System with self-test function and procedure for verifying the self-test function of a system

Abstract

System (2, 32) with self-test function, comprising: at least one electrical or electronic system component (4) having at least one technical function, a fault simulation unit (10) integrated in the system (2, 32), a self-test unit (6) integrated in the system (2, 32), and a verification control unit (12) integrated in the system (2, 32), wherein the at least one system component (4) is coupled to the fault simulation unit (10), wherein the fault simulation unit (10) is configured to influence the operation of the system component (4) such that the at least one technical function is selectively impaired, wherein the fault simulation unit (10) comprises at least one electronically controllable fault simulation cell (24, 76) which is integrated in each of the at least one system component (4) and is configured to selectively control a line (16,22) to open the relevant system component (4) or to selectively close a connection of the relevant line (16, 22) with another line (16, 22) or an additional electronic component, wherein the self-test unit (6) is configured to monitor operating parameters of the system component (4) and to generate a warning signal indicating an impairment of the respective at least one technical function, wherein the verification control unit (12) is configured to compare the warning signals generated by the self-test unit (6) with expected warning signals depending on the impaired technical functions, and wherein a maintenance message is issued if the generated warning signal does not match an expected warning signal.

Description

TECHNICAL AREA

[0001] The invention relates to a system with a self-testing function and a method for verifying the self-testing function of a system. BACKGROUND OF THE INVENTION

[0002] Aircraft and other means of transport or vehicles typically have extensive electronic equipment, often implemented as line-replaceable items (LRIs) or line-replaceable units (LRUs). For the proper operation of the aircraft, it is advisable to equip such units with a self-test function to detect and rectify any malfunctions promptly. This self-test function, also known as a built-in test (BIT), can be performed before the aircraft is put into operation or at regular intervals. Verification of the self-test function is usually carried out under laboratory conditions after the unit to be tested has been implemented. SUMMARY OF THE INVENTION

[0003] It is theoretically conceivable that even such a self-testing function could be limited by unforeseen conditions. The object of the invention is therefore to propose a system with a self-testing function, wherein the self-testing function is also verifiable.

[0004] The problem is solved by a system with a self-testing function having the features of independent claim 1. Advantageous embodiments and further developments can be found in the dependent claims and the following description.

[0005] A system with a self-testing function is proposed, comprising at least one system component possessing at least one technical function, a fault simulation unit integrated into the system, a self-testing unit integrated into the system, and a verification control unit integrated into the system, wherein the at least one system component is coupled to the fault simulation unit, wherein the fault simulation unit is configured to influence the operation of the system component in such a way that the at least one technical function is selectively impaired, wherein the self-testing unit is configured to monitor operating parameters of the system component and to generate a warning signal indicating an impairment of the respective at least one technical function, and wherein the verification control unit is configured toThe verification control unit compares the warning signals generated by the self-test unit with expected warning signals depending on the impaired technical functions. Furthermore, the verification control unit can be configured to determine deviations from an expected result based on this comparison. These deviations could indicate a malfunction of the self-test unit.

[0006] In particular, several system components may be present, which are interconnected or interact with each other in some other way to form the system. The system to be tested can be of any nature and may include mechanical as well as electronic system components. However, a primary focus is on the self-testing function of electronic system components, as explained below. In a general embodiment, however, no such restriction is initially imposed.

[0007] A key component is the fault simulation unit, which can selectively restrict individual technical functions of specific system components, causing the affected component to deviate from its intended operating range. This event should be detected by the self-test unit, which then generates a corresponding warning signal. The self-test unit therefore monitors relevant operating parameters associated with the affected technical functions. This can be a separate component, an integrated component coupled to at least one system component, or an algorithm integrated into the system. The self-test unit provides information about normal operating behavior when technical functions are functioning correctly.By comparing an operating parameter resulting from the technical impairment with a normal value of the operating parameter in question, a deviating operating behavior can be determined, which leads to the generation of a warning signal.

[0008] The verification control unit is designed to compare the warning signals generated by the self-test unit with the expected warning signals. If technical functions are selectively impaired in such a way that an operating range is exceeded and a warning signal should be generated, the verification control unit can verify the generation of the warning signal. If it is not generated, a malfunction in the self-test unit is present.

