DE102019219067A1 - Method for the automatic qualification of a virtual model for a motor vehicle component - Google Patents

Abstract

The invention relates to a method for the automatic qualification of a virtual model for testing a motor vehicle component as well as a system and a computer program product for carrying out such a method. In the first step 100 of the method, requirement specifications for a control unit of a motor vehicle component to be tested are provided; In the second step 200, a virtual model is created in accordance with ISO standard 26262 Level 3 to simulate the hardware and software of the control unit; in the third step 300 the virtual model is qualified; In the fourth step 400, the virtual model is tested for gaps in the model coverage using code and toggle coverage metrics as well as test impact analyzes and is thus specifically supplemented with new test content to form a final virtual model; in the fifth step 500, the test results of the final virtual model are verified by means of test bench tests of the real motor vehicle component; In the sixth step 600, the final virtual model for the automatic qualification of motor vehicle components according to ISO standard 26262 is provided. The method enables the specification of measurable quality metrics in the model development and consequently a quality statement for virtual models for the validation of test processes.

Description

The invention relates to a method for automatically qualifying a virtual model for testing a motor vehicle component. The invention also relates to a system and a computer program product for carrying out such a method.

Almost all control and regulation tasks occurring in modern motor vehicles while driving are carried out using software-based, mostly electronic vehicle components or systems. Examples of the range of tasks performed by these components or systems in typical driving operations are the automatic dimming for oncoming traffic on the one hand and highly automated driving with several assistance systems, in which the driving environment is monitored under full control by these systems, on the other.

In modern motor vehicles, the software therefore not only improves comfort for the driver, but also makes an important contribution to accident prevention and occupant protection.

With the latest developments towards autonomous or driverless driving and electromobility, there is not only an increased use of software-based components in a motor vehicle, and consequently an increase in the cost share of such systems in the total vehicle costs. In fact, this development is determined in particular by a qualitative further development of the existing software and hardware solutions, which results from the number and complexity of the problems that have to be taken into account in partially autonomous driving.

In the case of electric vehicles, new, highly complex vehicle components and systems are being added, from the on-board electrical system to the steering. Since the new components are used in electric vehicles of different performance classes as part of the applicant's MEB and PPE projects (MEB, Modular E-Drive Construction Kit; PPE, Premium Platform Electric), it is therefore necessary to provide proof of functional safety in accordance with the requirements in of the respective performance class.

In modern motor vehicles, not only must each software-based individual component per se meet high requirements with regard to its functional reliability. The requirement for a high level of functional reliability must be met equally reliably by all such components in the system network, taking into account specific performance classes.

This must be proven by means of suitable functional tests of the individual vehicle components. In particular, to validate autonomous driving functions, virtual validation techniques are used in functional tests of this type, with which very high driving performances are simulated in large computer farms in order to prove the reliability of a vehicle component.

In this case, suitable test signals are applied to each system component to be tested in a known manner and the system response is analyzed. In accordance with the large number of individual system components in a modern motor vehicle, such tests are not only complex, they are also cost-intensive.

The implementation of these tests is regulated in the ISO standard 26262 for safety-relevant electrical or electronic systems in motor vehicles according to a multi-level concept (level 1 - system level, level 2 - hardware level, level 3 - software level). According to this, each malfunction is to be analyzed with regard to severity, degree of hazard (exposure) and controllability during driving and assigned to one of a total of five corresponding hazard levels QM, ASIL A, ASIL B, ASIL C, ASIL D, with ASIL D. the highest and QM the lowest risk level (ASIL - Automotive Safety Integrity Level, QM - Quality Management). Based on this, the remedial measures specified in detail in the standard must then be provided.

The models used to date for virtual validation are mostly of very low quality, which has a negative effect on the reliability of such tests.

Since higher safety requirements are to be placed on vehicle components for autonomous driving in particular, many functions in the vehicle are increasingly being raised from a quality management level (QM) to an ASIL level.

Accordingly, the models used for the simulation for the virtual safeguarding of an autonomous driving function must also meet higher quality requirements.

The quality or informative value of these models is determined by the scope of the influencing variables or model parameters taken into account when creating the model.

According to the model parameters taken into account according to the multi-level concept according to ISO standard 26262 when developing a virtual model of a motor vehicle component, models with different expressiveness or quality can be defined.

Based on ISO standard 26262, a distinction is made between three levels, with level 1 relating to software functionality, level 2 additional virtual hardware interactions and level 3 both the software and hardware functionality of a system component.

The quality of a model is therefore tied to the degree of development of the model creation, with the significance or accuracy of a level 1 simulation being correspondingly lowest and a level 3 simulation being the highest. A prerequisite for the usability of a virtual model in the product validation process is that it meets the requirements of ISO standard 26262. Such a quality certificate must be provided according to ISO standard 26262-8 for each virtual model according to the respective degree of development or development status of a component.

According to the state of the art, in these tests of motor vehicle components the individually used virtual models are usually subjected to static analyzes that relate only to compliance with the modeling rules, that is, are based on comparisons without taking into account changes over time. A recording and safeguarding of functional relationships or changes over time is only possible as part of additional tests, for example according to the so-called back-to-back procedure. With test procedures of this kind it is possible to dynamically test individual model versions and development statuses of a component.

