On the other hand, in hardware-based fault injection, there is a risk that fault injection is erroneously performed in a normal operation mode where no fault injection is performed.

[0007] Therefore, the present disclosure provides a fault injection circuit and the like that can reduce the risk of erroneous fault injection.

[0008] The fault injection circuit according to this disclosure is a fault injection circuit for performing a fault injection test, comprising two or more setting circuits, a determination circuit, a monitoring circuit, and a stop circuit, each configured by hardware, wherein the two or more setting circuits each set the occurrence of the same fault injection, the determination circuit determines whether the occurrence of the fault injection has been set in all of the two or more setting circuits, and outputs a fault injection occurrence condition fulfillment signal indicating that the conditions for fault injection have been met if the occurrence of the fault injection has been set in all of the two or more setting circuits, the monitoring circuit monitors whether the fault injection occurrence condition fulfillment signal has been output from the determination circuit in the normal operating mode of the device to be tested for fault injection, and the stop circuit stops the fault injection to the target device if the fault injection occurrence condition fulfillment signal has been output from the determination circuit in the normal operating mode.

[0009] The fault injection system according to this disclosure comprises the above-described fault injection circuit and a power control circuit that turns off the power to the fault injection circuit in the normal operating mode.

[0010] These comprehensive or specific embodiments may be implemented as a system, method, integrated circuit, computer program, or recording medium such as a computer-readable CD-ROM, or as any combination of a system, method, integrated circuit, computer program, and recording medium.

[0011] According to one aspect of this disclosure, the fault injection circuit and the like can reduce the risk of fault injection occurring by mistake.

[0012] This is a block diagram showing an example of a fault injection system according to an embodiment. This is a block diagram showing an example of a setting circuit according to an embodiment. This is a block diagram showing a first example of a camera display system to which the fault injection circuit according to an embodiment is applied. This is a diagram illustrating fault injection to the video input section in the first example. This is a timing chart of each signal in the camera display system in the first example. This is a block diagram showing a second example of a camera display system to which the fault injection circuit according to an embodiment is applied. This is a diagram illustrating fault injection to the safety mechanism in the second example.

[0013] The embodiments will be described in detail below with reference to the drawings.

[0014] The embodiments described below are all general or specific examples. The numerical values, shapes, materials, components, arrangement positions of components, and connection configurations shown in the following embodiments are examples only and are not intended to limit this disclosure.

[0015] (Embodiment) The following describes the fault injection circuit and fault injection system according to the embodiment.

[0016] Figure 1 is a block diagram showing an example of a fault injection system 1 according to an embodiment.

[0017] The fault injection system 1 includes a fault injection circuit 100, a power supply control circuit 50, and an AND circuit 60.

[0018] The fault injection circuit 100 is a circuit for performing a fault injection test to verify whether the safety mechanism for detecting faults is functioning correctly. For example, the fault injection test is performed by injecting a fault into the IF (Intended Function) of the device being tested when the device is started up.

[0019] The fault injection circuit 100 includes two or more setting circuits, an AND circuit 20, a monitoring circuit 30, and a stop circuit 40. The two or more setting circuits, the AND circuit 20, the monitoring circuit 30, and the stop circuit 40, as well as the power control circuit 50 and the AND circuit 60, are each configured by hardware. In Figure 1, setting circuits 10a and 10b are shown as two or more setting circuits. In the following description, the two or more setting circuits will be referred to as setting circuits 10a and 10b, but the fault injection circuit 100 may include three or more setting circuits.

[0020] Setting circuits 10a and 10b each configure the occurrence of the same fault injection. For example, as shown in Figure 1, setting circuits 10a and 10b each accept the same fault injection configuration. The fault injection configuration includes settings indicating the type of fault to be injected by fault injection, and settings indicating the start or stop of fault injection. By providing setting circuits 10a and 10b (hardware) that configure the occurrence of the same fault injection, redundancy can be achieved, reducing the risk of fault injection occurring erroneously.

[0021] Here, the details of the setting circuits 10a and 10b will be explained using Figure 2.

[0022] Figure 2 is a block diagram showing an example of a setting circuit 10a according to an embodiment. In the following description, one of the setting circuits 10a among two or more setting circuits will be explained, but since each of the two or more setting circuits has the same components, the explanation of setting circuit 10a can also be applied to all of the setting circuits among the two or more setting circuits.

