DE102022201518A1 - Method for monitoring a control unit - Google Patents

Abstract

Method for monitoring a control device, in which conducted interference caused during operation of the control device is detected in a defined frequency range, the conducted interference detected is plotted against the frequency, so that a frequency pattern (16) results, in which frequency pattern (16) at least one Marker is defined, which is evaluated with regard to the evaluation characteristics frequency, amplitude and time.

Description

The invention relates to a method for monitoring a control device and an arrangement for carrying out the method.

State of the art

Control units (ECU: Electronic Control Unit) are electronic modules and are used in vehicles as embedded systems to control and regulate processes and components. In order to ensure safe operation of the vehicle, it is necessary to monitor the operation of the control units used either continuously or at regular intervals. This also includes checking components of the control units.

• - Selbstdiagnose des Steuergeräts
  • Hierunter fällt bspw. eine sogenannte eingebaute Testeinrichtung (BIST: Build in self test), eine Auswertung von internen Signalen des Steuergeräts z. B. mit einem Watchdog und eine Spannungsüberwachung über einen Analog-Digital-Wandler (ADC: Analog Digital Converter). Die erlangten Daten werden dazu verwendet, Fehler in den Funktionen des Steuergeräts zu erkennen und Einträge in den Fehlerspeicher des Steuergeräts zu schreiben. Die meisten dieser Diagnosefunktionen sind erst dann verfügbar, wenn der Mikrocontroller hochgefahren ist.
• - Plant-test Konzept:
  • Aktuell wird eine spezielle Testsoftware initial auf dem Steuergerät aufgespielt bzw. installiert, um einzelne Subsysteme in der Produktion zu testen (STIL-SW).
• - Beurteilung der EMV-Leistungsfähigkeit:
  • EMV-Tests werden nur an einigen wenigen Steuergeräten bzw. es wird ein kundenspezifisches Delta Testing nur während des Freigabeprozesses in der Entwicklung durchgeführt. Delta Testing bedeutet, dass kein volles Erprobungsprogramm notwendig ist,
  • sondern einige spezifische Testschritte durchgeführt werden müssen, die speziell zur Absicherung der relevanten EMV-Eigenschaften dienen. Derzeit ist keine Möglichkeit gegeben, die EMV-Leistungsfähigkeit wenigstens in kritischen Punkten, z. B. bei kritischen Radiofrequenzen, Navigation, LTE (Long Term Evolution), im Feld zu beurteilen. Im Feld bedeutet hier: auch am Ende des Lebenszyklus des Steuergeräts. Sollte sich das EMV-Verhalten des Steuergeräts während des Lebenszyklus ändern,
  • so kann dies typischerweise nicht diagnostiziert werden.
• - Diagnose „über den Äther“ (over the air)
  • Nach und nach setzen sich Systeme durch, die eine sogenannte „Diagnose over the air“ erlauben. Systemparameter werden aufgezeichnet und vom Fahrzeug bspw. an den OEM (Original Equipment Manufacturer) übertragen. Ein Problem ist, dass es sich bei den übertragenen Daten meistens um Systemparameter handelt, die zwar eine Analyse der aktuellen Fahrsituation oder des aktuellen Systemstatus erlauben. Eine tiefgründige Analyse der Hardware, z. B. eine Überschreitung von EMV-Grenzwerten oder eine Annäherung an Systemgrenzen (predicted failure diagnostics on hardware level), ist allerdings in den meisten Fällen nicht möglich.
• - Sicherheitsziel-Verletzung (Safety-Goal Violation)
  • Aktuelle Diagnosemöglichkeiten erlauben keine oder nur eine beschränkte Vorhersage der möglichen Safety-goal Verletzung, bspw. sicherheitsrelevante interne Spannungen befinden sich zum Zeitpunkt der Steuergeräte-Fertigung im unauffälligen bzw. korrekten Band, die theoretische Berechnung der Alterung von Bauteilen ist hier bereits mit einbezogen. Es sind lediglich Abschätzungen des Lebenszyklus vorhanden, z. B. SOH (Stateof-health bei Batterien), bzw. Betriebsdauerzähler (Life-time Counter). Diese Abschätzungen basieren auf theoretischen Modellen, bieten aber keine Möglichkeit, eine Prognose entsprechend der aktuellen Belastungssituation oder dem aktuellen Zustand der Komponenten eines Steuergeräts anzupassen.
• - Sicherheit (Security)
  • Falls ein Subsystem ein anderes überwacht, erfordert dies eine „aktive“ Handlung des zu überwachenden Subsystems. Die Handlung des zu überwachenden Systems kann bspw. eine Meldung bestimmter Parameter oder auch eine Unterlassung einer Meldung (Watchdog-Prinzip) sein. In beiden Fällen muss die Plausibilität bzw. Authentizität der Handlung dieses Subsystems sichergestellt sein. Dies bedeutet, dass eine Überwachung eines Subsystems ohne seine aktive Beteiligung kaum möglich ist.
• - Übertragung von Daten
  • In einem Steuergerät findet ein ständiger Austausch von Daten zwischen zwei Subsystemen statt. So erfolgt bspw. die Kommunikation zwischen einem Mikrocontroller und einem Mikroprozessor über Kommunikationsbusse wie SPI oder Direktverbindungen. Dies erfordert den Einsatz von Kommunikationsleitungen, was den Platzbedarf auf der Leiterplatte erhöht und in bestimmten Fällen auch zusätzliche Anforderungen an das Layout, bspw. hinsichtlich Terminierung, Einhaltung einer bestimmten Leitungsimpedanz usw., stellt.

