Testing method of computer reinitialization device

Abstract

A method for in-situ and on-the-fly testing of a reinitialization device (1) of a computer (2), comprising an execution sequence and a test sequence, the execution sequence being executed during the execution of software (L1, L2) and comprising the following steps: ‑ incrementing a test counter, ‑ storing the test counter in a non-volatile memory (3), ‑ triggering reinitialization of the computer (2), the test sequence being executed when starting the software (L1, L2) and comprising the following steps: ‑ reading the test counter from the non-volatile memory (3), ‑ comparing the test counter, and if it is equal to its initial value plus 1, reinitializing a test counter (CT), the test result being positive, and if it is greater than its initial value plus 1, the test result being negative.

Description

Technical Field

[0001] The present invention relates to computers in critical environments, such as computers used to control engines, and more particularly to a method making it possible to test the correct functioning of reinitialization means of such computers. Background Art

[0002] Computers typically consist of hardware and software. The hardware is capable of executing the software to perform component-driven functions. It is known to protect such computers by adding at least one hardware and / or software module to the computer that is capable of monitoring the correct operation of the computer and taking protective measures where appropriate.

[0003] like Figure 1 The figure shows the organizational structure used in a motor vehicle according to the VDA standard. Computer 2, such as an engine computer, executes Level 1 (L1) nominal software to ensure engine control functions. A first monitoring module, in the form of Level 2 (L2) monitoring software, monitors the correct operation of the L1 software, in particular by reproducing certain key calculations and comparing their results with those obtained by the L1 nominal software. When L2 detects a problem, it implements a protection strategy based on the problem. These protection strategies, in increasing order of problem severity, include: operating in a degraded mode, stopping injection, or reinitializing computer 2.

[0004] Degraded mode means that Computer 2 and L1 software maintain a certain level of operational capability. L2 software sends a command to L1 software to switch to degraded mode, which L1 software executes. Degraded mode allows the engine to operate at a reduced speed, such as by reducing engine speed, thereby enabling the vehicle to be driven, typically to a garage.

[0005] The purpose of stopping injection is to stop the engine to avoid an accident. This means that the computer 2 and / or the L1 software are no longer sufficiently reliable. Therefore, this command, determined by the L2 software, is executed by an L3 (Level 3) device, which is independent of the computer 2 and is usually pure hardware (usually an electronic circuit such as an ASIC) that acts directly on the injectors.

[0006] As a last resort, reinitialization aims to reinitialize computer 2 in order to return computer 2 and the L1 and L2 software to a nominal state. If the reliability of computer 2 and / or the L1 software is questionable, this command, typically determined / triggered by the L2 software, is executed by the L3 device, which is independent of computer 2 and acts directly on it. The L3 device can also perform certain tests to verify that it, computer 2, and / or the communication components between it and computer 2 are functioning correctly. If a fault is detected, the L3 device may decide to trigger reinitialization.

[0007] Since this involves the highest level of safety, reinitialization can be crucial. It's best to verify that the reinitialization trigger is functioning correctly. It's common to test this function at the end of manufacturing. According to prior art, it's often not tested again after this point. Summary of the Invention

[0008] To fill this gap, the present invention proposes a method for testing an L3 reinitialization device for reinitializing a computer 2 , which method can advantageously be used in situ, even during operation of the computer 2 and the component M.

[0009] To this end, the present invention relates to a method for in-situ and on-the-fly testing of a reinitialization device of a computer, the device executing at least reinitialization software, the computer executing at least driver software to drive a component, the method comprising an execution sequence and a verification sequence, the execution sequence being executed during the execution of the driver software and comprising the following steps: - incrementing a test counter, - storing the test counter in a non-volatile memory, - triggering computer reinitialization, the verification sequence being executed when the driver software is started and comprising the following steps: - reading the test counter from the non-volatile memory, - comparing the test counter: if the test counter is equal to its initial value, there is no test result, if the test counter is equal to its initial value plus 1, the test counter is reinitialized and the test result is positive, and if the value of the test counter is any other value, a "reinitialization" error is generated and the test result is negative.