[0023] The setting circuit 10a has a write protection unit 11 and a register unit 12. In other words, two or more setting circuits each have a write protection unit 11 and a register unit 12.

[0024] The write protection unit 11 provides protection against writing to the register unit 12. In order to write information indicating the occurrence of fault injection to the register unit 12, it is necessary to release the protection against writing to the register unit 12, thus reducing the risk of accidental fault injection.

[0025] For example, the write protection unit 11 may set an enable flag (e.g., a flag such as 0x01) and release the protection when it obtains an enable signal from an external circuit (e.g., a CPU) of the fault injection circuit 100. Since the write protection unit 11 needs to obtain an enable signal in order to write information indicating the occurrence of fault injection to the register unit 12, the risk of accidental fault injection can be reduced.

[0026] For example, the write protection unit 11 may set a predetermined write key (for example, a key such as 0x21E4_0BB6) and release the protection when it obtains the predetermined write key from an external circuit of the fault injection circuit 100. Since the write protection unit 11 needs to obtain the predetermined write key in order to write information indicating the occurrence of fault injection to the register unit 12, the risk of accidental fault injection can be reduced.

[0027] The register section 12 is controlled by an external circuit of the fault injection circuit 100. For example, the register section 12 stores information indicating the type of fault to be injected by fault injection. This allows the type of fault to be injected to be set. For example, if the device targeted for fault injection testing is a device in a camera display system, the types of faults may include write control faults, read control faults, address faults, or memory faults. For example, suppose that information indicating a write control fault is stored at address 0x0001, information indicating a read control fault is stored at address 0x0002, information indicating an address fault is stored at address 0x0004, and information indicating a memory fault is stored at address 0x0008. In this case, selecting address 0x0001 allows a write control fault to be injected, selecting address 0x0002 allows a read control fault to be injected, selecting address 0x0004 allows an address fault to be injected, and selecting address 0x0008 allows a memory fault to be injected.

[0028] Furthermore, for example, the register unit 12 stores information indicating the start or stop of fault injection. This makes it easy to start or stop fault injection. For example, suppose that information indicating the start of fault injection is stored at address 0x0000, and information indicating the stop of fault injection is stored at address 0x0010. In this case, fault injection can be started by selecting address 0x0000, and fault injection can be stopped by selecting address 0x0010.

[0029] In this way, by providing a register section 12 controlled by an external circuit of the fault injection circuit 100, the fault injection process can be reduced according to the use case, thereby shortening the processing time. In addition, the timing of fault injection can be freely set.

[0030] Returning to the explanation in Figure 1, the AND circuit 20 determines whether fault injection has been set in all of the setting circuits 10a and 10b. The AND circuit 20 is an example of a determination circuit. For example, setting circuits 10a and 10b each output a signal (e.g., a high-level signal) to the AND circuit 20 indicating that fault injection has been set when fault injection has been set. The AND circuit 20 outputs a fault injection condition fulfillment signal indicating that the fault injection condition has been met when fault injection has been set in all of the setting circuits 10a and 10b. For example, the AND circuit 20 outputs a fault injection condition fulfillment signal (e.g., a high-level signal) when high-level signals are output from both setting circuits 10a and 10b.

[0031] The monitoring circuit 30 monitors whether a fault injection condition is met signal has been output from the AND circuit 20 in the normal operating mode of the device being tested for fault injection. For example, as shown in Figure 1, a signal indicating whether the current operating mode of the device is the normal operating mode or the fault injection operating mode is input to the monitoring circuit 30 from an external circuit of the fault injection circuit 100. The normal operating mode is the mode in which the device performs normal operations after startup. The fault injection operating mode is the mode in which the fault injection test is performed while the device is startup. When a signal indicating that the current operating mode of the device is the normal operating mode is input to the monitoring circuit 30, it monitors whether a fault injection condition is met signal has been output from the AND circuit 20.

[0032] Furthermore, the monitoring circuit 30 may notify of an abnormality when the AND circuit 20 outputs a signal indicating that the fault injection conditions have been met during normal operation. This allows the user or others to be notified of any fault injection abnormalities.