The following methods for monitoring a control unit are known:

• - Control unit self-diagnostics
  • This includes, for example. A so-called built-in test device (BIST: Build in self test), an evaluation of internal signals of the control unit z. B. with a watchdog and voltage monitoring via an analog-to-digital converter (ADC: analog digital converter). The data obtained is used to detect errors in the functions of the control unit and to write entries in the control unit's error memory. Most of these diagnostic functions are only available after the microcontroller has booted up.
• - Plant test concept:
  • Special test software is currently being loaded or installed on the control unit to test individual subsystems in production (STIL-SW).
• - Evaluation of the EMC performance:
  • EMC tests are only carried out on a few control units or customer-specific delta testing is only carried out during the release process in development. Delta testing means that a full testing program is not necessary,
  • but a few specific test steps must be carried out, which serve specifically to secure the relevant EMC properties. There is currently no way to improve EMC performance at least in critical points, e.g. B. at critical radio frequencies, navigation, LTE (Long Term Evolution), to be assessed in the field. In the field here means: also at the end of the control unit's life cycle. Should the EMC behavior of the control unit change during its life cycle,
  • so this typically cannot be diagnosed.
• - Diagnosis "over the ether" (over the air)
  • Systems that allow so-called "diagnostics over the air" are gradually gaining ground. System parameters are recorded and transmitted from the vehicle to the OEM (Original Equipment Manufacturer), for example. One problem is that the transmitted data are mostly system parameters that allow an analysis of the current driving situation or the current system status. An in-depth analysis of the hardware, e.g. B. exceeding EMC limit values or approaching system limits (predicted failure diagnostics on hardware level) is not possible in most cases.
• - Safety-Goal Violation
  • Current diagnostic options allow no or only a limited prediction of the possible safety goal violation, e.g. safety-relevant internal voltages are in the inconspicuous or correct band at the time of control unit production, the theoretical calculation of the aging of components is already included here. There are only estimates of the life cycle, e.g. B. SOH (state of health for batteries), or operating time counter (lifetime counter). These estimates are based on theoretical models, but do not offer the possibility of adapting a prognosis according to the current load situation or the current condition of the components of a control unit.
• - security
  • If one subsystem monitors another, this requires "active" action by the subsystem being monitored. The action of the system to be monitored can be, for example, a report of certain parameters or an omission of a report (watchdog principle). In both cases, the plausibility or authenticity of the action of this subsystem must be ensured. This means that a subsystem can hardly be monitored without its active participation.
• - Transmission of data
  • In a control unit, there is a constant exchange of data between two subsystems. For example, communication between a microcontroller and a microprocessor takes place via communication buses such as SPI or direct connections. This requires the Use of communication lines, which increases the space requirement on the printed circuit board and, in certain cases, also places additional requirements on the layout, e.g. with regard to termination, compliance with a certain line impedance, etc.

