FR3082961A1 - DEVICE FOR DIAGNOSING A FAILURE OF A PROCESSING UNIT BASED ON QUESTIONS / ANSWERS - Google Patents

Abstract

The invention relates to a device (10) for diagnosing the failure of a processing unit (MC) comprising a module (MU) capable of verifying the correct operation of the processing unit (MC) by regularly asking it questions and by analyzing the responses, and an anomaly counter (FC) capable of counting bad or absent responses and of producing a fault diagnosis when it exceeds a first threshold (FT), where the anomaly counter (FC) is reset according to a period (DT).

Description

The present invention relates generally to the field of automotive electronics and the operational safety of processing units. It relates in particular to a fault diagnosis device.

To meet ISO 29292 engine control safety standards, it is known to monitor the proper functioning of a MC processing unit (from the main controller) by means of a MU module (of the 'English "Monitoring Unit": separate monitoring unit).

Figure 1 shows a system organically represented vertically and temporally horizontally. A processing unit MC, in the upper part, exchanges by means of a communication means, in the middle part, with a MU module, in the lower part. The time T is shown from left to right. The following steps are regularly repeated at each cycle k.

In step 1, the module MU chooses a question Q (k) to be sent to the processing unit MC, for the k ^th cycle or current cycle.

In step 2, the question Q (k) is inserted into an SPI frame and sent to the processing unit MC. The SPI transmission (for “Serial Peripheral Interface” in English, or “Serial Peripheral Interface” in French) is shown diagrammatically by the bidirectional arrow in FIG. 1.

In step 3, the processing unit MC decodes the SPI frame and extracts the question Q (k).

In step 4, the processing unit MC consumes the question Q (k) and calculates the response, the reception 4 of this question Q (k) triggering the determination by the processing unit MC of a response A ( k).

The processing unit MC deals with the question Q (k) by executing an algorithm enabling it to determine the answer A (k). Advantageously, this algorithm involves one or more of the components of the processing unit MC, such as the multiple cores of a microprocessor, the communication bus or buses and preferably all, ..., and implements a or several functions of the processing unit MC. Advantageously, the set of questions is constructed so as to solicit all the components and all the functions necessary for carrying out the tasks of the processing unit MC.

In step 5, the processing unit MC provides the answer A (k) to the question Q (k).

In step 6, the response A (k) is inserted into an SPI frame and sent to the module MU.

In step 7, the MU module decodes the SPI frame and extracts the response A (k). The module MU knows the expected responses and can thus verify, in step 7, whether the processing unit MC has returned the correct response A (k). If a good response is received, it can be assumed that the MC processing unit, including the communication bus, is functioning properly. Alternatively, the MC processing unit may return a wrong answer or not return a response. For this second case, the MU module typically uses a timer triggered when the question Q is sent. If no response A is received at the expiration of the timer, also called "time-out", it is considered that the answer is missing. An absent or wrong answer is indicative of an anomaly.

When a failure of the MC treatment unit is diagnosed, protective measures are triggered. The MC processing unit is typically reset, and for example restarted in a degraded mode, safe for the controlled system but most often having limited performance, such as a mode, called in English "limp-home", authorizes operation of the engine / vehicle restricted in its functions and / or limited in time, but safe for the vehicle and its driver, in order to allow them to reach a place of destination or a garage.

Certain anomalies are inevitable and do not lend themselves to consequence. For example, it may happen that an answer to a later question is received by the MU module before an answer to an earlier question, in other words two answers are received in a different order from that of the questions. This phenomenon is known as "jitter" or guigue in French. The MU module then concludes with a wrong answer. This creates an anomaly that is not indicative of a real failure, such as a failure of a hardware component. This is all the more likely when the MC processing unit includes several hearts and / or when the MU module sends the questions at a high frequency. It can then happen that the algorithm for determining the response requesting different hearts is delayed for the determination and thus the supply of a response, if at least one of the hearts is overloaded.

Also, in a known manner, in order not to unduly resort to restrictive protective measures, a failure is not diagnosed at the first anomaly, but after a succession of several anomalies, in a limited time, typically treated by means of a filtered.