[0033] The stop circuit 40 stops fault injection to the target device when the AND circuit 20 outputs a fault injection condition condition signal during normal operation mode. Specifically, when the monitoring circuit 30 detects that the AND circuit 20 has output a fault injection condition condition signal, it instructs the stop circuit 40 to stop fault injection to the target device. This ensures that fault injection can be stopped even if it occurs unintentionally during normal operation mode.

[0034] The power control circuit 50 turns off the power to the fault injection circuit 100 in normal operation mode. This reduces the risk of accidental fault injection and also reduces power consumption, as the power to the fault injection circuit 100 is turned off in normal operation mode. The power control circuit 50 also outputs a reset signal to the AND circuit 60 in normal operation mode. When a reset signal is output, the AND circuit 60 stops fault injection to the target device. The AND circuit 60 is an example of a reset circuit. When a reset signal is output, fault injection to the target device is stopped, thus reducing the risk of accidental fault injection. In this way, the power control circuit 50 and the AND circuit 60 are provided to further reduce the risk of accidental fault injection.

[0035] As explained above, even with redundancy provided by setting circuits 10a and 10b (hardware) that set the occurrence of the same fault injection, there is a risk of erroneous fault injection if the fault injection condition is met signal is faulty, such as when the AND circuit 20 fails, or when the wiring that transmits the fault injection condition met signal output by the AND circuit 20 fails. In contrast, the monitoring circuit 30 monitors the fault injection condition met signal, and if the fault injection condition met signal, which is normally output in the fault injection operation mode, is output in the normal operation mode, fault injection to the target device is stopped. Therefore, the risk of erroneous fault injection can be reduced. Furthermore, since the fault injection circuit 100 is configured as hardware, high-speed and high-coverage fault injection testing can be performed.

[0036] Next, we will explain two examples of applications for the fault injection circuit 100.

[0037] First, the first example will be explained using Figures 3 to 5.

[0038] Figure 3 is a block diagram showing a first example of a camera display system to which the fault injection circuit 100 according to the embodiment is applied.

[0039] For example, the camera display system includes a camera 200, a video input unit 300, an image anomaly detection unit 400, a frame memory 500, a video output unit 600, and a display unit 700. The camera 200 outputs image data obtained by imaging to the video input unit 300. The video input unit 300 writes the image data input from the camera 200 to the frame memory 500. The video output unit 600 reads the image data from the frame memory 500 and outputs it to the display unit 700 (for example, an LCD (Liquid Crystal Display)), and the display unit 700 displays the image. Figure 5 illustrates an example where the initial value of the frame memory 500 is black, but the initial value of the frame memory 500 is not limited to black and is not particularly limited. In the first example, the device targeted for fault injection testing is the video input unit 300 of the camera display system.

[0040] When the video input unit 300 receives a fault injection signal from the fault injection circuit 100, a fault injection is performed in the video input unit 300. For example, if the fault injection signal indicates a write control fault, a write abnormality can be intentionally generated from the video input unit 300 to the frame memory 500.

[0041] The image anomaly detection unit 400 checks the image data output by the video input unit 300 to the frame memory 500 and detects a malfunction in the video input unit 300. For example, the image anomaly detection unit 400 determines that the video input unit 300 is malfunctioning if writing to the frame memory 500 stops for a certain period of time or longer. The image anomaly detection unit 400 also has a function to notify of the anomaly.

[0042] Here, the details of fault injection into the video input unit 300 will be explained using Figures 4 and 5.

[0043] FIG. 4 is a diagram for explaining fault injection to the video input unit 300 in the first example. FIG. 4 shows a configuration around the video input unit 300.

[0044] For example, the video input unit 300 includes an AND circuit 301 and a write control unit 302. It is assumed that in a fault injection operation mode, a fault injection occurrence condition satisfaction signal is generated, the stop circuit 40 does not stop the fault injection, the power supply control circuit 50 does not output a reset signal, and a fault injection signal is output from the AND circuit 60. The AND circuit 301 receives the fault injection signal from the AND circuit 60 and a signal indicating whether the current operation mode of a target device is a normal operation mode or the fault injection operation mode. For example, the signal is a low-level signal when the current operation mode of the target device is the normal operation mode, and is a high-level signal when the current operation mode of the target device is the fault injection operation mode. The AND circuit 301 outputs the fault injection signal to the write control unit 302 when the fault injection signal (e.g., a high-level signal) is input, and a signal (e.g., a high-level signal) indicating that the current operation mode of the target device is the fault injection operation mode is input.

