State machine fault detection method based on autosar architecture

Abstract

The application relates to the technical field of state machine fault detection, and discloses a state machine fault detection method based on an AUTOSAR architecture, which utilizes an NvM module of a basic software layer of the AUTOSAR architecture to write network management messages of a state machine, and is used for identifying faults of the state machine in the basic software layer; a state machine fault code is established in a DTC, the state machine fault code comprises a plurality of fault bits and a plurality of fault flags corresponding to the plurality of fault bits one by one; a state machine ID is established in a communication matrix DBC, the state machine ID comprises a plurality of states corresponding to the state machine and the plurality of fault bits one by one; and a state machine fault detection result is obtained according to the corresponding fault bits of the state machine in different states. Through separate management of application layer and basic software layer instructions associated with the state machine, when a fault occurs in a controller, the fault of the state machine can be quickly and accurately known, fault positioning can be quickly and accurately performed, and the fault diagnosis efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of state machine fault detection technology, and in particular to a state machine fault detection method based on the AUTOSAR architecture. Background Technology

[0002] With the rapid development of new energy electric vehicles, the scale of their motor controller software has expanded, leading to increasingly complex software functions. Therefore, it is necessary to use the Automotive Open System Architecture (AUTOSAR) for standardized development of automotive electronic systems. The AUTOSAR standard provides a foundation for iterative software updates, facilitating portability to systems with different requirements and improving the development efficiency of software engineers in upgrading software performance. The state machine determines the controller's state transitions based on network management messages. However, due to differences in device operating characteristics, some devices are woken up by any frame, while others are woken up by specific frames, posing a certain risk of wake-up failures. Furthermore, the vehicle's actions after wake-up are also determined by the received message instructions. Therefore, fault detection of the state machine is necessary to avoid vehicle loss of control due to erroneous instructions. Summary of the Invention

[0003] This invention provides a state machine fault detection method based on the AUTOSAR architecture to solve the technical problems of inaccurate fault location and developers' inability to quickly identify the cause of faults in existing state machine detection methods.

[0004] This invention proposes a state machine fault detection method based on AUTOSAR architecture, comprising the following steps:

[0005] The NvM module of the basic software layer of the AUTOSAR architecture is used to write network management messages into the state machine to identify faults in the state machine in the basic software layer.

[0006] In the DTC of the AUTOSAR architecture, a state machine fault code is established, which includes multiple fault bits and multiple fault flags that correspond one-to-one with the multiple fault bits.

[0007] In the communication matrix DBC of the AUTOSAR architecture, a state machine ID is established, which includes multiple states that correspond one-to-one with the multiple fault bits of the state machine;

[0008] Based on the fault bits corresponding to different states of the state machine, obtain the state machine fault detection results.

[0009] Furthermore, the multiple states of the state machine include: power-on wake-up, initialization, standby, drive state preparation, drive state, speed mode, high voltage discharge, fault state, shutdown, and power-off hibernation.

[0010] Furthermore, the multiple fault indicators include: power-on wake-up abnormality, initialization abnormality, standby abnormality, drive state preparation abnormality, drive state abnormality, speed mode abnormality, high voltage discharge abnormality, fault state error, shutdown abnormality, and power-off hibernation abnormality.

[0011] Furthermore, the plurality of fault bits include: 0x01, 0x02, 0x03, 0x04, 0x05, 0x01, 0x06, 0x07, 0x08, 0x09 and 0x10.

[0012] Furthermore, if the state machine is detected to be in the initialization state but the basic software layer has not sent a wake-up frame message, or has sent a wake-up frame message but the state machine has not entered the initialization state, then the state machine fault detection result is output as a fault, the fault bit is 0x01, and the fault flag is power-on wake-up abnormal.

[0013] If the basic software layer has sent a wake-up frame message and the state machine enters the initialization state, the MCU performs a self-test. If the self-test detects a fault, it enters the fault state; otherwise, it enters the standby state. If the state machine is detected to be in the standby state but no MCU self-test is performed, or if the MCU self-test is performed but the state machine does not enter the standby or fault state, the state machine fault detection result is output as a fault, the fault bit is 0x02, and the fault flag is initialization abnormal.

