Engine controller function safety verification system and method

Abstract

The invention relates to an engine controller function safety verification system and method, and belongs to the technical field of automobile function safety, and the system comprises an upper computer which is used for controlling a safety verification device and an engine controller; the safety verification device is used for simulating the operation working conditions of the vehicle and the engine, injecting a preset fault under a preset working condition and determining fault response time based on a feedback signal of the engine controller; the engine controller is used for generating a feedback signal after the preset fault is injected; and the test tool is used for verifying the function safety of the engine controller based on the fault response time. According to the engine controller function safety verification system, operation of an engine and a vehicle in different scenes is simulated through the safety verification device, the preset fault is injected under the preset working condition, so that the safety mechanism of the engine controller is triggered, the feedback signal is collected, and the fault response time is calculated; and the function safety verification test of the engine controller and the whole vehicle level is realized.

Description

Technical Field

[0001] The present invention relates to the field of automobile functional safety technology, and in particular to an engine controller functional safety verification system and method. Background Art

[0002] The automobile engine is the machine that provides power for the automobile. It is the heart of the automobile and the basic guarantee for the operation of the vehicle. It plays an important role in vehicle safety. However, as the complexity and integration of electronic and electrical systems such as engine systems continue to increase, the risks of systematic failures and random hardware failures also increase accordingly. Therefore, functional safety has gradually become an important technical indicator for the safety of smart cars.

[0003] Existing functional safety testing technologies are mainly aimed at testing chip hardware or research and testing of fault injection methods. In terms of functional safety research of engine control systems, methods such as hazard event identification, risk assessment, and fault analysis are mainly studied from the perspective of system development. However, research from the perspective of system testing and safety verification is rarely carried out. At present, functional safety verification methods for engine controllers have not been involved. Summary of the invention

[0004] In view of this, it is necessary to provide an engine controller functional safety verification system and method to achieve the purpose of verifying the functional safety of the engine controller.

[0005] In order to achieve the above object, the present invention provides an engine controller functional safety verification system, comprising: Host computer, safety verification device, engine controller and test tools; The host computer is used to control the safety verification device and the engine controller; The safety verification device is used to simulate the operating conditions of the vehicle and the engine, inject a preset fault under the preset condition, and determine the fault response time based on the feedback signal of the engine controller; The engine controller is used to generate the feedback signal after a preset fault is injected; The test tool is used to verify the functional safety of the engine controller based on the fault response time.

[0006] In a possible implementation, the security verification device includes: Preset models, processor boards, I / O boards, acquisition boards, and fault injection boards; The fault injection board is used to inject the preset fault into the preset model through the I / O board; The processor board is used to run the preset model; The preset model is used to simulate the operating conditions of the vehicle and the engine; The acquisition board is used to locate the time when the fault occurs.

[0007] In a possible implementation, the preset model includes: Engine model, transmission model, vehicle model and scenario module; The engine model is used to collect the injection pulse width and throttle opening to determine the engine speed; The transmission model is used to convert the engine speed into torque; The scene module is used to determine scene information; The vehicle model is used to control the operating conditions of the vehicle and the engine based on the scenario information and the torque.

[0008] In a possible implementation, the acquisition board includes: a first board and a second board; The first board is used to collect analog signals; The second board is used to collect digital signals.

[0009] In a possible implementation, the scene information includes: Location, road conditions and visibility.

[0010] In a possible implementation manner, the feedback signal includes: Hardwire, bus or internal flag bit transition.

[0011] In a possible implementation, the test tool includes a calibration measurement tool and a bus tool; The calibration measurement tool is used to read and modify internal variables of the engine controller; The bus tool is used to communicate with the engine controller.

[0012] In a possible implementation, the preset fault includes an electrical fault and a network fault; The electrical fault includes a sensor voltage fault or a sensor signal fault; The network failure includes a message loss failure, a signal failure or a verification error.

[0013] In a possible implementation, the method further includes: Junction boxes and load banks; The junction box is used for wiring harness transfer; The load box is used to connect to the injector and the throttle.

[0014] The present invention also provides an engine controller functional safety verification method, comprising: Build a test case library for functional safety of engine control systems; Based on the test case library, setting the operating conditions of the vehicle and the engine in the safety verification device, and injecting preset faults; collecting a feedback signal generated by the engine controller based on the preset fault to determine a fault response time; Functional safety of the engine controller is verified based on the fault response time.

