GB2603536A

GB2603536A - Method of checking the functionality of a vehicle microcontroller

Info

Publication number: GB2603536A
Application number: GB2101763.7A
Authority: GB
Inventors: Sankar Ganesh; Mazumder Aishik
Original assignee: Delphi Technologies IP Ltd
Current assignee: Delphi Technologies IP Ltd
Priority date: 2021-02-09
Filing date: 2021-02-09
Publication date: 2022-08-10
Anticipated expiration: 2041-02-09
Also published as: GB202101763D0; GB2603536B

Abstract

A method of checking the functionality of a vehicle Electronic Control Unit (ECU) 8 or a microcontroller 1 thereof, comprising the steps of: (a) providing a raw crankshaft signal 4 from a crankshaft sensor, said signal having a waveform comprising of a series of rising and falling edges; (b) inputting said raw crankshaft signal, or a signal derived therefrom, to said ECU or microcontroller thereof; (c) using one or more clock signals provided internally in the ECU or microcontroller thereof, to provide a replicated crankshaft signal from said input crankshaft signal of step (b); (d) comparing said raw crankshaft signal, or a signal derived therefrom, with said replicated crankshaft signal; (e) determining if there is an ECU or ECU microcontroller fault based on said comparison of step (d). It is an object of the invention to provide improved diagnostics coverage for state of health monitoring of an ECU main microcontroller that doesn’t rely on a serial peripheral interface for monitoring.

Description

METHOD OF CHECKING THE FUNCTIONALITY OF A VEHICLE MICROCONTROLLER

TECHNICAL FIELD

This invention relates to a method of checking the functionality of Engine Control Units (ECU), Engine Control Modules (ECM) and such like in vehicles and in particular to checking the functionality of the main microcontroller of an ECM/ECU, (or any microcontroller), such as clock signals provided therewithin.

BACKGROUND OF THE INVENTION

Automotive systems including Engine Control Units (ECU), Engine Control Modules (ECM), are required to be functional safety compliant and conform to Automotive Safety Integrity Level (ASLL) standards such as e.g. ASIL A, B, C and D. The invention relates to a plausibility check for monitoring the main microcontroller (of the ECU/ECM) state of health (SOH) as per 15026262 Part 6, Clause 7. An external monitoring controller or an ASIC performing external watchdog function is recommended for ASLL A, B, C and it is highly recommended for ASIL D as per IS026262. In existing art, both primary and secondary ways of ECM SOH monitoring rely on Serial Peripheral Interface (SPI) messages. There are provided requirements for implementing SPI interface diagnostics ((MOSI, MISO, Serial Clock and Chip select lines getting stuck high or low). This methodology is vulnerable to the possibility of SPI interface failure in real time. If there is SPI failure in real time, in existing art, diagnostics coverage for SOH cannot be provided.

It is an object of the invention to provide improved diagnostics coverage for SOH monitoring of ECU/ECM main microcontroller that doesn't rely on the SPI for SOH monitoring and to provides an improved cost-effective solution.

SUMMARY OF THE INVENTION

In one aspect is provided a method of checking the functionality of a vehicle Electronic Control Unit (ECU) or a microcontroller thereof, comprising the steps of: a) providing a raw crankshaft signal from a crankshaft sensor, said signal having a waveform comprising of a series of rising and falling edges; b) inputting said raw crankshaft signal, or a signal derived therefrom, to said ECU or microcontroller thereof; c) using one or more clock signals provided internally in the ECU or microcontroller thereof, to provide a replicated crankshaft signal from said input crankshaft signal of step b), d) comparing said raw crankshaft signal, or a signal derived therefrom, with said replicated crankshaft signal; e) determining if there is an ECU or ECU microcontroller fault based on said comparison of step d).

if in step e) a fault is determined, there may be implementation o fone or more of the following further step(s) of: indicating a fault; shutting down one or more sub-systems, varying the control of the engine of the vehicle.

Step d) may comprise, in a time window, for each of the two said signals of step d), counting the number of rising and/or falling edges in said time window, and comparing the accumulated counts.

An ECU or ECU microcontroller fault maybe determined if said accumulated counts in said two signals vary by more than a certain threshold number or percentage.

