CN116126610A

CN116126610A - System and method for improving IIC communication security

Info

Publication number: CN116126610A
Application number: CN202310088686.3A
Authority: CN
Inventors: 请求不公布姓名
Original assignee: Chuangshi Microelectronics Chengdu Co ltd
Current assignee: Chuangshi Microelectronics Chengdu Co ltd
Priority date: 2023-01-17
Filing date: 2023-01-17
Publication date: 2023-05-16

Abstract

The invention relates to the technical field of communication safety, and discloses a system and a method for improving IIC communication safety, wherein a register initial value detection module automatically detects once after power-on to confirm whether a register initial value is correct; the IIC communication bus monitoring module monitors the state of the communication bus in real time when the main control computer initiates IIC communication, and if abnormal conditions exist, the communication bus monitoring module feeds back in time; the register state detection module detects the state of the register, checks a communication loop and ensures accurate communication data; the external bus detection module adopts a CRC check method to realize external bus detection of data in the communication process, and a check result and the byte number participating in check are taken as observable data to be output through an MIPI interface so that the main control computer can judge whether the communication data is correct or not. The system can realize the rapid positioning of communication faults, and improves the fault analysis efficiency and safety of the IIC communication process.

Description

System and method for improving IIC communication security

Technical Field

The invention relates to the technical field of communication security, in particular to a system and a method for improving IIC communication security.

Background

With the high-speed development of integrated circuits, IIC communication, which is a high-performance serial bus with simple structure and multi-host control, is widely applied, and meanwhile, the safety and the reliability of IIC communication are also important points of attention. In particular, there is a higher demand for security of IIC communications applied to vehicles. Existing IIC communications already have a very sophisticated way of communication, but their onboard control interfaces are more or less defective. For example, transmission rate mismatch causes transmission data loss, communication timing abnormality, and the like. In addition, the communication itself has occasional and irregular problems, so that the security of the IIC communication system cannot be ensured.

In view of this, the present application is specifically proposed.

Disclosure of Invention

The invention provides a system and a method for improving IIC communication safety, which solve the problem that the communication safety of an IIC communication system cannot be ensured due to the defect of a control interface.

The invention is realized by the following technical scheme:

in one aspect, a system for improving IIC communication security includes a host computer and a CIS chip, and the host computer and the CIS chip are connected through an IIC communication bus. The CIS chip is composed of a register initial value detection module, an IIC communication bus monitoring module, a register state detection module, an external bus detection module and a safety management module. The register initial value detection module is used for comparing the register initial value with the corresponding register expected value before the state of the SDA data line is changed, if the register initial value is inconsistent with the corresponding register expected value, the register with the inconsistent initial value and the register expected value is judged to be a fault register, the register expected value is used for replacing the initial value of the corresponding fault register, and an error0 signal is sent to the main control computer. The main control machine is used for judging whether the initial value of the register is successfully replaced by the corresponding expected value of the register by reading the value of the fault register according to the feedback of the error0 signal, and if the replacement is unsuccessful, the initial value of the register is changed in an IIC communication mode. The IIC communication bus monitoring module is used for carrying out abnormality monitoring on the whole process of IIC communication, if abnormality is monitored, the corresponding abnormality is extracted, and an error1 signal is sent to the main control computer. The register state detection module is used for judging whether the communication loop of the register has communication faults according to the output data of the communication loop of the register, if so, replacing the output data of the communication loop with the communication faults, and sending error signals or warning signals to the main control machine. The external bus detection module is used for performing CRC (cyclic redundancy check) on the address and the write data transmitted in the IIC communication process, and feeding back a check result to the main control computer. The safety management module is used for processing the error0 signal, the error1 signal, the error2 signal, the error3 signal and the warning signal and outputting the processed signals to the main control computer through the I/O port.

The register initial value detection module comprises an ECC check value calculation unit, a data read-write unit, an ECC check unit, a numerical comparison unit, a register initial value replacement unit and a register address writing unit. The ECC check value calculation unit is used for calculating a corresponding ECC check value according to the expected value of the register. The data read-write unit is used for writing the read ECC check value into the OTP memory together with the corresponding expected value of the register. The ECC check unit is used for performing parity check on data in the OTP memory and outputting expected values of the register to the numerical comparison unit. The numerical value comparison unit is used for comparing the expected value of the register with the corresponding initial value of the register, and if the expected value of the register is inconsistent with the corresponding initial value of the register, the numerical value comparison unit sends an error0 signal to the main control computer. The register initial value replacement unit is used for replacing the corresponding register initial value by the register expected value when the register expected value is inconsistent with the corresponding register initial value. The register address writing unit is used for writing the address of the register, the initial value of which is inconsistent with the expected value, into the read-only memory.

The main control machine comprises a register address reading module, a register value reading module, a judging module and an IIC communication module. The register address reading module is used for reading the register address in the read-only memory according to the error0 signal. The register value reading module is used for reading the current initial value of the register according to the error0 signal. The judging module is used for comparing the current register initial value with the register expected value, judging that the register initial value is not successfully replaced by the corresponding register expected value if the current register initial value is inconsistent with the register expected value, and judging that the register initial value is successfully replaced by the corresponding register expected value if the current register initial value is not consistent with the register expected value. The IIC communication module is used for changing the initial value of the register in an IIC communication mode when the initial value of the register is not successfully replaced by the corresponding expected value of the register.

The IIC communication bus monitoring module comprises an information collecting unit, a state conversion unit, a data analysis unit and an abnormality extraction unit. The information collection unit is used for collecting the clock line change state and the data line change state of the IIC communication bus. The state conversion unit is used for carrying out corresponding abnormal condition monitoring on each phase of IIC communication according to the clock line change state and the data line change state, and generating an abnormal condition monitoring result; the abnormal condition detection result includes: the initial state signal is not generated when the IIC communication bus is switched from the idle state to the slave address phase, the ACK response signal is not generated in the register address phase, the ACK response signal is not generated in the data phase, and the end state signal is not generated at the end of the data phase. The data analysis unit is used for merging the data line change states of the slave address stage, the register address stage and the data stage into 8-bit data, monitoring whether abnormal conditions of inconsistent data bits occur between the 8-bit data and the data output after the IIC communication is finished, and generating an abnormal condition monitoring result if abnormal conditions of inconsistent data bits occur. The abnormality extraction unit is used for extracting an abnormality detection result of the state conversion unit and the data analysis unit and sending an error1 signal to the main control computer.

The state conversion unit includes a first state judgment subunit, a second state judgment subunit, a third state judgment subunit, and a fourth state judgment subunit. The first state judging subunit is used for judging whether the clock line change state and the data line change state simultaneously meet the condition A when the IIC communication bus is switched from the idle state to the slave address stage; if the condition A is met, judging that a starting state signal is generated; otherwise, judging that the initial state signal is not generated; condition a: during the high level of the clock line, the data line changes from the high level to the low level. The second state judging subunit is configured to judge, in the slave address stage, whether the clock line change state and the data line change state simultaneously meet the condition B or the condition C; if the condition B is met, judging that an ACK response signal is generated and entering a register address stage; if the condition C is met, judging that a NACK response signal is generated and ending the communication; condition B: the clock line is high and the data line is low; condition C: the clock line is high and the data line is high. The third state judging subunit is configured to judge, in the register address stage, whether the clock line change state and the data line change state simultaneously satisfy a condition D or a condition E; if the condition D is met, judging that an ACK response signal is generated and entering a data stage; if the condition E is met, judging that a NACK response signal is generated and ending the communication; condition D: the clock line is high and the data line is low; condition E: the clock line is high and the data line is high. The fourth state judging subunit is used for judging whether the clock line change state and the data line change state meet the condition F or the condition G at the same time after judging that the data transmission of the current byte is completed in the data stage; if the condition F is met, judging that an ACK response signal is generated, entering a data stage by default, and ending the communication until the condition G is met, judging that an ending state signal is generated; condition F: the clock line is high and the data line is low; condition G: during the high level of the clock line, the data line changes from the low level to the high level.