According to a known embodiment, it is, for example, used as a filter an anti-rebound device (or "anti bounce" in English). As illustrated in FIG. 2, such a device processes an AN anomaly signal in the following manner. The anti-rebound device includes an anti-rebound counter AB. This counter AB is incremented at each anomaly (bad or absent response), indicated by a high state of the signal AN, and is decremented at each good response, provided that this good response is received within a given period of time following the anomaly and limit. So when an anomaly is detected, the anti-rebound device triggers a timer, if at least one correct response is received before the timer expires, the anomaly is ignored and / or canceled. If on the contrary, at the expiration of the timer, no correct answer has been received, the anomaly is counted. Thus the anomaly A1, present during a cycle, causes an increment B1 of the counter AB. However, the correct response received following A1, indicated by a low state of the signal AN, causes the counter AB to decrement, which returns to its initial value. Similarly, the anomaly A2, present during two successive cycles, successively causes two increments B2 of the counter AB. However, two correct responses received during two cycles following A2, cause two successive decrements of the counter AB which returns to its initial value. Also anomalies A1 and A2 are ignored.

When the anti-rebound counter AB exceeds a given threshold AT, a failure is diagnosed. This is illustrated in FIG. 2, by the anomaly A3, successively repeated for 8 cycles, which successively increments the counter AB until it reaches the threshold AT.

Thus, it takes several successive anomalies, within a certain time, without good intermediate response, to diagnose a failure. The threshold is an important parameter. It advantageously offers a certain tolerance and a possibility of "correction", in particular anomalies due to a phenomenon of "jitter" or jitter. Disadvantageously, the presence of the threshold, and the "time-out" retained, delay all the more a decision-making. Also the threshold is generally reduced, typically equal to a few units, for example equal to 3 in FIG. 2. This corresponds temporally to 3 diagnostic recurrences, ie 30 ms for a recurrence of 10 ms. Such an anti-rebound device effectively evacuates irrelevant anomalies such as those caused by a phenomenon of "jitter" or guigue.

However, such an anti-rebound device has yet another drawback. Its ability to "correct" becomes detrimental in that it has the effect of masking a sporadic anomaly.

When an anomaly has a frequency higher than the correct answer frequency, including a continuously present anomaly, as is the case for the anomaly A3 in Figure 2, the anti-rebound device works well in that the counter AB anti-rebound will rapidly increase until it exceeds the AT threshold and thus rightly lead to the diagnosis of a failure. However, if, like the anomalies A1, A2 in FIG. 2, an anomaly has a frequency lower than the frequency of correct response, this anomaly A1, A2, even recurrent, is masked by the anti-rebound device and is ignored.

The objective of the invention is to propose a device for diagnosing the failure of a processing unit having the same functionalities, but without having the drawbacks of the anti-rebound device, ie a device capable of diagnosing a failure, having a certain tolerance to anomalies for example caused by a phenomenon of "jitter" or wasting and still capable of diagnosing a sporadic failure.

This objective is achieved thanks to a device for diagnosing the failure of a processing unit comprising a module capable of verifying the proper functioning of the processing unit by regularly asking it questions and analyzing the answers, and a counter of anomaly capable of counting bad or absent responses and of producing a fault diagnosis when it exceeds a first threshold, the anomaly counter being reset according to a period.

According to another characteristic, the number of possible increment counter increments during a period is greater than the first threshold, preferably greater than twice the first threshold.

According to another characteristic, the device also comprises a recording means capable of recording at least one item of information relating to the anomaly counter.

According to another characteristic, the information recorded comprises the value of the anomaly counter before reinitialization.

According to another characteristic, the information recorded is the time or times when the value of the anomaly counter reaches or exceeds a second threshold, below the first threshold and / or the number of times the anomaly counter reaches or exceeds the second threshold.

According to another characteristic, the information recorded is the complete profile of the anomaly counter.

According to another characteristic, the information recorded is accompanied by a state of the environment of the processing unit.

According to another characteristic, the information recorded is compared with that obtained for a reference processing unit or for an average processing unit in order to diagnose a sporadic failure.

Other innovative characteristics and advantages of the invention will emerge on reading the description below, provided for information and in no way limitative, with reference to the appended drawings, in which:

FIG. 1, already described, illustrates a diagnostic system based on questions and answers,

FIG. 2, already described, shows the operation of an anti-rebound device according to the prior art,

- Figure 3 shows the operation of a device according to the invention.

For the sake of clarity, identical or similar elements are identified by identical reference signs in all of the figures.

The invention relates to a device 10 for diagnosing the failure of a processing unit MC. This device includes a MU module capable of verifying the proper functioning of the MC processing unit by regularly asking it questions and analyzing the answers. This device 10 also includes an FC anomaly counter capable of counting bad or absent responses and of producing a fault diagnosis when it exceeds a first FT threshold. The operation of this FC anomaly counter is illustrated in Figure 3.

According to a characteristic specific to the invention, the anomaly counter FC is periodically reset, and this according to a period DT.