[0009] The fault simulation unit, the self-test unit, and the verification control unit are interconnected in such a way that, for example, the fault simulation unit can sequentially impair several different technical functions and inform the verification control unit that such a limitation exists. The verification control unit is then able to receive and analyze a corresponding warning signal. This reception can occur directly or indirectly, for example, via a monitor unit. It is conceivable that the verification control unit could correlate individual warning signals, impairments of technical functions, and received warning signals in order to subsequently store, transmit, or display the resulting state matrix.

[0010] In this context, a warning signal could encompass more than just a warning itself. In fact, the warning signal could include information about technical limitations, indicating which technical function is restricted. This information could also be examined by the verification control unit to determine whether correct warning signals are being issued, signals that can be clearly attributed to the respective technical limitation.

[0011] Overall, the system according to the invention is very advantageous due to the verifiable self-test function in the self-test unit. The self-test unit can be reliably tested thanks to the very simple possibility of simulating various faults. It is therefore advantageous to make all technical functions specified in a specification verifiable. This results in several advantages: Verification can encompass the complete functionality of the system in question. For example, it would be economically feasible to increase the already high number of transistors in complex electronic systems and verify all functional BIT ("Built-In Test") requirements in detail. This increases confidence in safety-critical systems.

[0012] The reliability of a self-verification function can be increased by its simplicity. Conversely, the degree of reliability of a self-verification function could decrease with the number of assumptions underlying the verification and the number of logical inferences required. The system according to the invention can significantly increase reliability through error simulation that is as realistic as possible.

[0013] The system according to the invention could be suitable as a fail-safe system. A failure of the operational hardware can be detected by the self-test function. A failure of the self-test function can also be verified using the fault simulation unit and the verification control unit. A failure or faulty activation of a fault simulation is detected by the self-test function. The fault simulation and the self-test function can thus monitor each other. The principle of mutual monitoring applies here.

[0014] The system according to the invention remains flexible in its application. The fault simulations can be controlled and monitored via a processor, as explained further below. This allows the verification process to be modified even subsequently, e.g., during the operational phase of the system, using software executed in the processor.

[0015] Furthermore, the system according to the invention is cost-effective. It is significantly more cost-effective because no additional system needs to be sacrificed for verification purposes. The actual hardware, through the integration of the fault simulation unit, self-test unit, and verification control unit, could lead to marginally higher costs for the individual system.

[0016] Impairment of a technical function is understood to mean that a system component does not perform its intended function as expected. This could occur, for example, if a component of the system is disrupted by applying incorrect input variables, interrupting or disrupting a logic circuit, or altering an output variable, such as by changing electrical parameters, or by similar measures.

[0017] In principle, several requirements can be placed on the system according to the invention, such as how the aforementioned units interact to achieve verification of the self-test function. The selective impairment of a technical function by the fault simulation unit should be as realistic as possible. Several realistic impairments that could actually occur during the operation of a system should therefore be realistically implementable by the fault simulation unit. These should also be implementable under real operating conditions, as will become clearer below in connection with a stimulation unit. Furthermore, a systematic integration of impairments of technical functions suitable for performing a complete self-test of the system is advantageous.

[0018] The fault simulation unit should be implemented in such a way that no side effects occur that go beyond the intended impairment of a technical function. It is therefore specifically designed—in other words, preferably configured—to simulate various impairments, particularly sequentially. When the fault simulation unit is deactivated, there should be no impairment whatsoever to the system. This can be supplemented by an isolation unit described below. The fault simulation unit is specifically designed to remain permanently deactivated during actual system operation.

[0019] In a particularly preferred embodiment, the at least one system component is designed as an electrical or electronic system component. These can comprise different types of system components, each electrically connected to other system components or other systems and interacting with them in a predetermined manner. Besides simpler electrical system components such as resistors or electrical conductors, simple electronic system components such as inductors, capacitors, transistor circuits, rectifiers, amplifier circuits, and the like are also conceivable. However, more complex integrated circuits are also conceivable, ranging from microcontrollers to complex processors, or circuits with integrated microcontrollers and processors.Electrical or electronic system components to be tested by the self-test unit can each be selectively controlled in order to selectively interrupt individual electrical connections or to establish electrical connections not normally intended.