In US 2016/0329996 A1 For example, a method and a system for the static analysis of a virtual model of an electrical component are specified, with which individual output signals are recorded and visualized as a function of simulated control signal errors.

Out US 2018/0137022 A1 a virtual development environment for testing motor vehicle components with several test programs for time-controlled error feed and therefore for dynamic analysis is known. A motor vehicle component is then analyzed using a virtual model, for which purpose the latter is connected via a suitable interface to test programs in different program languages for simulating different operating states of the motor vehicle component.

Since with the development towards highly automated driving, the demands on the functional reliability of the individual components and systems provided for this are constantly increasing, conventional testing techniques are increasingly reaching their functional and economic limits. In particular, autonomous driving functions can no longer be reliably safeguarded and scaled with test benches of the usual type due to the large number and complexity of the parameter combinations to be taken into account. The use of virtual models is therefore not only essential in the development of such components, but also in particular in ensuring the required high product quality. The quality features of the models used in the test processes are therefore of decisive importance.

There is therefore a need for test methods for safeguarding highly complex systems and components of motor vehicles by means of virtual models, the quality features of which can be proven in an economical manner to safeguard the increased high safety standards for highly automated driving, taking into account specific performance classes.

The invention is based on the object of specifying measurable quality metrics in model development that enable a quality statement for virtual models and thus a safeguarding of test processes, as they are used in particular in the context of test methods for highly complex systems and components of motor vehicles.

The object of the invention is achieved by the subjects of the independent claims. Preferred further developments are the subject of the subclaims.

A first aspect of the invention relates to a method for the automatic qualification of virtual models for the test of motor vehicle components, which is used for scaling complex parameter combinations, and thus in particular for the protection of systems and components of motor vehicles according to the safety standards for highly automated driving, in an economical manner and taking into account specific performance classes. The method according to the invention has the method steps described below.

In a first step, according to the method, the hardware and software requirements that a control unit of a motor vehicle component to be tested must meet are defined or provided. In the case of a system to be tested, such as a steering system for a self-driving motor vehicle that is composed of a large number of individual components, requirement specifications must accordingly be provided for each individual control device that is included in the system.

In a second step, a model of a motor vehicle component to be tested is created on the basis of the respective product requirements. Almost every component of a modern motor vehicle has at least one electronic control unit (ECU) for functional and safety reasons, which in this respect forms part of the hardware of the respective component and which provides its software for interaction with the control system of the entire vehicle. A modern motor vehicle component can therefore also be referred to as an embedded system. A functional simulation of such a real motor vehicle component with suitable algorithms in the form of a computer program is referred to as a virtual model, virtual control device or virtual ECU.

The virtual control device model created in the second method step includes both the software and the hardware functionality of a system component and is in this respect also able to record virtual hardware interactions with the greatest possible informative value and accuracy. The virtual control device model thus fulfills the requirements of ISO standard 26262 Level 3 for use in the product validation process in the manufacture of motor vehicles or their components. A virtual control unit model that meets these requirements is referred to as a virtual control unit model, level 3 or virtual ECU level 3 model, or vECU for short. The created control unit model is therefore suitable as a virtual control unit model, vECU, according to ISO standard 26262 Level 3 for simulating the hardware and software of at least one control unit of a motor vehicle component to be tested.

In a third step, this suitability is verified in accordance with ISO standard 26262. For this purpose, the virtual control unit model, vECU, is qualified using a back-to-back method using a large number of metrics. The system integration of individual model versions and development statuses of a component is recorded dynamically on the basis of various metrics or mathematical functions in the form of characteristic values in order to map functional relationships and to secure the individual causal relationships within specified system limits.

Proof that a virtual model has been designed and secured in the test validation in such a way that possible errors in the procedure are excluded and thus the freedom from defects of a product can be guaranteed, is provided with the third and subsequent fourth process step in accordance with ISO standard 26262 .

In the fourth procedural step, the virtual control unit model, vECU, is created using a secured black box test procedure in accordance with the requirements for the hardware and software of the at least one control unit of the motor vehicle component to be tested, and therefore taking into account all the requirements information available for a product to be tested tested a total of six sub-steps. Corresponding black box-based test procedures are known from real product validation. They are suitable both for testing individual components of a motor vehicle and for testing the entire vehicle.

In a first sub-step of the fourth method step, test vectors and stimuli or excitations are initially recorded at the interfaces of the at least one control unit of the motor vehicle component to be tested. This is done on a conventional test stand, the real control unit being controlled with specified input values and the resulting output values being recorded. A test execution in accordance with the specifications is in this case by means of the preceding ones Procedural steps ensured. The recording or recording, or storage, of the test vectors and stimuli or excitations, or input values, and the associated output values or expected values, or system response, takes place with a suitable electronic storage device, preferably a file server.

In a second sub-step of the fourth method step, at least one test set for the virtual control unit model, vECU, is created and recorded from the recorded test vectors, stimuli and expected values.

In a third sub-step of the fourth method step, the at least one test set is played with the virtual control unit model, vECU.