Thus, as shown in Figure 3, the same AN fault signal as previously in Figure 2, is used to facilitate comparison. This AN anomaly signal is processed by the device 10 according to the invention in the following manner. An FC anomaly counter is used to count wrong or missing responses. An absent or incorrect response causes the FC anomaly counter to increment. Unlike the anti-rebound device, correct answers are not taken into account, in that a correct answer does not decrement the FC anomaly counter. Thus the anomaly A1 causes an increment C1 of the anomaly counter FC. This value is then maintained despite the subsequent arrival of at least one correct answer. At the end of a DT period, the FC counter is reset to D1.

A period DT can, for example, be determined by means of a counter CK incremented at each cycle and reset when it reaches its maximum value CT. Thus the period DT is equal to the duration of a cycle multiplied by CT.

Then the anomaly A2 causes a double increment C2. The FC anomaly counter then maintains the value thus reached. At the end of the following DT period, the FC counter is reset to D2.

Conversely, the anomaly A3 causes a multiple increment C3, such that the anomaly counter FC reaches the failure threshold FT before the end of the period DT, and thus before a reset is carried out. Also a failure is diagnosed in D3.

In order for such a device 10 to be able to detect a fault, the anomaly counter FC should be able to exceed its threshold FT before a reset. Also, the reset period DT must be long enough. At a minimum, the number of increments of the FC anomaly counter possible during a period DT, that is to say the number of increments produced by an uninterrupted succession of anomalies, must be greater than the first threshold FT. Preferably, the period DT is advantageously chosen to be greater, for example at least equal to twice the first threshold FT.

Thus the time being divided into cycles, the anomaly counter FC is incremented with each cycle where a response is bad or absent and the reset period DT is an integer p of cycles at least equal to the value and preferably greater than the first FT threshold. In Figure 3, DT corresponds to 6 cycles and FT is equal to 3.

It appears from the preceding description that the device according to the invention advantageously makes it possible to diagnose a failure when a sufficiently large succession of anomalies is present, while tolerating a certain margin of error, and a certain amount of anomalies, advantageously "Corrected" or "forgotten" temporally thanks to the periodic reset mechanism.

The signal DF of FIG. 3 is indicative of the state of failure. It is at a low level in the absence of failure. It is at the high level following D3 and when the FT anomaly counter exceeds the FT threshold.

In order not to unduly trigger conservative but restrictive measures following a failure diagnosis, the FT threshold can be increased by a margin. In the event of a component failure, generally leading to a persistent anomaly, this FT threshold, at the rate of one increment per cycle, is quickly reached. However, the FT threshold should not be too high in order not to delay the diagnosis too much.

The FC anomaly counter advantageously contains information on the behavior of the processing unit MC in terms of reliability and evolution of this reliability. Also according to another characteristic of the device 10, the latter advantageously further comprises a recording means capable of recording at least one item of information relating to the anomaly counter FC. This information recording can be used in different ways or in different forms.

According to a first embodiment, the information recorded comprises the value of the FC anomaly counter before reinitialization. This information is represented by the signal VA of FIG. 3. This signal is worth 1 for the first period DT, 2 for the second period DT and 3 for the third period DT.

Between a minimum value FTO, of a few units, necessary to remove the consequences of a "jitter" or wasting without diagnosing a failure, and a higher value of the FT threshold actually retained and which may include a margin, a range appears in which an analysis of the behavior of anomalies as seen by the FC anomaly counter can be useful for operational safety and / or preventive maintenance in the medium or long term.

According to another embodiment, in order to observe a possible evolution of the anomalies, a second MV threshold is implemented. This second threshold is advantageously lower than the first threshold FT and still advantageously greater than the minimum value FTO defined above.

In this case, the information recorded is the instant (s) when the value of the FC anomaly counter reaches or exceeds the second threshold MT. This is illustrated by the signal PD in FIG. 3. Alternatively, the number of times the anomaly counter FC reaches or exceeds the second threshold MT can be recorded.

According to another embodiment, the information recorded is the complete profile of the FC anomaly counter.

Advantageously, for a more detailed analysis of the anomaly situation, the information recorded is accompanied by a state of the environment. It is understood here by environment, the system controlled by the processing unit MC. Thus in the case of a processing unit MC is an engine computer, the environment is the engine and / or the vehicle. The state of the environment can include a recording of the parameter values among: water temperature, air temperature around the MC processing unit, engine speed, vehicle speed or any other significant parameter.

Advantageously, the second threshold MT is arranged as close as possible, by higher value, to the minimum value FTO. Thus, the FTO value being indicative of nominal operation is only dimensioned to evacuate the "jitter" or guigue. It follows that exceeding the second MV threshold may correspond to another cause of anomaly. This other cause, sporadic enough to be corrected by the reset mechanism, can however be thus detected by the device 10.