The pamphlet DE 10 2015 217 110 A1 describes a method for carrying out a diagnosis in a motor vehicle, in which a frequency analysis is carried out for a time profile of a physical variable. Here, amplitudes of frequencies can be taken into account.

From the pamphlet DE 10 2013 201 425 A1 a method for operating an electrical device in a motor vehicle is known. With this method, several lines for frequencies and their amplitude responses are taken into account.

The pamphlet DE 10 2008 002 196 A1 describes a method for checking the function of a component in a vehicle, in which an amplitude and/or a frequency are taken into account as characteristic features of a state variable.

Disclosure of Invention

Against this background, a method according to claim 1 and an arrangement with the features of claim 9 are presented. Embodiments emerge from the dependent claims and from the description.

The method presented is used to monitor a control unit, in which conducted interference caused during operation of the control unit is recorded in a defined frequency range, the conducted interference recorded is plotted against the frequency, resulting in a frequency pattern in which at least one marker is defined in the frequency pattern , which is evaluated with regard to the evaluation characteristics frequency, amplitude and time.

It should be noted that the frequency range of a marker is typically affected by ECU-specific sources of interference, e.g. B. switching regulator or clock is determined. However, this can also be determined by measurements on a reference device.

• - Selbstdiagnose des Steuergeräts
  • Das hierin vorgeschlagene Verfahren ermöglicht auf einfache Weise eine Diagnose bzw. Analyse von Bauteilen bzw. Baugruppen, die nicht direkt bspw. über einen ADC eines Mikrocontrollers gemessen werden können. Dazu zählen bspw. passive Bauteile, wie z. B. Filterkondensatoren, Spulen usw., oder auch komplexe Bauteile ohne Eigendiagnose, wie z. B. Oszillatoren.
  • Durch die hohe Flexibilität dieser Diagnosemethode ist es möglich, die Auswertung bestimmter Parameter teilweise oder ganz ohne Mikrocontroller zu realisieren, was auch solche Vorgänge wie z. B. StartUp- oder Sleep-Phasen abdeckt.
• - Plant-test Konzept:
  • Derzeit wird eine spezielle Testsoftware initial auf dem Steuergerät aufgespielt bzw. installiert, um einzelne Subsysteme des Steuergeräts zu testen. Dies erfordert eine lange Testzeit, weil die Testschritte größtenteils sequentiell ausgeführt werden. Mit der Methode der Frequenzanalyse besteht die Möglichkeit, mehrere Subsysteme gleichzeitig in einem oder in wenigen Testschritten zu bewerten, was zu einer deutlichen Verkürzung der Testzeit führt.
• - Beurteilung der EMV-Leistungsfähigkeit:
  • Die hierin beschriebene Diagnosemethode erlaubt eine einfache Überwachung von kritischen Frequenzbereichen während des Betriebs des Steuergeräts.
• - Direkt- bzw. Livediagnose over the air
  • Aktuell werden einzelne kritische Funktionsblöcke auf einem Steuergerät überwacht. Mit dem vorgestellten Verfahren lässt sich der Zustand des gesamten Steuergeräts oder aber auch einzelner Subsysteme bis hin zu Einzelkomponenten mittels einer Frequenzanalyse mit geringem Aufwand diagnostizieren.
  • Beispiel: Das Steuergerät überträgt sein eigenes erstelltes Frequenzprofil over the air an den OEM oder eine Werkstatt. Ein anderes System, bspw. ein leistungsfähiges System bzw. eine entfernte Recheneinheit, wertet das Profil anschließend aus.
    • - Für die Auswertung wird keine bzw. nur eine minimale Rechenleistung auf dem Steuergerät verwendet.
    • - Eine Anpassung der Service- bzw. Wartungsintervalle des Gesamtfahrzeugs ist möglich.
• - Sicherheitsziel-Verletzung
  • Durch die Auswertung des Verhaltens eines Steuergeräts im Frequenzbereich ergeben sich zahlreiche Möglichkeiten, eine ggf. bevorstehende Verletzung der Sicherheitsziele zu diagnostizieren.
    • - Stand alone Safety Überwachung Durch Erstellen eines Frequenzmusters kann die Funktionalität von sicherheitsrelevanten Baugruppen effektiv überwacht werden.
    • - Redundante Sicherheitsüberwachung:
      • Das Frequenzmusters kann als redundante Methode zur zusätzlichen Bewertung des Sicherheitsziels verwendet werden. Bspw. meldet eine Spannungsüberwachung eine Unterspannung, gleichzeitig deutet das Frequenzmuster auf die Überlast eines Reglers hin. Daraus folgt eine erhöhte Wahrscheinlichkeit dafür, dass eine Fehlfunktion des Reglers bzw. Subsystems vorliegt.
    • - Sicherheitsüberwachung des aktuellen Systemzustands:
      • Dies stellt eine Möglichkeit dar, über das Frequenzmuster, d. h. auf Grundlage von realen Messdaten, eine bessere Abschätzung der Lebensdauer bestimmter insbesondere sicherheitsrelevanter Komponenten vorzunehmen. Ein Beispiel hierfür ist ein Elektrolytkondensator im Filter. Derzeit ist nur eine theoretische Abschätzung der Lebensdauer anhand von Herstellerangaben, Temperaturprofilen, theoretischer Belastung und Betriebsstunden des Gesamtsystems möglich. Nunmehr ist mit dem Frequenzmuster eine Echtzeitüberwachung der Filterwirkung und somit eine Früherkennung eines Ausfalls der Filterkomponente möglich.
• - Sicherheit (Security)
  • Ein Subsystem, z. B. ein Mikrocontroller, kann durch Auswertung seines Frequenzmusters von einem anderen System, bspw. einem Mikroprozessor oder einem ASIC, überwacht werden. Dies gestattet Rückschlüsse auf den Zustand des überwachten Systems, ohne dass dieses irgendwelche speziellen Handlungen unternehmen muss. Gleichzeitig kann das Frequenzmuster spezifische Merkmale enthalten, die die Manipulationssicherheit erhöhen.
• - Übertragung von Daten
  • Die Beeinflussung und anschließende Auswertung des Frequenzmusters kann dazu genutzt werden, bestimmte Daten systemweit zu übermitteln, ohne dafür dedizierte Kommunikationsleitungen oder Busse zu verwenden.