[0020] In a preferred embodiment, the at least one system component comprises digital electronics. These digital electronics can be implemented, in particular, as a complex integrated circuit and especially as a processor unit or a computing unit. The digital electronics are based on a logic circuit with binary state patterns or sequences. In this case, the fault simulation unit can be configured to influence individual sections of the digital electronics in such a way that the state patterns or sequences of binary signals are modified. This can be achieved, among other things, by influencing logic gates, influencing an electrical output of logic gates, or by other measures. Additional components, in particular transistors, can be integrated into the system to implement the fault simulation unit.The number of transistors in a processor or computing unit is only marginally increased. The additional components serve to selectively and controllably impair signal flows or to supply power to adjacent components.

[0021] In an advantageous embodiment, the fault simulation unit comprises at least one electronically controllable fault simulation cell, which is integrated into the at least one system component and is configured to selectively open a line of the respective system component or to selectively close a connection of the respective line to another line or an additional electronic component. The actual, selective opening of a line can be used to interrupt a signal line, a power line, or the like, so that the self-test unit can react by detecting a missing signal or other impairment. Furthermore, a fault simulation cell could also establish a connection that is not normally provided for. For example, it could simulate a bridging of two adjacent terminals of an integrated circuit or the like.In a simple case, the fault simulation cell includes an electrical switch. In a preferred embodiment, this could be implemented as an electronic switch, particularly one based on an AND gate. Complex systems can include a whole series of fault simulation cells that can selectively impair several technical functions to implement a complex self-test function.

[0022] For example, the other wire could be a ground wire or a connection to logic level "1". Detecting a connection between a system component wire and a ground wire could indicate insufficient electrical insulation, which could stem from a mechanical fault.

[0023] Furthermore, in an advantageous embodiment, the additional electronic component could be selected from a group of electronic components comprising a resistor, a capacitor, an inductor, analog filters, digital filters, logic gates, jumper lines, voltage sources, or combinations thereof. Such electronic components can, in particular, interrupt, restrict, or modify electrical connections. This allows signal disturbances to be simulated, for example, representing a typical, conceivable fault.

[0024] In a particularly advantageous embodiment, the fault simulation unit comprises an external control unit and an internal control unit connectable to the external control unit, wherein the at least one fault simulation cell is arranged in the internal control unit and is controllable by the external control unit, and wherein the at least one fault simulation cell and / or the internal control unit are configured such that the at least one fault simulation cell is not switched when not connected to the external control unit. The division into an external control unit and an internal control unit is particularly advantageous when implementing a larger number of fault simulation cells. The aforementioned fault simulation cells are assigned to the internal control unit and are connected, for example, by control lines that terminate in a terminal that can be connected to a corresponding terminal of the external control unit.The external control unit, on the other hand, could be designed differently depending on the complexity of the system under test. For example, the external control unit could have individual buttons, switches, or similar devices that can be connected to the control lines. A user could then selectively activate individual fault simulation cells by pressing switches or buttons, thereby simulating corresponding faults. Alternatively, particularly in more complex systems, the external control unit could include a processor, a computing unit, or similar device designed to automatically execute a specific test program. Following a predefined scheme, which might be specified by a system approval regulation, corresponding control commands would be sent to the internal control unit. There, the individual fault simulation cells could be activated based on these control commands.The key advantage of this subdivision is that the system cannot actuate the switching units without the external control unit. Unactuated fault simulation cells remain in their normal operating state, and the system can operate conventionally without the external control unit. The external control unit can be controlled by, integrated into, or implemented by the verification control unit.

[0025] Preferably, at least one fault simulation cell incorporates an electronic switch. Unlike electromechanical switches, electronic switches are implemented purely electronically and therefore do not suffer from the disadvantages of electromechanical switches. The electronic switches can be implemented, for example, using transistors, diodes, thyristors, and other semiconductor circuits. The system, particularly when implemented as a digital circuit, could be fully embedded within the integrated circuit to enable improved self-testing functionality by allowing verification of the self-test function itself. Consequently, the fault simulation cells can be directly considered during the system design and development, eliminating the need for subsequent modifications to a newly developed system to implement self-test verification.With sensible design and planning of a system, especially an electronic one, significant cost and effort savings can be achieved, and the verification of the self-test function can be made possible.