[0045] The write control unit 302 writes image data input from the camera 200 to the frame memory 500, and when a fault injection signal is input from the AND circuit 301, stops writing to the frame memory 500 for a certain period or more. The image abnormality detection unit 400 detects that writing to the frame memory 500 has been stopped for a certain period or more, and determines that the video input unit 300 is abnormal.

[0046] Figure 5 is a timing chart of each signal in the camera display system in the first example. From top to bottom, Figure 5 shows the timing chart of the camera display system reset state, the camera display system operating mode, image data output by the camera 200, the fault injection condition fulfillment signal output from the AND circuit 20, the fault injection signal output from the fault injection circuit 100, the fault injection abnormality notification output from the monitoring circuit 30, the image data written to the frame memory 500, the image abnormality notification output from the image abnormality detection unit 400, the image data read from the frame memory 500, and the image displayed by the display unit 700 (LCD).

[0047] First, the camera display system starts up when the reset is released. During the camera display system's startup period, the operating mode of the camera display system becomes the fault injection operation mode, and a fault injection test is performed. For example, the fault injection occurrence condition fulfillment signal after redundancy by setting circuits 10a and 10b is output normally in the fault injection operation mode, and a fault injection signal is input from the fault injection circuit 100 to the video input unit 300. Image data showing image A is output from the camera 200, but the video input unit 300 stops writing the image data showing image A to the frame memory 500. The image anomaly detection unit 400 detects that writing to the frame memory 500 has stopped for a certain period of time or longer, and issues an image anomaly notification indicating that the video input unit 300 is abnormal. This confirms that the image anomaly detection unit 400 is correctly detecting anomalies in response to fault injection, or in other words, that the anomaly detection function of the image anomaly detection unit 400 is working correctly. Furthermore, since the display unit 700 does not display image A but instead displays a black image, users can confirm that the fault injection test is being performed correctly by checking the display unit 700.

[0048] Next, the startup period of the camera display system ends, the operation mode of the camera display system shifts to the normal operation mode, and normal operation (for example, the operation of displaying an image output from the camera 200 on the display unit 700) is performed in the normal operation period. Image data representing an image B is output from the camera 200, the video input unit 300 writes the image data representing the image B into the frame memory 500, the video output unit 600 reads the image data representing the image B from the frame memory 500, and the display unit 700 displays the image B.

[0049] In the normal operation mode, even if the fault injection occurrence condition satisfaction signal is incorrectly activated due to a fault, the monitoring circuit 30 monitors whether the fault injection occurrence condition satisfaction signal is output from the AND circuit 20 in the normal operation mode. Therefore, the stop circuit 40 invalidates the fault injection signal through fault injection stop processing, and the monitoring circuit 30 can notify the abnormality of the fault injection. Since the fault injection signal is invalidated, the video input unit 300 normally writes the image data representing an image C output from the camera 200 into the frame memory 500. Then, the video output unit 600 reads the image data representing the image C from the frame memory 500, and the display unit 700 displays the image C.

[0050] As described above, the fault injection occurrence condition satisfaction signal is monitored by the monitoring circuit 30, and when the fault injection occurrence condition satisfaction signal that is originally output in the fault injection operation mode is output in the normal operation mode, the fault injection to the video input unit 300 is stopped. Therefore, the risk of erroneous fault injection can be reduced.

[0051] In the first example, a fault injection test was described in which the fault injection circuit 100 performs fault injection on the video input unit 300 to confirm whether the image anomaly detection unit 400, which is located downstream of the video input unit 300 as a safety mechanism for detecting faults, operates correctly. Although not explained here, a fault injection test may also be performed in which the fault injection circuit 100 performs fault injection on the camera 200, frame memory 500, video output unit 600, or display unit 700 to confirm whether the safety mechanism located downstream of the IF (Intended Function) to which the fault injection was performed operates correctly.

[0052] Next, the second example will be explained using Figures 6 and 7.

[0053] Figure 6 is a block diagram showing a second example of a camera display system to which the fault injection circuit 100 according to the embodiment is applied.

