CN110764966B

CN110764966B - Self-adaptive method and system for working mode of ECU safety monitoring system

Info

Publication number: CN110764966B
Application number: CN201910867359.1A
Authority: CN
Inventors: 丛聪; 孙潇; 刘晓波; 刘小强
Original assignee: Weichai Power Co Ltd
Current assignee: Weichai Power Co Ltd
Priority date: 2019-09-12
Filing date: 2019-09-12
Publication date: 2023-07-18
Anticipated expiration: 2039-09-12
Also published as: CN110764966A

Abstract

The application discloses a self-adaptive method and a system for an ECU safety monitoring system working mode, wherein the self-adaptive method comprises the following steps: the security monitoring chip acquires the level state of the interface circuit of the debugger, stores the level state as an unsigned variable, and sends the unsigned variable to the main chip through an SPI command; receiving a comparison signal sent by a main chip, and checking with an unsigned variable; and enabling a debugging mode or a product mode according to the verification result, and executing a security mechanism under a corresponding mode. The level state acquired by the interface circuit of the debugger is stored as an unsigned variable and is sent to the main chip, then the unsigned variable is checked with a comparison signal sent by the main chip, a debugging mode or a product mode is started according to a checking result, and a safety mechanism under a corresponding mode is executed, so that the working mode which needs to be started can be automatically identified under the condition that a hardware circuit is not changed, whether the complete safety mechanism is started or not is selected, debugging information confusion is avoided, and extra consumption, experiment cost and labor cost of hardware change are reduced.

Description

Self-adaptive method and system for working mode of ECU safety monitoring system

Technical Field

The application relates to the field of vehicle control systems, in particular to a self-adaptive method and a system for an ECU safety monitoring system working mode.

Background

When an electronic control unit (Electronic Control Unit, ECU) sample is produced offline, the electronic control unit is generally divided into a product ECU and a debugging ECU according to the design maturity of the ECU, and two sets of different hardware circuit designs are applied to distinguish whether the complete safety monitoring system function is supported. A certain fixed PIN PIN circuit design of the safety monitoring chip is pulled up to a 5V power supply through a pull-up resistor, the safety monitoring system is configured into a debugging mode, the overflow of the watchdog fault accumulator does not trigger the reset of the main chip, and when the PIN circuit is connected to the ground through a pull-down resistor, a product mode is started, and the overflow of the watchdog fault accumulator triggers different fault response modes according to a safety mechanism. The scheme realizes the switching of the working modes of the safety monitoring system by adopting two different hardware circuit design methods.

In the prior art, the product mode and the debugging mode of the software function of the safety monitoring system can be switched by controlling different hardware circuit designs, but in the actual experimental test process of the product ECU, especially in the initial stage of product mode ECU off-line experiments, once the basic software layer codes are updated iteratively, the manual modification circuit is required to be switched into the debugging mode for debugging again when the ECU sealing shell is damaged, the air tightness of the ECU is damaged, and meanwhile, the additional consumption of the ECU hardware is increased, so that the experimental cost and the labor cost are increased. When the ECU does not seal, that is, the working mode is switched by a change mode of the hardware such as a resistor connection or a change line connection, additional consumption of hardware change is also caused, and experiment cost and labor cost are increased. In addition, in the initial stage of debugging a new ECU sample, especially when the BT function is imperfect or the key functions such as the task of an operating system are incomplete and inaccurate, a product mode complete safety mechanism is directly used to trigger a safety monitoring system to report faults and trigger software reset, so that debugging information is disordered, and further the experiment cost and the labor cost are increased.

In summary, it is desirable to provide an adaptive method and system for an ECU security monitoring system working mode, which can automatically identify the working mode to be activated without modifying the hardware circuit, so as to select whether to activate the complete security mechanism, avoid the confusion of debug information, reduce additional consumption, reduce experiment cost and reduce labor cost.

Disclosure of Invention

In order to solve the problems, the application provides a self-adaptive method and a self-adaptive system for an ECU safety monitoring system working mode.