[0014] When the state machine is in standby mode, if it receives a ready message from the basic software layer, it enters the driver state preparation mode; if it detects that the basic software layer has issued a ready message, but does not enter the driver state preparation mode or the fault state, it outputs the state machine fault detection result as a fault, the fault bit is 0x03, and the fault flag is standby abnormal.

[0015] Furthermore,

[0016] When the state machine is in the drive state preparation state, if a torque control command is received from the application layer, it enters the drive state; if a speed control command is received, it enters the speed mode. If a ready message is detected from the basic software layer, but the drive state or speed mode is not entered, the state machine fault detection result is output as a fault, the fault bit is 0x04, and the fault flag is abnormal drive state preparation.

[0017] When the state machine is in the drive state, the state machine controls the motor according to the torque command of the application layer, while monitoring the MCU operation status, estimating the actual torque of the motor and sending it to the bus; if the torque command of the application layer is received but the state machine does not execute it, or the state machine transmits the torque command without receiving the command, the state machine outputs the fault detection result as a fault, the fault bit is 0x05, and the fault flag is abnormal drive state.

[0018] When the state machine is in speed mode, it controls the motor according to the speed command from the application layer, while monitoring the MCU's operating status, estimating the actual speed of the motor, and sending it to the bus. If the state machine receives a speed command from the application layer but does not execute it, or if the state machine transmits a speed command without receiving one, it outputs the state machine fault detection result as a fault, with the fault bit being 0x06, and the fault flag indicating an abnormal speed mode.

[0019] Furthermore, when the state machine is in a high-voltage discharge state, if a discharge command is received from the application layer but the state machine does not execute it, or if the state machine transmits a discharge command without receiving a command, the state machine outputs a fault detection result as a fault, with the fault bit being 0x07, and the fault flag being a high-voltage discharge abnormality.

[0020] Furthermore, when the state machine is in a fault state, if a fault instruction is received from the application layer but the state machine does not enter the fault state, or if the state machine enters the fault state without receiving a fault instruction, the state machine fault detection result is output as a fault, the fault bit is 0x08, and the fault flag is a fault state error.

[0021] Furthermore, when the state machine is in the shutdown state, if it receives a shutdown command from the application layer but the state machine does not enter the shutdown state, or if it enters the shutdown state without receiving a shutdown command, the state machine fault detection result is output as a fault, the fault bit is 0x09, and the fault flag is shutdown abnormal.

[0022] Furthermore, when the state machine is in a power-down sleep state, if it is detected that the state machine is in a sleep state but has not sent a power-down sleep frame message, or has sent a power-down sleep frame message but has not entered a sleep state, then the state machine fault detection result is output as a fault, the fault bit is 0x10, and the fault flag is power-down sleep abnormal.

[0023] The beneficial effects of the technical solution provided by this invention include: By utilizing the AUTOSAR architecture to configure fault codes related to the state machine at the basic software layer and adding corresponding fault IDs to the DTC, this invention manages the application layer and basic software layer instructions associated with the state machine separately. This allows for rapid and accurate identification of state machine faults when a controller malfunctions, enabling quick and precise fault location and improving fault diagnosis efficiency. Designed based on the AUTOSAR specification, this invention fully leverages the advantages of the AUTOSAR architecture, allowing for rapid iterative upgrades should software requirements change in the future. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of the state machine fault detection method based on the AUTOSAR architecture of the present invention;

[0026] Figure 2 This is a schematic diagram of the state machine adjustment process for the state machine fault detection method based on the AUTOSAR architecture of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] The Automotive Open System Architecture (AUTOSAR) standardizes the development of automotive electronic systems. The AUTOSAR standard provides a foundation for iterative software updates, facilitates portability to systems with different requirements, and improves the development efficiency of software engineers in upgrading software performance.