In a fourth sub-step of the fourth method step, model code coverage metrics and / or interface toggle metrics are collected from code areas generated with the test set.

Model code coverage metrics capture areas in the code of a simulation that are not addressed by a virtual ECU model, vECU, or are not included in the simulation, while uninitialized interfaces of a virtual ECU model, vECU, with interface toggle metrics identify are.

By using these metrics according to the invention, it is possible to evaluate a virtual control unit model, vECU, with regard to its reliability. In order to guarantee the highest model quality and reliability, a virtual control unit model, vECU, must therefore be able to capture all areas in the code of a simulation and initialize all interfaces.

Since the virtual control unit model, vECU, of a motor vehicle component to be tested, created according to the second process step, is based directly on the requirements to be met by a real motor vehicle component, incomplete model code coverage and / or interface initialization should be interpreted as a sign of incomplete test coverage. An incomplete test coverage by a virtual control unit model, vECU, corresponds to an only incomplete test of the real product on a test bench and consequently does not allow any reliable quality statement about a real motor vehicle component tested in this way. In particular, such a test result is not suitable for meeting the high requirements that must be placed on the implementation of tests for safety-relevant electrical or electronic systems in motor vehicles according to the relevant standards. There is thus a need to remedy such a deficiency.

Based on the previous method steps, in a fifth sub-step of the fourth method step, the code areas of the recorded model code coverage metrics and / or interface toggle metrics of the at least one test set are aggregated and in the form of a model code coverage and / or interface toggle map provided.

The model code coverage or interface toggle map obtained by merging the different captured model code coverage metrics and / or interface toggle metrics represents a virtual control unit model, vECU, which has been completed in this respect and which, if complete, suitable for a valid quality statement about a real motor vehicle component.

In a sixth sub-step of the fourth method step, this is checked for gaps and incomplete coverage by evaluating the coverage metrics. Each area of the present model code coverage or interface toggle map is examined in detail and it is determined whether or not it is started or initialized during the simulation of the real motor vehicle component with the virtual control unit model, vECU.

The simulation is referred to as complete if the virtual control unit model, vECU, the functional behavior of the hardware and software of the at least one control unit, and therefore all possible system states of the motor vehicle component to be tested, completely covers, so that all code areas in the model Code coverage and / or interface toggle map are completely covered. In this case, the virtual control unit model, vECU, represents a final overall model of the motor vehicle component to be tested.

If, after the sixth sub-step of the fourth method step, not all areas of the model code coverage and / or interface toggle map are completely covered and thus one or Both of these maps still have at least one gap, which stands for at least one code area that has only been partially passed or not passed through and / or at least that interface initialization has not taken place when the virtual control unit model, vECU, is executed, according to the method, all previous sub-steps of the fourth method step are each with a Another modified test set is repeated until all code areas in the model code coverage and / or interface toggle map are completely covered. The repeated execution of these sub-steps is therefore carried out with the aim of finding additional suggestions from the virtual model in order to close the identified gaps in the scope of the test. This iterative procedure thus also leads to a final overall model that is suitable for a valid quality statement about a real motor vehicle component. The sixth sub-step of the fourth method step consequently provides an indication of the completeness of the tests carried out and thus of the quality of the virtual control unit model used, vECU.

In this way, the method according to the invention enables a targeted completion of a used virtual control unit model, vECU, and the creation of test sets that are capable of capturing the software and hardware functionality of a system component, including virtual hardware interactions, with the greatest possible expressiveness and accuracy .

In order to prove this, the test results obtained with the help of the virtual control unit model, vECU, must match the corresponding test results of the real motor vehicle component. This proof is provided in a fifth procedural step. The test results obtained with the final virtual control unit model, vECU, are verified by comparative tests with the real vehicle components on a test bench.

Finally, in a sixth step, the final virtual control unit model, vECU, is provided for automatic qualification of the hardware and software of at least one control unit of a motor vehicle component to be tested in accordance with ISO standard 26262.

Virtual models of motor vehicle components that are qualified according to the method according to the invention are therefore suitable for use in all control device projects, regardless of the functional safety classification.

The comparability of virtual and real test results ensured with the method according to the invention, and therefore of virtual and real test methods, and the use according to the invention of model code coverage or interface toggle metrics, enables automatic test completion and verification via the completeness of the test scope is provided, which automatically fulfills the requirements of ISO standard 26262 Level 3 for the test of motor vehicle components and thus enables automatic ISO 26262 qualification.

A second aspect of the invention relates to a system for the automatic qualification of virtual control unit models, vECU, for the test of motor vehicle components according to ISO standard 26262, which is designed according to a method according to the invention, as described above.

The system has six system units for carrying out the method according to the invention.

A first system unit is designed for testing the hardware and software of at least one control unit of a motor vehicle component to be tested, or a test item, with a test stand or with several test stands for motor vehicle components or motor vehicles by means of secured black box tests. The first system unit thus enables a real test object to be stimulated with test vectors and stimuli, and the resulting responses to be checked for compliance with expected values.

A second system unit is provided in order to record the test vectors and stimuli used in the first system unit when testing the real test object and to make them available for further use. For this purpose, the second system unit comprises at least one file server with suitable software.