The register state detection module comprises a register fault judging unit, an output data rewriting unit, a register information backup unit and an output data replacing unit. A register failure determination unit for performing the following operations: the communication loop of the register is duplicated for two times, and the output data a, the output data b and the output data c of the three communication loops are compared pairwise; if a=b=c, then determining that the communication loop is fault-free; if a is not equal to b is not equal to c, judging that the communication loop fails, and sending an error2 signal to the main control computer; if a=b+.c or a+.b=c, then determining that the communication loop is faulty, and sending a warning signal to the master control. And an output data rewriting unit configured to rewrite the output data c with the output data a and the output data b when a=b+.c, and rewrite the output data a with the output data b and the output data c when a+.b=c. And the register information backup unit is used for writing the register address and the register data obtained by analyzing the IIC communication module into the SRAM in real time in the IIC communication process. And an output data replacing unit for extracting data of a register having the same address as the register from the SRAM memory and replacing the output data a, the output data b and the output data c with the extracted data when a not equal to b not equal to c.

The register state detection module further comprises a register classification unit, which is used for classifying the registers into a first class of registers and a second class of registers according to the functions of the registers; the first type of registers include registers with a mode switching function and registers with a scene switching function, and the second type of registers are all registers except the first type of registers.

The register fault judging unit comprises a first-class register fault judging subunit and a second-class register fault judging subunit. A class of register fault determination subunits for performing the following operations: the communication loop of one type of register is duplicated for two times, and the output data a, the output data b and the output data c of the three communication loops are compared pairwise; if a=b=c, then determining that the communication loop is fault-free; if a is not equal to b is not equal to c, judging that the communication loop fails, and sending an error2 signal to the main control computer; if a=b+.c or a+.b=c, then determining that the communication loop is faulty, and sending a warning signal to the master control. And the second-class register fault judging subunit is used for comparing the output data d of the communication loop of the second-class register with the data of the register with the same address as the second-class register in the SRAM memory, judging that the communication loop has no fault if the output data d is consistent with the data of the register with the same address as the second-class register, and sending an error3 signal to the main control computer if the output data d is not consistent with the data of the register with the second-class register.

The output data replacement unit includes a first output data replacement subunit and a second output data replacement subunit. A first output data replacing subunit, configured to extract, from the SRAM memory, data of registers having the same address as one type of registers, and replace the output data a, the output data b, and the output data c with the extracted data, when a+.b+.c; and the second output data replacing subunit is used for replacing the output data d by corresponding register data in the SRAM memory when the communication circuit is judged to be faulty.

The external bus detection module outputs a CRC check result and the byte number of the object participating in the CRC check to the main control computer through the MIPI interface, and the external bus detection module comprises a first check unit, a second check unit, a third check unit and a fourth check unit. The first checking unit is used for performing CRC check on the slave address. The second checking unit is used for performing CRC check on the read-write flag bit. The third checking unit is used for performing CRC check on the register address. The fourth checking unit is used for performing CRC check on the write data.

The security management module comprises a logic or processing unit and a read-only memory unit. The logic or processing unit is used for carrying out logic or processing on the error0 signal, the error1 signal, the error2 signal, the error3 signal and the warning signal. The read-only memory unit is used for storing the processing result of the error0 signal, the processing result of the error1 signal, the processing result of the error2 signal, the processing result of the error3 signal and the processing result of the rolling signal respectively by taking 1bit as a unit.

In another aspect, a method for improving security of IIC communications includes the steps of: s1: before the state of the SDA data line is changed, comparing the initial value of the register with the corresponding expected value of the register, if the initial value of the register is inconsistent with the corresponding expected value of the register, judging the register with the inconsistent initial value and the expected value of the register as a fault register, replacing the initial value of the corresponding fault register by the expected value of the register, and sending an error0 signal to the main control machine side; s2: reading the value of a fault register at one side of a main control machine, judging whether the initial value of the register is successfully replaced by the corresponding expected value of the register according to the read value of the fault register, and if the replacement is unsuccessful, changing the initial value of the register in an IIC communication mode; s3: performing anomaly monitoring on the whole IIC communication process, extracting corresponding anomaly conditions if anomalies are monitored, and sending an error1 signal to one side of the main control machine; s4: judging whether the communication loop of the register has faults according to the output data of the communication loop of the register, if so, replacing the output data of the communication loop with faults, and sending error signals or warning signals to one side of the main control machine; s5: and performing CRC (cyclic redundancy check) on the address and the write data transmitted in the IIC communication process, and feeding back a check result to one side of the main control computer.

Wherein, the liquid crystal display device comprises a liquid crystal display device,

s1 comprises

S11: calculating a corresponding ECC check value according to the expected value of the register; s12: writing the read ECC check value into the OTP memory together with the corresponding expected value of the register; s13: parity checking is carried out on data in the OTP memory, and expected values of the registers are output to a numerical comparison unit; s14: comparing the expected value of the register with the corresponding initial value of the register, and if the expected value of the register is inconsistent with the corresponding initial value of the register, sending an error0 signal to the main control computer; s15: when the expected value of the register does not coincide with the corresponding initial value of the register, the corresponding initial value of the register is replaced with the expected value of the register.

S2 comprises

S21: reading a register address in the read-only memory according to an error0 signal; s22: reading the current initial value of the register according to the error0 signal; s23: comparing the current initial value of the register with the expected value of the register, if the current initial value of the register is inconsistent with the expected value of the register, judging that the initial value of the register is not successfully replaced by the expected value of the corresponding register, otherwise, judging that the initial value of the register is successfully replaced by the expected value of the corresponding register; s24: when the initial value of the register is not successfully replaced by the corresponding expected value of the register, the initial value of the register is changed through the IIC communication mode.

S3 comprises

S31: collecting the clock line change state and the data line change state of the IIC communication bus; s32: according to the clock line change state and the data line change state, corresponding abnormal condition monitoring is carried out on each phase of IIC communication, and an abnormal condition monitoring result is generated; the abnormal condition detection result includes: when the IIC communication bus is switched from an idle state to a slave address stage, no initial state signal is generated, no ACK response signal is generated in the slave address stage, no ACK response signal is generated in the register address stage, no ACK response signal is generated in a data stage, and no end state signal is generated at the end of the data stage;

s33: merging the data line change states of the slave address stage, the register address stage and the data stage into 8-bit data, monitoring whether abnormal conditions of inconsistent data bits occur between the 8-bit data and the data output after the IIC communication is finished, and generating an abnormal condition monitoring result if abnormal conditions of inconsistent data bits occur; and extracting an abnormal condition detection result of the state conversion unit and the data analysis unit, and sending an error1 signal to the main control machine side.

Further, S32 includes

S32.1: when the IIC communication bus is switched from an idle state to a slave address stage, judging whether the clock line change state and the data line change state meet the condition A at the same time; if the condition A is met, judging that a starting state signal is generated; otherwise, judging that the initial state signal is not generated; condition a: during the period that the clock line is high level, the data line is changed from high level to low level; s32.2: judging whether the clock line change state and the data line change state meet the condition B or the condition C at the same time in the slave address stage; if the condition B is met, judging that an ACK response signal is generated and entering a register address stage; if the condition C is met, judging that a NACK response signal is generated and ending the communication; condition B: the clock line is high and the data line is low; condition C: the clock line is high and the data line is high; s32.3: judging whether the clock line change state and the data line change state meet the condition D or the condition E at the same time in the register address stage; if the condition D is met, judging that an ACK response signal is generated and entering a data stage; if the condition E is met, judging that a NACK response signal is generated and ending the communication; condition D: the clock line is high and the data line is low; condition E: the clock line is high and the data line is high; s32.4: in the data stage, judging whether the clock line change state and the data line change state meet the condition F or the condition G at the same time after judging that the data transmission of the current byte is completed; if the condition F is met, judging that an ACK response signal is generated, and entering a data stage by default until the condition G is met; if the condition G is met, judging that an ending state signal is generated, and ending the communication; condition F: the clock line is high and the data line is low; condition G: during the high level of the clock line, the data line changes from the low level to the high level.