[0029] Existing state machine fault detection methods suffer from the following problems: 1. When a fault occurs, the cause is analyzed based on the application layer fault message. However, sometimes the cause is not a state machine malfunction, leading to inaccurate fault localization. 2. The wake-up and sleep commands for the state machine originate from the underlying software, the motor state from the application layer software, and the fault level is transmitted by the DTC (Distributed Control Center). The command sources involve the entire controller. If a state machine malfunctions, developers cannot quickly identify the cause.

[0030] like Figure 1 As shown, the state machine fault detection method based on the AUTOSAR architecture includes the following steps:

[0031] The NvM module (NVRAMManager) of the Basic Software Layer (BSW) of the AUTOSAR architecture is used to write network management messages to the state machine to identify faults in the state machine within the Basic Software Layer.

[0032] In the AUTOSAR architecture, a state machine fault code is established in the DTC (Diagnostic Trouble Code). The state machine fault code includes multiple fault bits and multiple fault flags that correspond one-to-one with the multiple fault bits.

[0033] In the communication matrix DBC of the AUTOSAR architecture, a state machine ID is established, which includes multiple states that correspond one-to-one with the multiple fault bits of the state machine.

[0034] Based on the fault bits corresponding to different states of the state machine, obtain the state machine fault detection results.

[0035] The state machine has multiple states, including: power-on wake-up, initialization, standby, drive state preparation, drive state, speed mode, high voltage discharge, fault state, shutdown, and power-off hibernation.

[0036] The multiple fault indicators include: power-on wake-up abnormality, initialization abnormality, standby abnormality, drive state preparation abnormality, drive state abnormality, speed mode abnormality, high voltage discharge abnormality, fault state error, shutdown abnormality, and power-off hibernation abnormality.

[0037] The plurality of fault bits include: 0x01, 0x02, 0x03, 0x04, 0x05, 0x01, 0x06, 0x07, 0x08, 0x09 and 0x10.

[0038] The above-mentioned fault bits correspond one-to-one with multiple fault flags. For example, when the fault bit is 0x01, the fault flag is power-on wake-up error; when the fault bit is 0x02, the fault flag is initialization error.

[0039] State 1: The power-on wake-up process is that the state machine receives a wake-up frame message from the basic software layer (bottom layer). After receiving the message, it enters the initialization state. If the state machine is detected to be in the initialization state, but the basic software layer has not sent a wake-up frame message, or has sent a wake-up frame message, but the state machine has not entered the initialization state, then the state machine fault detection result is output as a fault, the fault bit is 0x01, and the fault flag is power-on wake-up abnormal.

[0040] State 2: If the basic software layer has sent a wake-up frame message and the state machine enters the initialization state, the MCU performs a self-test, including running all hardware and software. If a fault is found during the self-test, the MCU enters the fault state; otherwise, it enters the standby state. If the state machine is detected to be in the standby state but no MCU self-test is performed, or if the MCU self-test is performed but the MCU does not enter the standby or fault state, the state machine fault detection result is output as a fault, the fault bit is 0x02, and the fault flag is initialization abnormal.

[0041] State 3: When the state machine is in standby state, if it receives a ready message from the basic software layer, it enters the driver state preparation state; if it detects that the basic software layer has issued a ready message, but does not enter the driver state preparation state or the fault state, it outputs the state machine fault detection result as a fault, the fault bit is 0x03, and the fault flag is standby abnormal.

[0042] State 4: When the state machine is in the drive state preparation state, if a torque control command is received from the application layer, it enters the drive state; if a speed control command is received, it enters the speed mode. If a ready message is detected from the basic software layer, but the drive state or speed mode is not entered, the state machine fault detection result is output as a fault, the fault bit is 0x04, and the fault flag is abnormal drive state preparation.

[0043] State 5: When the state machine is in the drive state, the state machine controls the motor according to the torque command of the application layer, while monitoring the MCU operation status, estimating the actual torque of the motor and sending it to the bus; if the torque command of the application layer is received but the state machine does not execute it, or the state machine transmits the torque command without receiving the command, the state machine outputs the fault detection result as a fault, the fault bit is 0x05, and the fault flag is abnormal drive state.

