JP2017004079A - Failure simulation apparatus and failure simulation method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To eliminate error accumulation and evaluate system operation during an element failure in a long-time simulation on a closed loop system in a control system.SOLUTION: A failure simulation apparatus comprises: a simulation unit including an ECU process and a circuit process including a fault element; a simulation control unit transmitting a failure injection command to the simulation unit on the basis of a preset failure condition; and a data management unit switching over between data transmission/reception and non-data transmission/reception to/from the ECU process on the basis of the failure injection command from the simulation control unit.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a failure simulation apparatus and a failure simulation method, and is preferably applied to a failure simulation apparatus and a failure simulation method for evaluating the influence of a failure on a control target.

  In the automobile industry, application of functional safety standard ISO 26262 and standard compliance are becoming essential in the development of software for electrical / electronic components and microcomputers mounted on them. Therefore, automakers and suppliers are developing development environments to satisfy the requirements of this standard.

  For example, in the standard ISO26262 Part4 8.4.2 for hardware and software integration and testing, verification by an actual machine or simulation is a requirement for all failures of all elements mounted on a printed circuit board. In a failure injection test using an actual machine, it is not easy to deal with a mode in which an ECU (Electric Control Unit) is damaged at one time or a mode in which reproducibility is lost due to accumulation of electrical damage. In addition, since the experiment exceeds 1000 items, the influence on man-hour, period, and cost is not small. Under such circumstances, a fault injection test method using a virtual ECU based on simulation has been studied.

  For example, Patent Document 1 discloses a method for fault analysis using simulation (Method for Fault Analysis Using Simulation) for open circuit and short circuit faults of electronic components. In the simulation method of Patent Document 1, a model of a faulty ECU circuit is created by connecting variable resistors in series or in parallel. Then, the circuit topology is changed for each failure, and a simulation of the failed ECU circuit is executed.

US Patent Application Publication No. 2006/0041417

  In the fault simulation method described in Patent Document 1, in the open loop circuit simulation without feedback of sensor information, the fault effect can be reproduced within a certain error range. However, in a closed-loop control system, there is a known problem that sensor information feedback errors accumulate as time elapses. In particular, driving simulations of automobiles require evaluation in units of several seconds to several tens of seconds, which requires an enormous number of execution steps (hundreds of millions of steps) for electronic circuits, and error accumulation leads to system malfunction. There is also. For this reason, there has been a problem that the system operation at the time of failure cannot be verified due to erroneous failure before the conditions for failure injection are satisfied.

  The present invention has been made in consideration of the above points, and in a long-time simulation targeting a closed loop system of a control system, a failure that can eliminate error accumulation and evaluate system operation at the time of element failure A simulation apparatus and a failure simulation method are proposed.

  In order to solve this problem, in the present invention, a simulation unit comprising an ECU process and a circuit process including a faulty element, a simulation control unit for sending a fault injection command to the simulation unit based on a preset fault condition, A failure simulation apparatus is provided, comprising: a data management unit that switches presence / absence of data transmission / reception to / from the ECU process based on a failure injection command from a simulation control unit.

  In order to solve such a problem, in the present invention, a simulation unit including a circuit process including an ECU process and a faulty element, a simulation control unit for controlling the simulation unit, and data for switching presence / absence of data transmission / reception to / from the ECU process A failure simulation method in a failure simulation device comprising: a step of sending a failure injection command to the simulation unit based on a preset failure condition; and the data management unit, And a step of switching the presence / absence of data transmission / reception to / from the ECU process based on a fault injection command from the simulation control unit.

  According to the present invention, it is possible to evaluate system operation at the time of element failure by eliminating error accumulation in a long-time simulation for a closed loop system of a control system.

It is a block diagram which shows the structure of the failure simulation system which concerns on the 1st Embodiment of this invention. It is an example of the user interface which performs the setting of the data management part concerning the embodiment. It is a conceptual diagram which shows the example of preparation of the element used for the fault injection | pouring concerning the embodiment. It is a chart which shows an example of the failure injection conditions concerning the embodiment. It is an example of the flowchart which shows the failure simulation process concerning the embodiment. It is an example of the flowchart which shows the flow of the data in the data management part concerning the embodiment. It is an example of the flowchart which shows the flow of the data in the data management part which concerns on the 2nd Embodiment of this invention. It is a display example of a screen screen showing a simulation error according to the embodiment.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

(1) First Embodiment FIG. 1 is a block diagram showing a configuration of a failure simulation system according to the present embodiment. In the following, simulation is performed to inject electrical faults such as open circuit, short circuit, and drift into the electronic components that make up the on-board electronic control unit (hereinafter referred to as ECU: Electric Control Unit), and to evaluate the impact of the fault on the controlled vehicle plant. Although the present invention is applied to a method, the present invention is not limited to such an example and can be applied to a control object other than a vehicle plant.