[0010] Specific features or embodiments that may be used alone or in combination are:

[0011] - The execution sequence further comprises the steps of: - storing the test indicator in the non-volatile memory, and the verification sequence further comprises the steps of: - verifying the presence of the test indicator in the non-volatile memory, reinitializing the test counter only if the test indicator is present, deleting the test indicator.

[0012] -The execution sequence further comprises the following steps: -storing the reinitialization time (date) in a non-volatile memory, and the verification sequence further comprises the following steps: -reading the reinitialization time from the non-volatile memory, -determining the reinitialization duration based on the difference between the reinitialization time and the current time, -comparing the reinitialization duration with a maximum threshold, if the reinitialization duration is greater than the maximum threshold: generating a "duration" error and the test result is negative.

[0013] -The execution sequence also includes an initial step: - Checking the status of the component, the other steps of the execution sequence are only executed when the component is inactive.

[0014] The component is an internal combustion engine, and the component is inactive when injection stops.

[0015] The method further comprises a preliminary step of checking prerequisites for its execution, said conditions preferably being determined on the basis of at least one of the following criteria: calendar duration, computer operating duration and / or number of operating cycles of a component.

[0016] - The method further comprises the following steps: - activating at least one indication signal if the test result is negative, if a "reinitialization" error occurs, and / or if a "duration" error occurs. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The invention will be better understood from a reading of the following description, which is given purely by way of example and with reference to the accompanying drawings, in which:

[0018] Figure 1 shows a block diagram of the organizational structure of a computer and its reinitialization device,

[0019] Figure 2 A flowchart showing the execution sequence of the method is shown,

[0020] Figure 3 A flow chart showing the testing sequence of the method is shown. DETAILED DESCRIPTION

[0021] The method according to the present invention is Figure 1The computer 2 shown is used in conjunction with the L1 and L2 software. This computer 2 executes at least L1 and L2 software to drive a component M. This component may be, for example, an internal combustion engine M, and computer 2 is the engine control computer. The L1 software includes sensors 11 for observing the state of component M and actuators 10 for influencing said state. Due to the potentially critical nature of the actions controlled by computer 2, computer 2 must be protected. The first level of security is provided by the L2 monitoring software. The L2 monitoring software exchanges information with the L1 via links 13 and 14. Additional sensors 12 may also be provided. Non-volatile memory 3 enables the recording of temporary information when computer 2 is stopped, powered off, or reinitialized. Since the L2 software and / or computer 2 may also malfunction, as described above, computer 2 is equipped with an L3 reinitialization device 1 that can reinitialize computer 2 if a malfunction is detected. As a last resort, reinitialization aims to restore computer 2 and the L1 and possibly L2 software to a nominal state. If the reliability of computer 2 and / or L1 software is questionable, reinitialization is performed by the L3 device 1, which is independent of computer 2. Device 1 acts directly on computer 2 via component 17, for example, by acting on the reset pin of computer 2. Reinitialization is typically determined by L2 software and transmitted via communication component 15. Communication component 16 enables L3 device 1 to notify L2 in reply. The L3 device can also perform certain tests to verify the correct operation of itself, computer 2, and / or the communication components 15, 16, and 17 between it and computer 2. In the event of a detected fault, the L3 device can trigger reinitialization at its own discretion, again via component 17.

[0022] The purpose of the present invention is to verify that the execution of the reinitialization—from the decision to reinitialize until the computer 2 returns to an operational state—is carried out correctly, so that the L3 safety device 1 can be relied upon for safety. To this end, the purpose of the present invention is to perform a test reinitialization to verify that the reinitialization decision does in fact result in a valid reinitialization of the computer 2. This reinitialization is advantageously performed in situ, i.e., with the computer 2 operatively installed, and in operation, i.e., with the computer 2 and the component M running during the test. The reinitialization is observed during its execution to verify that it is carried out correctly.

[0023] To this end, the test method comprises an execution sequence S1 capable of controlling reinitialization by sending a reinitialization command to the reinitialization device 1. The execution sequence S1 is performed during the execution of the L1 and L2 software. Where appropriate, the method can select a preferred moment that is more favorable than another moment.