[0044] State 6: When the state machine is in speed mode, the state machine controls the motor according to the speed command from the application layer, while monitoring the MCU's operating status, estimating the actual speed of the motor and sending it to the bus; if the application layer speed command is received but the state machine does not execute it, or if the state machine transmits the speed command without receiving the command, the state machine outputs the fault detection result as a fault, the fault bit is 0x06, and the fault flag is speed mode abnormal.

[0045] State 7: When the state machine is in the high-voltage discharge state, the state machine should disable torque output and request active discharge. After the active discharge is completed, the MCU enters the standby state. If a discharge command is received from the application layer but the state machine does not execute it, or if the state machine transmits a discharge command without receiving a command, the state machine fault detection result is output as a fault, the fault bit is 0x07, and the fault flag is high-voltage discharge abnormality.

[0046] State 8: When the state machine is in a fault state, the MCU remains in a safe state, i.e., executes ASC / FW. Recoverable faults can only exit the fault state after the fault is cleared. If an application layer fault command is received, but the state machine does not enter the fault state, or if the state machine enters the fault state without receiving a fault command, the state machine fault detection result is output as a fault, the fault bit is 0x08, and the fault flag is a fault state error.

[0047] It should be noted that the fault state in this state 8 is different from the fault states of the state machine (states 1-7, states 9-10). The fault in this state 8 may be a failure of other hardware or software of the MCU, while the fault bits of states 1-7 and states 9-10 are only for the failure of the state machine itself.

[0048] State 9: Shutdown state. When the state machine receives a shutdown message from the underlying layer, it enters the shutdown state. Once it receives a power-on message from the underlying layer, it can only jump to the initialization state and cannot directly jump to other states. When the state machine is in the shutdown state, if it receives a shutdown instruction from the application layer but the state machine does not enter the shutdown state, or if it enters the shutdown state without receiving a shutdown instruction, the state machine fault detection result is output as a fault, the fault bit is 0x09, and the fault flag is shutdown abnormal.

[0049] State 10: In power-down sleep mode, the CAN bus enters listen-only mode, clears self-test information, disables torque output, executes ASC / FW, and stores data in NVRAM. When the state machine is in power-down sleep mode, if it is detected that the state machine is in sleep mode but has not sent a power-down sleep frame message, or has sent a power-down sleep frame message but has not entered sleep mode, then the state machine fault detection result is output as a fault, the fault bit is 0x10, and the fault flag is power-down sleep abnormal.

[0050] Those skilled in the art will understand that the present invention may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0051] This invention is described with reference to flowchart illustrations and / or block diagrams of methods and systems according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0052] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0053] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0054] In the description of this invention, it should be noted that the terms "upper," "lower," etc., indicating the orientation or positional relationship are based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Unless otherwise expressly specified and limited, the terms "installed," "connected," and "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication between two elements. For those skilled in the art, the specific meaning of the above terms in this invention can be understood according to the specific circumstances.

[0055] It should be noted that in this invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0056] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features of the invention herein.