S4 comprises

S41: the communication loop of one type of register is duplicated for two times, and the output data a, the output data b and the output data c of the three communication loops are compared pairwise; if a=b=c, then determining that the communication loop is fault-free; if a is not equal to b is not equal to c, judging that the communication loop fails, and sending an error2 signal to the main control computer; if a=b not equal to c or a not equal to b=c, judging that the communication loop fails, and sending a warning signal to the main control computer; the register comprises a register with a mode switching function and a register with a scene switching function; s42: in the case of a=b+.c, the output data a and b are used to rewrite the output data c, and in the case of a+.b=c, the output data b and c are used to rewrite the output data a; s43: in the IIC communication process, sequentially writing a register address and register data obtained by analyzing the IIC communication module into an SRAM (static random Access memory) in real time; s44: when a is not equal to b is not equal to c, extracting data of registers with the same address as one type of registers from the SRAM memory, and replacing the output data a, the output data b and the output data c by the extracted data; s45: comparing the output data d of the communication loop of the second-class register with the data of the register with the same address as the second-class register in the SRAM memory, if the output data d of the communication loop of the second-class register is consistent with the data of the register with the same address as the second-class register, judging that the communication loop has no fault, otherwise, judging that the communication loop has fault, and sending an error3 signal to the main control computer; the second-class registers are all registers except the first-class registers; s46: when it is determined that the communication circuit has failed, the output data d is replaced with the corresponding register data in the SRAM memory.

S5 comprises

S51: CRC (cyclic redundancy check) is respectively carried out on the slave address, the read-write flag bit, the register address and the write data; s52: and outputting the CRC check result and the byte number of the object participating in the CRC check to the side of the main control computer through the MIPI interface.

Compared with the prior art, the invention has the following advantages and beneficial effects:

1. the register initial value detection module, the IIC communication bus monitoring module, the register state detection module and the external bus detection module in the CIS chip can detect faults of each link in the IIC communication process, and feed detected faults back to the main control computer through the I/O port, so that the communication faults are rapidly positioned, and the fault analysis efficiency of the IIC communication process is improved; meanwhile, corresponding remedial measures are taken for faults of each link, so that the safety of IIC communication is improved.

2. In the register initial value detection module, the data read-write unit can write the read ECC check value and the corresponding register expected value into the OTP memory together, and the ECC check unit performs parity check on data in the OTP memory, so that the reliability of the data read from the OTP memory is ensured, and the possibility of communication failure caused by error of the input register expected value when the register initial value and the register expected value are compared can be reduced.

3. The IIC communication bus monitoring module is connected with the same clock line signal and the same data line signal as the IIC communication module in a parallel mode, can observe the state of communication initiated by the main control computer in real time, and monitors whether the communication process is abnormal and whether the register can be configured smoothly in real time.

4. The register state detection module divides the registers into a first class of registers and a second class of registers, adopts different fault monitoring and remedying modes aiming at two different classes of registers, improves the detection speed, and reduces the circuit area and the resource consumption.

5. The external bus detection module adopts a CRC check mode, and data communicated by the main control computer are fed back to the main control computer after being checked, so that interaction between the CIS chip and the main control computer is abnormal and controllable, and the integrity of the whole link communication safety detection is ensured.

6. After the safety management module carries out logic or processing on each fault feedback signal, the processing result is output to the main control computer through the I/O port, so that the I/O port multiplexing of the CIS chip can be reduced; and the processed results are respectively stored by a read-only memory with 1bit as a unit, and the main control computer can quickly acquire the fault type by reading the read-only memory.

Drawings

In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the drawings that are needed in the examples will be briefly described below, it being understood that the following drawings only illustrate some examples of the present invention and therefore should not be considered as limiting the scope, and that other related drawings may be obtained from these drawings without inventive effort for a person skilled in the art.

Fig. 1 is a schematic structural diagram of a system for improving security of IIC communication according to embodiment 1 of the present invention;

fig. 2 is a schematic diagram of a register initial value detection flow provided in embodiment 1 of the present invention;

fig. 3 is a schematic diagram of an IIC communication bus monitoring flow provided in embodiment 1 of the present invention;

FIG. 4 is a schematic diagram of a CRC check object selection manner according to embodiment 1 of the present invention;

fig. 5 is a schematic diagram of the working principle of the security management module provided in embodiment 1 of the present invention;

fig. 6 is a schematic diagram of an IIC communication security detection mechanism provided in embodiment 1 of the present invention.

Detailed Description

For the purpose of making apparent the objects, technical solutions and advantages of the present invention, the present invention will be further described in detail with reference to the following examples and the accompanying drawings, wherein the exemplary embodiments of the present invention and the descriptions thereof are for illustrating the present invention only and are not to be construed as limiting the present invention.

Example 1

The embodiment provides a system for improving IIC communication safety, which detects and remedies faults in the whole IIC communication process from four aspects of register initial value detection, IIC communication bus monitoring, register state detection and external bus detection, gathers detected faults to a safety management module through error signals and warning signals, processes the faults through the safety management module and feeds back the faults to a main control computer, and therefore the faults on the whole IIC communication link are rapidly positioned and remedied, and the safety of the IIC communication is improved.

As shown in FIG. 1, the system is integrally composed of a master control machine (host shown in FIG. 1) and a CIS chip, wherein the master control machine is connected with the CIS chip through an IIC communication bus (comprising an SCL clock line and an SDA data line). The CIS chip further comprises a register initial value detection module, an IIC communication bus monitoring module, a register state detection module and an external bus detection module.

The register initial value detection module is used for comparing the register initial value with the corresponding register expected value before the state of the SDA data line is changed, if the register initial value is inconsistent with the corresponding register expected value, the register with the inconsistent initial value and the register expected value is judged to be a fault register, the initial value of the corresponding fault register is replaced by the register expected value, and an error0 signal is sent to the main control computer. The main control machine is used for judging whether the initial value of the register is successfully replaced by the corresponding expected value of the register by reading the fault register according to the feedback of the error0 signal, and if the replacement is unsuccessful, the initial value of the register is changed in an IIC communication mode. The IIC communication bus monitoring module is used for carrying out abnormality monitoring on the whole process of IIC communication, if abnormality is monitored, the corresponding abnormality is extracted, and an error1 signal is sent to the main control computer. The register state detection module is used for judging whether the communication loop of the register has communication faults according to the output data of the communication loop of the register, if so, replacing the output data of the communication loop with the communication faults, and sending error signals or warning signals to the main control machine. The external bus detection module is used for performing CRC (cyclic redundancy check) on the address and the write data transmitted in the IIC communication process, and feeding back a check result to the main control computer. The safety management module is used for processing the error0 signal, the error1 signal, the error2 signal, the error3 signal and the warning signal and outputting the processed signals to the main control computer through the I/O port.

Next, in terms of module composition, working principle and technical effects, the embodiment is described in detail with respect to a main control computer, a register initial value detection module, an IIC communication bus monitoring module, a register state detection module, an external bus detection module and a security management module, respectively.

First register initial value detection module

Before IIC communication is performed, accuracy of initial values of all registers needs to be ensured, that is, the initial values of all registers should meet configuration in a default mode state, so that unintended results of IIC communication caused by configuration errors of the registers are avoided. In this embodiment, a register initial value checking module is used to detect the initial value of the register for the IIC communication system after power-up.

In the aspect of module composition, the register initial value detection module comprises an ECC check value calculation unit, a data reading and writing unit, an ECC check unit, a numerical comparison unit, a register initial value replacement unit and a register address writing unit. The ECC check value calculation unit is used for calculating a corresponding ECC check value according to the expected value of the register. The data read-write unit is used for writing the read ECC check value into the OTP memory together with the corresponding expected value of the register. The ECC check unit is used for performing parity check on data in the OTP memory and outputting expected values of the register to the numerical comparison unit. The numerical value comparison unit is used for comparing the expected value of the register with the corresponding initial value of the register, and if the expected value of the register is inconsistent with the corresponding initial value of the register, the numerical value comparison unit sends an error0 signal to the main control computer. The register initial value replacement unit is used for replacing the corresponding register initial value by the register expected value when the register expected value is inconsistent with the corresponding register initial value. The register address writing unit is used for writing the address of the register, the initial value of which is inconsistent with the expected value, into the read-only memory.

As shown in fig. 2, the operating principle of the register initial value detection module is that after HW standby is released and before the state of the SDA data line is changed, the initial values of all registers are compared with the expected values of the registers (i.e., the initial values of the registers configured in a default mode are satisfied), if the initial values of the registers are inconsistent with the expected values of the registers, it is determined that the initial values of the registers are wrong, an error0 signal is generated immediately, and the error0 signal is output to the security management module (such as the SMC module shown in fig. 2).