[0026] Advantageously, the system can also include at least one isolation unit for the on-demand electrical isolation of one of the at least one system components under test from other system components. To prevent unexpected behavior from various system components, it may be useful to electrically isolate individual system components from other system components during testing. For example, the self-test unit could test the properties of the relevant system component during a specific test procedure, while the other system components are isolated from it. Once the parameters of the relevant system component have been successfully tested, the isolation can be removed. This returns the system component to its normal operating state. This process could be repeated successively for all other system components.

[0027] Preferably, the system further comprises a stimulation unit that can be connected to the at least one system component and is configured to simulate input variables for that component. The stimulation unit is designed, in particular, to provide an electrically isolated system component with specific input variables. If the system component interacts with other system components during normal operation and exhibits behavior that depends on the input variables, a self-test process can only be performed if the system component is supplied with the correct input variables. These input variables can be of any nature and depend entirely on the type of system. In addition to voltages, signals, electrical states, and the like, data can, of course, also be provided.The stimulation unit is therefore calibrated to the system and controlled by the fault simulation unit or the verification control unit. The operation of the system component in question then no longer differs from its operational operation.

[0028] In a particularly preferred embodiment, the system further comprises a monitoring unit configured to record a response from the system. For example, the monitoring unit can be configured to record a response from the system to a stimulus delivered by the stimulation unit. It can also be configured to record a response from the system to a simulated fault. Preferably, the monitoring unit is configured to compare the response with an expected response and issue a message as soon as the response deviates from the expected response. This allows for the detection of a fault in the stimulation unit or in the system itself. The monitoring unit can be implemented separately or integrated into the self-test unit and / or the verification control unit.

[0029] The invention further relates to a method for checking self-test functions in a system, comprising the steps of influencing the operation of at least one system component by means of a fault simulation unit integrated in the system, such that a technical function is selectively impaired, monitoring operating parameters of the system component by means of a self-test unit integrated in the system and generating a warning signal indicating an impairment of the respective technical function, comparing the generated warning signal with expected warning signals depending on the impaired technical functions by means of a verification control unit, and issuing a maintenance notice if the generated warning signal does not match an expected warning signal.

[0030] Preferably, influencing the operation includes selectively opening a line of the system component in question or selectively closing a connection of the line in question with another line or an additional electronic component.

[0031] In an advantageous embodiment, the method may further include the step of electrically isolating the system component in question, at least while influencing its operation.

[0032] Particularly preferably, the method further features the simulation of input variables for the system component in question by means of a stimulation unit that can be connected to the at least one system component.

[0033] The invention further relates to an aircraft with at least one of the aforementioned systems. In particular, the system can be an electronic system. A possible hierarchical organization of the hardware in an aircraft can comprise a) the system itself, i.e., the aircraft, b) a subsystem, such as avionics, c) a Line Replaceable Item (LRI), d) a Shop Replaceable Item (SRI), and e) an electronic component, e.g., an integrated circuit. Often, electronic devices such as navigation computers or transponders in an aircraft are housed in enclosures and can be directly replaced in the event of a defect; these are therefore called Line Replaceable Items (LRIs). Such an LRI can consist of individual modules, which are called Shop Replaceable Items (SRIs), since defective modules can or should only be replaced in a workshop. Typically, an SRI could be a sub-functional group of the LRI.The SRIs typically communicate with each other via a system bus, which is further described below in . Fig. 3 is shown. This can be applied to all levels. List of characters

[0034] Further features, advantages, and applications of the present invention will become apparent from the following description of the exemplary embodiments and the figures. All features described and / or illustrated, individually and in any combination, constitute the subject matter of the invention, irrespective of their composition in the individual claims or their cross-references. In the figures, the same reference numerals denote identical or similar objects. Fig. Figure 1 shows a schematic, block-based representation of a system according to the invention. Fig. 2a and Fig. 2b demonstrates a principle of fault simulation according to the state of the art ( Fig. 2a) and according to the invention ( Fig. 2b). Fig. Figure 3 shows another system in a schematic representation. Fig. 4a to Fig. Figure 4b shows two examples of how a technical function of a system component can be influenced. Fig. 5a to Fig. Figure 5d shows several examples of how to control a fault simulation unit. Fig. 6a to Fig. Section 6c shows further examples of error simulation in a system. Fig. Figure 7 shows an aircraft. DETAILED PRESENTATION OF EXEMPLARY EXECUTION FORMS