On the one hand, the application provides an adaptive method for the working mode of an ECU safety monitoring system, which comprises the following steps:

s1, acquiring the level state of a debugger interface circuit, storing the level state as an unsigned variable, and sending the unsigned variable to a main chip through an SPI command;

s2, receiving a comparison signal sent by the main chip, and checking with the unsigned variable;

s3, enabling a debugging mode or a product mode according to the verification result, and executing a security mechanism under a corresponding mode.

Further, the self-adaptive method for the working mode of the ECU safety monitoring system, as described above, executes a safety mechanism in a corresponding mode, and includes the following steps:

s31, periodically executing the steps S1 to S2, and if the verification result is false, executing fault count accumulation;

s32, according to the current starting mode and the fault count value, returning to S1 after executing the fault response strategy, or maintaining the current working state of the system and executing S31.

Further, the adaptive method for the operation mode of the ECU safety monitoring system as described above,

when the value of the unsigned variable is 1 and the verification result is true, enabling a debugging mode;

when the value of the unsigned variable is 0 and the verification result is true, enabling a product mode;

and when the verification result is false, enabling a product mode.

when the fault count exceeds the threshold and the current enabling mode is the debugging mode, fault information is recorded, the current working state is maintained, and S31 is executed;

and when the fault count exceeds the threshold value and the current enabling mode is the product mode, recording fault information, and returning to the step S1 after executing a fault response strategy.

Further, the adaptive method for the working mode of the ECU safety monitoring system as described above further includes, after the recording of the fault information: the fault count is cleared.

Further, according to the self-adaptive method for the working mode of the ECU safety monitoring system, the comparison signal is obtained by the main chip after the received unsigned variable is inverted.

Further, the adaptive method for the working mode of the ECU safety monitoring system, as described above, wherein the receiving the comparison signal sent by the main chip and verifying the comparison signal with the unsigned variable includes:

and performing exclusive OR operation on the unsigned variable and the received comparison signal.

Further, the adaptive method for the operation mode of the ECU safety monitoring system as described above is executed if the verification result is true S31.

Further, the adaptive method for the operation mode of the ECU safety monitoring system as described above, the fault response strategy includes: the software system resets and shuts off the drive output.

In a second aspect, the present application proposes an adaptive system for an ECU safety monitoring system operating mode, comprising:

the safety monitoring chip is used for acquiring the level state of the interface circuit of the debugger, storing the level state as an unsigned variable, and sending the unsigned variable to the main chip through an SPI command; receiving a comparison signal sent by a main chip, and checking with the unsigned variable; and enabling a debugging mode or a product mode according to the verification result, and executing a security mechanism under a corresponding mode.

The application has the advantages that: the level state acquired by the interface circuit of the debugger is stored as an unsigned variable and is sent to the main chip, then the unsigned variable is checked with a comparison signal sent by the main chip, the debugging mode or the product mode is started according to a check result, and a safety mechanism under a corresponding mode is executed.

Drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for the purpose of illustrating preferred embodiments and are not to be construed as limiting the application. Also, like reference numerals are used to designate like parts throughout the figures. In the drawings:

FIG. 1 is a schematic step diagram of an adaptive method for ECU security monitoring system operating modes provided herein;

FIG. 2 is a schematic diagram of an adaptive method for ECU safety monitoring system operating modes provided herein;

FIG. 3 is a flow chart of an adaptive method for ECU safety monitoring system operating modes provided herein;

fig. 4 is a schematic diagram of an adaptive system for the ECU safety monitoring system operating mode provided herein.

Detailed Description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

According to an embodiment of the present application, an adaptive method for an operation mode of an ECU security monitoring system is provided, as shown in fig. 1, and the method includes: the method comprises the following steps:

s1, acquiring the level state of a debugger interface circuit, storing the level state as an unsigned variable, and sending the unsigned variable to a main chip through a serial peripheral interface (Serial Peripheral Interface, SPI) instruction;

s2, receiving a comparison signal sent by the main chip, and checking with an unsigned variable;

Executing a security mechanism in a corresponding mode, comprising the steps of:

In step S2, the security monitoring chip checks the stored unsigned variable with the received comparison signal sent by the main chip, and when the value of the unsigned variable is 1 and the check result is true, the debugging mode is started; when the value of the unsigned variable is 0 and the verification result is true, enabling a product mode; and when the verification result is false, enabling a product mode.