[0054] The second example of the camera display system differs in that it includes a video input unit 310 instead of a video input unit 300, and a safety mechanism 410 instead of an image anomaly detection unit 400. Other aspects are the same as in the first example, so their explanation will be omitted, and the following will focus on the differences from the first example.

[0055] In the second example, the device targeted for fault injection testing is the safety mechanism 410 of the camera display system. In other words, fault injection to the safety mechanism 410 is performed when the safety mechanism 410 receives the fault injection signal from the fault injection circuit 100, without the video input unit 300 receiving the fault injection signal from the fault injection circuit 100. The video input unit 310 also notifies the safety mechanism 410 of the status of writing to the frame memory 500.

[0056] Here, the details of fault injection into the safety mechanism 410 will be explained using Figure 7.

[0057] Figure 7 is a diagram illustrating the injection of a fault into the safety mechanism 410 in the second example. Figure 7 shows the configuration of the area surrounding the safety mechanism 410.

[0058] For example, the video input unit 310 has a write control unit 311. The write control unit 311 writes image data input from the camera 200 to the frame memory 500, but if a write control failure or the like occurs, it will stop writing to the frame memory 500 for a certain period of time and notify the safety mechanism 410 of this situation. The safety mechanism 410 (specifically the abnormality detection unit 412) also has a function to notify of abnormalities.

[0059] For example, the safety mechanism 410 includes an AND circuit 411 and an abnormality detection unit 412. Suppose that in fault injection operation mode, a fault injection condition fulfillment signal is generated, the stop circuit 40 does not stop fault injection, the power control circuit 50 does not output a reset signal, and a fault injection signal is output from the AND circuit 60. The AND circuit 411 receives the fault injection signal from the AND circuit 60 and a signal indicating whether the current operating mode of the target device is normal operation mode or fault injection operation mode. For example, this signal is a low-level signal when the current operating mode of the target device is normal operation mode, and a high-level signal when the current operating mode of the target device is fault injection operation mode. If the AND circuit 411 receives a fault injection signal (e.g., a high-level signal) and a signal indicating that the current operating mode of the target device is fault injection operation mode (e.g., a high-level signal), it outputs the fault injection signal to the abnormality detection unit 412.

[0060] The abnormality detection unit 412 has a function equivalent to the image abnormality detection unit 400 in the first example. In the normal operation mode, the abnormality detection unit 412 determines whether the video input unit 310 is abnormal by monitoring whether the video input unit 310 has stopped writing to the frame memory 500 for a certain period of time or longer. On the other hand, in the fault injection operation mode, when a fault injection signal is input from the AND circuit 411, the abnormality detection unit 412 performs the same processing as when the video input unit 310 is abnormal, thereby confirming whether the safety mechanism 410 is operating normally.

[0061] Thus, in the second example, the stop circuit 40 performs fault injection into the safety mechanism 410 that detects abnormalities in the target device when a fault injection condition is met signal is output from the AND circuit 20 in the fault injection operation mode of the target device. This allows confirmation that the safety mechanism 410 that detects abnormalities in the target device is functioning correctly. Furthermore, since fault injection is not performed on IFs (Intended Functions) such as the video input unit 310, the risk of IFs failing due to fault injection can be reduced.

[0062] (Other Embodiments) Embodiments have been described above as examples of the technology relating to this disclosure. However, the technology relating to this disclosure is not limited thereto and can be applied to embodiments that are modified, replaced, added to, or omitted as appropriate. For example, the following modified examples are also included in one embodiment of this disclosure.

[0063] For example, in the above embodiment, the monitoring circuit 30 is described as notifying of an abnormality when a fault injection condition is met signal is output from the AND circuit 20 in the normal operating mode. However, the monitoring circuit 30 does not necessarily have a function to notify of an abnormality.

[0064] For example, in the above embodiment, an example was described in which the setting circuits 10a and 10b have a write protection unit 11, but the setting circuits 10a and 10b do not necessarily have a write protection unit 11.