Alternatively or additionally the second threshold MV (or a third threshold) can be positioned at a minimum value not diagnosing a failure in nominal operation. This value can correspond to or be higher than FTO in that it includes acceptable anomalies but not related to "jitter" or guigue. These anomalies do not advantageously have to be identified, the value of the threshold MT can be determined empirically. Such a threshold MT then provides a "photograph" of the nominal anomaly state of the processing unit MC. Crossing this MV threshold is then indicative of an increase in the number of anomalies relative to the initial state and signals a sporadic failure.

This can still be used to monitor the evolution of reliability over time. An increase in the number of anomalies, indicated by a change in an observed value of the MV threshold, which can provide a metric of the degradation of reliability.

Different types of processing of the information recorded by the device 10 are possible. It is possible to compare the information coming from the same device 10 over time in order to observe the time evolution of reliability. It is still possible to compare the information from a device 10 with that from other devices. A networking of the information thus obtained makes it possible to carry out statistical processing, in order to determine, for example, an average and trends.

According to a preferred embodiment, the recorded information can still be compared with that obtained for a reference MCR processing unit or for an average MCM processing unit in order to diagnose a sporadic failure.

An MCR reference processing unit is a unit that it is sure is functional. It can for example be a new unit. For such an MCR reference processing unit, the behavior of the anomalies can be assumed to be minimum, or typically only reduced to the phenomena caused by the “jitter” or guigue. Thus by comparing the behavior, for example observed by the number of anomalies, the number of exceedances of the second MV threshold or any other metric issuing from the FC anomaly counter, it is possible to detect a situation different from the nominal situation. The cause of this difference is necessarily sporadic failure. It is not caused by the only "jitter" or guigue since a difference appears. It is not a sustained failure since such a sustained failure would have been detected by means of the first FT threshold.

It can be difficult to determine a reference MCR treatment unit. Indeed, it is not certain that a random unit is fully functional. In addition, following an evolution of the software, a worsening or jitter phenomenon may be introduced. Also, in order to overcome such variations, it is advantageously considered a population of devices according to the invention. By statistically analyzing the information recorded by all the devices of this population, it can be determined recorded information indicative of a hypothetical average MCM processing unit (or alternatively an optimal, minimum, maximum processing unit, etc.). Such an average processing unit is advantageously used like a reference processing unit MCR.

The consequences of a sporadic failure are different from the consequences of a sustained failure and generally much less critical. Also a different treatment can advantageously be envisaged. If for a sustained failure binding conservative measures are typically taken due to urgency and possible criticality, for a sporadic failure it may be simply advisable, for example by means of an indication on the dashboard, to have an analysis by a dealer garage.

Such detection of a sporadic failure is very advantageous in that it can be carried out at the earliest upon the appearance of a variation in the abnormality behavior. Also its treatment can advantageously prevent a larger failure which may possibly follow by aggravation of the cause of the failure.

The invention is described in the foregoing by way of example. It is understood that the person skilled in the art is able to carry out different variant embodiments of the invention, by combining for example the different characteristics above taken alone or in combination, without however departing from the scope of the invention.

Claims (8)

1. Device (10) for diagnosing the failure of a processing unit (MC) comprising a module (MU) capable of verifying the correct functioning of the processing unit (MC) by regularly asking it questions and analyzing the responses, and an anomaly counter (FC) capable of counting bad or absent responses and of producing a fault diagnosis when it exceeds a first threshold (FT), characterized in that the anomaly counter (FC) is reset according to a period (DT). 2. Device (10) according to claim 1, wherein the number of increments of the anomaly counter (FC) possible during a period (DT) is greater than the first threshold (FT), preferably greater than twice the first threshold (FT). 3. Device (10) according to any one of claims 1 or 2, further comprising a recording means capable of recording at least one item of information relating to the anomaly counter (FC). 4. Device (10) according to claim 3, wherein the recorded information comprises the value of the anomaly counter (FC) before reinitialization. 5. Device (10) according to any one of claims 3 or 4, where the recorded information is the time or times when the value of the anomaly counter (FC) reaches or exceeds a second threshold (MT), lower than first threshold (FT) and / or the number of times the anomaly counter (FC) reaches or exceeds the second threshold (MT). 6. Device (10) according to any one of claims 3 to 5, wherein the information recorded is the complete profile of the anomaly counter (FC). 7. Device (10) according to any one of claims 3 to 6, wherein the recorded information is accompanied by a state of the environment of the processing unit (MC). 8. Device (10) according to any one of claims 3 to 7, in which the recorded information is compared with that obtained for a reference processing unit (MCR) or for an average processing unit (MCM) in order to diagnose sporadic failure.