With the method presented here, the frequency pattern described below can be used with appropriate markings or markers for the following functions:

• - Control unit self-diagnostics
  • The method proposed here enables a diagnosis or analysis of components or assemblies that cannot be measured directly, for example via an ADC of a microcontroller, in a simple manner. These include, for example, passive components such. B. filter capacitors, coils, etc., or complex components without self-diagnosis, such. B. Oscillators.
  • Due to the high flexibility of this diagnostic method, it is possible to evaluate certain parameters partially or entirely without a microcontroller. B. covers start-up or sleep phases.
• - Plant test concept:
  • Special test software is currently being loaded or installed initially on the control unit in order to test individual subsystems of the control unit. This requires a long test time because the test steps are mostly executed sequentially. With the frequency analysis method, it is possible to evaluate several subsystems simultaneously in one or a few test steps, which leads to a significant reduction in test time.
• - Evaluation of the EMC performance:
  • The diagnostic method described here allows easy monitoring of critical frequency ranges during operation of the control unit.
• - Direct or live diagnosis over the air
  • Individual critical function blocks are currently monitored on a control unit. With the method presented, the status of the entire control unit or even individual subsystems down to individual components can be diagnosed with little effort using a frequency analysis.
  • Example: The control unit transmits its own created frequency profile over the air to the OEM or a workshop. Another system, for example a powerful system or a remote computing unit, then evaluates the profile.
    • - No or only minimal computing power is used on the control unit for the evaluation.
    • - An adjustment of the service or maintenance intervals of the entire vehicle is possible.
• - Security Target Violation
  • By evaluating the behavior of a control unit in the frequency range, there are numerous possibilities, one of which may be imminent to diagnose imminent breaches of security objectives.
    • - Stand alone safety monitoring By creating a frequency pattern, the functionality of safety-relevant assemblies can be effectively monitored.
    • - Redundant security monitoring:
      • The frequency pattern can be used as a redundant method for additional assessment of the security objective. For example, a voltage monitor reports an undervoltage, while at the same time the frequency pattern indicates that a controller is overloaded. As a result, there is an increased probability that the controller or subsystem is malfunctioning.
    • - Security monitoring of the current system status:
      • This represents a possibility of using the frequency pattern, ie on the basis of real measurement data, to make a better estimate of the service life of certain, in particular, safety-relevant components. An example of this is an electrolytic capacitor in the filter. Currently, only a theoretical estimate of the service life is possible based on manufacturer information, temperature profiles, theoretical load and operating hours of the entire system. Now, with the frequency pattern, real-time monitoring of the filter effect and thus early detection of a failure of the filter component is possible.
• - security
  • A subsystem, e.g. A microcontroller, for example, can be monitored by another system, for example a microprocessor or an ASIC, by evaluating its frequency pattern. This allows conclusions to be drawn about the status of the monitored system without it having to take any special actions. At the same time, the frequency pattern can contain specific features that increase the security against manipulation.
• - Transmission of data
  • The influencing and subsequent evaluation of the frequency pattern can be used to transmit certain data system-wide without using dedicated communication lines or buses.

