DE102012010896A1 - Method for performing three plane processor instruction set tests in e.g. battery management system in electrically operated motor car, involves determining faults in control system depending on test responses of instruction set tests - Google Patents

Abstract

The method involves transmitting test request commands of a main control apparatus (21) to auxiliary control apparatuses (22) over a bus system (3). Processor instruction set tests are performed in processors (4) of the auxiliary control apparatuses based on a received test request command. Test responses of the processor instruction set tests are generated in the auxiliary control apparatuses. The test responses are transmitted to the main control apparatus over the bus system. Faults in a control system (1) are determined depending on the test responses of the instruction set tests. Independent claims are also included for the following: (1) a main control apparatus (2) a system for performing processor instruction set tests.

Description

Technical area

The invention relates to distributed, automotive control device systems in which a plurality of control devices are connected to one another via a bus system. The invention further relates to measures for checking the proper functioning of the control devices.

State of the art

By the ISO 26262 Safety mechanisms for the use of control units in motor vehicles are required to detect errors in safety-related functions in the control unit software. The detection of errors is realized on the basis of a three-level concept in which the through the ISO 26262 required security mechanisms are implemented in a second level and a third level of the concept, while the first level is responsible for the execution of the safety-related function.

In the third level of the three-level concept, in a processor instruction set test, requests are made to the processor, which must be answered by the processor of the controller with a corresponding response, so that a freedom of the processor of the controller can be detected.

The level 3 requests to test the processor instruction set are generated in a monitoring unit previously provided locally in the controller, so that in the three-level concept only a local question-answer instruction set test is provided, which in a controller with a local Arithmetic unit and a local monitoring unit is realized.

Current automotive control systems, such as a battery management system, are very complex and controlled by a combination of controllers. The control of the entire system is distributed to several control units, which usually have a main control unit (master) and slave control units (slaves). The connection between the control units takes place by means of a bus system, for example via an SPI bus or a CAN bus. The accuracy of the control system is therefore guaranteed only if each of the control units works properly. In the sense of the ISO 26262 Therefore, a functional check must be carried out by all control units.

It is an object of the present invention to provide a function check using a processor instruction set test for all control devices, the load on the bus system being kept as low as possible.

Disclosure of the invention

This object is achieved by the method for checking the function of a plurality of control devices according to claim 1 and by the device and the system according to the independent claims.

Further advantageous embodiments of the present invention are specified in the dependent claims.

• – Übermitteln von Testanfragebefehlen von dem Hauptsteuergerät an die mehreren Nebensteuergeräte über das Bussystem;
• – Durchführen eines Prozessorbefehlssatztests in dem Prozessor der Nebensteuergeräte basierend auf dem entsprechend empfangenen Testanfragebefehl und Generieren von Testantworten der Prozessorbefehlssatztests in den mehreren Nebensteuergeräten;
• – Übermitteln der Testantworten über das Bussystem an das Hauptsteuergerät;
• – Feststellen eines Fehlers im System abhängig von den Testantworten der Prozessorbefehlssatztests.

According to a first aspect, a method for performing processor instruction set tests in a system, particularly in a control system for automotive applications, is provided with a main controller and a plurality of slave controllers interconnected via a bus system, the main controller and the plurality of slave controllers each having a processor have, with the following steps:

• Transmitting test request commands from the main controller to the plurality of slave controllers via the bus system;
• - performing a processor instruction set test in the processor of the slave controllers based on the corresponding received test request command and generating test responses of the processor instruction set tests in the plurality of slave controllers;
• - transmitting the test responses via the bus system to the main control unit;
• - Detecting a fault in the system depending on the test word processor test set test responses.

One idea of the above method is to perform a processor instruction set test in a composite of multiple controllers, the processor instruction set test testing each processor of the controllers. The processor instruction set test is controlled by a master controller so that information about a fault in one of the slave controllers can be signaled at a central location in the system, namely the master controller.

Furthermore, the test request commands from the main controller via the bus system can be delayed in the multiple. Sub-control devices are transmitted, so that the test request commands and the test responses are transmitted with a time delay over the bus system.

To check the auxiliary control units is from the main control unit via the bus system a test request is made, with the slave controllers are addressed in a time shift to compensate for the data transfer load in the bus system. In this way, load spikes in the bus system due to a level 3 processor command set test can be avoided.

In particular, the processor instruction set tests in the slave controllers may be performed sequentially, with a processor instruction set test being started in a slave controller when a test response has been received from another slave controller.

According to one embodiment, the processor instruction set tests in the slave controllers may be performed sequentially, wherein processor instruction set testing in a processor of the master controller is performed in overlap with a processor instruction set test in one of the slave controllers.

• – eine Testbefehlgeneratoreinheit zum Generieren und Übermitteln von Testanfragebefehlen an die mehreren Nebensteuergeräte über das Bussystem;
• – eine Vergleichseinheit zum Empfangen von Testantworten der Prozessorbefehlssatztests in den mehreren Nebensteuergeräten und zum Feststellen eines Fehlers im System abhängig von den Testantworten der Prozessorbefehlssatztests.