It should be further noted that, since the expected value of the register is known, the ECC check value calculation unit may calculate the corresponding ECC check value accordingly; writing the calculated ECC check value and the expected value of the register into an OTP memory through a data reading and writing unit, and then reading OTP data with the ECC check value from the OTP memory; the ECC check unit performs parity check on the read OTP data; the value comparison unit compares the expected value of the register with the corresponding initial value of the register, so that the reliability of the data read from the OTP memory can be greatly ensured, and the possibility of detecting faults of the initial value of the register caused by error of the input expected value of the register can be reduced when the initial value of the register is compared with the expected value of the register.

Furthermore, in the process of detecting the initial value of the register, if the initial value of the register is found to be wrong, the initial value replacing unit of the register can replace the wrong initial value of the register by utilizing the data in the OTP memory, so that the initial value of the register is taken as a remedy for the fault of the initial value of the register. Meanwhile, the register initial value detection module generates an error0 signal, the error0 signal is sent to the SMC module, the error0 signal is subjected to logic or processing by the SMC module and then fed back to the main control computer, and therefore the main control computer can rapidly locate faults in the register initial value detection stage. In addition, in the register initial value detection process, the address of the register, of which the initial value is inconsistent with the expected value, can be stored in the read-only memory through the register address writing unit. After the master control machine receives the error0 signal, the information of the register with the error initial value can be obtained by reading the read-only memory; the main control computer can also judge whether the error initial value is replaced successfully by reading the current initial value of the register and comparing the current initial value with the expected value of the register.

(II) Main control computer

When the master control machine receives the error0 signal sent by the register initial value detection module and finds that the wrong register initial value is not successfully replaced by the expected value of the register in the OTP memory, the wrong register initial value needs to be changed in an IIC communication mode, so that the bad influence of the unreasonable register initial value in a default mode state is avoided. In addition, the host computer needs to switch application modes, for example, when driving at night and in low-light environment of the tunnel lamp, exposure needs to be adjusted, HDR function needs to be switched, and register configuration needs to be changed through IIC communication.

Therefore, the main control machine provided in this embodiment includes a register address reading module, a register value reading module, a determining module, and an IIC communication module. The register address reading module is used for reading the register address in the read-only memory according to the error0 signal. The register value reading module is used for reading the current initial value of the register according to the error0 signal. The judging module is used for comparing the current register initial value with the register expected value, judging that the register initial value is not successfully replaced by the corresponding register expected value if the current register initial value is inconsistent with the register expected value, and judging that the register initial value is successfully replaced by the corresponding register expected value if the current register initial value is not consistent with the register expected value. The IIC communication module is used for changing the initial value of the register in an IIC communication mode when the initial value of the register is not successfully replaced by the corresponding expected value of the register.

(III) IIC communication bus monitoring module

Although the existing IIC communication protocol and IIC communication method are mature, since no response can be returned in the IIC communication process, the situation such as occasional timing anomaly still occurs. In this embodiment, the IIC communication bus monitoring module is used to monitor in real time the state of IIC communication initiated by the main control unit, the abnormal condition in the communication process, whether the initial value of the register can be configured smoothly, and so on. And once the abnormal state is detected, immediately feeding back to the main control computer.

The IIC communication bus monitoring module is a module that is parallel to the IIC communication module.

In the aspect of module composition, the IIC communication bus monitoring module comprises an information collecting unit, a state conversion unit, a data analysis unit and an abnormality extraction unit. The information collection unit is used for collecting the clock line change state and the data line change state of the IIC communication bus. The state conversion unit is used for carrying out corresponding abnormal condition monitoring on each phase of IIC communication according to the clock line change state and the data line change state, and generating an abnormal condition monitoring result; the abnormal condition detection result includes: the initial state signal is not generated when the IIC communication bus is switched from the idle state to the slave address phase, the ACK response signal is not generated in the register address phase, the ACK response signal is not generated in the data phase, and the end state signal is not generated at the end of the data phase. The data analysis unit is used for merging the data line change states of the slave address stage, the register address stage and the data stage into 8-bit data, monitoring whether abnormal conditions of inconsistent data bits occur between the 8-bit data and the data output after the IIC communication is finished, and generating an abnormal condition monitoring result if abnormal conditions of inconsistent data bits occur. The abnormality extraction unit is used for extracting an abnormality detection result of the state conversion unit and the data analysis unit and sending an error1 signal to the main control computer.

The state conversion unit comprises a first state judgment subunit, a second state judgment subunit, a third state judgment subunit and a fourth state judgment subunit. The first state judging subunit is used for judging whether the clock line change state and the data line change state simultaneously meet the condition A when the IIC communication bus is switched from the idle state to the slave address stage; if the condition A is met, judging that a starting state signal is generated; otherwise, judging that the initial state signal is not generated; condition a: during the high level of the clock line, the data line changes from the high level to the low level. The second state judging subunit is configured to judge, in the slave address stage, whether the clock line change state and the data line change state simultaneously meet the condition B or the condition C; if the condition B is met, judging that an ACK response signal is generated and entering a register address stage; if the condition C is met, judging that a NACK response signal is generated and ending the communication; condition B: the clock line is high and the data line is low; condition C: the clock line is high and the data line is high. The third state judging subunit is configured to judge, in the register address stage, whether the clock line change state and the data line change state simultaneously satisfy a condition D or a condition E; if the condition D is met, judging that an ACK response signal is generated and entering a data stage; if the condition E is met, judging that a NACK response signal is generated and ending the communication; condition D: the clock line is high and the data line is low; condition E: the clock line is high and the data line is high. The fourth state judging subunit is used for judging whether the clock line change state and the data line change state meet the condition F or the condition G at the same time after judging that the data transmission of the current byte is completed in the data stage; if the condition F is met, judging that an ACK response signal is generated, entering a data stage by default, and ending the communication until the condition G is met, judging that an ending state signal is generated; condition F: the clock line is high and the data line is low; condition G: during the high level of the clock line, the data line changes from the low level to the high level.

In the aspect of connection, the IIC communication bus monitoring module is respectively connected with an SCL clock line and an SDA data line of the IIC communication bus, so that the IIC communication bus monitoring module and the IIC communication module can acquire the same input information, and the function of parallel monitoring is realized.

The working principle of the IIC communication bus monitoring module is shown in fig. 3. The information collecting unit collects the changing edge of the SDA data line and the changing edge of the SCL clock line through the high-frequency system clock, and monitors key changing time points through the changing edge of the SDA data line and the changing edge of the SCL clock line. According to the IIC communication principle, during the period when the SCL clock line is high, the SDA data line changes from high to low indicating the start state of IIC communication, and the SDA data line changes from low to high indicating the end state of IIC communication. Between the start and end states are address and data phases. In the address and data stage, the change edge of the SDA data line is only used as data change, and is not used as a moment point for monitoring signal change; after the address and data phases are finished, the change of the SDA data line is only monitored on the rising edge of the SCL clock line, and the data of the SDA data line is changed on the falling edge of the SCL clock line, so that the change of the SDA data line is not monitored on the falling edge of the SCL clock line.

The state conversion is the key of the IIC communication bus monitoring module in the parallel monitoring process, and is essentially to perform fault monitoring on each link of the IIC communication process by simulating the IIC communication process, including initial state monitoring, slave address stage monitoring, register address stage monitoring, data stage monitoring and end state monitoring. The following describes the operation principle of the state conversion unit by way of example with reference to its composition and IIC communication principle.

When the main control computer starts communication, the IIC communication bus is switched from an idle state to a slave address stage, and whether an initial state signal is generated or not needs to be monitored. And judging whether the SDA data line is changed from a high level to a low level during the period that the SCL clock line is in the high level by the first state judging subunit, if so, judging that an initial state signal is generated in the stage that the IIC communication bus is switched from an idle state to a slave address, and otherwise, judging that the initial state signal is not generated.

Subsequently, the host transmits a 7-bit save address (8 th bit is a read/write flag bit) through the IIC communication bus. The CIS chip is connected with the main control computer through the IIC communication bus, and the IIC communication bus monitoring module monitors the IIC communication module in a parallel mode, so that the CIS chip is used as a slave computer in communication with the main control computer, and after the main control computer sends the slave address, the CIS chip needs to judge whether the received slave address is matched with the received slave address. Specifically, in the slave address stage, the chip_ack state determination is performed by the second state determining subunit, where the meaning of the chip_ack state determination is: judging whether the clock line change state and the data line change state simultaneously meet the requirement that the clock line is at a high level and the data line is at a low level, if so, indicating that the CIS chip address is successfully matched with the slave address, and generating an ACK confirmation signal; if the clock line change state and the data line change state meet the condition that the clock line is at a high level and the data line is at a high level, the CIS chip address and the slave address are not successfully matched, a NACK signal is generated, and the communication is ended.