A third system unit is for creating a test set based on the test vectors and stimuli provided by the second system unit, for applying the test set to a virtual control unit model, vECU, and for comparing the model responses with the responses recorded using the first system unit of at least one corresponding real motor vehicle component educated. For this purpose, the third system unit comprises at least a first computer system with suitable software which enables the stimulation scenarios and responses provided by the file server of the second system unit apply to the virtual model and compare the responses of the virtual model with the recorded responses of the real motor vehicle component.

A fourth system unit comprises at least one second computer system for playing the test set with the virtual control unit model, vECU, also provided by the third system unit, using a vector replay method and with suitable software for capturing model code coverage metrics and interface Toggle metrics of code areas that were generated with the help of the test set to aggregate the generated code areas of the recorded model code coverage metrics and interface toggle metrics of the test set in a model code coverage map or Interface toggle map and for evaluating the test set by means of a test impact analysis.

A fifth system unit has at least a third computer system with suitable software that is designed to check the scope of testing possible with the virtual control unit model, vECU, of the third system unit compared to the scope of testing of the real motor vehicle component established with the first system unit. The fifth system unit is therefore designed in particular to check the behavior of the hardware and software of the at least one control unit of the motor vehicle component to be tested, simulated with the virtual control unit model, vECU, for completeness in relation to a specified test scope.

In addition, the at least one third computer system of the fifth system unit is provided with suitable software for iteratively carrying out test updates with the involvement of the first to fifth system units.

In this respect, the fifth system unit is suitable for supporting the development of tests for gaps detected in the test scope of the virtual model provided by the third system unit, as well as for a test update that may be required to close the test gaps found on the basis of new test contents or test sets.

A sixth system unit comprises at least one fourth computer system with suitable software for verifying the test results obtained with the final virtual control unit model, vECU, by means of comparative tests with the real motor vehicle component on a test bench. In addition, the computer program comprised by the sixth system unit is designed to control repetitions of tests, including the first to fifth control units.

A further aspect of the invention relates to a computer program product which comprises a computer-readable program code or computer-readable instructions, which when executed by a computer causes the latter to carry out a method according to the invention as described above. Yet another aspect of the invention relates to a computer-readable storage medium comprising a computer program product which comprises instructions which, when executed by a computer, cause the computer to carry out a method according to the invention as described above. The storage medium can be a volatile memory or a non-volatile memory.

Preferred embodiments of the invention result from the other features mentioned in the subclaims.

In a preferred embodiment of the method according to the invention, the virtual control unit model, vECU, is created using Matlab / Simulink, S functions and / or functional mockup units, FMU.

Matlab / Simulink is a software product from The MathWorks for system modeling. Additional code can be integrated into a model created with Matlab / Simulink using S functions. Functional Mockup Units, FMU, represent standardized interfaces that allow models that are not based on Matlab / Simulink to be integrated into a virtual model created with them.

In a further preferred embodiment of the method according to the invention, the virtual control unit model, vECU, is carried out in accordance with ISO standard 26262 Level 3 to simulate the hardware and software of the at least one control unit of the motor vehicle component to be tested, including executable code from compiled programs.

In addition, it is preferred to qualify the virtual control unit model, vECU, according to the method according to the invention using a back-to-back method according to ISO standard 26262, part 8, using a large number of metrics.

In addition, in a further preferred embodiment of the method according to the invention, the black box tests used to test the virtual control unit model, vECU, are developed and safeguarded in accordance with ISO standard 26262. Alternatively, it is either preferable to develop and secure the black box tests in accordance with the automotive standard ASpice or in accordance with both standards, ISO 26262 and ASpice.

In a further preferred embodiment of the method according to the invention, the virtual control unit model, vECU, is used for a test impact analysis to prioritize new test sets in order to ensure the functional quality of an updated virtual model, vECU.

In a particularly preferred embodiment of the method according to the invention, a functional comparability of test results obtained with simulated motor vehicle components and test results obtained with real motor vehicle components on test benches is demonstrated using a vector replay process. The vector replay method is used according to the invention to determine the accuracy of virtual control unit models, vECU, and therefore to qualify them.

In addition, in a further preferred embodiment of the invention, the virtual control unit model, vECU, is used for automatic qualification, in particular for automatic qualification according to ISO standard 26262, of the hardware and / or software of at least one control unit of at least one motor vehicle component.

The various embodiments of the invention mentioned in this application can be advantageously combined with one another, unless stated otherwise in the individual case.

• 1 ein schematisches Ablaufdiagramm der Verfahrensschritte des erfindungsgemäßen Verfahrens;
• 2 eine Anordnung zur Durchführung des erfindungsgemäßen Vektor-Replay-Verfahrens;
• 3 ein einfaches virtuelles Modell für eine beispielhafte Code-Coverage-/Toggle-Coverage-Analyse;
• 4 ein Beispiel einer nach dem erfindungsgemäßen Verfahren erstellten Code-Coverage-/Toggle-Coverage-Landkarte;
• 5 ein Beispiel einer Test-Impact-Analyse zur Modellanpassung nach dem erfindungsgemäßen Verfahren unter Verwendung der Code-Coverage-/Toggle-Coverage-Landkarte gemäß 4;
• 6 eine schematische Darstellung eines Systems zur automatischen Qualifizierung eines virtuellen Modells zum Testen einer Kraftfahrzeugkomponente nach dem erfindungsgemäßen Verfahren.