In another aspect, a main controller for performing processor instruction set tests in a system, particularly in a control system for automotive applications, is provided, wherein the main controller is connected to a plurality of slave controllers via a bus system. The main control unit includes:

• A test command generator unit for generating and transmitting test request commands to the plurality of slave controllers via the bus system;
• A comparison unit for receiving test responses of the processor instruction set tests in the plurality of slave controllers and for determining a fault in the system depending on the tester responses of the processor instruction set tests.

• – ein Bussystem, das ein Hauptsteuergerät und mehrere Nebensteuergeräte miteinander verbindet,
• – das Hauptsteuergerät mit mindestens einem Prozessor, und
• – die mehreren Nebensteuergeräte,

wobei das Hauptsteuergerät ausgebildet ist, um Testanfragebefehle an die mehreren Nebensteuergeräte über das Bussystem zu übermitteln, um Testantworten über das Bussystem zu empfangen und um einen Fehler im System abhängig von den Testantworten der Prozessorbefehlssatztests festzustellen,
wobei die Nebensteuergeräte ausgebildet sind, um einen Prozessorbefehlssatztest basierend auf dem entsprechend empfangenen Testanfragebefehl durchzuführen und entsprechend Testantworten der Prozessorbefehlssatztests zu generieren.In another aspect, a system for performing processor instruction set testing, particularly a control system for automotive applications, is provided. The system includes:

• A bus system interconnecting a main control unit and a plurality of sub-controllers,
• - the main control unit with at least one processor, and
• - the several auxiliary control units,

wherein the main controller is configured to transmit test request commands to the plurality of slave controllers over the bus system to receive test responses over the bus system and to determine a fault in the system based on the processor command set test responses;
wherein the slave controllers are configured to perform a processor instruction set test based on the correspondingly received test request instruction and to generate corresponding test responses of the processor instruction set tests.

Brief description of the drawings

Preferred embodiments of the present invention will be explained in more detail with reference to the accompanying drawings. Show it:

1 a schematic representation of a control system with multiple controllers for use in automotive applications; and

2 a flowchart illustrating the sequence of the method for checking the control units in the control unit network.

Description of embodiments

1 shows a system 1 , in particular a control system for use in automotive applications. For example, the system can 1 be a battery management system in an electrically powered motor vehicle. The overall system 1 includes several controllers 2 , wherein one of the control units as the main control unit 21 and the remaining control units as slave control units 22 are formed.

The controllers 2 are via a bus system 3 interconnected, which may be formed for example as a CAN bus or SPI bus. The bus system 3 can be designed so that it is only the connection between the control units 2 and separated from the other components.

Each of the controllers has a processor 4 on to the desired functions of the system 1 to realize. Usually, software implementations are provided in which the processor 4 one in a respective memory 5 stored program code and thereby ensures the corresponding functionality of the controller.

A processor instruction set test according to the specifications of ISO 26262 as part of the three-level concept will be under the control of the main control unit 21 executed. The main control unit 21 performs using the slave controllers 22 Functions needed to control components in the vehicle.

The processor instruction set test is a test that verifies the proper execution of machine instructions in the processors of the controllers. For this purpose, a corresponding code is supplied to the processors, which leads to a specific processor response, which corresponds to the test answer.

The flow of the processor instruction set test in conjunction with the flowchart of FIG 2 described in detail.

To perform the processor instruction set test is in the main controller 21 a test command generator unit 6 which generates test request commands in step S1. The test request commands are intended to ensure the proper execution of processor commands in the appropriate processors 4 the control units 2 to check. So generates the test command generator unit 6 Test request commands for both the processor 4 of the main control unit 21 as well as for the processors 4 the auxiliary control units 22 ,

To perform the processor instruction set test, the test request instruction is made by the bus system in step S2 3 to a test unit 7 one of the auxiliary control units 22 transmitted. The test unit 7 of the relevant sub-control unit 22 receives the test request command and performs a corresponding test with the processor in step S3 4 of the relevant sub-control unit 22 out.

It is a response unit 8th provided the appropriate response of the processor 4 of the relevant sub-control unit 22 on the test request commands and in step S4 suitably via the bus system 3 to one in the main controller 21 provided comparison unit 9 transmitted.

The response of the response unit 8th is in a comparison unit in step S5 9 of the main control unit 21 compared with a correspondingly expected predetermined comparison response.

In a query step S6, a deviation of the confirmed response from the response unit 8th of the relevant sub-control unit 22 determined by the given answer (alternative: yes), there is an error, which is signaled in step S7.