Step d) may comprise comparing the shape of the two signals.

Step c) may comprise using one or more of said clock signals of said ECU or ECU microcontroller to interrogate the input signal so as to read, at each clock interval, the state of the input signal, and to provide said replicated crank signal by outputting on a line/terminal, said read value

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention is now described by way of example with reference to the accompanying drawings in which: - Figure 1 shows a schematic representation of a system to illustrate aspects of the invention, Figure 2 shows the architecture in the microcontroller; Figure 3 illustrates replication of a crank signal - Figure 4 illustrates failure of replication of a crank signal due to clock failure

DESCRIPTION OF THE PREFERRED EMBODIMENTS

In general, the invention performs a plausibility check i.e. so as to monitor main microcontroller (ECU/ECM) state of health, by the process of the microcontroller receiving a crank signal (which may be filtered), replicating the received crank signal to provide a replicated crank signal, and then providing functionality (methodology) to compare the replicated crank signal with the original crank signal or a similarly filtered crank signal/signal derived from the crank signal. If the two compared waveforms or signal vary by more than a certain amount a fault may be flagged.

Preferably the comparison methodology is provided by a unit external from the main microcontroller, which may be provided a bespoke unit, an "external watchdog" if you like.

Examples of the invention may thus use existing hardware resources like an existing monitor controller (external to the main microcontroller) or an Application Specific Integrated Chip ASIC with capability of reading replicated crank signals and performing the comparison.

The replicated crank signal may be regarded as random in pattern as it is based on the engine's RPM So, the functionality or methodology of receiving the replicated crank from the main microcontroller and the comparison, is preferably embodied or implemented using an external "watch dog" unit i.e. external to the main microcontroller (e.g. a monitor microcontroller or ASIC external to the main microcontroller.) So to recap, in aspects of the invention, a plausibility check for main microcontroller SOH is implemented by replicating a crank signal (derived from the original crank signal in the microcontroller (e.g. under the control of microcontroller clock signals) and comparing the replicated crank signal with either the original crank signal or a signal derived therefrom (e.g. filtered crank signal) (provided outside the main controller).

Detailed description of the Invention

Figure 1 shows a schematic representation of a system to illustrate aspects of the invention, Reference numeral 1 represent a main microcontroller of an ECU/ECM 8 who state of health is to be monitored; i.e. by methodology according to the invention, also referred to as "plausibility checking". The microcontroller 1 includes an internal clock 2.

In aspects of the invention the microprocessor receives a crank input signal 3 originating form a crankshaft position sensor input signal 4 from crank sensor.

Such sensors are well known in the art and typically comprise a toothed when which rotates with the crankshaft to generate a signal of rising and falling edges. The input signal 3 (filtered crankshaft signal) may be previously filtered by filter circuit 5. So, the in other words the crank signal may be of frequency input type and the raw crank signal filtered by de-glitch filter.

A replicated crankshaft signal 10 is provided by the main microcontroller from a General-Purpose Input Output (GP10) pin 60 based on the received filtered crank signal 3, to unit 7 which is can be regarded as an "external watchdog". The way this replicated crank signal is provided will be explained later. If the functionality e.g. the clock of the main microcontroller is all good, then the replicated crankshaft signal will have the same general waveform as the filtered crank signal 3 or raw crank signal 4 The external watch dog i.e. unit 7 receives a filtered crank signal 6 from the filter circuit 5 which may be the same as signal 3. The functionality of unit 7 is configured to compare the signal 6 with the replicated crank signal 10. The waveform of the two signals 10 and 6 should be similar (i.e. have the same shape in terms of rising/falling edges). The comparison methodology embodied in the unit 7 may be varied, and the skilled person would be aware of any suitable methodology such as counting the number of rising and or falling edges in a period (time window) for both signals 6 and 10 and comparing these counts.

If the waveforms are not substantially similar then the unit 7 may send out a signal e, g on a line 11 from the safety enable pin which will flag a fault. This may be used on its own or with e.g. with signal 20 from the safety enable pin on the main microcontroller, to control any vehicle systems such as fuel 12 spark 13 or throttle 14 system (e.g. limit parameters or perform a limp home mode control). This may be used in conjunction with output enable signal 22 from the main microcontroller.