After the slave address is confirmed, the master controller transmits a register address. In the register address stage, the addr_ack state determination is performed by the third state determination subunit. The meaning of addr_ack status determination is: judging whether the clock line is high level and the data line is low level is true, if so, judging that an ACK response signal is generated in a register stage, namely the register receives register address; if the clock line is high and the data line is also high, it is determined that a NACK signal is generated, that is, the register does not respond, ending the communication.

If the register responds, a data transfer may take place. In the data stage, the read/write flag bit determines whether to be a read process or a write process, and the sub unit dada_ack is judged by the fourth state judgment sub unit, that is, whether the current 1byte data is transmitted completely is judged. If the clock line is high and the data line is low at this time, it may be determined that the current 1byte data has been transferred, and an ACK response signal is generated, and the transfer of the next byte data may be continued until the end state signal is monitored (i.e., the data line is changed from low to high during the time when the clock line is high), ending the communication.

The data analysis unit collects the high and low states of the SDA data line according to the slave address stage, the register address stage and the rising edge of the SCL clock line in the data stage, merges the high and low states into 8bit data, compares the 8bit data with the data transmitted by the IIC communication module, and detects whether the communicated data are correct.

And finally, extracting an abnormal condition detection result of the state conversion unit and the data analysis unit by the abnormal extraction unit, and sending an error1 signal to the main control computer.

It should be noted that, the slave address stage, the register address stage, and the data stage are cycled eight times to be one state, and the next state can be entered after eight cycles are completed. The IIC communication bus monitoring module automatically monitors the IIC communication bus in real time, confirms whether an initial state signal, an end state signal and an ACK response signal of each stage in the communication process are correctly generated, confirms whether state switching meets the conditions, and finally extracts abnormal conditions such as abnormal time sequence, incapability of sending response bits, inconsistent data bit comparison results and the like in the analysis process, generates an Error1 signal and outputs the Error1 signal to the SMC module.

(IV) register State detection Module

The IIC communication bus monitoring module can monitor the communication state between the main control computer and the CIS chip, but cannot guarantee the safety of the communication loop inside the CIS chip. For example, when a vehicle travels at a strong distance from a high-voltage line or an electromagnetic field, a communication circuit inside the CIS chip is susceptible to electromagnetic interference; when the CIS chip is exposed for a long time or operated at high intensity, data transmission is unstable due to an excessively high chip temperature. Therefore, even if the IIC communication bus monitoring module monitors an abnormal situation, it cannot be guaranteed that the data written in through the IIC communication manner can be accurately written in the corresponding register.

Therefore, the embodiment realizes the detection of the security of the communication loop inside the CIS chip through the register state detection module.

In the aspect of module composition, the register state detection module comprises a register fault judging unit, an output data rewriting unit, a register information backup unit and an output data replacing unit. Wherein, the register fault determination unit is used for executing the following operations: the communication loop of the register is duplicated for two times, and the output data a, the output data b and the output data c of the three communication loops are compared pairwise; if a=b=c, then determining that the communication loop is fault-free; if a is not equal to b is not equal to c, judging that the communication loop fails, and sending an error2 signal to the main control computer; if a=b+.c or a+.b=c, then determining that the communication loop is faulty, and sending a warning signal to the master control. And an output data rewriting unit configured to rewrite the output data c with the output data a and the output data b when a=b+.c, and rewrite the output data a with the output data b and the output data c when a+.b=c. And the register information backup unit is used for writing the register address and the register data obtained by analyzing the IIC communication module into the SRAM in real time in the IIC communication process. And an output data replacing unit for extracting data of registers having the same address as one type of registers from the SRAM memory and replacing the output data a, the output data b and the output data c with the extracted data when a is not equal to b not equal to c.

The working principle is as follows:

1. processing mode aiming at register

The register fault judging unit copies the communication loop of the register for two other times, and assigns the same input configuration for each communication loop; the output data of the three communication loops are then subjected to a triple voting. As shown in table 1, the triple voting specifically includes three cases, the first case is that when the output data of three communication circuits are all identical, it is determined that the communication circuit has no fault; in the second case, when the output data of the three communication loops are inconsistent, judging that the communication loops have faults, generating error2 signals, and sending the error2 signals to the safety management module for processing; the third case is that, for the case that only two communication loops out of the output data of three communication loops are consistent, and the output data of the other communication loops are inconsistent, the communication loops are regarded as malfunctioning, but only warning processing is given, namely a warning signal is generated, and the warning signal is sent to the safety management module. In the third case, the output data rewriting unit will rewrite another different output data with the same two output data.

In addition, during the register communication, the register information backup unit writes the register address and the register data obtained by analyzing the IIC communication module into the SRAM in sequence in the IIC communication process in real time, and takes the data in the SRAM as backup, thereby being convenient for extraction during rewriting.

Output data comparison	Final output	Judgment result	Signal signIdentification device
				a＝b＝c	y＝a	No fault occurs	Without any means for
a≠b≠c	y＝a＝b＝c＝s	With occurrence of faults	error2
				a＝b≠c	y＝b＝c	With occurrence of faults	warning
a≠b＝c	y＝c＝a	With occurrence of faults	warning

TABLE 1

In table 1, y represents the output to the other module, and s represents the backup value in the SRAM.

However, when the output data of the three communication circuits are not identical, it cannot be determined which output data is correct, and therefore the output data cannot be rewritten, and only the output data of the three communication circuits can be uniformly replaced by the backup data in the SRAM memory. The specific implementation mode is as follows: the output data replacing unit extracts data of a register having the same address as the register from the SRAM memory, and replaces the output data a, the output data b, and the output data c with the extracted data.

It should be noted that the storage value of the 1-bit wide register is only 0 and 1, so that it cannot satisfy the decision rule in the triple-voting circuit, and thus the triple-voting decision method is not applicable to the 1-bit wide register.

It should be noted that, the register state detection module may perform the corresponding operation of each functional unit for all registers. However, in practical applications, registers may be classified into different types according to different functions. In order to balance security, detection speed and circuit area and reduce resource consumption, the embodiment splits the register into a first type register and a second type register according to different functions of the register. The registers of one type refer to a register with a mode switching function and a register with a scene switching function; the register with the mode switching function is a register for switching mode application, such as clock frequency division, frame rate adjustment and the like; the register having a scene switching function is a register for switching scene applications such as auto exposure and moving object detection. The second-class registers refer to all registers except the first-class registers.

And the register state monitoring module is used for respectively adopting different modes for fault detection aiming at the communication loop of the first-class register and the communication loop of the second-class register.

In terms of module composition, the register state detection module further comprises a register classification unit, which is used for classifying the registers into a first class of registers and a second class of registers according to the functions of the registers; the first type of registers include registers with a mode switching function and registers with a scene switching function, and the second type of registers are all registers except the first type of registers. The register fault judging unit comprises a first-class register fault judging subunit and a second-class register fault judging subunit. A class of register fault determination subunits for performing the following operations: the communication loop of one type of register is duplicated for two times, and the output data a, the output data b and the output data c of the three communication loops are compared pairwise; if a=b=c, then determining that the communication loop is fault-free; if a is not equal to b is not equal to c, judging that the communication loop fails, and sending an error2 signal to the main control computer; if a=b+.c or a+.b=c, then determining that the communication loop is faulty, and sending a warning signal to the master control. And the second-class register fault judging subunit is used for comparing the output data d of the communication loop of the second-class register with the data of the register with the same address as the second-class register in the SRAM memory, judging that the communication loop has no fault if the output data d is consistent with the data of the register with the same address as the second-class register, and sending an error3 signal to the main control computer if the output data d is not consistent with the data of the register with the second-class register. The output data replacement unit includes a first output data replacement subunit and a second output data replacement subunit. A first output data replacing subunit, configured to extract, from the SRAM memory, data of registers having the same address as one type of registers, and replace the output data a, the output data b, and the output data c with the extracted data, when a+.b+.c; and the second output data replacing subunit is used for replacing the output data d by corresponding register data in the SRAM memory when the communication circuit is judged to be faulty.