The invention is explained in more detail below in exemplary embodiments with reference to the associated drawings. Show it:

• 1 a schematic flow diagram of the method steps of the method according to the invention;
• 2 an arrangement for performing the vector replay method according to the invention;
• 3rd a simple virtual model for an exemplary code coverage / toggle coverage analysis;
• 4th an example of a code coverage / toggle coverage map created by the method according to the invention;
• 5 an example of a test impact analysis for model adaptation according to the method according to the invention using the code coverage / toggle coverage map according to FIG 4th ;
• 6th a schematic representation of a system for the automatic qualification of a virtual model for testing a motor vehicle component according to the method according to the invention.

1 shows by way of example the individual process steps of the process according to the invention.

In a first process step 100 the requirements to be met by a motor vehicle component to be tested are specified. Specifically, the requirements for the hardware and software of a control device to be tested are provided.

In a second process step 200 a virtual control unit model, vECU, is created in accordance with ISO standard 26262 Level 3 to simulate the hardware and software of the control unit of the motor vehicle component to be tested.

In a third process step 300 the virtual control unit model, vECU, of the motor vehicle component to be tested is qualified. For this purpose, a large number of parameters or metrics are recorded using a back-to-back method.

In a fourth process step 400 the virtual control unit model, vECU, is checked with secured black box tests based on the previously provided requirement specifications for the hardware and for the software of the at least one control unit of the motor vehicle component to be tested.

• Im ersten Teilschritt 410 werden Testvektoren und Stimuli an den Schnittstellen des Steuergerätes der zu testenden Kraftfahrzeugkomponente aufgenommen.
• Im zweiten Teilschritt 420 wird anhand der aufgenommenen Testvektoren und Stimuli ein Testsatzes erstellt.
• Im dritten Teilschritt 430 wird der Testsatz mittels eines Vektor-Replay-Verfahrens mit dem virtuellen Steuergerätemodell, vECU, abgespielt.
• Im vierten Teilschritt 440 werden Model-Code-Coverage-Metriken von den, mit dem Testsatz erzeugten 23 Code-Bereichen erfasst.
• Im fünften Teilschritt 450 werden die 23 erzeugten Code-Bereiche der erfassten Model-Code-Coverage-Metriken und/oder Interface-Toggle-Metriken des Testsatzes in einer Model-Code-Coverage- und/oder Interface-Toggle-Landkarte 40 aggregiert.
• Im sechsten Teilschritt 460 wird das mit dem virtuellen Steuergerätemodell, vECU, simulierte funktionale Verhalten der Hardware und der Software des Steuergerätes der zu testenden Kraftfahrzeugkomponente auf Vollständigkeit überprüft. Dazu wird die Model-Code-Coverage- und/oder Interface-Toggle-Landkarte 40 analysiert.

The check of the virtual control unit model, vECU, is carried out according to the invention in six sub-steps 410-460 carried out:

• In the first step 410 test vectors and stimuli are recorded at the interfaces of the control unit of the motor vehicle component to be tested.
• In the second step 420 a test set is created based on the recorded test vectors and stimuli.
• In the third step 430 the test set is played using a vector replay process with the virtual control unit model, vECU.
• In the fourth sub-step 440 model code coverage metrics are recorded from the 23 code areas generated with the test set.
• In the fifth sub-step 450 the 23 generated code areas of the recorded model code coverage metrics and / or interface toggle metrics of the test set are in a model code coverage and / or interface toggle map 40 aggregated.
• In the sixth sub-step 460 the functional behavior of the hardware and the software of the control unit of the motor vehicle component to be tested, simulated with the virtual control unit model, vECU, is checked for completeness. The model code coverage and / or interface toggle map is used for this purpose 40 analyzed.

Are in the model code coverage and / or interface toggle map 40 in the process, areas with no or only partial coverage are determined, the process steps 410-460 each time with a different test set repeated until all code areas in the model code coverage and / or interface toggle map 40 are covered.

If this is the case, it must be done in a fifth procedural step 500 the one obtained with the thus final virtual ECU model, vECU, and using the model code coverage and / or interface toggle map 40 documented test results can be verified on the basis of comparative tests with the relevant real motor vehicle component on a test bench.

If the real and the simulated test results match, the final virtual control device model, vECU, is provided in a sixth method step 600 for an automatic qualification of the hardware and software of control devices of motor vehicle components to be tested according to ISO standard 26262.

2 shows an arrangement 20th for carrying out the vector replay method according to the invention, comprising a test stand 22nd with a real motor vehicle component 21 with a control unit, a file server 23 , a computer 25th with an executable virtual model stored on it 24 the real motor vehicle component.