  As shown in FIG. 1, the failure simulation system mainly includes a main storage unit 100, a CPU 115, an external storage device 116, an input / output device 118, and the like.

  The input / output device 118 performs input of simulation conditions and screen output of simulation results. The external storage device 116 stores the failure condition 117 input from the input / output device 118. The CPU 115 performs calculations necessary for the simulation.

  The main storage unit 100 stores a simulation unit 101, a simulation control unit 114, and a data management unit 113.

  The simulation unit 101 includes an ECU (Engine Control Unit) process 102, an inverter process 107, a motor process 109, a current monitor circuit process 110, and a simulation control unit 114.

  The ECU process 102 executes the control program 104 to generate a PWM (Pulse Width Modulation) signal that drives the inverter. The inverter process 107 turns on / off an FET (Field Effect Transistor) based on the PWM signal to generate a voltage signal for driving the motor. The motor process 109 calculates a generated torque and a rotation angle based on the drive signal. The current monitor circuit process 110 detects and scales the motor drive current from the shunt resistance. The current monitor circuit process 110 incorporates a fault element 112 that can inject an open / short fault. With each of these processes, an electric power steering system (EPS) fault injection simulation can be executed. The simulation control unit 114 controls a series of processes of the simulation unit.

  FIG. 2 shows an example of a user interface for setting the data storage unit. The user first inputs a circuit diagram 200 in which wiring between elements is defined. Then, a table 201 defining a failure injection trigger signal and a signal for performing data replacement is created. The user selects the SET 202 after creating the table 201.

  In the table 201, the fault injection trigger signal (Type: Trigger) is set as FLT-TRG existing on the circuit diagram, and the signal for replacing data (Type: Replace) is set as the three-phase current estimated value (IU / I V / I-W) is set, and the value after replacement is the true value of the three-phase current (Ideal-IU / Ideal-IV / Ideal-IW).

  The three-phase current estimation value is a value calculated by the control program 104 in the ECU process 102. For this reason, it is necessary to construct an environment accessible from the outside of the control program 104.

  After creating the table 201, the user can start the simulation by selecting the RUN 203.

  FIG. 3 is an example of creating an element used for fault injection. An element model for fault injection defines an operation by a hardware description language. Here, a description example 300 in the VHDL-AMS language is shown.

  The element used for fault injection shown in FIG. 3 is described so that the resistance value can be switched between a variable Ron and a variable Roff by an external control input (S_IN). An element model 301 for open failure can be created by connecting this element to a normal circuit element in series, and an element model 302 for short-circuit failure can be created by connecting in parallel. At this time, it is necessary to set the variable Ron to a very small value near 0Ω and the variable Roff to a large value of several MΩ. The occurrence of a failure can be simulated when the element model for an open fault is S_IN = OFF, and the element model for a short-circuit fault is S_IN = ON.

  FIG. 4 shows a vehicle behavior condition 400 that is an example of the fault injection condition. As shown in FIG. 4, the failure element 401 is an element used for failure injection, and examples thereof include R (resistance), L (coil), and C (capacitor). When these failure elements satisfy the respective vehicle behavior conditions, ie, speed 402, yaw rate 403, and brake 404, a failure is injected into the failure element to cause a failure.

  In FIG. 4, when the vehicle speed reaches 40 km / h, yaw rate 10 deg / s, and brake 0.2G, a failure is injected into the failure element R001. Further, when the vehicle speed reaches 10 km / h, the yaw rate 5 deg / s, and the brake 0.1G, a failure is injected into the failure element L001. Further, when the vehicle speed reaches 40 km / h, yaw rate 1 deg / s, and brake 0.3G, a failure is injected into the failure element C200.

  In FIG. 4, the fault injection condition is the vehicle behavior. However, the present invention is not limited to this example. When the driver operation such as steering, accelerator, brake, etc. reaches a predetermined behavior, or the distance, relative speed, etc. A fault may be injected when the environment becomes a predetermined condition.