When the fault count exceeds the threshold and the current enabling mode is the debugging mode, fault information is recorded, the current working state is maintained, and S31 is executed; and when the fault count exceeds the threshold value and the current enabling mode is the product mode, recording fault information, and returning to the step S1 after executing a fault response strategy.

After recording the fault information, the method further comprises: the fault count is cleared.

The contrast signal is obtained by inverting the received unsigned variable by the main chip.

In step S2, the step of receiving the comparison signal sent by the main chip and verifying with the unsigned variable includes:

In step S31, if the verification result is true, S31 is executed. That is, S1 to S2 are periodically executed, and if the verification result is true, S1 to S2 are continuously executed according to the set period, and the verification result is determined.

The fault response strategy includes: the software system resets and shuts off the drive output. The software system comprises all software functions of the security monitoring chip and the main chip.

The product mode of the ECU is one of the working modes of the safety monitoring system, is used for a software safety mechanism after sample measurement, and has complete fault detection, fault processing and response strategies.

The debug mode of the ECU is one of the modes of operation of the safety monitoring system, and does not generate actual fault handling and response actions when software detects the occurrence of a safety-related fault.

The cycle of executing steps S1 to S2 may be set as necessary.

The safety mechanism represents a solution to specifying influencing factors for the electronic system, electrical system or element to reach a safety goal, fault detection or control failure modes.

The safety monitoring system complies with ISO26262 functional safety requirements and provides all activities of the safety-related system consisting of power, electronics, software elements, etc. of the safety-related functions throughout the life cycle.

Fault response means solutions and schemes for integrity fault detection that reduce the impact of failure modes within the allowed range, including fault response actions and response times, to achieve a safe state of the system.

Embodiments of the present application will be further described with reference to the drawings.

As shown in fig. 2, the ECU includes: the interface circuit of the debugger, the security monitoring chip and the main chip.

Preferably, PIN7 of the debugger interface circuit is connected to a first general purpose input GPI1 (General Purpose Input, GPI) PIN of the security monitor chip, the SPI of the security monitor chip is connected to the SPI of the master chip, a Reset (Reset) PIN of the security monitor chip is connected to a Reset PIN of the master chip, and a general purpose output (General Purpose Output, GPO) PIN of the master chip is connected to a second general purpose input GPI2 PIN of the security monitor chip.

The detection of the PIN7 level of the interface circuit of the debugger is realized through the GPI1 PIN of the security monitoring chip.

And the level state of the PIN7 acquired by the safety monitoring chip is sent to the main chip through an SPI instruction, and the main chip outputs corresponding reverse level state hard wire transmission (through hardware signal transmission and without software control) to the GPI2 PIN of the safety monitoring chip through the GPO PIN.

The security monitoring chip receives the contrast signal transmitted back by the GPO pin of the main chip through the GPI2 pin.

The security monitoring chip performs digital verification on the signal of GPI1 and the signal of GPI 2. If the verification result is incorrect, all outputs of the safety monitoring chip maintain the last working cycle state. If the verification result is correct, judging the level of PIN7 collected by GPI in the safety monitoring chip. If the level is high, the enable reset pin is normally high (i.e., enter debug mode, reset pin is normally high). If the level is low, the safety mechanism fault response is enabled (i.e. the product mode is entered, the fault response strategy is executed), and when the safety monitoring chip detects a fault state, necessary response measures are executed, such as resetting the main chip or cutting off part of the drive output.

The safety monitoring system is arranged on the safety monitoring chip.

Whether a complete security mechanism is enabled is selected by automatically identifying the mode of operation. The safety monitoring system enables a complete fault response mechanism, namely a reset function or a cut-off drive output function, in a product mode through monitoring the level of a debugger interface circuit. In the debug mode, the complete security mechanism is not enabled, and the enabling of the reset function of the security monitoring system is limited. The hardware circuit design is not required to be modified to distinguish whether complete safety mechanism fault response is started, and the working mode self-adaption is achieved.

Embodiments of the present application are further described below with reference to flowcharts.

As shown in fig. 3, the ECU is powered on and initialized, and in a BootLoader (BT) and application initialization module, the level state of the debugger interface circuit PIN7 is preferentially read, stored as an unsigned variable moc_stpinx, and the reset PIN ROT of the initialization security monitor chip is at a high level (the software reset function is triggered when the default ROT is at a low level).