[0024] Furthermore, the method includes a verification sequence S2. After sending the reinitialization command, this sequence allows observing the device 1 and / or computer 2 to verify that the reinitialization command was actually executed, that the reinitialization of the computer 2 followed the command, and that the reinitialization was performed correctly. To this end, the verification sequence S2 is preferably executed after (re)starting the L1 and L2 software. This allows the verification sequence S2 to be executed immediately after starting the computer 2, and thus as soon as possible after restarting the computer 2 after reinitialization.

[0025] Both the execution sequence S1 and the test sequence S2 are advantageously software modules. These modules are functionally L3 or L2 level. They are executed by the computer 2 and advantageously triggered by L1 software.

[0026] Figure 2 Execution sequence S1 is shown. During reinitialization, the memory of computer 2 is erased. Therefore, before reinitialization, execution sequence S1 performs one or more steps to store information. This information is stored in non-volatile memory 3 for durability. When read again by verification sequence S2, the state of this information allows differentiation between a nominal startup, a startup after a reinitialization test, or a test requested without reinitialization, thereby enabling determination of the test result.

[0027] According to one characteristic, step E13 increments a test counter CT. This test counter CT counts the number of reinitialization tests requested by the execution sequence S1. This counter is then recorded in the non-volatile memory 3 during step E14. The test counter CT is advantageously stored in a persistent non-volatile memory. Then, during step E17, the execution sequence S1 triggers the reinitialization of the computer 2. This is done by making a request to the L3 device 1 via the component 15.

[0028] The execution sequence S1 is advantageously implemented by software executed on the computer 2. Thus, if the computer 2 is reinitialized, step E17 generally ends the execution sequence S1. The steps performed after E17 can make it possible to observe that there has been no reinitialization. The present invention does not reserve this option.

[0029] According to the present invention, the test sequence S2 is responsible for detecting the correct or incorrect operation of the reinitialization. To this end, when the computer 2 is started, the test sequence S2 is executed. The test sequence S2 includes the following steps, such as Figure 3As shown. According to one characteristic, a first step E23 comprises reading a test counter CT from the non-volatile memory 3. In a subsequent step E24, this test counter CT is compared with a possible value. If the test counter CT is equal to its initial value, i.e., the value before any increment E13, this indicates that the execution sequence S1 has not been performed beforehand. Therefore, no reinitialization test has been requested. Therefore, no test result is possible. The verification sequence S2 can be terminated by branching to the terminal step E30. If the test counter CT is equal to its initial value plus 1, it can be assumed that the execution sequence S1 has been performed once, and that the ongoing restart follows a subsequent reinitialization E17. Therefore, it can be assumed that a test was requested and that the test was carried out correctly. Therefore, in this case, the comparison E24 branches to a step E25, which reinitializes the test counter CT and restores the test counter CT to its initial value, for example 0. If the test was carried out correctly, the verification sequence S2 can continue with a step E29 with a positive test result, OK. If the value of the test counter CT is any other than the initial value plus one, this is due to at least two increments in step E13, and therefore execution sequence S1 was executed at least twice, triggering reinitialization in step E17 twice, without subsequently executing the test sequence S2. This indicates that the computer 2 was not effectively reinitialized after at least one of the reinitialization requests E17 following increment step E13. Otherwise, the test counter CT would have been reinitialized in step E25. Therefore, in this case, comparison E24 branches to step E31, generating a "reinitialization" error. The test sequence S2 continues and terminates in step E32 with a negative test result (NOK).

[0030] The test method may also comprise other features, which, alone or in combination, enable numerous implementation variants.

[0031] According to another feature, the execution sequence S1 also includes a step E15 of writing / storing a test indicator IT into the non-volatile memory 3. The test indicator IT is advantageously stored in a memory that is not erased during reinitialization. This test indicator IT typically includes the presence or absence of data, or includes a variable containing a certain value. As a supplement, the verification sequence S2 also includes the following steps. The presence of the test indicator IT is checked by reading E21 the non-volatile memory 3 to search for it. If E22 the test indicator IT is found, this confirms that a reinitialization test is in progress. Therefore, a reinitialization E25 of the test counter CT can be performed. Then, in step E25, the test indicator is also deleted. Otherwise, if no test indicator IT is found in the non-volatile memory 3, the comparison E22 branches to step E30, ending the verification sequence S2. In this case, there is no test result. The use of the test indicator IT makes it possible to confirm that a test has been requested without relying solely on the test counter CT.