  FIG. 5 is an example of a flowchart showing a failure simulation process. As described above, when the user selects the RUN 203 that instructs the start of simulation, the simulation control unit 114 performs simulation control.

  As shown in FIG. 5, the simulation control unit 114 first reads a failure condition set by the user (S101) and starts a simulation (S102).

  The simulation control unit 114 transmits a one-step execution command to the simulation unit 101 (S103).

  The simulation unit 101 receives an execution command from the simulation control unit 114 (S107), executes a one-step simulation (S108), and returns the execution result to the simulation control unit 114 (S109).

  The simulation control unit 114 receives the execution result from the simulation unit 101 (S104), compares with the failure condition set by the user (S105), and determines whether or not the failure condition is satisfied (S106).

  In Step S106, Steps S103 to S105 are repeated until it is determined that the failure condition is satisfied. If it is determined that the failure condition is satisfied, the failure injection process after Step S110 is executed.

  In the fault injection process, the simulation control unit 114 sets the fault information in the fault injection element (S110), and simultaneously transmits a data transmission presence / absence switching command to the data management unit 113 (S111).

  Then, the data management unit 113 receives the switching command transmitted in step S111 (S115), stops data transmission (S116), and returns a notification of completion of switching processing to the simulation control unit 114 (S117).

  When the simulation control unit 114 confirms the completion of the data transmission stop, the simulation control unit 114 executes a simulation of all subsequent steps (S112). Then, after the simulation is completed (S113), the simulation control unit 114 outputs the simulation result to the screen (S114), and ends the series of failure simulation processing.

  FIG. 6 is an example of a flowchart showing the flow of data in the data management unit 113 in the present embodiment.

  As shown in FIG. 6, when the simulation unit 101 starts simulation, first, the ECU process 102 generates a PWM signal based on the control program 104 (S201).

  Next, the simulation part 101 produces | generates the motor drive signal which drives a motor from the PWM signal produced | generated by step S201 by the inverter process 107 (S202). In step S202, the simulation unit 101 transmits the true value data of the three-phase current to the data management unit 113.

  The simulation unit 101 calculates a motor operation such as a generated torque and a rotation angle from the motor drive signal generated in step S202 by the motor process 109 (S203), and converts the motor from the motor to the shunt resistor by the current monitor circuit process 110. The flowing current is detected (S204).

  Then, the ECU process 102 captures the current value detected by the current monitor circuit process 110 by the A / D converter (S205), and performs the estimation process of the three-phase current value by executing the control program 104 (S206).

  Here, when the data management unit 113 receives the true value data of the three-phase current generated by the inverter process (S208), the data management unit 113 determines whether there is a failure injection trigger (S209).

  If it is determined in step S209 that there is no failure injection trigger, the data management unit 113 transmits the true value data to the ECU process 102 and overwrites it (S210). On the other hand, if it is determined that there is a failure injection trigger, the data management unit 113 ends the process without transmitting true value data. And the simulation part 101 determines whether the whole simulation was complete | finished (S207), and performs said series of processes until a simulation is complete | finished.

  According to the present embodiment, in a long-time simulation targeting a closed loop system of a control system including interactions such as feedback of sensor information and actuation based on the feedback, error accumulation is eliminated and system operation at the time of element failure is performed. Can be evaluated.

(2) Second Embodiment In the first embodiment, the data management unit 113 accesses a three-phase current estimated value in the control program 104 until there is a fault injection trigger, and overwrites the true value. I was taking it. Here, since a theoretically detected value having no error can be calculated from the true value, the data detected by the A / D converter 106 is used instead of overwriting the estimated three-phase current value of the control program 104. It is also possible to prevent error accumulation by replacing with. In this case, the theoretical detection value can be directly compared with the detection value of the current monitor circuit. For this reason, the data management unit 113 can calculate an instantaneous error amount and an accumulated error amount by calculating a difference between the two at any time during execution of the simulation.

  FIG. 7 is an example of a flowchart showing a data flow of the data management unit 113 in the present embodiment. With reference to FIG. 7, the steps changed from the first embodiment will be described in detail.

  As shown in FIG. 7, when the simulation unit 101 starts simulation, first, the ECU process 102 generates a PWM signal based on the control program 104 (S301).

  Next, the simulation part 101 produces | generates the motor drive signal which drives a motor from the PWM signal produced | generated by step S201 by the inverter process 107 (S302). In step S302, the simulation unit 101 transmits the true value data of the three-phase current to the data management unit 113.