[0035] Fig. Figure 1 shows a system in a very schematic way. 2 with a self-test function. It should be noted that this description is intended only to illustrate the general structure of the system according to the invention. 2It is intended to serve a specific purpose and is therefore not very detailed. Various details of the system are illustrated in the following figures.

[0036] The system 2 It features a number of system components 4 each of which can perform at least one technical function. Examples of system components include: 4 functionally coupled to each other, so that they contribute to the realization of the system 2 can interact with each other. In addition, the system indicates 2 a self-testing unit 6 on, which are connected to the system components 4 is connected. This connection can, for example, be an electrical connection with signal and / or voltage-carrying lines of the system components. 4 include the self-test unit 6 This should enable it to perform certain technical functions of the system components. 4to monitor or check in order to assess whether the relevant system parameters are within an expected range. The self-test unit 6 This could, for example, result in a warning signal at the first exit. 8 provide information that indicates whether a particular operating parameter deviates from expected behavior.

[0037] For verification of the self-test unit 6 It also includes a fault simulation unit. 10 as well as a verification control unit 12 planned. The fault simulation unit 10 is with the individual system components 4 coupled and trained to control the operation of the system components 4 to influence the respective, at least one technical function selectively impaired. As explained below, this impairment can be achieved through various measures.

[0038] The fault simulation unit 10 is carried out by the verification control unit 12 controlled. Furthermore, the verification control unit 12 trained to perform the self-testing unit 6 The generated warning signals are compared with expected warning signals, which depend, for example, on the specific impaired technical function. The verification control unit can be used for this purpose. 12 to possess knowledge of a test scheme which is a test pattern with several steps to be carried out to impair certain functions of the system components 4 It can include the verification control unit. 12 It could also still be able to use the fault simulation unit. 10to execute a test procedure. Consequently, various faults can be simulated sequentially, in order to subsequently evaluate the warning signals issued by the self-test unit in response to the simulated faults. 6 to receive and compare with the expected warning signals. If, for example, a warning signal is missing for a specific simulated fault, or if a warning signal corresponding to the simulated fault contains unexpected information, a corresponding defect in the self-test unit may be detected. 6 be accepted. The system 2 It is therefore able to reliably perform a self-test and, if necessary, also reliably check the self-test function.

[0039] In Fig. 2a and Fig. Section 2b illustrates how a technical function of a system component can be impaired. Fig. Figure 2a shows the state of the art. Here, a conventional system component is used. 4'shown, which is a simple circuit 14 with a line 16 It features a self-test function. To test this function, a wire is manually inserted into a section of the circuit. 18 interrupted and, for example, by soldering on a switch 20 connected. Here, the line is shown as an example. 16 with a ground wire 22 connected or it is closed, i.e. by the switch 20 bridged. The switch 20 is usually located outside the system component 4' or the higher-level system, to be easily accessible to the operator. Furthermore, it can be ensured that the system housing remains closed during operation to best simulate real-world use cases. The self-test function can detect a malfunction of the system component. 4' detect and output a corresponding signal. Such an approach is suitable for simple system components.4' While conceivable under certain circumstances, such manual disconnection of a wire is particularly difficult with complex circuits and multiple layers of a circuit board. 16 Not possible. One via the switch 20Conditional changes in cable routing can impair the signal transmission characteristics of high-frequency signals, such as those found in modern electronic circuits, with regard to propagation delay and frequency response, and may also lead to increased crosstalk with adjacent signals. Such a simulation circuit is only acceptable for verification purposes if it can be demonstrated that the impairment of signal transmission caused by the switch remains within the tolerance limits specified for the transmission line. Furthermore, this procedure can only be used for a one-time verification of a self-test under laboratory conditions, meaning that the self-test must be verified after the system is commissioned. 2 would be completely impossible.