If no error is detected in step S6 (alternative: no), then in step S8 it is queried whether additional processors 4 from auxiliary control units 22 to be tested with the processor instruction set test. If this is the case (alternative: yes), the method of steps S1 to S6 is repeated. If this is not the case (alternative: no), the method is ended and it is signaled in step S9 that the processor instruction set test did not result in an error. Usually, to determine a correctness of the system 1 all processors 4 the auxiliary control units 22 be tested.

The check according to the processor instruction set test takes place substantially simultaneously with the level 1 calculations in the controllers 2 instead of. The level 1 calculations require communication between the controllers 2 that is a load in the bus system 3 caused. To avoid that by simultaneously performing the processor instruction set test in all controllers 2 the bus system load by corresponding responses of the auxiliary control units 22 greatly increased and thus required for the implementation of the level 1 functions, usually time-critical, data communication between the ECUs 2 is delayed, it is now provided, the test request commands successively or with a time delay via the bus system 3 to the auxiliary control units 22 to convey.

Furthermore, the test request commands should be sent to the slave controllers 22 be sent that the responses generated on it temporally offset from each other to the main control unit 21 be sent back. For example, the corresponding auxiliary control unit can do this 22 addressed and the test request command are transmitted. Subsequently, a corresponding answer of the relevant sub-control unit 22 Waited before a next test request command to another of the slave controllers 22 is transmitted. In this way, each of the slave controllers can be successively successively 22 be tested. The advantage of the successive processor instruction set tests in the slave controllers 22 consists in the predictable low bus load. This also remains independent of the number of auxiliary control units 22 always the same.

Furthermore, it can be provided that a test request command is sent only when a response to a previously issued test request command has been received or a predetermined period of time has elapsed.

LIST OF REFERENCE NUMBERS

1

control system

2

ECUs

3

bus system

4

processor

5

Storage

6

Test command generator unit

7

test unit

8th

response unit

9

comparing unit

21

Main control unit

22

In addition to the control unit

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• ISO 26262 [0002]
• ISO 26262 [0002]
• ISO 26262 [0005]
• ISO 26262 [0023]

Claims (6)

Method for performing processor instruction set tests in a system ( 1 ), in particular in a control system for automotive applications, with a main control unit ( 21 ) and several auxiliary control devices ( 22 ), which via a bus system ( 3 ), the main control unit ( 21 ) and the several auxiliary control devices ( 22 ) each have a processor ( 4 ), comprising the following steps: transmitting test request commands from the main control unit ( 21 ) to the several auxiliary control devices ( 22 ) via the bus system ( 3 ); Performing a processor instruction set test in the processor ( 4 ) of the auxiliary control devices ( 22 ) based on the corresponding received test request command and generating test responses of the processor command set test in the plurality of slave control devices ( 22 ); - transmission of the test responses to the main control unit ( 21 ) via the bus system ( 3 ); and - detecting an error in the system ( 1 ) depending on the test responses of the processor instruction set tests. The method of claim 1, wherein the test request commands are from the main controller (16). 21 ) to the several auxiliary control devices ( 22 ) via the bus system ( 3 ) are transmitted with a time delay, so that the test request commands and the test responses are transmitted with a time delay via the bus system ( 3 ) be transmitted. The method of claim 1 or 2, wherein the processor instruction set tests in the slave controllers ( 22 ), wherein a processor instruction set test in a slave control device ( 22 ) is started when a test response from another sub-control unit ( 22 ) was received. Method according to one of claims 1 to 3, wherein the processor instruction set tests in the auxiliary control devices ( 22 ), wherein a processor instruction set test in a processor ( 3 ) of the main control unit ( 21 ) temporally overlapping to a processor instruction set test in one of the slave controllers ( 22 ) is carried out. Main control unit ( 21 ) for performing processor instruction set tests in a system ( 1 ), in particular in a control system for automotive applications, wherein the main control unit ( 21 ) via a bus system ( 3 ) with several auxiliary control devices ( 22 ), comprising: a test command generator unit for generating and transmitting test request commands to the plurality of slave control devices ( 22 ) via the bus system ( 3 ); A comparison unit for receiving test responses of the processor instruction set tests in the plurality of slave control devices ( 22 ) and to detect a fault in the system ( 1 ) depending on the test responses of the processor instruction set tests. System ( 1 ) for performing processor instruction set tests, in particular a control system for automotive applications, comprising: a bus system ( 3 ), which is a main control unit ( 21 ) and several auxiliary control devices ( 22 ), - the main control unit ( 21 ) with at least one processor ( 3 ), and - the several auxiliary control devices ( 22 ), the main control unit ( 21 ) is adapted to issue test request commands via the bus system ( 3 ) to the several auxiliary control devices ( 22 ) to transmit test responses via the bus system ( 3 ) and an error in the system ( 1 ) depending on the test responses of the processor instruction set tests, the slave controllers ( 22 ) are adapted to perform a processor instruction set test based on the corresponding received test request command and to generate corresponding test responses of the processor instruction set tests.

Images