It should be noted that the function of the register fault determination subunit is the same as that of the register fault determination unit, and the function of the first output data replacement subunit is the same as that of the register fault determination unit. And for the second-class register, the register address and the register value are stored in the second-class register in real time in a mode of writing the backup value into the SRAM memory when the first-class register is communicated. And comparing the output data d of the communication loop of the second-class register with the data of the register with the same address as the second-class register in the SRAM memory through a second-class register fault judging unit, judging that the communication loop has no fault if the output data d is consistent with the data of the register with the same address as the second-class register, otherwise, judging that the communication loop has fault, and sending an error3 signal to the safety management module. Meanwhile, the second output data replacing unit replaces the output data d with the corresponding register data in the SRAM memory.

It should be further noted that the purpose of splitting the registers into the first class register and the second class register in this embodiment is to balance security, detection speed and circuit area, and reduce resource consumption. In practical application, the user can select to unify the first-class register and the second-class register according to the processing mode of the first-class register, namely, the second-class register can be subjected to fault judgment by using a first-class register fault judging subunit, and the first data replacing unit can be used for replacing data. When the corresponding subunits are utilized for processing the first-class register and the second-class register, the effects of balancing the safety, the detection speed and the circuit area and reducing the resource loss can be achieved.

(V) external bus detection Module

The IIC communication bus monitoring module and the register state detection module respectively monitor the abnormality between the main control computer and the CIS chip and in the CIS chip, and timely feed back the monitored abnormality to the main control computer. The external bus detection module adopts a CRC (cyclic redundancy check) mode to check the data communicated by the main control computer and then feeds the data back to the main control computer again, so that the interaction between the CIS chip and the main control computer is abnormally controllable, and the safety detection of the whole communication link is ensured.

In the aspect of module composition, the external bus detection module comprises a first check unit, a second check unit, a third check unit and a fourth check unit. The first checking unit is used for performing CRC check on the slave address. The second checking unit is used for performing CRC check on the read-write flag bit. The third checking unit is used for performing CRC check on the register address. The fourth checking unit is used for performing CRC check on the write data.

In connection, the external bus detection module outputs the CRC check result and the byte number of the object participating in the CRC check to the main control computer through the MIPI interface.

And the main control computer performs IIC communication data, including register addresses and configured register data. The external bus detection module performs CRC check on both the register address and the register data. In addition, the number of the participating verification objects and the verified result are output as observable data through the MIPI interface.

The working principle is as shown in fig. 4, and in the Write mode, the external bus detection module performs CRC check on the slave address, the read/Write flag bit, the register address, and the Write data. In the Read mode, the Read data corresponding to the check object cannot realize the process from the main control computer to the CIS chip and back to the main control computer, so that CRC check is not performed. The number of objects involved in the test is counted in bytes.

As can be seen in connection with fig. 4:

a single byte write address of 0x3028, register A [4:0] with a value of 5' h 18: { slave address [7:1],1' b0}, 0x30, 0x28, 0x18, performing CRC check, and participating in checking that the number of bytes is 4 bytes;

register B [19:0] with a multibyte write address of 0x30A0 and a value of 20' h1C 08: { slave address [7:1],1' b0}, 0x30, 0xA0, 0x00, 0x1C, 0x08, performing CRC check, and participating in checking that the number of bytes is 6 bytes;

register C [7:0] with a single byte read address of 0x 302C: { slave address [7:1],1'b0}, 0x30, 0x2C, { slave address [7:1],1' b1} performs CRC check, and participates in checking that the number of bytes is 4 bytes;

register D [15:0] with a multibyte read address of 0x30A 8: { slave address [7:1],1'b0}, 0x30, 0xA8, { slave address [7:1],1' b1}, and performing CRC check to participate in checking that the number of bytes is 4 bytes.

It should be noted that, the main control computer knows the configuration to be communicated, can carry out CRC calculation by itself, compares the calculated result with output observable data, if not consistent, indicates that a fault occurs, and can quickly lock the position where the problem occurs, thereby reducing debug time. In addition, the main control machine can select a register to be checked, and the starting position and the ending position of a group of registers can be flexibly selected by configuring an enable signal CRC_EN of the CRC checking function. The specific configuration mode is as follows: firstly, configuring CRC_EN=1' b1, and opening a CRC check function; then configuring a communication register A, a communication register B and a communication register C; crc_en=1' b0 is reconfigured, and the CRC check function is turned off. register A, register B, register C are the objects that need to be checked, while CRC_EN does not participate in the check. In addition, the main control machine can select the time point of observation of the checking result. If the CRC check is performed during SW standby, the result of the check and the counted byte number are packed by MIPI protocol and output as observable data at the first frame. If CRC check is performed during streaming, it is necessary to wait until the next frame to be fed back to the host.

Sixth, safety management module

The error0 signal, the error1 signal, the error2 signal, the error3 signal and the warning signal are sign signals of different safety guarantee mechanisms when faults are detected, and the signals are processed by a safety management module (SMC module) and then are output through an I/O port as an observation terminal so as to conveniently inform a main control computer of the occurrence of the faults and discover the problems in time.

In terms of module composition, the security management module comprises a logic or processing unit and a read-only memory unit. The logic or processing unit is used for carrying out logic or processing on the error0 signal, the error1 signal, the error2 signal, the error3 signal and the warning signal. The read-only memory unit is used for storing the processing result of the error0 signal, the processing result of the error1 signal, the processing result of the error2 signal, the processing result of the error3 signal and the processing result of the rolling signal respectively by taking 1bit as a unit.

The working principle of the security management module is shown in fig. 5, all error signals and warning signals are logically or processed and output in the module, and the I/O port multiplexing of the CIS chip is reduced. Meanwhile, the flag signals can be read out through a read-only type register err_code, and the main control computer can know which type of fault occurs through reading the read-only type register err_code. Specifically, err_code is a 5bit read-only type register, each 1bit representing an error or rolling type; err_code [0]: detecting an error0 signal when corresponding register initial values are inconsistent with a register expected value; ERR_CODE [1]: monitoring error1 signals when abnormality occurs corresponding to the IIC communication bus; err_code [2]: in the state detection process of the corresponding register, one type of register has inconsistent communication loop data when voting, and a warning signal is fed back to the main control computer; err_code [3]: in the corresponding register state detection process, one type of register cannot vote on error2 signals when a result is obtained; err_code [4]: in the corresponding register state detection process, the second-class register communication loop outputs an error3 signal when the result is inconsistent with the backup value in the SRAM.

All flag signals default to a low initial state and the corresponding error or warning signal will be pulled high when a fault is detected. After receiving the sign signals, the main control computer clears the detection state through a reset register ERR_CLR, and ensures that all the sign signals are in an initial state before the next detection.

In summary, according to the system for improving IIC communication security provided in this embodiment, corresponding security detection and guarantee mechanisms are set according to the circuit characteristics of each link, so that the positions of faults of different links and types can be rapidly located and fed back in real time, and the overall fault analysis efficiency is improved. Meanwhile, as for the security mechanism added in the communication loop of the sender, remedial measures are taken while faults are detected, so that the risk degree of overall faults is reduced.