For testing the real motor vehicle component 21 is the test bench 22nd Electrically connected to the control unit and designed in such a way that test results obtained with it can be secured in accordance with Automotive Spice and ISO 26262. The test bench 22nd is also with the file server 23 connected, for storing the test of the real motor vehicle component 21 put to the test 22nd available test results in the form of the suggestions and expected values used and to play them back with the on the computer 25th saved virtual model 24 while recording the code and toggle coverage metrics of the virtual model 24 . The computer 25th is electrically connected to the file server 23 connected. On the computer 25th Suitable software is also provided to aggregate all coverage metrics in a final overall report.

3rd represents a simple virtual model that can be used for code or toggle coverage analysis with reference to 4th should be explained by way of example.

In 3rd denote: A - a first function 31 , x - an input quantity 310 , a - a signal 311 , b - a signal 312 , B - a function 32 and y - a signal 320 .

                    Func B() {
                     Wenn((a < 2) und (a >= 0)) {
                      y=a*b
                     } sonst {
                      y=b

                     }
                    }

A calculates the signals a and b from the values of x. The signals a and b have the value ranges a [0..2] and b [0..1]. The signal y from function B has the value range y [0..5]. The code of function B is:

                    Func B () {
                     If ((a <2) and (a> = 0)) {
                      y = a * b
                     } else {
                      y = b

                     }
                    }

$$\text{a}=2;\text{ b}=1\to \text{y}=1.$$

A code coverage of 100% is achieved for the following value pairs: $$\text{a}=0;\text{b}=0\to \text{y}=0$$

$$\text{a}=2;\text{b}=1\to \text{y}=1.$$

The maximum signal y can therefore only be 1 if the following applies: signal a = 1 and signal b = 1, based on the value ranges given above for a and b; if a = 2, the else condition applies, according to which y is assigned the value of b. This means that 100% code coverage can be achieved, but not a toggle coverage of 100%, since the value range of y is not exhausted; the values in the range 2 ... 5 are not reached. In 4th this corresponds to a functional area that is not covered 42 where the code or toggle coverage is also less than 100%.

This small code example is intended to make it clear that there is no suitable input scenario for achieving a toggle coverage of 100%. This means that either the specification of the virtual model is incorrect or that there is an implementation error in the virtual model.

4th shows an example of a code coverage / toggle coverage map created according to the method according to the invention 40 , or an overall report as can be obtained with the method according to the invention.

This overall report provides information on all code fragments of the virtual model that have not been started. Each individual block of the representation represents a function of the virtual model, vECU. Functional areas that are not fully covered can be, for example, code branches of the virtual model that are not passed through or unexcited input signals of a functional area (toggle coverage).

These gaps are to be closed by new stimulation scenarios for the virtual model. If no scenarios for closing these functional gaps can be found, this can be an indication of so-called dead code areas of the model. From a cyber security perspective, such code areas should be removed if necessary.

The tests developed on the basis of the new excitation scenarios for the virtual model must then be retested again in the real test bench world with the test item or the motor vehicle component. In addition, the test specifications must be adapted and the test scenarios included in the overall report if they indicate test gaps.

5 shows the in 4th Code coverage / toggle coverage map shown 40 , in which, however, the code areas are specified as they can result after a further run through the virtual control unit model, vECU, with a second, modified test set. The overall report presented here thus serves as the basis for a test impact analysis according to the invention. In 5 are in addition to the functional areas fully covered by the virtual ECU model, vECU 51 also not covered functional areas 53 and functional areas that are not fully or only partially covered 52 shown.

The test impact analysis is used to determine which tests are needed for new code fragments 52 , 53 that have been added to a virtual model through model adjustments, through already to cover existing tests. Using suitable optimization software, the smallest possible test set is determined from this, which is required in order to achieve the maximum code and toggle coverage before a model is adapted.

After the model has been adapted, the optimization software is again used to calculate, on the basis of the new test set, whether it is possible to cover code areas that have not yet been recorded; in 5 become the areas 53 partially started while the areas 52 cannot be started. Thus is for the areas 53 the test set is already partially available and only needs to be adapted to achieve full coverage, which is then included in the overall report as an area 51 appears. For all code areas 52 however, new tests need to be developed.

To this extent, the test impact analysis represents a particularly advantageous possibility of specifically prioritizing individual tests and consequently significantly reducing the time required to evaluate an updated virtual model. The method according to the invention thus represents a particularly time-saving procedure for obtaining a statement about the functional quality of the updated virtual model.

Using the example of 5 This advantageous procedure is as follows: First, the areas 53 and the areas 52 tested; it is assumed here that the aforementioned prioritized model adjustments will have no negative impact on the areas 51 can be made, ie that no existing function is destroyed by the model adjustments.

After adapting the test content for the areas 53 and a creation of the new test content for the areas 52 the relevant code areas must be completely covered and therefore as areas 51 appear in the overall report. Following this, the test content of the areas can be used 52 , 53 and the existing test content of the areas 51 the minimum test set can be calculated with which a complete code and toggle coverage and thus a complete detection of all functions of a control unit of a motor vehicle component to be tested by the virtual control unit model, vECU, is achieved. This test set can be used to release the adapted virtual model.