Output 21 may also be input to a critical output system 23 which may comprise diagnostic warning indicator. This may be controlled based also on an output 24 from critical output enable The unit 7 has a Timer Channel 1 and Timer Channel 0 (designated with reference numerals 9a and 9b) respectively which receive the signals 6 and 10 respectively The timer channels are capable of sensing frequency input signals (Replicated crank signals from Main and filter circuit.

There may be an SPI interfaces 16a and 16b on unit 7 and the main microcontroller 1 respectively for communication. (used in normal operation and for main SOT-I monitoring e.g. at power-up). As mentioned there may be discrete output signal to control the safety critical sub-systems (Fuel, Spark and Throttle) on Main micro SOH failure. Preferably there is an ability to reset main micro on its SOH failure.

So, to repeat (e.g. if the external watch dog is an ASIC), unit 7 may capturing the edges in both the replicated crank signal and received signal 6), and stores counts in respective registers (that is to say counting the rising and/or falling edges in a time window and storing the counts in respective registers). Unit 7 in any case compares the signals 10 and 6 by e.g. as comparing the count of accumulated crank edges (rising and/or falling) in a time window.

Generating the replicated crank from main The received filtered crank input signal is input to an Enhanced Modular I/0 subsystem (ENHOS) 17 which processes it and performs an output to Direct memory Access (DMA) 18 which provides an output to the output port 19 to output the replicated crank signal 10. The EMIOS and or the DMA are under the control of the clock 2 EMIOS is part of the main microcontroller. The Enhanced Modular Input Output Sub System module (EMIOS) may be replaced with a similar Timer Processing Unit (TPU) in free scale, which intervene in replicated crank signal generation without affecting other customer design requirements.

Figure 2 shows the architecture of the clock 10, EMIOS 17 and DMA 18 in more detail. As per the clock architecture in microcontroller (Cobra55), EMIOS timer module in microcontroller is run by the peripheral clock derived from reference clock of PLL module 50. Output from the clock module 2 is clock signal 51which is input to a global pre-scalar unit 32 of EMIOS 17. Unit 32 is involved in processing the input filtered signal 3 to provide the replicated crank signal along with channel DMA registers 41 (including Transfer Control Descriptors (TCD) comprising TCD20 (42) TCD21 (43) in DMA 19. The functionality of the Channel DMA registers is also under the control and thus influence of the clock signal 51.

The filtered clock signal 3 is input to one of the channels, channel #31 of a series of channels 31 of the EMIOS 17.

In more detail, The EMIOS is used for capturing and replicating the crank signal on GPIO module output pin 60 using DMA module also. With regards the EMIOS configurationLEMIOS may be regarded as a Timer module in Main microcontroller and has it has got multiple timer channels. [Channel from #0 through #31]. So, the EMIOS module is configured to run based on the peripheral clock derived from reference clock of PLL module 50 of clock 2. There is a global pre-scalar 32 for all timer channels for adjusting the clock according to the requirement.

Using pre-scalar settings in the pre-scalar unit, timer channel #31 which receives the filtered crank signal 3 is set e.g. for a clock of 100jtsec pulse (100jtsec is chosen, as passenger car maximum RPM is 8000 and it leads to max 125nsec crank pulse). EMIOSO channel 31 is configured for capturing filtered crank signal rising and falling edges. The term "capturing" means using the timer channel clock (derived from the clock signal 51) to interrogate at that clock frequency the incoming signal to determine whether at a high or low state exists, at the intervals equivalent to this frequency and then to replicated the signal (high/ low states) on the DMA and output it on the port 60. So, on capturing rising or falling edge this channel is configured to trigger DMA.

Regarding DMA configuration; DMA channel 20 is configured to replicate crank on output port 60/pin19. DMA channel 20 is configured to link with two DMA registers (TCD20 and TCD21) using scatter gather mode. A GPIO module may be configured to output the replicated crank signal on port 60 /output port pin 19.

TCD is the Transfer Control Descriptor.