[0015] The beneficial effects of the present invention are as follows: the engine controller functional safety verification system and method provided by the present invention control the safety verification device and the engine controller through a host computer. The vehicle's operating conditions can be set through the safety verification device, and the engine and vehicle can be simulated to operate in different scenarios. Preset faults are injected under preset conditions, thereby triggering the safety mechanism of the engine controller. The feedback signal of the engine controller is then collected and the fault response time is calculated. By analyzing the collected data, it is verified whether the safety measures are effective and whether the safety goals are achieved, thereby realizing functional safety verification tests at the engine controller and vehicle level. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 A schematic structural diagram of an embodiment of an engine controller functional safety verification system provided by the present invention; Figure 2 A schematic diagram of the structure of an embodiment of a security verification device provided by the present invention; Figure 3 A schematic diagram of the main signal flows between the models provided by the present invention; Figure 4 A schematic diagram of a method for calculating fault injection and fault response time provided by the present invention; Figure 5 One of the method flow charts of an embodiment of the engine functional safety verification method provided by the present invention; Figure 6 This is a second method flow chart of an embodiment of the engine functional safety verification method provided by the present invention. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0019] In the description of the embodiments of the present invention, unless otherwise specified, "multiple" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone.

[0020] The descriptions of "first", "second", etc. involved in the embodiments of the present invention are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the technical features defined as "first" or "second" may explicitly or implicitly include at least one of the features.

[0021] Figure 1 A structural diagram of an embodiment of the engine controller functional safety verification system provided by the present invention is shown in FIG. Figure 1 As shown in the figure, the engine controller functional safety verification system includes: Host computer 110, safety verification device 120, engine controller 130 and test tool 140; The host computer 110 is used to control the safety verification device 120 and the engine controller 130; The safety verification device 120 is used to simulate the operating conditions of the vehicle and the engine, inject a preset fault under a preset condition, and determine the fault response time based on the feedback signal of the engine controller 130; The engine controller 130 is used to generate the feedback signal after the preset fault is injected; The testing tool 140 is used to verify the functional safety of the engine controller 130 based on the fault response time.

[0022] The host computer contains the software tools required for the test, which can be used to control the safety verification device and monitor and modify the internal parameters of the engine controller.

[0023] The safety verification device is used to simulate the operation of the vehicle and engine in different scenarios and inject faults under specific working conditions. When the fault is injected, the safety mechanism of the engine controller is triggered. At this time, the safety verification device automatically collects the feedback signal of the engine controller and calculates the response time.

[0024] The engine controller contains the engine controller hardware and software to be verified. After the preset fault is injected, the safety mechanism of the engine controller will be triggered and a feedback signal will be generated.

[0025] The test tools mainly include calibration measurement tools (reading and modifying ECU internal variables) and bus tools (sending and receiving messages). They can verify the functional safety of the engine controller based on the fault response time and verify whether the safety measures are effective and whether the safety goals are achieved by analyzing the collected data.

[0026] Compared with the prior art, the engine controller functional safety verification system provided by the embodiment of the present invention controls the safety verification device and the engine controller through the host computer. The vehicle's operating conditions can be set through the safety verification device, and the operation of the engine and vehicle in different scenarios can be simulated. Preset faults are injected under preset conditions, thereby triggering the safety mechanism of the engine controller. The feedback signal of the engine controller is then collected and the fault response time is calculated. By analyzing the collected data, it is verified whether the safety measures are effective and whether the safety goals are achieved, thereby realizing functional safety verification tests at the engine controller and vehicle level.

[0027] In some embodiments of the present invention, the security verification device includes: Preset models, processor boards, I / O boards, acquisition boards, and fault injection boards; The fault injection board is used to inject the preset fault into the preset model through the I / O board; The processor board is used to run the preset model; The preset model is used to simulate the operating conditions of the vehicle and the engine; The acquisition board is used to locate the time when the fault occurs.

[0028] Figure 2 A schematic diagram of the structure of an embodiment of the security verification device provided by the present invention is shown in FIG. Figure 2 As shown, the safety verification device includes a preset model, a processor board, an I / O board and a fault injection board. The preset model includes an engine model, a transmission model, a vehicle model and a scenario module.