As shown in fig. 6, when the fault occurs at the position (1), the abnormal action of the IIC communication bus is illustrated, and the fault position can be rapidly located without waiting for the subsequent action by monitoring in real time and feeding back to the main control machine (Host shown in fig. 6) through the IIC communication bus monitoring module. When the master control machine switches application scenes and needs to configure a register to carry out IIC communication, the application scenes are required to be sent to an IIC communication module in the CIS chip through an SCL clock line and an SDA data line to carry out protocol analysis. In the process, the IIC communication bus monitoring module can observe the states of the SCL clock line and the SDA data line in real time to monitor whether communication is abnormal or not. When the fault occurs in the position (1), the IIC communication bus monitoring module feeds back the abnormal condition to the main control computer in real time. When the position (2) fails, the action abnormality of the internal IIC communication analysis module is indicated, and the action abnormality can be timely detected and fed back to the main control computer for timely response through the IIC communication bus detection module and the external bus detection module. The IIC communication bus monitoring module detects internal timing, flag bits, and status switches. If the IIC communication module in the step (2) fails in protocol analysis, the failure is fed back to the main control computer in real time. Under the condition that the IIC communication bus monitoring module does not detect faults, normal communication can be guaranteed, but whether communication data are correct or not cannot be known, and at the moment, the external bus monitoring module adopts CRC to check the address and the data of the communication register. The checked data participate in checking byte numbers and are fed back to a Host side through an MIPI interface to judge whether the communication data are correct or not. The CRC check can select an object register and a result observation time point, has certain flexibility, and improves the fault analysis efficiency. When a fault occurs at (3), it is indicated that the register value has changed or that the value has not been written correctly. The fault can be timely fed back to the Host through the register initial value detection and register state detection module, and the fault is repaired through remedial measures. The initial value detection of the register after the CIS chip is powered on is used for ensuring the accuracy of the initial state of the register communication loop at the position (3). When the initial value is detected to be inconsistent with the expected value stored in the OTP, the data stored in the OTP can be used for remedying, and an Error signal can be fed back in real time. The register state detection module checks whether a fault has occurred at (3). The module considers the problems of fault detection speed, loop area of CIS, resource consumption and the like, and registers are divided into two types during detection. And for one type of register, copying the communication loop of the register to perform triple voting processing, and directly comparing other registers with the backup value stored in the SRAM. When a fault is detected, the fault is fed back to the Host side in real time, and meanwhile, the fault is remedied in a rewriting mode, so that the accuracy of communication data is further ensured. When the fault occurs in the position (4), the data read out by the main control computer is abnormal, and the data analyzed by the IIC communication bus monitoring module and the data analyzed by the IIC communication module can be compared to confirm the correctness and immediately fed back to the main control computer.

Example 2

Corresponding to embodiment 1, the present embodiment provides a method for improving IIC communication security, including the following steps: s1: before the state of the SDA data line is changed, comparing the initial value of the register with the corresponding expected value of the register, if the initial value of the register is inconsistent with the corresponding expected value of the register, judging the register with the inconsistent initial value and the expected value of the register as a fault register, replacing the initial value of the corresponding fault register by the expected value of the register, and sending an error0 signal to the main control machine side; s2: reading the value of a fault register at one side of a main control machine, judging whether the initial value of the register is successfully replaced by the corresponding expected value of the register according to the read value of the fault register, and if the replacement is unsuccessful, changing the initial value of the register in an IIC communication mode; s3: performing anomaly monitoring on the whole IIC communication process, extracting corresponding anomaly conditions if anomalies are monitored, and sending an error1 signal to one side of the main control machine; s4: judging whether the communication loop of the register has faults according to the output data of the communication loop of the register, if so, replacing the output data of the communication loop with faults, and sending error signals or warning signals to one side of the main control machine; s5: and performing CRC (cyclic redundancy check) on the address and the write data transmitted in the IIC communication process, and feeding back a check result to one side of the main control computer.

s1 comprises

S2 comprises

S3 comprises

Further, S32 includes

S4 comprises

S5 comprises

The foregoing description of the embodiments has been provided for the purpose of illustrating the general principles of the invention, and is not meant to limit the scope of the invention, but to limit the invention to the particular embodiments, and any modifications, equivalents, improvements, etc. that fall within the spirit and principles of the invention are intended to be included within the scope of the invention.

Claims

1. The system for improving IIC communication safety is characterized by comprising a main control computer and a CIS chip; the main control computer is connected with the CIS chip through an IIC communication bus; the CIS chip comprises a register initial value detection module, an IIC communication bus monitoring module, a register state detection module and an external bus detection module;

the register initial value detection module is used for comparing the register initial value with the corresponding register expected value before the state of the SDA data line is changed, judging a register with the initial value inconsistent with the register expected value as a fault register if the register initial value inconsistent with the register expected value is inconsistent with the corresponding register expected value, replacing the initial value of the corresponding fault register by the register expected value, and sending an error0 signal to the main control computer;

The main control machine is used for judging whether the initial value of the register is successfully replaced by the corresponding expected value of the register by reading the value of the fault register according to the feedback of the error0 signal, and if the replacement is unsuccessful, changing the initial value of the register in an IIC communication mode;

the IIC communication bus monitoring module is used for carrying out abnormality monitoring on the whole process of IIC communication, extracting corresponding abnormal conditions if abnormality is monitored, and sending error1 signals to the main control computer;

the register state detection module is used for judging whether the communication loop of the register has faults according to the output data of the communication loop of the register, if so, replacing the output data of the communication loop with faults and sending error signals or warning signals to the main control computer;

and the external bus detection module is used for performing CRC (cyclic redundancy check) on the address and the write data transmitted in the IIC communication process and feeding back a check result to the main control computer.

2. The system for improving security of IIC communications of claim 1 wherein,

the register initial value detection module comprises

The ECC check value calculation unit is used for calculating a corresponding ECC check value according to the expected value of the register;

The data read-write unit is used for writing the read ECC check value into the OTP memory together with the corresponding expected value of the register;

the ECC check unit is used for performing parity check on the data in the OTP memory and outputting the expected value of the register to the numerical comparison unit;

the numerical value comparison unit is used for comparing the expected value of the register with the corresponding initial value of the register, and sending an error0 signal to the main control computer if the expected value of the register is inconsistent with the corresponding initial value of the register;

a register initial value replacement unit for replacing the corresponding register initial value with the register expected value when the register expected value is inconsistent with the corresponding register initial value;

and the register address writing unit is used for writing the addresses of the registers, the initial values of which are inconsistent with the expected values, into the read-only memory.

The main control computer comprises

The register address reading module is used for reading the register address in the read-only memory according to the error0 signal;

the register value reading module is used for reading the current initial value of the register according to the error0 signal;

a judging module, configured to compare the current initial register value with the expected register value, and if the current initial register value is inconsistent with the expected register value, judge that the initial register value is not successfully replaced by the expected register value, otherwise, judge that the initial register value is successfully replaced by the expected register value;

And the IIC communication module is used for changing the initial value of the register in an IIC communication mode when the initial value of the register is not successfully replaced by the corresponding expected value of the register.

3. The system for improving security of IIC communications of claim 1 wherein,

the IIC communication bus monitoring module comprises

The information collection unit is used for collecting the clock line change state and the data line change state of the IIC communication bus;

the state conversion unit is used for carrying out corresponding abnormal condition monitoring on each phase of IIC communication according to the clock line change state and the data line change state, and generating an abnormal condition monitoring result; the abnormal condition detection result includes: when the IIC communication bus is switched from an idle state to a slave address stage, no initial state signal is generated, no ACK response signal is generated in the slave address stage, no ACK response signal is generated in the register address stage, no ACK response signal is generated in a data stage, and no end state signal is generated at the end of the data stage;

the data analysis unit is used for merging the data line change states of the slave address stage, the register address stage and the data stage into 8-bit data, monitoring whether abnormal conditions of inconsistent data bits occur between the 8-bit data and the data output after the IIC communication is finished, and generating an abnormal condition monitoring result if abnormal conditions of inconsistent data bits occur;

The abnormality extraction unit is used for extracting an abnormality detection result of the state conversion unit and the data analysis unit and sending an error1 signal to the main control computer;

the state conversion unit comprises

The first state judging subunit is used for judging whether the clock line change state and the data line change state simultaneously meet the condition A when the IIC communication bus is switched from the idle state to the slave address stage; if the condition A is met, judging that a starting state signal is generated; otherwise, judging that the initial state signal is not generated; condition a: during the period that the clock line is high level, the data line is changed from high level to low level;

the second state judging subunit is configured to judge, in the slave address stage, whether the clock line change state and the data line change state simultaneously meet the condition B or the condition C; if the condition B is met, judging that an ACK response signal is generated and entering a register address stage; if the condition C is met, judging that a NACK response signal is generated and ending the communication; condition B: the clock line is high and the data line is low; condition C: the clock line is high and the data line is high;

a third state judging subunit, configured to judge, in a register address stage, whether the clock line change state and the data line change state simultaneously satisfy a condition D or a condition E; if the condition D is met, judging that an ACK response signal is generated and entering a data stage; if the condition E is met, judging that a NACK response signal is generated and ending the communication; condition D: the clock line is high and the data line is low; condition E: the clock line is high and the data line is high;

A fourth state judging subunit, configured to judge, in the data stage, whether the clock line change state and the data line change state simultaneously satisfy the condition F or the condition G after the data transmission of the current byte is completed; if the condition F is met, judging that an ACK response signal is generated, and entering a data stage by default until the condition G is met; if the condition G is met, judging that an ending state signal is generated, and ending the communication; condition F: the clock line is high and the data line is low; condition G: during the high level of the clock line, the data line changes from the low level to the high level.