Essentially the clock signal (or a scaled clock signal derived from the clock) is involved in a repetitive interrogation process (i.e. at intervals) to see the state of the incoming signal, e.g. high or low, and then effectively outputs the state on line 60 for the producing the replicated signal. If the clock signal fails, then the replicated crank signal will not mirror the original or filtered crank signal. 4/6 This will be explained in more detail with reference to figures 3 and 4.

Example Algorithm of Replicating Crank Signal The following steps may be taken in an example: a) ENHOSO channel 31 captures crank input critical edge (rising edge).

b) On capturing the critical edge, it triggers DMA channel 20 register (TCD20).

c) Which in-turn drives the output port 60/pin19 with a high state and transfer the control to DMA register (TCD21) d) TCD21 DMA register waits for non-critical crank edge (falling edge) to be captured by ENROSO channel 31.

e) Once it happens, it drives the output port 60/pin 19 with low state and transfer 25 the control to DMA register (TCD20).

f) The above steps a) to e) will be repeated to replicate crank on the output port 60/pin 19.

Figure 3 illustrates this. DMA registers channels /TCD channels #20 and #21 (designated 42 and 43 respectively) are connect or provide outputs to the output port 60/pin19 for providing replicated crank signal further. Arrow Al refers to the action that on capturing the rising crank edge EMIOSO (Channel 0) triggers the DMA channel #20 (TCD #20). This in turn drives the output port to a high state -arrow A2. Conyersly Arrow A3 refers to the action that on capturing the falling crank edge EMIOSO (Channel 0) triggers the DMA channel 421 (TCD #21). This in turn drives the output port to a low state -arrow A4.

If there is peripheral clock failure, there will be EMIOS timer module failure and which in-turn means the replicated crankshaft signal will not mirror the filtered crankshaft signal in form.

Figure 4 shows a common timeline for plots a) b c) d) e) The base clock signal has a short period 100.

Plots (b) and (c) show the Up-Scaled Input Capture Module Clock signal 101 and the UP scaled DMA clock signal 103 respectively which are derived from the base clock signal 51 and have periods 102. At point Jr there is a failure in the base clock signal 51 (plot a).

During each appropriate clock interval (e.g. the upscaled DMA clock signal) the input capture module determines/interrogates the state of the incoming filtered crank signal and outputs the state to the DCM register for outputting the replicated crank signal. After the base clock signal fails so too will the clock signals 101 and 103 Plot d) shows the incoming filtered clock signal 3, Reference numeral 104 refers to rising edges and 105 to falling edges Arrow 106 represents that on detection (after essentially interrogation at intervals using the clock signals 101 and/or 103) of the rising edge by Input Capture Module it generates DMA request to copy data "1" to the output port 60 address.

Thus, the DMA drives the output port (60) to a high (1) state Arrow 107 represents that on detection (after essentially interrogation at intervals using the clock signals 101 and/or 103) of a falling edge by Input Capture Module it generates DMA request to copy data "0" to the appropriate output port address. Thus, the DMA drives the output port (60) to a low (0) state.

Plot e) shows the replicated crank signal 108 obtained when there is a clock failure and plot f) shows the filtered crank signal 109 obtained when there no clock failure, which is also the same waveform i.e. shape as the signal 6, as well as the replicated crank signal 10 when ther eis no clock failure.

Due to failure of the one or more clock signals 51,101,103, the clock used will fail to repeatedly check the state of the incoming filtered signal -effectivly failing to detect the the rising and falling edges of the filtered crank signal and thus request signals will not be generated to the DMA. Parallel with this due to failure of the UP-Scaled DMA clock Signal all the related DMA requests will not get executed. This the replication of the fitered crank signal will fail; the replicated crank signal will be stuck on the last defined state after the failure.

Comparison As mentioned, the waveform of the replicated crank signal 10 is compared with original crank signal 4 (or a signal derived therefrom) such as the filtered crank signal 6. A degree of similarity or difference is ascertained between the two signals. The skilled person would be aware of various ways of performing such a comparison such as using Fourier analysis, FFT, shape comparison techniques, and such like.