[0029] The engine controller functional safety verification system provided by the embodiment of the present invention builds a functional safety verification device, simulates the operation of the engine and the vehicle in different scenarios, and injects faults, identifies the time when the fault occurs, and calculates the fault response time.

[0030] In some embodiments of the present invention, the preset model includes: Engine model, transmission model, vehicle model and scenario module; The engine model is used to collect the injection pulse width and throttle opening to determine the engine speed; The transmission model is used to convert the engine speed into torque; The scene module is used to determine scene information; The vehicle model is used to control the operating conditions of the vehicle and the engine based on the scenario information and the torque.

[0031] The engine controller model receives operating intention signals such as accelerator pedal, gear position, switch status (cruise) and other sensor signals to calculate the required injection and intake volumes, and control actuators such as injectors and intake valves.

[0032] Figure 3 A schematic diagram of the main signal flow between the models provided by the present invention, such as Figure 3 As shown in the figure, the engine model collects injection signals (injection pulse width, injection advance angle), throttle opening and other control signals to calculate the engine speed, and then the transmission model converts the engine speed into torque and outputs it to the vehicle model to achieve vehicle and engine operating condition control. The transmission model can realize automatic shifting and manual shifting, two different shifting conditions.

[0033] The vehicle model can be a vehicle longitudinal dynamics model, which is calculated based on the longitudinal dynamics of the vehicle. The equation is as follows: F t =T t / r t Among them, F t is the driving force from the engine, T t is the output torque of the main reducer, r t is the wheel radius.

[0034] F f =Wf Among them, F f is the rolling resistance of the wheel, W is the wheel load, and f is the rolling resistance coefficient. On a flat road, it is the neutral position of the car, and on an uphill road, it is the component of force perpendicular to the slope when the car is in neutral position.

[0035] f can be calculated using the following empirical formula: f=f0+f1·u a Among them, u a is the vehicle speed, f0 and f1 are the coefficients of the empirical formula.

[0036] The sensor actuator signals that the model uses to interact with the engine controller are converted through the I / O board (physical signal to electrical signal conversion).

[0037] The real-time processor board is mainly used to run preset models.

[0038] Figure 4 This is a schematic diagram of the fault injection and fault response time calculation method provided by the present invention. The existing test bench is not capable of accurately collecting the time when the fault occurs and the time when the controller responds to the fault. The reason is that the fault injection board is a relay-type board. There is a response time from the host computer sending a command to the board injecting the fault, and the specific time when the fault occurs cannot be accurately located.

[0039] Therefore, this application locates the time when the fault occurs by adding an acquisition board. Figure 4 Taking the accelerator pedal sensor as an example, the first board (analog quantity acquisition channel) and the second board (digital quantity acquisition channel) are added to the signal simulation loop. After the fault injection occurs, depending on the type of fault, the analog quantity and digital channel acquisition results will be significantly different from those during normal operation. By making judgments in the model, the time of fault occurrence can be located.

[0040] After completing the location of the fault occurrence time, the controller will give feedback according to the fault situation, and the hard line, bus or internal flag will jump. According to the collection of the feedback signal, the controller fault feedback moment will be located. The fault response time can be calculated by locating the two moments.

[0041] In some embodiments of the present invention, the acquisition board includes: a first board and a second board; The first board is used to collect analog signals; The second board is used to collect digital signals.

[0042] This application locates the time when the fault occurs by adding an acquisition board. Figure 4 Taking the accelerator pedal sensor as an example, the first board (analog quantity acquisition channel) and the second board (digital quantity acquisition channel) are added to the signal simulation loop. After the fault injection occurs, depending on the type of fault, the analog quantity and digital channel acquisition results will be significantly different from those during normal operation. By making judgments in the model, the time of fault occurrence can be located.

[0043] For example, in the electronic control system of a car, the accelerator pedal sensor is a key component, which is responsible for converting the driver's accelerator operation into an electrical signal and transmitting it to the engine control unit (ECU). In order to ensure the reliability and safety of the system, these sensors are usually monitored, and fault detection and diagnosis functions are added during the design stage.