The security monitoring chip sends MoC_stPINx to the main chip through a 16-bit SPI command (comprising parity check bits and data bits), the main chip analyzes the data bits in the SPI command, the data bits are inverted, and an inversion code (comparison signal) is output through the GPO.

Judging whether MoC_stPINx is 1 and the comparison signal is 0, if MoC_stPINx is 1 and the comparison signal is 0, entering a debugging mode, and outputting a high level by ROT.

Judging whether MoC_stPINx is 0 and the comparison signal is 1, and if MoC_stPINx is 0 and the comparison signal is 1, entering a product mode.

After entering the debug mode or the product mode, the periodic tasks of the system are started. The safety monitoring chip circularly collects the level state of the debugger interface circuit PIN7, stores the level state as an unsigned variable MoC_stPINx and sends the MoC_stPINx to the main chip through an SPI command.

The safety monitoring chip receives a comparison signal sent by the main chip GPO through a GPI2 pin, and performs exclusive OR operation check on the comparison signal and the original data acquired in the current period, namely MoC_stPINx.

If the verification result is true (i.e. when 1), the verification is passed, the MoC_stPINx is polled in the running process of the ECU software, other related safety functions are checked and verified until the period is over, and the next periodic task is started.

If the check result is false (i.e. 0), it indicates that the check is not passed, and the failure counter is incremented by one. And when the fault count in the fault counter is smaller than or equal to the maximum calibration amount, the MoC_stPINx is polled in the running process of the ECU software, other related safety functions are checked and verified until the period is over, and the next periodic task is started. And when the fault count accumulation exceeds the maximum calibration limit calibration quantity, judging the current working mode when the safety monitoring system reports monitoring faults or the digital verification failure counter overflows.

If the current mode is the debugging mode, the ROT pin maintains a high level, fault information is recorded, and the fault count is cleared.

If the current mode is the product mode, fault information is recorded, a corresponding fault response strategy is executed according to a safety mechanism, for example, a fault with higher safety level executes a reset function, and a fault with lower safety level performs degradation processing to close part of driving output capacity. And performing fault count clearing.

Wherein ENA is a driving enable in software, when ena=0, executing a fault response strategy, and cutting off driving output; at ena=1, no fault shutdown output is performed, and the reset pin remains normally high, i.e., rot=1.

According to an embodiment of the present application, there is also provided an adaptive system for an operation mode of an ECU safety monitoring system, as shown in fig. 4, including: the safety monitoring chip is used for acquiring the level state of the interface circuit of the debugger, storing the level state as an unsigned variable, and sending the unsigned variable to the main chip through an SPI command; receiving a comparison signal sent by a main chip, and checking with the unsigned variable; and enabling a debugging mode or a product mode according to the verification result, and executing a security mechanism under a corresponding mode.

As shown in fig. 4, the embodiment of the present application further includes: a debugger interface circuit and a host chip.

The debugger interface circuit is used for detecting whether the debugger is connected or not and outputting the corresponding level state to the safety monitoring chip.

The main chip is used for reversing the unsigned variable sent by the safety monitoring chip to obtain a comparison signal and sending the comparison signal to the safety monitoring chip.