[0040] As in Fig. 2b shows a system component 4 of the system according to the invention 2 however, a fault simulation cell24 in the form of an electronic switching unit, which is an integral part of a circuit 26 the system component 4 forms. The fault simulation cell 24 is electronically controllable and for this purpose has, for example, a pair of connections 28 on, which can advantageously be implemented via a test port on a housing. To the terminal pair 28 can a switch 30 to be connected. By pressing the switch 30 opens the fault simulation cell 24 the corresponding line 16 The particular advantage of the circuit lies in the fact that the signal transmission characteristics of the line are improved. 16 such as frequency response, signal propagation time, and crosstalk are no longer affected by the switch. 30 with connection pair 28 is determined not by the connecting cable, but solely by the fault simulation cell. 24 The fault simulation cell24 Ideally, this will be done in the area of ​​management. 16 attached so that the routing of the cable 16 The simulation unit does not require significant modification, and therefore the signal transmission characteristics are not substantially altered. The fault simulation cell 24 is an integral part of the system and thus the signal transmission properties of the fault simulation cell are affected 24 These factors are taken into account during system design so that they do not impair system function. Such a fault stimulation cell can be used as a standard fault simulation cell in a system. 2 can be used in several locations.

[0041] Generalizing the fault simulation cell 24 can a fault simulation cell 24 be defined, which could have a fault activation unit and a modification unit, as in Fig. 6a further explained. The fault activation unit can typically have electronic switches that the modification unit can turn on or off, with the modification unit determining the type of fault simulation.

[0042] Another special advantage is that the fault simulation cell 24 In the example shown, it is implemented as an AND gate, which only works when a switch is activated and connected. 30 The connection is interrupted, thus simulating an error. Is the switch... 30 not at the connecting pair 28 Once connected, the connection is always maintained. The system component 4 It will then be operated in the conventional way.

[0043] It should be noted at this point that the circuit 26 an integrated circuit with a high 6, 7 or 8-digit number of transistors and the fault simulation cell 24It is implemented merely as an additional logic gate, and consequently the complexity of the circuit is reduced. 26 It changes practically nothing. Furthermore, it only affects a few representative points in the circuit. 26 such a switching unit 24 necessary.

[0044] Fig. 3 shows a system 32 , which the system 2 This corresponds, but is only an example of a single system component. 4 This can be, for example, a circuit board or a fairly complex integrated circuit, such as an embedded processor. A verification control unit. 50 is equipped with multiple fault simulation cells 24 connected, which is analogous to Fig. 2b in the system component 4 are arranged. The verification control unit is required for this purpose. 50 with a fault simulation unit 34 coupled, whereby the switches 30 the fault simulation unit34 assigned or realized through them.

[0045] The fault simulation unit 34 could include a large number of fault simulation cells 24 have a single control unit or an internal control unit 36 and an external control unit 38 Especially when using a large number of fault simulation cells. 24 It is advisable, for example, to initiate a verification process of the self-test function from the external control unit. 38 to execute, whereby the external control unit 38 continuously sends information to the internal control unit 36 sends which of the error simulation cells 24 Each component must be addressed individually. To prevent interference with other system components, the system assigns... 32 additionally an insulating unit 40 This can, if necessary, select the system component to be tested. 4electrically from other system components 4 isolate.

[0046] A self-check can encompass both self-monitoring and self-testing. In both cases, the system can be enhanced through a monitoring function. 42 are monitored, with the system additionally being subjected to a stimulus by a stimulation unit during the self-test. 44 is suspended.

[0047] A self-test unit is required to perform the self-test. 42 intended to be used with the system component 4 , the insulation unit 40 , the stimulation unit 44 and a monitor unit 46 is coupled. The stimulation unit 44 is intended to send various signals to the system component 4 to transfer so that the required input variables are available and in the system component 4 a specific behavior can be triggered, which is controlled by the monitor unit 46This can be detected. This is particularly useful when the insulating unit 40 the system component 4 completely separates it from the interaction partners normally present during normal operation. Consequently, by stimulation using test signals, the self-test unit42 can monitor the behavior of the system component. 4 test under real-world conditions and issue an error message if the system component's behavior deviates from normal. 4 The error message does not correspond to the expected behavior. It can be transmitted via a system bus. The error message can also be timestamped and stored in non-volatile memory. 48 The memory contents can be accessed via a test connector. 37 The available serial interface can be queried. The history of error messages is then available for maintenance purposes.