The arrangement presented is used to carry out the method and is implemented, for example, in hardware and/or software. The arrangement can also be integrated in a control unit, for example also in the control unit that is being monitored.

Further advantages and refinements of the invention result from the description and the accompanying drawings.

It goes without saying that the features mentioned above and those still to be explained below can be used not only in the combination specified in each case, but also in other combinations or on their own, without departing from the scope of the present invention.

character list

• 1 shows a typical frequency pattern of a control unit in a graph.
• 2 FIG. 12 shows a frequency characteristic of a marker in a graph.
• 3 shows in a graph an amplitude characteristic of a marker.
• 4 shows a time characteristic of a marker in three graphs.
• 5 shows the characteristics of a marker and a signal evaluation in a graph.

Embodiments of the invention

The invention is shown schematically on the basis of embodiments in the drawings and is described in detail below with reference to the drawings.

1 shows a typical frequency pattern 16 of a control unit in a graph 10, on whose abscissa 12 the frequency is plotted and on whose ordinate 14 the amplitude is plotted.

It must be taken into account that, due to various switching processes and changes in voltage and current over time, a control unit exhibits a certain radiation behavior of conducted interference in a defined frequency range during operation. Conducted interference is transmitted from the interference source directly to the interference sink via supply or signal lines. If the radiated disturbances are plotted against the frequency, the so-called frequency pattern results. This represents a characteristic frequency behavior of the control unit. Based on the frequency pattern, certain operating points of the components or subsystems can be analyzed.

1 16 represents the frequency pattern 16 of a control device. Here one can see typical switching frequencies of different voltage regulators, in this case a switching converter with 450kHz (reference number 18) and a switching converter with 2MHz (reference number 20) as switching frequency.

• - Frequenz
• - Amplitude
• - Zeit

This in 1 The frequency pattern shown thus includes typical switching frequencies of different voltage regulators. Markings, the so-called markers, can be defined, which allow conclusions to be drawn about the current operating point or system status. These markers include the following evaluation characteristics:

• - frequency
• - amplitude
• - Time

Evaluation of the frequency:

When evaluating the frequency, the focus is on a previously defined frequency range in which the marker is located. In this way, a frequency range can be determined, the so-called frequency window, which can be used to evaluate the current operating point of a subsystem. It will appear in this context 2 referred.

2 shows a graph 50, on whose abscissa 52 and on whose ordinate 54 the amplitude is plotted. For example, a frequency window for the switching converters mentioned above can be defined as f1 (box 1, reference number 56) = 450 kHz +/- x and f2 (box 2, reference number 58) = 2MHz +/- x. If the switching frequency of the converter is outside of the defined frequency window 56 or 58 due to a defect or a deviation in the specification of the components, this feature can be used for diagnostic purposes or for early detection of a failure. A deviation of the switching frequency can e.g. B. caused by an incorrectly populated resistor, which is used to set the clock frequency.