[0044] By adding the first and second boards to the signal simulation loop, the analog and digital quantities can be collected and analyzed respectively to monitor the working status of the accelerator pedal sensor. The following are the basic steps for using these two boards for fault detection and location: Normal operation data collection: When the system is operating normally, the normal operation data of the accelerator pedal sensor, including analog and digital signal characteristics, needs to be collected first. These data will serve as a benchmark for subsequent fault detection comparison.

[0045] Fault injection: In order to test the system's fault detection capability, different types of faults can be artificially injected, such as simulating signal distortion, open circuit, short circuit and other fault conditions of the accelerator pedal sensor.

[0046] Fault data collection: After the fault is injected, the first and second boards will continue to collect signals from the accelerator pedal sensor. Due to the presence of the fault, the collected data will be different from the data during normal operation.

[0047] Data analysis and judgment: By comparing the data collection results when the fault occurs with the baseline data during normal operation, the abnormal changes in the signal can be analyzed. According to the characteristics of these changes, thresholds can be set in the model or pattern recognition algorithms can be used to determine whether a fault has occurred and the type of fault.

[0048] Fault location: Once a fault is detected, the system can locate the specific location and time of the fault based on the change time and characteristics of the signal and the known fault type. This is crucial for rapid diagnosis and repair of the problem.

[0049] Response measures: After detecting a fault, the system can take corresponding response measures, such as switching to backup sensors, reducing engine power, reminding the driver to check the vehicle, etc., to ensure driving safety.

[0050] In this way, not only can the reliability of the automobile electronic control system be improved, but also timely warnings can be provided when a fault occurs, helping the driver to take appropriate measures to avoid potential safety accidents. In some embodiments of the present invention, the scene information includes: Location, road conditions and visibility.

[0051] The scenario module is used to simulate scenario information. The operating scenario mainly includes elements such as location, road conditions, and visibility.

[0052] For example, a vehicle is traveling at an ultra-low speed on an urban road and is waiting for a traffic light at the head of a queue. In this scenario, if the vehicle accelerates unexpectedly, it may suddenly start and hit pedestrians or other road users.

[0053] Or a vehicle is traveling at a high speed on a highway, and the vehicle behind it is traveling at a constant speed and maintaining a certain distance. In this scenario, if the vehicle decelerates unexpectedly, it may cause a rear-end collision with the vehicle behind it. Different combinations can be made in the scenario library to fully verify various scenarios.

[0054] In some embodiments of the present invention, the feedback signal includes: Hardwire, bus or internal flag bit transition.

[0055] After locating the time of the fault occurrence, the engine controller will give feedback based on the fault situation and jump on the hard line, bus or internal flag.

[0056] Based on the collection of feedback signals, the controller fault feedback moment is located, and the fault response time can be calculated by locating the two moments.

[0057] In some embodiments of the present invention, the test tool includes a calibration measurement tool and a bus tool; The calibration measurement tool is used to read and modify internal variables of the engine controller; The bus tool is used to communicate with the engine controller.

[0058] The calibration measurement tool is used to read and modify the internal variables of the ECU (Engine Control Unit). During the functional safety verification process, by reading the internal variables of the ECU, the real-time status and operating parameters of the engine controller can be obtained for analysis and evaluation of the performance of the engine controller. At the same time, the ability to modify the internal variables of the ECU allows testers to set specific test conditions to more comprehensively verify the functional safety of the engine controller.

[0059] The bus tool is used to send and receive messages, that is, to communicate with the engine controller. In functional safety verification, the bus tool can simulate various bus communication scenarios, including normal communication and communication under abnormal conditions. By sending and receiving messages, testers can verify the functional safety of the engine controller in terms of bus communication, such as whether it can correctly handle various bus messages and its response capabilities in the event of a bus failure.

[0060] In some embodiments of the present invention, the preset faults include electrical faults and network faults; The electrical fault includes a sensor voltage fault or a sensor signal fault; The network failure includes a message loss failure, a signal failure or a verification error.

[0061] Fault injection includes electrical faults and network faults. Electrical faults include one or more faults such as sensor (such as first accelerator pedal fault, second accelerator pedal fault, brake switch) power supply voltage fault, signal out of range, unreasonable signal, etc.

[0062] Network failures include single message loss failure, signal error failure, verification error, etc.