• Eine erste Systemeinheit 61 mit einem Prüfstand 22 zum Anregen des realen Prüflings und zur Prüfung der Antworten auf Einhaltung von Erwartungswerten.
• Eine zweite Systemeinheit 62 mit einem File-Server zum Aufzeichnen der Anregungswerte und Antworten und zum Bereitstellen derselben für eine weitere Verwendung.
• Eine dritte Systemeinheit 63 die zum Anwenden der von der zweiten Systemeinheit 62 bereitgestellten Anregungswerte oder Anregungsszenarien und Antworten auf das virtuelle Modell und zum Vergleichen der Antworten des virtuellen Modells mit den aufgezeichneten Antworten des realen Prüflings vergleicht. Die dritte Systemeinheit 63 weist dazu ein erstes Computersystem mit dem darauf gespeicherten virtuellen Steuergerätemodell, vECU, und mit einer geeigneten Software auf.
• Eine vierte Systemeinheit 64 zum Aufzeichnen der Code- und Toggle-Coverage-Metriken beim Abspielen der Tests mit dem von der dritten Systemeinheit 63 bereitgestellten virtuellen Modell und zum Auswerten der aufgezeichneten Code- und Toggle-Coverage-Metriken sowie Bewerten der Tests mit der Test-Impact-Analyse. Die vierte Systemeinheit 64 ist dazu mit einem zweiten Computersystem mit einer geeigneten Software ausgebildet.
• Eine fünfte Systemeinheit 65 ist zur Unterstützung der Entwicklung von Tests für die mit der vierten Systemeinheit 64 festgestellten funktionalen Lücken des virtuellen Modells und zur anschließenden Testaktualisierung durch Schließen der festgestellten Simulationslücken des Modells ausgebildet. Die fünfte Systemeinheit 65 weist dazu ein drittes Computersystem mit einer geeigneten Software auf.
• Eine sechste Systemeinheit 66 mit einem vierten Computersystem mit einer geeigneten Software ist schließlich zum Anwenden der mit der fünften Systemeinheit 65 aktualisierten Tests auf den realen Prüfling vorgesehen und zur Steuerung von Testwiederholungen unter Einbeziehung aller Systemeinheiten 61-66, solange, bis keine neuen Tests bzw. Testaktualisierungen mehr anzugeben sind.

6th shows a system in a schematic representation 60 for the automatic qualification of a virtual model for testing a motor vehicle component according to the method according to the invention. From the system 60 includes:

• A first system unit 61 with a test bench 22nd to stimulate the real test object and to check the answers for compliance with expected values.
• A second system unit 62 with a file server for recording the stimulus values and responses and making them available for further use.
• A third system unit 63 those for applying the from the second system unit 62 provided excitation values or excitation scenarios and responses to the virtual model and compares the responses of the virtual model with the recorded responses of the real test object. The third system unit 63 has a first computer system with the virtual control unit model, vECU, stored on it, and with suitable software.
• A fourth system unit 64 to record the code and toggle coverage metrics when playing the tests with that of the third system unit 63 provided virtual model and for evaluating the recorded code and toggle coverage metrics as well as evaluating the tests with the test impact analysis. The fourth system unit 64 is designed for this purpose with a second computer system with suitable software.
• A fifth system unit 65 is to support the development of tests for those with the fourth system unit 64 established functional gaps in the virtual model and for the subsequent test update by closing the established simulation gaps in the model. The fifth system unit 65 has a third computer system with suitable software for this purpose.
• A sixth system unit 66 with a fourth computer system with suitable software is finally for using the with the fifth system unit 65 updated tests are provided on the real test item and for the control of test repetitions with the inclusion of all system units 61-66 until no more new tests or test updates need to be specified.

List of reference symbols

100

first procedural step

200

second procedural step

300

third process step

400

fourth procedural step

410

first sub-step of the fourth process step

420

second sub-step of the fourth process step

430

third sub-step of the fourth method step

440

fourth sub-step of the fourth process step

450

fifth sub-step of the fourth process step

460

sixth sub-step of the fourth process step

500

fifth procedural step

20th

Arrangement for vector replay processes

21

Automotive component

22nd

test bench

23

File server

24

virtual model of the motor vehicle component

25th

computer

30th

virtual model

31

Function a

310

Input variable x

311

Signal a

312

Signal b

32

Function B

320

Signal y

40

Model code coverage / interface toggle map, full report

41

Fully covered functional area / code coverage / toggle coverage

42

Functional area / code coverage / toggle coverage not covered

50

Model code coverage / interface toggle map for test impact analysis

51

Fully covered functional area / code coverage / toggle coverage

52

Functional area / code coverage / toggle coverage not fully covered

53

Functional area / code coverage / toggle coverage not covered

60

System for the automatic qualification of virtual models

61

first system unit

62

second system unit

63

third system unit

64

fourth system unit

65

fifth system unit

66

sixth system unit

QUOTES INCLUDED IN THE DESCRIPTION

This list of the documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• US 2016/0329996 A1 [0018]
• US 2018/0137022 A1 [0019]

Claims (11)