[0032] According to another feature, if reinitialization is performed, the test method is further employed to test whether the reinitialization is performed within a sufficiently short time. To this end, execution sequence S1 further includes a step E16 of storing a reinitialization time TR in non-volatile memory 3. Reinitialization time TR is advantageously stored in a persistent non-volatile memory. This reinitialization time TR is sufficiently close to reinitialization request E17 to be considered the reinitialization start time. Verification sequence S2 further includes the steps of reading E26 the reinitialization time TR from non-volatile memory 3 and determining E27 a reinitialization duration DR based on the difference DR = T-TR between the reinitialization time TR and the current time T. The current time T is sufficiently close to the moment when computer 2 and its software become operational again after reinitialization to be considered the reinitialization end time. Therefore, duration DR can be considered the total reinitialization duration from the start of reinitialization request E17 to the return to an operational state. Verification sequence S2 advantageously also includes a step E28 of comparing reinitialization duration DR with a maximum threshold S. This duration threshold S is typically set in a prescribed or legal manner. For reference, threshold S is several tens of milliseconds, preferably 150 ms. If the reinitialization duration DR is greater than the maximum threshold value S, the test sequence S2 branches to step E33, which generates a "Duration" error. The test sequence S2 continues to the terminal step E34 with a negative test result (NOK). Conversely, if the reinitialization duration DR is less than the threshold value S, the test sequence S2 continues to the terminal step E29 with a positive test result.

[0033] In order not to interfere with the driving of component M, the moment of triggering reinitialization E17 is preferably selected to be when component M is inactive. This ensures that the test interferes less or does not interfere with the driving of component M, so that the test can be carried out in situ and during operation. To this end, the execution sequence S1 also includes a step E12 of checking the status of component M. If component M is active, the checking step E12 branches to a step E18 that ends the execution sequence S1. Alternatively, the execution sequence S1 can be paused until the status of component M becomes inactive. If component M is inactive or becomes inactive, the execution sequence S1 continues to execute the other steps E13 to E17, as described above.

[0034] In the case where the component M is an internal combustion engine, the internal combustion engine M is considered inactive when the injection is cut off. This corresponds, for example, to a stopped engine M or a running engine M during a deceleration and / or accelerator pedal release phase. This ensures that the driver does not notice the test, or, even if he does, does not interfere with it.

[0035] The reinitialization function must be tested from time to time. However, it is not necessary to repeat the test too frequently. Therefore, according to another feature, before any trigger E17 of reinitialization, the prerequisite condition CP is checked during step E11 of the execution sequence S1. This prerequisite condition CP can be determined based on any criteria that allow the execution to be postponed. Thus, the prerequisite condition CP can be determined, for example, based on one or more criteria selected from the following: calendar duration, operating duration of the computer 2, and / or number of operating cycles of the component m.

[0036] If the calendar duration criterion is used, the reinitialization test execution sequence S1 can be executed, and thus test reinitialization E17 can be triggered, only if the last test reinitialization E17 was performed more recently than the calendar duration. The calendar duration can be, for example, one hour, three days, or one month. Similarly, if the criterion is the operating duration of computer 2, test reinitialization E17 can be triggered only if the computer has been running for at least a specified operating duration since the last test reinitialization E17. The operating duration can be, for example, one hour, three days, or one month. Similarly, if the criterion is the number of operating cycles of component M, test reinitialization E17 can be triggered only if component M has performed at least the specified number of operating cycles since the last test reinitialization E17. The number of operating cycles can be, for example, 100. If component M is an internal combustion engine, one cycle includes the operation between starting and disconnecting the contacts.

[0037] Two or more criteria can be combined using the operators "OR" and / or "AND".

[0038] According to another feature, the method further comprises the step of activating at least one indicator signal if the test result is negative (NOK). In the event of a "reinitialization" error and / or a "duration" error, a personalized indicator signal or a specific shared indicator signal can be activated. The one or more indicator signals can be visual and / or acoustic. In the case of a motor vehicle, the indicator signal is advantageously displayed on the instrument panel to warn the driver.