A particularly advantageous method may comprise, in a time window, counting and comparing the number of rising and/or falling edges of the replicated crank signal 10 and the filtered crank signal. If the results shows significant differences, i.e. the accumulated count of the rising and/or falling edges for the two signals differ by more than a certain threshold (number or percentage) a fault in the main microcontroller (e,g a clock failure) may be assumed and a fault indicated and or subsequent action taken, such as resetting the main microcontroller or activating safety systems and shutting down sub-systems It may be assumed or ensured in preferred examples that a standard 58X crank wheel is being used in the engine assembly, the engine is running; the engine is not running in limp home mode. Preferably the methodology counts the crank edges for a stipulated time period after detecting the gap in crank wheel pattern.

Example: below is an example of the comparison of (filtered) crank signal with replicated cranks signals.

a) Identify the gap in replicated crank pattern by reading replicated crank signal using Timer channel.

b) Begin counting the replicated crank edges (e.g signals 6 and 10) after detecting synch gap for a stipulated time of e.g. 1 second.

c) Replicated crank critical edges can be configured as either rising or falling.

d) Compare the number of (rising and/or falling edges) accumulated from Main microconvoller's and replicated crank signals.

e) Mismatch in the comparison for e.g. three consecutive times, will lead to latching Main SOH failure.

f) A monitor micro may I reset main microcontroller and shut off safety critical sub-systems (Fuel, Spark and Throttle).

g) Match in comparison will lead to latching Main SOH safe status by External Watch dog (Monitor microcontroller).

The methodology can be easily deployed in an ASIC with capability of reading replicated crank signal and controlling safety sub-systems. At the Power Up, using SPI communication master will turn on trigger (Trigger Crank Edges Accumulation) and configure register (Crank edge accumulator timer register) with the stipulated time (Crank Edges Accumulation Time) for accumulating crank edges. External Watch dog (ASIC) may start accumulating number of replicated crank critical edges from Main microcontroller after detecting the synchronization gap for stipulated time. External Watch dog (ASIC) may start accumulating number of replicated crank critical edges from ASIC (Delphi LSD) after detecting the synchronization gap for stipulated time. The accumulated replicated crank edges from Main microcontroller and ASIC (Delphi LSD) can be compared and matched (Compare and Match register). Any mismatch in a compare and match register (main SOH failure) will lead to turning on Functional Safety Enable pin, provided the ASIC (Delphi LSD) generating replicated crank signal is in safe state. This in-turn can reset main micro and turn off safety critical sub-systems. The term ECU/ECM may be interchangeable.

LSD: Low Side Drive TPU: Timer Processing Unit NTOSI: Master out Slave in NIISO: Master in Slave Out PLL: Phase Locked Loop ENHOS: Enhanced Modular Input Output Subsystem GPIO: General Purpose Input Output DMA: Direct Memory Access

Claims

CLAIMS1. A method of checking the functionality of a vehicle Electronic Control Unit (ECU) or a microcontroller thereof, comprising the steps of a) providing a raw crankshaft signal from a crankshaft sensor, said signal having a waveform comprising of a series of rising and falling edges; b) inputting said raw crankshaft signal, or a signal derived therefrom, to said ECU or microcontroller thereof; c) using one or more clock signals provided internally in the ECU or microcontroller thereof, to provide a replicated crankshaft signal from said input crankshaft signal of step b); d) comparing said raw crankshaft signal, or a signal derived therefrom, with said replicated crankshaft signal; e) determining if there is an ECU or ECU microcontroller fault based on said comparison of step d).
2. A method as claimed in claim I wherein if in step e) a fault is determined, implementing one or more of the following further step(s) of: indicating a fault; shutting down one or more sub-systems, varying the control of the engine of the 20 vehicle.
3. A method as claimed in claims 1 or 2 where step d) comprises, in a time window, for each of the two said signals of step d), counting the number of rising and/or falling edges in said time window, and comparing the accumulated counts.
4. A method as claimed in claim 3 wherein an ECU or ECU microcontroller fault is determined if said accumulated counts in said two signals vary by more than a certain threshold number or percentage
5. A method as claimed in claim 1 to 2 wherein step d) comprises comparing the shape of the two signals.
6. A method as claimed in claims 1 to 5 where step c) comprises using one or more of said clock signals of said ECU or ECU microcontroller to interrogate the input signal so as to read, at each clock interval, the state of the input signal, and to provide said replicated crank signal by outputting on a line/terminal, said read 5 value.