Evaluation of the amplitude:

3 shows a graph 70, on the abscissa 72 of which the frequency is plotted and on the ordinate 74 of which the amplitude is plotted. The graph 70 shows the amplitude as a possible evaluation feature of a marker. Depending on the operating point of a specific component, such as a switching converter, the amplitude of the peak value or peaks changes. An amplitude window 76 or 78 can thus be defined in which z. B. the switching converter is working properly. If the amplitude of the peak leaves the defined range, this can indicate an overload or a missing load of a downstream subsystem.

Evaluation of the time:

During the start-up process of an ECU, the subsystems, in this example the controllers, may be started up sequentially. This is based on 4 , which illustrates a time characteristic of a marker. The illustration shows three graphs at a point in time t0 90, t1 92 and t2 94.

The evaluation of the markers at a specific time allows conclusions to be drawn about the proper startup of the subsystems and can be used, for example, to diagnose the start sequence.

The evaluation can be carried out locally in the control unit using Fast Fourier Transformation (FFT: Fast Fourier Transformation). A powerful microcontroller can generate a frequency pattern itself or with the help of an external DSP (digital signal processor) and check whether certain markers occur in this frequency pattern.

Furthermore, the evaluation of the frequency pattern can be carried out by a more powerful system. This option is of particular interest for tests in the factory, evaluation at the OEM or in the workshop. Here, the frequency pattern of a control unit is recorded and evaluated by an external measuring device. In this case, no internal control unit resources are required.

In addition, a selective evaluation of individual markers can be carried out using hardware. The evaluation of individual features can also be implemented as a pure hardware function. In this case, a specific behavior can also be triggered when the ECU's microcontroller is inactive, e.g. B. at StartUp or Sleep.

5 shows a graph 100 on the left-hand side, with the frequency plotted on the abscissa 102 and the amplitude on the ordinate 104. The representation is a combination of the 2 and 3 . On the right side of the 5 signal processing is shown, which will be discussed below.

A signal whose frequency pattern is to be analyzed is filtered using bandpass filters. In this way, the frequency characteristic of a marker is evaluated. Thereafter, an amplitude characteristic of a marker is monitored with a window comparator. If both features of the marker are present, the marker can be recognized as valid. The detected marker is in a RS flip Flop cached until microcontroller is up and available.

A combination of different evaluation options can also be carried out. The evaluation options mentioned can also be combined with one another. In this way, the control unit can monitor the particularly critical parameters by internally evaluating the frequency pattern. At the same time, a more powerful test system can generate and evaluate a complete frequency pattern.

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• DE 102015217110 A1 [0004]
• DE 102013201425 A1 [0005]
• DE 102008002196 A1 [0006]

Claims (9)

Method for monitoring a control device, in which Conducted interference caused during operation of the control unit is recorded in a defined frequency range, the recorded conducted interference is plotted against the frequency, resulting in a frequency pattern (16), at least one marker is defined in the frequency pattern (16), which is evaluated with regard to the evaluation features frequency, amplitude and time. procedure after claim 1 , in which at least one frequency window (56, 59) is used when evaluating the frequency in order to evaluate a current operating point of a subsystem of the control unit. procedure after claim 1 or 2 , in which at least one amplitude window (76, 78) is used when evaluating the amplitude in order to evaluate a load on a subsystem of the control unit. Procedure according to one of Claims 1 until 3 , in which the at least one marker is evaluated at a specific time in order to assess a startup of a subsystem. Procedure according to one of Claims 1 until 4 , in which the evaluation takes place locally in the control unit. Procedure according to one of Claims 1 until 4 , in which the evaluation takes place outside the control unit. Procedure according to one of Claims 1 until 6 , in which the evaluation is carried out using Fast Fourier Transformation. Procedure according to one of Claims 1 until 7 , in which the evaluation is carried out at least partially with hardware. Arrangement for monitoring a control device for carrying out a method according to one of Claims 1 until 8th is set up.

Images