[0065] In the above embodiment, each component included in the fault injection circuit 100 and the fault injection system 1 is composed of dedicated hardware. Some or all of the functions of the fault injection circuit 100 according to the above embodiment are typically implemented as an integrated circuit (LSI). These may be individually integrated into a single chip, or some or all of them may be integrated into a single chip. Furthermore, the integrated circuit implementation is not limited to an LSI, but may also be implemented using a dedicated circuit or a general-purpose processor. An FPGA (Field Programmable Gate Array) that can be programmed after LSI manufacturing, or a reconfigurable processor that can reconfigure the connections and settings of circuit cells inside the LSI may also be used.

[0066] Furthermore, if advances in semiconductor technology or other derived technologies lead to the emergence of integrated circuit technologies that can replace LSIs, then naturally, those technologies may be used to integrate each component included in the fault injection circuit 100 and the fault injection system 1 into integrated circuits.

[0067] Furthermore, this disclosure also includes forms obtained by applying various modifications to the embodiments that a person skilled in the art could conceive, and forms realized by arbitrarily combining the components and functions of each embodiment without departing from the spirit of this disclosure.

[0068] (Note) The above description of embodiments discloses the following technology.

[0069] (Technical 1) A fault injection circuit for performing a fault injection test, comprising two or more setting circuits, a determination circuit, a monitoring circuit, and a stop circuit, each of the two or more setting circuits setting the occurrence of the same fault injection; the determination circuit determining whether the occurrence of the fault injection is set in all of the two or more setting circuits, and outputting a fault injection occurrence condition fulfillment signal indicating that the conditions for fault injection have been met if the occurrence of the fault injection is set in all of the two or more setting circuits; the monitoring circuit monitoring whether the fault injection occurrence condition fulfillment signal has been output from the determination circuit in the normal operating mode of the device to be tested for fault injection; and the stop circuit stopping the fault injection to the target device if the fault injection occurrence condition fulfillment signal has been output from the determination circuit in the normal operating mode.

[0070] Even with redundancy in place, such as having two or more setting circuits (hardware) that configure the occurrence of the same fault injection, there is a risk of erroneous fault injection if the judgment circuit fails, or if the wiring that transmits the fault injection condition fulfillment signal output by the judgment circuit fails, resulting in a faulty fault injection condition fulfillment signal. In contrast, a monitoring circuit monitors the fault injection condition fulfillment signal, and if the fault injection condition fulfillment signal, which should be output in fault injection operation mode, is output in normal operation mode, fault injection to the target device is stopped. Therefore, the risk of erroneous fault injection can be reduced. Furthermore, because the fault injection circuit is configured as hardware, high-speed, high-coverage fault injection testing can be performed.

[0071] (Technology 2) The fault injection circuit according to Technology 1, wherein the monitoring circuit further notifies of an abnormality when the fault injection occurrence condition is met signal is output from the determination circuit in the normal operating mode.

[0072] According to this, it is possible to notify of abnormalities in fault injection.

[0073] (Technical 3) The fault injection circuit according to Technical 1 or 2, wherein each of the two or more setting circuits has a register section controlled by an external circuit of the fault injection circuit.

[0074] This allows for flexible configuration of fault injection settings.

[0075] (Technical 4) The fault injection circuit according to Technical 3, wherein the register section stores information indicating the type of fault to be injected by the fault injection.

[0076] This allows you to configure the type of fault to be injected.

[0077] (Technical 5) The fault injection circuit according to Technical 3 or 4, wherein the register section stores information indicating the start or stop of the fault injection.

[0078] This allows for easy initiation or cessation of fault injection.

[0079] (Technical 6) The fault injection circuit according to any one of Technical 3 to 5, wherein each of the two or more setting circuits has a write protection unit that provides protection against writing to the register section.

[0080] According to this, in order to write information indicating the occurrence of fault injection to the register section, it is necessary to remove the protection against writing to the register section, thus reducing the risk of accidental fault injection.

[0081] (Technical 7) The fault injection circuit described in Technical 6, wherein the write protection unit releases the protection when it obtains an enable signal from the external circuit.

[0082] According to this, in order to write information indicating the occurrence of fault injection to the register section, the write protection section needs to acquire an enable signal, thus reducing the risk of accidental fault injection.

[0083] (Technical 8) The fault injection circuit described in Technical 6, wherein the write protection unit releases the protection when it obtains a predetermined write key from the external circuit.