[0063] In some embodiments of the present invention, it further includes: Junction box 150 and load box 160; The junction box 150 is used for wiring harness transfer; The load box 160 is used to connect to the injector and the throttle.

[0064] like Figure 1 As shown, the engine controller functional safety verification system further includes a junction box 150 and a load box.

[0065] The load box is mainly used to connect real loads, such as injectors, throttles, etc.

[0066] The Break-Out-Box (BOB) is mainly used for wiring harness transfer and can be connected to external loads, etc., to facilitate testing and troubleshooting.

[0067] Figure 5 One of the method flow charts of an embodiment of the engine function safety verification method provided by the present invention is as follows Figure 5 As shown, the engine functional safety verification method includes: S501. Build a test case library for functional safety of engine control systems; S502, based on the test case library, setting the operating conditions of the vehicle and the engine in the safety verification device, and injecting a preset fault; S503, collecting a feedback signal generated by the engine controller based on the preset fault, and determining a fault response time; S504: Verify the functional safety of the engine controller based on the fault response time.

[0068] The execution entity of the engine function safety verification method provided by the present invention may be the engine function safety verification system provided in any of the above embodiments.

[0069] In S501, a test case library for the functional safety of the engine control system is constructed, and the test case library contains various fault scenarios and corresponding test cases to ensure that the engine control system can work normally under various circumstances.

[0070] In S502, based on the test case library, the operating conditions of the vehicle and the engine are set in the safety verification device, and preset faults are injected under the preset conditions to simulate various situations that may occur in actual operation, so as to perform fault detection and measure the response time.

[0071] In S503, after the fault is injected, the safety mechanism of the engine controller is triggered, and the fault response time is determined according to the fault occurrence time and the feedback signal collection time by collecting the feedback signal generated by the engine controller according to the preset fault.

[0072] In S504, the functional safety of the engine controller is verified according to the fault response time. If the response time meets expectations, it can be considered that the functional safety of the engine controller in the fault scenario has been verified.

[0073] Compared with the prior art, the engine controller functional safety verification method provided in the embodiment of the present invention sets the vehicle's operating conditions, simulates the operation of the engine and vehicle in different scenarios, and injects preset faults under preset conditions, thereby triggering the safety mechanism of the engine controller, and then collects the feedback signal of the engine controller and calculates the fault response time. By analyzing the collected data, it verifies whether the safety measures are effective and whether the safety goals are achieved, thereby realizing functional safety verification testing of the engine controller and the entire vehicle level, so as to ensure that the engine controller can respond promptly and accurately when facing various faults, thereby ensuring the safety and reliability of the vehicle.

[0074] Optionally, Figure 6 The second method flow chart of an embodiment of the engine function safety verification method provided by the present invention is as follows: Figure 6 As shown, the engine functional safety verification method includes: S601. Build a functional safety test case library for engine control systems.

[0075] The engine is the power provider of the vehicle. Its functional failure will lead to unexpected positive torque output and unexpected negative torque output, which will manifest as unexpected acceleration and unexpected deceleration on the vehicle. Therefore, the test case library is divided into two categories: avoiding unexpected vehicle acceleration and avoiding unexpected vehicle deceleration.

[0076] Among them, the avoidance of unexpected vehicle acceleration use case library is mainly divided into three categories: driver request torque error, torque request coordination error and torque output error.

[0077] The avoidance of unexpected vehicle deceleration use case library is mainly divided into three categories: auxiliary braking request error, auxiliary braking level calculation error and actuator state error.

[0078] S602: Set vehicle operating conditions and operation scenarios in the safety verification device, and inject faults.

[0079] Since the same failure mode may cause different hazards in different operating scenarios, and the same engine may have multiple vehicle configurations, it is necessary not only to verify various operating scenarios, but also to consider different vehicle models.

[0080] S603: Collect responses from the engine controller and calculate fault response time.

[0081] After the fault is injected under the set working conditions and operating scenarios, the safety mechanism of the engine controller will be triggered, so it is necessary to collect the actuator response and calculate the response time.

[0082] S604: Analyze data and generate a report.

[0083] Whether the test result passes or not is determined based on whether the fault is reported normally, whether an alarm is triggered after the fault occurs, the fault response time, and whether the safety mechanism is effective, and a test report is generated.