[0048] When influencing system components, especially in complex circuits, various options can be considered. Fig. Figure 4a shows an example of a fault simulation cell. 62 as a switching unit that simultaneously functions as a filter module 64 is equipped with a selection module 66 It can be controlled. Two switches 68 and 70 can receive an incoming signal either between an input 72 and an exit 74 loop through or through the filter module 64 guide. With the filter module 64 A signal can be manipulated so that malfunctions of assemblies can be specifically simulated.

[0049] Fig. Figure 4b shows an example of a fault simulation cell. 76 , which are equipped with an RC element 78 is equipped with two switches 68 and 70 with a system component 80It can be connected in parallel. By flipping the switches 68 and 70 can the RC element 78 They can be connected in parallel or disconnected. Appropriate dimensioning of the RC circuit is required. 78 Specific error scenarios can be simulated in a targeted manner.

[0050] Fig. 5a shows a variant of the external control unit 38 in the form of a switch box 38a with several externally operable switches, which are connected via the test plug 37 with the internal control unit 36 and thus with the fault simulation unit 34 is connectable.

[0051] Fig. 5b shows an equivalent setup as Fig. 5a, however, there is a switch box there instead 38a an external control unit 38b Designed for discrete control signals. This can perform the verification process automatically.

[0052] Fig. 5c shows a setup that corresponds to the one in Fig. 5b is equivalent. However, individual control lines are not tested individually via the test plug. 37 but via a serial interface 36a An external control unit 38c activates the individual error simulation cells 24 in the fault simulation unit 10 via the serial interface 36a .

[0053] Fig. 5d displays one Fig. 5c-based variant, in which an external control unit is used. 38d as a microcontroller 36b This is implemented via a serial interface. 36c via the test plug 37 connected to the outside world. The microcontroller 36b communicates with the self-test control unit 42 and stores the verification results in memory 48 away.

[0054] Fig. Figure 6a shows a basic structure of a fault simulation cell. 24Here, a system component to be influenced can be entered. 4 via a modification unit 82 , which are via switches 84 and 86 with the system component 4 It can be connected and actively influenced as needed. The switches 84 and 86 The components through which fault simulation can be activated can therefore be referred to as fault activation units. These can be controlled by the internal control unit. 36 are controlled, which are connected to the external control unit 38 is in signal communication.

[0055] Fig. Figure 6b shows the fault simulation cell 24 to simulate the interruption of a line, which here is considered a system component to be influenced 4 This is shown. It has a separation point. 92 on, which are equipped with a fault activation unit 88 and a modification unit 90 is linked. Instead of using two switches84 and 86 indicates the fault activation unit 88 an AND gate, which was already used in approximately... Fig. 2b is shown.

[0056] Fig. Figure 6c shows the implementation of an increased line resistance as a modification of the representation from Fig. 6b. A modification unit 94 exhibits resistance 96 up, who goes over the switches 84 and 86 The separation point is necessary. 92 bridged.

[0057] Finally, it shows Fig. 7 an aircraft 98 , which is exemplified by a system according to the invention 32 is equipped to train part of the avionics.

[0058] It should be further noted that "having" does not exclude any other elements or steps, and "a" or "an" does not exclude a plurality. It should also be noted that features described with reference to one of the above embodiments may also be used in combination with other features of other embodiments described above. Reference numerals in the claims are not to be considered as a limitation. Reference symbol list 2 System 4 System component 4' conventional system component 6 Self-test unit 8 first exit 10 fault simulation units 12 Verification control unit 14 circuit 16 Management 18 Cutting area 20 switches 22 Ground wire 24 fault simulation cells 26 circuit 28 connection pairs 30 switches 32 System 34 Fault simulation unit 36 internal control unit 36a Control unit with serial interface 36b Microcontroller 36c Serial interface for microcontrollers 37 test plugs 38 external control unit 38a Switch box 38b External control unit for discrete control signals 38c External control unit with serial interface 38d external control unit 40 Insulation Unit 42 Self-test unit 44 stimulation units 46-inch monitor unit 48 memory 50 Verification Control Unit 62 Fault simulation cell 64 Filter module 66 Selection module 68 switches 70 switches 72 Entrance 74 Exit 76 Fault simulation cell 78 RC link 80 System component 82 Modification Unit 84 switches 86 switches 88 Fault Activation Unit 90 modification unit 92 Separation point 94 Modification Unit 96 Resistance 98 aircraft