[0084] According to this, in order to write information indicating the occurrence of fault injection to the register section, the write protection section needs to acquire a predetermined write key, thus reducing the risk of accidental fault injection.

[0085] (Technical 9) The stop circuit is a fault injection circuit according to any one of Technical 1 to 8, wherein when the determination circuit outputs a signal indicating that the fault injection condition has been met in the fault injection operation mode of the target device, the stop circuit performs the fault injection to a safety mechanism that detects an abnormality in the target device.

[0086] This allows verification that the safety mechanism for detecting abnormalities in the target device is functioning correctly. Furthermore, since fault injection is not performed on the Intended Function (IF), the risk of the IF failing due to fault injection is reduced.

[0087] (Technical 10) A fault injection system comprising a fault injection circuit described in any of Technical 1 to 9, and a power control circuit that turns off the power to the fault injection circuit in the normal operating mode.

[0088] According to this, the power to the fault injection circuit is turned off in normal operating mode, which reduces the risk of accidental fault injection and also reduces power consumption.

[0089] (Technical 11) The fault injection system according to Technical 10, further comprising a reset circuit, the power control circuit further outputting a reset signal to the reset circuit in the normal operating mode, and the reset circuit stopping the fault injection to the target device when the reset signal is output.

[0090] According to this, if a reset signal is output, fault injection to the target device is stopped, thus reducing the risk of accidental fault injection.

[0091] This disclosure can be applied to systems for performing fault injection testing, etc.

[0092] 1. Fault injection system 10a, 10b. Setting circuit 11. Write protection unit 12. Register unit 20, 60, 301, 411. AND circuit 30. Monitoring circuit 40. Stop circuit 50. Power control circuit 100. Fault injection circuit 200. Camera 300, 310. Video input unit 302, 311. Write control unit 400. Image anomaly detection unit 410. Safety mechanism 412. Anomaly detection unit 500. Frame memory 600. Video output unit 700. Display unit

Claims

1. A fault injection circuit for performing a fault injection test, comprising two or more setting circuits, a determination circuit, a monitoring circuit, and a stop circuit, each configured by hardware, wherein the two or more setting circuits each set the occurrence of the same fault injection, the determination circuit determines whether the occurrence of the fault injection has been set in all of the two or more setting circuits, and outputs a fault injection occurrence condition fulfillment signal indicating that the conditions for fault injection have been met if the occurrence of the fault injection has been set in all of the two or more setting circuits, the monitoring circuit monitors whether the fault injection occurrence condition fulfillment signal has been output from the determination circuit in the normal operating mode of the device to be tested for fault injection, and the stop circuit stops the fault injection to the target device if the fault injection occurrence condition fulfillment signal has been output from the determination circuit in the normal operating mode.

2. The fault injection circuit according to claim 1, wherein the monitoring circuit further notifies of an abnormality when the fault injection condition is met signal is output from the determination circuit in the normal operating mode.

3. The fault injection circuit according to claim 1 or 2, wherein each of the two or more setting circuits has a register section controlled by an external circuit of the fault injection circuit.

4. The fault injection circuit according to claim 3, wherein the register section stores information indicating the type of fault to be injected by the fault injection.

5. The fault injection circuit according to claim 3 or 4, wherein the register section stores information indicating the start or stop of the fault injection process.

6. The fault injection circuit according to any one of claims 3 to 5, wherein each of the two or more setting circuits has a write protection unit that provides protection against writing to the register unit.

7. The fault injection circuit according to claim 6, wherein the write protection unit releases the protection when it receives an enable signal from the external circuit.

8. The fault injection circuit according to claim 6, wherein the write protection unit releases the protection when it obtains a predetermined write key from the external circuit.

9. The fault injection circuit according to any one of claims 1 to 8, wherein the stop circuit performs the fault injection to a safety mechanism that detects abnormalities in the target device when the determination circuit outputs a signal indicating that the fault injection condition has been met in the fault injection operation mode of the target device.

10. A fault injection system comprising a fault injection circuit according to any one of claims 1 to 9, and a power control circuit for turning off the power to the fault injection circuit in the normal operating mode.

11. The fault injection system according to claim 10, further comprising a reset circuit, the power control circuit further outputting a reset signal to the reset circuit in the normal operating mode, and the reset circuit stopping the fault injection to the target device when the reset signal is output.

Images