Claims

1. A state machine fault detection method based on AUTOSAR architecture, characterized in that, Includes the following steps: The NvM module of the basic software layer of the AUTOSAR architecture is used to write network management messages into the state machine to identify faults in the state machine in the basic software layer. In the DTC of the AUTOSAR architecture, a state machine fault code is established, which includes multiple fault bits and multiple fault flags that correspond one-to-one with the multiple fault bits. In the communication matrix DBC of the AUTOSAR architecture, a state machine ID is established, which includes multiple states that correspond one-to-one with the multiple fault bits of the state machine; Based on the fault bits corresponding to different states of the state machine, obtain the state machine fault detection results; The state machine has multiple states including: power-on wake-up, initialization, standby, drive state preparation, drive state, speed mode, high voltage discharge, fault state, shutdown, and power-off hibernation. The multiple fault indicators include: power-on wake-up abnormality, initialization abnormality, standby abnormality, drive state preparation abnormality, drive state abnormality, speed mode abnormality, high voltage discharge abnormality, fault state error, shutdown abnormality, and power-off hibernation abnormality. The plurality of fault bits include: 0x01, 0x02, 0x03, 0x04, 0x05, 0x01, 0x06, 0x07, 0x08, 0x09 and 0x10; When the state machine is in the drive state preparation state, if a torque control command is received from the application layer, it enters the drive state; if a speed control command is received, it enters the speed mode. If a ready message is detected from the basic software layer, but the drive state or speed mode is not entered, the state machine fault detection result is output as a fault, the fault bit is 0x04, and the fault flag is abnormal drive state preparation. When the state machine is in the drive state, the state machine controls the motor according to the torque command of the application layer, while monitoring the MCU operation status, estimating the actual torque of the motor and sending it to the bus; if the torque command of the application layer is received but the state machine does not execute it, or the state machine transmits the torque command without receiving the command, the state machine outputs the fault detection result as a fault, the fault bit is 0x05, and the fault flag is abnormal drive state. When the state machine is in speed mode, it controls the motor according to the speed command from the application layer, while monitoring the MCU's operating status, estimating the actual speed of the motor, and sending it to the bus. If the state machine receives a speed command from the application layer but does not execute it, or if the state machine transmits a speed command without receiving one, it outputs the state machine fault detection result as a fault, with the fault bit being 0x06, and the fault flag indicating an abnormal speed mode.

2. The state machine fault detection method based on AUTOSAR architecture as described in claim 1, characterized in that, If the state machine is detected to be in the initialization state, but the basic software layer has not sent a wake-up frame message, or has sent a wake-up frame message, but the state machine has not entered the initialization state, then the state machine fault detection result is output as a fault, the fault bit is 0x01, and the fault flag is power-on wake-up abnormal. If the basic software layer has sent a wake-up frame message and the state machine enters the initialization state, the MCU performs a self-test. If the self-test detects a fault, it enters the fault state; otherwise, it enters the standby state. If the state machine is detected to be in the standby state but no MCU self-test is performed, or if the MCU self-test is performed but the state machine does not enter the standby or fault state, the state machine fault detection result is output as a fault, the fault bit is 0x02, and the fault flag is initialization abnormal. When the state machine is in standby state, if it receives a ready message from the basic software layer, it enters the driver state preparation state; if it detects that the basic software layer has issued a ready message, but does not enter the driver state preparation state or the fault state, it outputs the state machine fault detection result as a fault, the fault bit is 0x03, and the fault flag is standby abnormal.

3. The AUTOSAR architecture based state machine fault detection method as claimed in claim 1, wherein, When the state machine is in a high-voltage discharge state, if a discharge command is received from the application layer but the state machine does not execute it, or if the state machine transmits a discharge command without receiving a command, the state machine outputs a fault detection result as a fault, with the fault bit being 0x07, and the fault flag being a high-voltage discharge abnormality.

4. The AUTOSAR architecture based state machine fault detection method of claim 1, wherein, When the state machine is in a fault state, if it receives a fault instruction from the application layer but the state machine does not enter the fault state, or if it enters the fault state without receiving a fault instruction, then the state machine fault detection result is output as a fault, the fault bit is 0x08, and the fault flag is a fault state error.

5. The AUTOSAR architecture based state machine fault detection method as claimed in claim 1, wherein, When the state machine is in the shutdown state, if it receives a shutdown command from the application layer but the state machine does not enter the shutdown state, or if it enters the shutdown state without receiving a shutdown command, then the state machine fault detection result is output as a fault, the fault bit is 0x09, and the fault flag is shutdown abnormal.

6. The AUTOSAR architecture based state machine fault detection method as claimed in claim 1, wherein, When the state machine is in a power-down sleep state, if it is detected that the state machine is in a sleep state but has not sent a power-down sleep frame message, or has sent a power-down sleep frame message but has not entered a sleep state, then the state machine fault detection result is output as a fault, the fault bit is 0x10, and the fault flag is power-down sleep abnormal.

Images