Claims

[1] System (2, 32) with self-testing function, comprising: at least one system component (4) which has at least one technical function, a fault simulation unit (10) integrated into the system (2, 32), a self-testing unit (6) integrated into the system (2, 32), and a verification control unit (12) integrated into the system (2, 32), wherein at least one system component (4) is coupled with the fault simulation unit (10), wherein the fault simulation unit (10) is designed to influence the operation of the system component (4) in such a way that at least one technical function is selectively impaired, wherein the self-test unit (6) is configured to monitor operating parameters of the system component (4) and to generate a warning signal in each case indicating an impairment of the respective at least one technical function, and wherein the verification control unit (12) is designed to compare the warning signals generated by the self-test unit (6) with expected warning signals depending on the impaired technical functions. [2] System (2, 32) according to claim 1, wherein the at least one system component (4) is designed as electrical or electronic system components (4). [3] System (2, 32) according to claim 2, wherein the at least one system component (4) comprises digital electronics. [4] System (2, 32) according to claim 2 or 3, wherein the fault simulation unit (10) has at least one electronically controllable fault simulation cell (24, 76) which is integrated into the at least one system component (4) and is configured to selectively open a line (16, 22) of the system component (4) or to selectively close a connection of the line (16, 22) to another line (16, 22) or to an additional electronic component. [5] System (2, 32) according to claim 4, wherein the other line (16, 22) has a ground connection or a connection to logic level “1”. [6] System (2, 32) according to claim 4 or 5, wherein the additional electronic component is selected from a group of electronic components comprising the group: - a resistance, - a capacity, - an inductor, - analog filters, - digital filters, - Logic components, - Bridging lines, and - Voltage sources. [7] System (2, 32) according to any one of claims 4 to 6, wherein the fault simulation unit (10) comprises an external control unit (38) and an internal control unit (36) that can be connected to the external control unit (38), wherein at least one fault simulation cell (24, 76) is arranged in the internal control unit (36) and is controllable by the external control unit (38), and wherein the at least one fault simulation cell (24, 76) and / or the internal control unit (36) are configured such that the at least one fault simulation cell (24, 76) is not switched without connection to the external control unit (38). [8] System (2, 32) according to one of claims 4 to 7, wherein the at least one fault simulation cell (24, 76) has an electronic switch. [9] System (2, 32) according to one of the preceding claims, further comprising at least one insulating unit (40) for electrically insulating one of the at least one system component (4) from other system components (4) as required. [10] System (2, 32) according to one of the preceding claims, further comprising a stimulation unit (44) which is connectable to the at least one system component (4) and is configured to simulate input variables for the system component (4) in question. [11] Method for checking self-test functions in a system (2, 32) comprising the steps: - Influencing the operation of at least one system component (4) by means of a fault simulation unit (10) integrated into the system (2, 32), such that a technical function is selectively impaired, - Monitoring of operating parameters of the system component (4) by a self-test unit (6) integrated into the system (2, 32) and generating a warning signal indicating an impairment of the respective technical function, - Comparison of the generated warning signal with expected warning signals depending on the impaired technical functions by a verification control unit (12), and - Issuing a maintenance notification if the generated warning signal does not match an expected warning signal. [12] Method according to claim 11, wherein influencing the operation comprises selectively opening a line (16, 22) of the system component (4) concerned or selectively closing a connection of the line (16, 22) concerned with another line (16, 22) or an additional electronic component. [13] Method according to claim 11 or 12, further comprising the step of electrically isolating the system component (4) concerned at least during the influencing of the operation. [14] Method according to one of claims 11 to 13, further comprising simulating input variables for the system component (4) in question by means of a stimulation unit (44) which can be connected to the at least one system component (4). [15] Aircraft with at least one system (2) according to any one of claims 1 to 10.

Images