Method for the automatic qualification of virtual models for the test of motor vehicle components, characterized by the steps of: providing (100) requirement specifications for the hardware and the software of at least one control device of at least one motor vehicle component to be tested; Creating (200) a virtual control device model, vECU, in accordance with ISO standard 26262 Level 3 for simulating the hardware and software of the at least one control device; Qualifying (300) the virtual control unit model, vECU, using a back-to-back method using a plurality of metrics; Testing (400) the virtual control unit model, vECU, with secured black box test methods according to the requirements for the hardware and for the software of the at least one control unit with the following steps: recording (410) test vectors and stimuli at the interfaces of the at least one Control device; - creating (420) at least one test set on the basis of the recorded test vectors and stimuli; - Playing (430) the test set with the virtual control unit model, vECU; - Detection (440) of model code coverage metrics and / or interface toggle metrics from code areas generated with the test set; - Aggregating (450) the generated code areas of the recorded model code coverage metrics and / or interface toggle metrics of the test set in a model code coverage and / or interface toggle map (40); - Checking (460) the, with the virtual control device model, vECU, simulated, functional behavior of the hardware and the software of the at least one control device for completeness, wherein, in a first case, the virtual control device model, vECU, the functional behavior of the hardware and the Software of the at least one control device is completely simulated in a final virtual control device model if all code areas are covered in the model code coverage and / or interface toggle map (40), or where, in a second case, the virtual one Control device model, vECU, the functional behavior of the hardware and software of the at least one control device is incompletely simulated if code areas are not covered in the model code coverage and / or interface toggle map (50), and in which In the second case, the method steps (410) to (460) are repeated with a further test set each time until all code areas in the model Code coverage and / or interface toggle map (40; 50) are covered; Verifying (500) the test results obtained with the final virtual control unit model, vECU, by means of comparative tests with the real motor vehicle component on a test bench (22); Providing (600) the final virtual control device model, vECU, for an automatic qualification of the hardware and software of at least one control device of a motor vehicle component to be tested according to ISO standard 26262. Procedure according to Claim 1 , characterized in that the creation (200) of the virtual control unit model, vECU, takes place by means of Matlab / Simulink, S-Function and / or Functional Mockup Units, FM. Procedure according to Claim 1 or 2 , characterized in that the virtual control unit model, vECU, according to ISO standard 26262 Level 3 for simulating the hardware and software of the at least one control unit of the motor vehicle component to be tested comprises executable code from compiled programs. Method according to one of the Claims 1 to 3rd , characterized in that the back-to-back method is used to qualify (300) the virtual control unit model, vECU, according to ISO standard 26262, part 8. Method according to one of the Claims 1 to 4th , characterized in that the black box tests used for testing (400) the virtual control unit model, vECU, are developed and secured in accordance with ISO standard 26262 and / or the ASpice standard. Method according to one of the Claims 1 to 5 , characterized in that the virtual control unit model, vECU, is used for a test impact analysis to prioritize new test sets to ensure the functional quality of an updated virtual model, vECU. Method according to one of the Claims 1 to 5 , characterized in that the vector replay method according to method steps (410) to (430), for demonstrating a functional comparability of test results with simulated motor vehicle components and their accuracy compared to test results with real motor vehicle components of test benches for the qualification of virtual ECU models, vECU. Method according to one of the Claims 1 to 5 , characterized in that the virtual control unit model, vECU, is used for automatic qualification, in particular for automatic qualification according to ISO standard 26262, of the hardware and / or software of at least one control unit of at least one motor vehicle component. System (60) for the automatic qualification of virtual models, in particular of virtual control unit models, vECU, for the test of motor vehicle components according to a method according to one of the Claims 1 to 5 , characterized by : a first system unit (61) comprising at least one test bench (22) for motor vehicle components for performing secure black box tests for the hardware and software of at least one control unit of a motor vehicle component to be tested; a second system unit (62) comprising at least one file server (23) with suitable software for recording and providing test vectors and stimuli of the at least one control unit of the motor vehicle component to be tested; a third system unit (63) comprising at least a first computer system with a virtual control unit model, vECU, stored thereon, and with suitable software for creating a test set based on the test vectors and stimuli provided, for applying the same to the virtual control unit model, vECU, and for comparison the model responses with the responses determined for the at least one motor vehicle component; a fourth system unit (64) comprising at least one second computer system for playing the test set with the virtual control unit model, vECU, by means of a vector replay method, and with suitable software for capturing model code coverage metrics and / or interface -Toggle metrics of code areas generated with the test set, aggregation of the generated code areas of the recorded model code coverage metrics and / or interface toggle metrics of the test set in a model code coverage and / or interface toggle map (40; 50) and evaluating the test set by means of a test impact analysis; a fifth system unit (65) comprising at least one third computer system with suitable software for checking the functional behavior of the hardware and software of the at least one control unit of the motor vehicle component to be tested for completeness and for test update; a sixth system unit (66) comprising at least one fourth computer system with suitable software for verifying the test results obtained with the final virtual control unit model, vECU, by means of comparative tests with the real motor vehicle component on a test bench (22) and for controlling test repetitions until until all possible test vectors and stimuli are taken into account. System according to Claim 9 , characterized in that the third to sixth system units (63, 64, 65, 66) have a common computer system. Computer program product which comprises a computer-readable program code which, when executed by a computer, causes the latter, a method according to one of the Claims 1 to 5 perform.

Images