[0039] Advantageously, the activation of the indication signal is superimposed with a record, advantageously time-stamped, preferably recorded in a non-volatile memory, which is visible to the maintenance team.

[0040] The invention has been illustrated and described in detail in the drawings and the foregoing description. This description is to be considered illustrative and given as an example, and is not to be considered as limiting the invention to this description. Numerous variations in implementation are possible.

[0041] Reference Signs List

[0042] 1: L3 reinitializes the device,

[0043] 2: Computer,

[0044] 3: non-volatile memory,

[0045] 10, 11: L1 and component input / output,

[0046] 12: Input of L2,

[0047] 13, 14: Communication components between L1 and L2,

[0048] 15, 16: Communication components between L2 and L3,

[0049] 17: Reinitialize the communication components,

[0050] L1, L2: Level 1 software and Level 2 software respectively.

[0051] L3: Level 3 reinitialization device,

[0052] S1: Execute sequence,

[0053] S2: test sequence,

[0054] E11 to E18: Steps of S1,

[0055] E21 to E34: Steps of S2,

[0056] M: component,

[0057] CP: Prerequisite,

[0058] CT: test counter,

[0059] IT: Test indicator,

[0060] TR: Reinitialization time,

[0061] T: current time,

[0062] DR: Reinitialization duration.

Claims

1. A method for in-situ and on-the-fly testing of a reinitialization device (1) of a computer (2), said device executing at least reinitialization software (L3), said computer (2) executing at least driver software (L1, L2) for driving a component (M), characterized in that: The method comprises an execution sequence (S1) and a test sequence (S2), wherein the execution sequence (S1) is performed during the execution of the driver software (L1, L2) and comprises the following steps: - increment (E13) the test counter (CT), - storing ( E14 ) the test counter (CT) in the non-volatile memory ( 3 ), - trigger (E17) the reinitialization of the computer (2), The test sequence (S2) is executed when the driver software (L1, L2) is started and comprises the following steps: - reading ( E23 ) the test counter (CT) from the non-volatile memory ( 3 ), - comparing (E24) the test counter (CT), if the test counter (CT) is equal to its initial value, there is no test result, if the test counter (CT) is equal to its initial value plus 1, reinitializing (E25) the test counter (CT), the test result (E29) is positive (OK), and if the value of the test counter (CT) is any other value, generating (E31) a "reinitialization" error, the test result (E32) is negative (NOK), The execution sequence (S1) further includes the following steps: - storing ( E15 ) a test indicator (IT) in a non-volatile memory ( 3 ), And the inspection sequence (S2) further includes the following steps: - checking ( E21 , E22 ) the presence of a test indicator (IT) in the non-volatile memory ( 3 ), reinitializing ( E25 ) the test counter (CT) only if the test indicator (IT) is present, deleting ( E25 ) the test indicator (IT).

2. The method according to claim 1, wherein The execution sequence (S1) further includes the following steps: - storing ( E16 ) the reinitialization time (TR) in a non-volatile memory ( 3 ), And the inspection sequence (S2) further includes the following steps: - reading ( E26 ) the reinitialization time (TR) from the non-volatile memory ( 3 ), - determining (E27) a reinitialization duration (DR) as a function of the difference between the reinitialization time (TR) and the current time (T), - Comparing the reinitialization duration (DR) with a maximum threshold (S) ( E28 ), if the reinitialization duration (DR) is greater than the maximum threshold (S): generating ( E33 ) a "Duration" error and the test result ( E34 ) is negative (NOK).

3. The method according to any one of claims 1 to 2, wherein: The execution sequence (S1) also comprises an initial step: - checking (E12) the state of the component (M), the other steps of the execution sequence (S1) being executed only when the component (M) is inactive.

4. The method according to claim 3, wherein: Component (M) is an internal combustion engine and is inactive when injection is stopped.

5. The method according to claim 1 , further comprising a preliminary step ( E11 ) of checking a prerequisite (CP) for its execution, said condition being determined according to at least one of the following criteria: calendar duration, computer ( 2 ) operating duration, and / or number of operating cycles of the component (M).

6. The method according to any one of claims 1 to 2, further comprising the steps of: - activating at least one indication signal if the test result is negative (NOK), if a "reinitialization" error occurs, and / or if a "duration" error occurs.

Images