4. The system for improving security of IIC communications according to claim 1, wherein the register state detecting module comprises

A register failure determination unit for performing the following operations: the communication loop of the register is duplicated for two times, and the output data a, the output data b and the output data c of the three communication loops are compared pairwise; if a=b=c, then determining that the communication loop is fault-free; if a is not equal to b is not equal to c, judging that the communication loop fails, and sending an error2 signal to the main control computer; if a=b not equal to c or a not equal to b=c, judging that the communication loop fails, and sending a warning signal to the main control computer;

An output data rewriting unit that rewrites the output data c with the output data a and the output data b in the case a=b+.c, and rewrites the output data a with the output data b and the output data c in the case a+.b=c;

the register information backup unit is used for writing the register address and the register data obtained by analyzing the IIC communication module into the SRAM in real time in the IIC communication process;

and an output data replacing unit for extracting data of a register having the same address as the register from the SRAM memory and replacing the output data a, the output data b and the output data c with the extracted data when a not equal to b not equal to c.

5. The system for improving security of IIC communications of claim 4 wherein,

the register state detection module further comprises

The register classification unit is used for classifying the registers into a first class of registers and a second class of registers according to the functions of the registers; the first-class registers comprise registers with a mode switching function and registers with a scene switching function, and the second-class registers are all registers except the first-class registers;

the register fault judging unit comprises

A class of register fault determination subunits for performing the following operations: the communication loop of one type of register is duplicated for two times, and the output data a, the output data b and the output data c of the three communication loops are compared pairwise; if a=b=c, then determining that the communication loop is fault-free; if a is not equal to b is not equal to c, judging that the communication loop fails, and sending an error2 signal to the main control computer; if a=b not equal to c or a not equal to b=c, judging that the communication loop fails, and sending a warning signal to the main control computer;

the second-class register fault judging subunit is used for comparing the output data d of the communication loop of the second-class register with the data of the register with the same address as the second-class register in the SRAM memory, judging that the communication loop has no fault if the output data d is consistent with the data of the register with the same address as the second-class register, and sending an error3 signal to the main control computer if the output data d is not consistent with the data of the register with the second-class register;

the output data replacement unit includes

A first output data replacing subunit, configured to extract, from the SRAM memory, data of registers having the same address as one type of registers, and replace the output data a, the output data b, and the output data c with the extracted data, when a+.b+.c;

and the second output data replacing subunit is used for replacing the output data d by corresponding register data in the SRAM memory when the communication circuit is judged to be faulty.

6. The system for improving security of IIC communication according to claim 1, wherein the external bus detection module comprises

The first checking unit is used for performing CRC (cyclic redundancy check) on the slave address;

the second checking unit is used for performing CRC check on the read-write flag bit;

a third checking unit, configured to perform CRC checking on the register address;

a fourth checking unit for performing CRC check on the write data;

the external bus detection module outputs a CRC check result and the byte number of the object participating in the CRC check to the main control computer through the MIPI interface;

the external bus detection module also comprises

The safety management module is used for processing the error0 signal, the error1 signal, the error2 signal, the error3 signal and the warning signal and then outputting the processed signals to the main control computer through the I/O port;

the security management module comprises

A logic or processing unit, configured to perform logic or processing on an error0 signal, an error1 signal, an error2 signal, an error3 signal, and a warning signal;

and the read-only memory unit is used for respectively storing the processing result of the error0 signal, the processing result of the error1 signal, the processing result of the error2 signal, the processing result of the error3 signal and the processing result of the rolling signal by taking 1bit as a unit.

7. A method for improving security of IIC communications, comprising the steps of:

s1: before the state of the SDA data line is changed, comparing the initial value of the register with the corresponding expected value of the register, if the initial value of the register is inconsistent with the corresponding expected value of the register, judging the register with the inconsistent initial value and the expected value of the register as a fault register, replacing the initial value of the corresponding fault register by the expected value of the register, and sending an error0 signal to the main control machine side;

s2: reading the value of a fault register at one side of a main control machine, judging whether the initial value of the register is successfully replaced by the corresponding expected value of the register according to the read value of the fault register, and if the replacement is unsuccessful, changing the initial value of the register in an IIC communication mode;

s3: performing anomaly monitoring on the whole IIC communication process, extracting corresponding anomaly conditions if anomalies are monitored, and sending an error1 signal to one side of the main control machine;

s4: judging whether the communication loop of the register has faults according to the output data of the communication loop of the register, if so, replacing the output data of the communication loop with faults, and sending error signals or warning signals to one side of the main control machine;

S5: and performing CRC (cyclic redundancy check) on the address and the write data transmitted in the IIC communication process, and feeding back a check result to one side of the main control computer.

8. The method for improving security of IIC communication of claim 7 wherein,

s1 comprises

S11: calculating a corresponding ECC check value according to the expected value of the register; s12: writing the read ECC check value into the OTP memory together with the corresponding expected value of the register; s13: parity checking is carried out on data in the OTP memory, and expected values of the registers are output to a numerical comparison unit; s14: comparing the expected value of the register with the corresponding initial value of the register, and if the expected value of the register is inconsistent with the corresponding initial value of the register, sending an error0 signal to the main control computer; s15: when the expected value of the register is inconsistent with the corresponding initial value of the register, replacing the corresponding initial value of the register by the expected value of the register;

s2 comprises

9. The method for improving security of IIC communication of claim 7 wherein,

s3 comprises

S31: collecting the clock line change state and the data line change state of the IIC communication bus; s32: according to the clock line change state and the data line change state, corresponding abnormal condition monitoring is carried out on each phase of IIC communication, and an abnormal condition monitoring result is generated; the abnormal condition detection result includes: when the IIC communication bus is switched from an idle state to a slave address stage, no initial state signal is generated, no ACK response signal is generated in the slave address stage, no ACK response signal is generated in the register address stage, no ACK response signal is generated in a data stage, and no end state signal is generated at the end of the data stage; s33: merging the data line change states of the slave address stage, the register address stage and the data stage into 8-bit data, monitoring whether abnormal conditions of inconsistent data bits occur between the 8-bit data and the data output after the IIC communication is finished, and generating an abnormal condition monitoring result if abnormal conditions of inconsistent data bits occur; extracting an abnormal condition detection result of the state conversion unit and the data analysis unit, and sending an error1 signal to one side of the main control machine;

S32 includes

10. The method for improving security of IIC communication of claim 7 wherein,

s4 comprises

S41: the communication loop of one type of register is duplicated for two times, and the output data a, the output data b and the output data c of the three communication loops are compared pairwise; if a=b=c, then determining that the communication loop is fault-free; if a is not equal to b is not equal to c, judging that the communication loop fails, and sending an error2 signal to the main control computer; if a=b not equal to c or a not equal to b=c, judging that the communication loop fails, and sending a warning signal to the main control computer; the register comprises a register with a mode switching function and a register with a scene switching function; s42: in the case of a=b+.c, the output data a and b are used to rewrite the output data c, and in the case of a+.b=c, the output data b and c are used to rewrite the output data a; s43: in the IIC communication process, sequentially writing a register address and register data obtained by analyzing the IIC communication module into an SRAM (static random Access memory) in real time; s44: when a is not equal to b is not equal to c, extracting data of registers with the same address as one type of registers from the SRAM memory, and replacing the output data a, the output data b and the output data c by the extracted data; s45: comparing the output data d of the communication loop of the second-class register with the data of the register with the same address as the second-class register in the SRAM memory, if the output data d of the communication loop of the second-class register is consistent with the data of the register with the same address as the second-class register, judging that the communication loop has no fault, otherwise, judging that the communication loop has fault, and sending an error3 signal to the main control computer; the second-class registers are all registers except the first-class registers; s46: when the communication loop is judged to be faulty, the output data d is replaced by corresponding register data in the SRAM memory;

S5 comprises

S51: CRC (cyclic redundancy check) is respectively carried out on the slave address, the read-write flag bit, the register address and the write data; s52:

and outputting the CRC check result and the byte number of the object participating in the CRC check to the side of the main control computer through the MIPI interface.