According to the method, the level state of the interface circuit of the debugger is obtained and stored as an unsigned variable, the unsigned variable is sent to the main chip through the SPI command, a comparison signal sent by the main chip is received and verified with the unsigned variable, a debugging mode or a product mode is started according to a verification result, a safety mechanism under the corresponding mode is executed, two working modes of the safety monitoring system can be compatible, the method for automatically detecting and adapting to different development stages of software of the safety monitoring system is provided, and the problem that the safety monitoring system is triggered to report faults and trigger software reset easily by directly using the complete safety mechanism of the product mode in the initial stage of debugging a new ECU sample, especially when key functions such as BT functions are incomplete or tasks of an operating system are incomplete and inaccurate is solved, debugging information is disordered, and the debugging process of other functions is affected. In addition, the method does not need to modify the hardware circuit design to distinguish whether to enable complete fault response of the safety mechanism, achieves working mode self-adaption, reduces extra consumption, experiment cost and labor cost. The method not only ensures that the security mechanism can provide effective software and hardware inspection information in the debugging process, but also ensures that the ECU can meet the expected security target requirement in the test experiment process, and improves the software compatibility and operability. The SPI command specific format is used for transmitting instructions and key data between the main chip and the safety monitoring chip, so that the difficulty in cracking information is high, and the safety of the data is improved. The method enables the ECU security mechanism to be compatible with the debugging mode and the product mode, and identifies the plug and play of the debugger by directly reading specific pins of the interface circuit of the debugger, so that the debugger can be accessed to enter the debugging mode, the accuracy of system judgment is ensured, the portability, operability and compatibility of codes in the debugging stage are enhanced, and the problem that the complete security mechanism and the fault response mechanism of the same version of software of the security monitoring system cannot be compatible with the software debugging process in the early stage of the ECU development and the software development maturing later stage is solved. The debugger, namely the product mode, is pulled out by realizing forward and reverse switching of the working mode (ECU working mode) of the safety monitoring system, so that software and hardware safety related function monitoring is greatly facilitated in the bench or whole vehicle experiment verification process to meet the safety target. When the client puts forward software demand iteration, the callback test mode can be reversely switched to re-develop and re-debug the software, so that the hardware design change cost is saved. The collection of the interface level of the debugger is realized through the pins of the external safety monitoring chip, the pins of the main chip are not occupied, and the pin resources are saved. And the unsigned variable and the comparison signal are checked through the safety monitoring chip, so that the reliability and the safety level of the program execution of the external monitoring chip are improved. The exclusive or digital verification process is used, so that the accuracy of the logical operation of the system can be ensured, and the requirement of higher security level can be met. The method can be applied to all ECU products with safety monitoring functions or systems, has wide application range and strong applicability, and can automatically identify the working mode by the safety monitoring system and realize forward and reverse mode switching under specific requirements, thereby reducing the additional hardware consumption of software iteration and the ECU experiment cost of products.

The foregoing is merely a preferred embodiment of the present application, but the scope of the present application is not limited thereto, and any changes or substitutions easily contemplated by those skilled in the art within the technical scope of the present application should be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. An adaptive method for the working mode of an ECU safety monitoring system is characterized by comprising the following steps:

s2, receiving a comparison signal sent by a main chip, and checking the comparison signal with the unsigned variable, wherein the comparison signal is a value obtained by inverting a received data bit corresponding to the unsigned variable by the main chip;

s3, enabling a debugging mode or a product mode according to the verification result, and executing a safety mechanism under a corresponding mode;

the method for executing the security mechanism in the corresponding mode comprises the following steps:

s32, executing a fault response strategy according to the current starting mode and the fault count value, and returning to S1, or maintaining the current working state of the system and executing S31;

when the fault count exceeds a threshold value and the current enabling mode is a product mode, fault information is recorded, and the S1 is returned after a fault response strategy is executed;

and when the verification result is false, enabling a product mode.

2. The adaptive method for an ECU safety monitoring system operation mode according to claim 1, further comprising, after said recording of the failure information: the fault count is cleared.

3. The adaptive method for an operation mode of an ECU safety monitoring system according to claim 1, wherein said receiving the comparison signal transmitted from the main chip and verifying the unsigned variable comprises:

and performing exclusive OR operation check on the unsigned variable and the received contrast signal.

4. The adaptive method for an operation mode of an ECU safety monitoring system according to claim 1, wherein if the verification result is true, S31 is performed.

5. The adaptive method for ECU safety monitoring system operation mode according to claim 1, wherein said fault response strategy comprises: the software system resets and shuts off the drive output.

6. An adaptive system for an ECU safety monitoring system operating mode, comprising:

the safety monitoring chip is used for acquiring the level state of the interface circuit of the debugger, storing the level state as an unsigned variable, and sending the unsigned variable to the main chip through an SPI command; receiving a comparison signal sent by a main chip and checking the comparison signal with the unsigned variable, wherein the comparison signal is a value obtained by inverting a received data bit corresponding to the unsigned variable by the main chip; enabling a debugging mode or a product mode according to the verification result, and executing a safety mechanism under a corresponding mode;

and when the verification result is false, enabling a product mode.