  The simulation unit 101 calculates a motor operation such as a generated torque and a rotation angle from the motor drive signal generated in step S202 by the motor process 109 (S303), and converts the motor from the motor to the shunt resistor by the current monitor circuit process 110. The flowing current is detected (S304).

  Then, the ECU process 102 captures the current value detected by the current monitor circuit process 110 by the A / D converter (S305), and performs the estimation process of the three-phase current value by executing the control program 104 (S306).

  Here, the data management unit 113 receives the true value data of the three-phase current generated by the inverter process, and calculates the theoretical detection value from the true value of the three-phase current (S308).

  Further, the current monitor circuit process 110 does not directly transmit the detected value to the ECU process 102 but transmits it to the data management unit 113 (S309).

  Then, current value data is transmitted from the data management unit 113 to the A / D converter 106 of the ECU process 102 (S310). At this time, when there is no failure injection command (no failure trigger), the theoretical detection value is transmitted, and when there is a failure injection command (with a failure trigger), the detection value of the current monitor circuit is transmitted.

  And the simulation part 101 determines whether the whole simulation was complete | finished (S307), and performs said series of processes until a simulation is complete | finished.

  FIG. 8 shows a display example of error information obtained by executing the processing shown in FIG. In the present embodiment, it is possible to execute a simulation for both a theoretical detection value having no error and a detection value including a circuit error. For this reason, when a desired parameter 702 such as a motor torque is selected by the user, a graph 701 showing the instantaneous error amount 703, the accumulated error amount 704, and the preset allowable error amount 705 is displayed. The user can easily confirm the effect of error reduction using the graph 701.

DESCRIPTION OF SYMBOLS 100 Main memory part 101 Simulation part 102 ECU process 104 Control program 106 A / D converter 107 Inverter process 109 Motor process 110 Current monitor circuit process 112 Failure element 113 Data management part 114 Simulation control part 116 External storage device 117 Failure condition 118 Input Output device

Claims (7)

A simulation unit comprising an ECU process and a circuit process including a faulty element;
A simulation control unit that sends a fault injection command to the simulation unit based on preset failure conditions;
Based on a fault injection command from the simulation control unit, a data management unit that switches presence / absence of data transmission / reception to the ECU process;
A failure simulation apparatus comprising: The simulation controller
The failure simulation apparatus according to claim 1, wherein the failure injection command is sent to the simulation unit when a failure element associated with the behavior of the vehicle satisfies a predetermined failure condition. The data management unit
Holds true and detected values,
When there is no fault injection command from the simulation control unit, the estimated current value calculated based on the detected value by the ECU process is overwritten with a true value,
The fault simulation apparatus according to claim 1, wherein when there is a fault injection command from the simulation control unit, the estimated current value is not overwritten with a true value. The data management unit
Holds true and detected values,
When there is no fault injection command from the simulation control unit, a signal obtained by scaling a true value is generated and transmitted to the A / D converter so that it can be fetched from the A / D converter in the ECU process. And
When there is a fault injection command from the simulation control unit, the detection value calculated in the current monitor circuit process is transmitted to the A / D converter,
The fault simulation apparatus according to claim 1, wherein data transmission to the ECU process is switched before and after fault injection. The data management unit
Calculate the simulation error amount from the difference between the true value and the detected value and output it to the monitor.
The fault simulation apparatus according to claim 4, wherein an alert is output when the error exceeds a certain amount. The simulation unit
An ECU process for generating a PWM signal based on a control program;
An inverter process for generating a motor drive signal from the PWM signal;
A motor process for calculating torque, rotation speed and driving current of the motor;
A current monitor circuit process for detecting the drive current of the motor;
Have
The ECU process takes the detection value of the current monitor circuit from the A / D converter, estimates the phase current in the control program, and generates the PWM signal, thereby simulating the operation of the electric power steering system The failure simulation apparatus according to claim 1, wherein: A fault simulation in a fault simulation apparatus comprising: a simulation unit comprising an ECU process and a circuit process including a faulty element; a simulation control unit for controlling the simulation unit; and a data management unit for switching presence / absence of data transmission / reception to / from the ECU process. A method,
The simulation control unit sending a failure injection command to the simulation unit based on a preset failure condition;
The data management unit switching the presence or absence of data transmission and reception to the ECU process based on a fault injection command from the simulation control unit;
A failure simulation method comprising:

Images