[0084] The engine controller functional safety verification method provided in an embodiment of the present invention can simulate the operating status of the vehicle and engine in different scenarios to perform fault injection and calculate the fault response time by building an engine controller safety verification system, thereby realizing engine control system and vehicle-level testing.

[0085] The engine controller functional safety verification system and method provided by the present invention are described in detail below in conjunction with specific application scenarios.

[0086] Embodiment 1: Assume that the safety goal of the verification is to avoid unexpected vehicle acceleration. Test cases are selected from the avoid unexpected vehicle acceleration case library, which can be divided into three categories: driver request torque error, torque request coordination error, and torque output error.

[0087] First, set the vehicle operation scenario, such as on a straight road in the city during the day. Then, adjust the engine operating conditions in the host computer so that the vehicle maintains a constant speed of a km / h, the vehicle in front is traveling at a constant speed of b km / h, and the following distance is c meters.

[0088] At this time, the fault injection module is used to inject accelerator pedal faults (such as accelerator power supply voltage failure, signal out of range, unreasonable throttle signal, etc.), causing the engine to output excessive torque, and the vehicle may rear-end the vehicle in front.

[0089] When a fault is injected, the safety mechanism of the engine controller will be triggered. At this time, the acquisition module detects the response signal of the Electronic Control Unit (ECU), including fault alarm, torque output limit and vehicle speed change, and calculates the fault response time according to the fault occurrence time and the controller feedback signal. Finally, it determines whether the test result passes or not based on whether the safety mechanism is effective, whether the vehicle collides with the vehicle in front, and whether it can enter the safe state (engine zero torque output) normally.

[0090] Embodiment 2: Assume that the safety goal of verification is to avoid unexpected vehicle deceleration. Test cases are selected from the avoid unexpected vehicle deceleration case library, which can be divided into three categories: auxiliary brake request error, auxiliary brake level calculation error, and actuator state error.

[0091] First, set the vehicle operation scenario, such as on the highway during the day. Then, adjust the engine operating conditions in the host computer so that the vehicle maintains a constant speed of d km / h, the vehicle behind it travels at a constant speed of e km / h, and the following distance is f meters.

[0092] At this time, the fault injection module is used to inject a brake pedal fault, causing the engine to output too little torque, and the vehicle may rear-end the vehicle in front.

[0093] When a fault is injected, the safety mechanism of the engine controller will be triggered. At this time, the acquisition module detects the response signal of the ECU, including fault alarm, torque output limit and vehicle speed change, and calculates the fault response time according to the time when the fault occurs and the controller feedback signal. Finally, it is judged whether the test result passes or not based on whether the safety mechanism is effective, whether the vehicle rear-ends the vehicle behind, and whether it can enter a safe state normally (exit engine auxiliary braking).

[0094] Optionally, if the engine is also matched with different models, it is necessary to select several typical vehicles, modify the relevant parameters of the vehicle model, and match them with the engine. Then, all or part of the use cases are verified on different vehicles.

[0095] Optionally, the location (urban area, highway), road conditions (straight, uphill and downhill) of the running scenario in the case have been built in the scenario module and are selected according to the specific test case.

[0096] Optionally, by setting different vehicle speeds and following distances, it is also possible to evaluate whether the fault response time setting is reasonable and whether the safety requirements are correct.

[0097] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the computer program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0098] The engine controller functional safety verification system and method provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. An engine controller functional safety verification system, characterized in that: include: Host computer, safety verification device, engine controller and test tools; The host computer is used to control the safety verification device and the engine controller; The safety verification device is used to simulate the operating conditions of the vehicle and the engine, inject a preset fault under the preset condition, and determine the fault response time based on the feedback signal of the engine controller; The engine controller is used to generate the feedback signal after a preset fault is injected; The test tool is used to verify the functional safety of the engine controller based on the fault response time.

2. The engine controller functional safety verification system according to claim 1, characterized in that: The safety verification device comprises: Preset models, processor boards, I / O boards, acquisition boards, and fault injection boards; The fault injection board is used to inject the preset fault into the preset model through the I / O board; The processor board is used to run the preset model; The preset model is used to simulate the operating conditions of the vehicle and the engine; The acquisition board is used to locate the time when the fault occurs.

3. The engine controller functional safety verification system according to claim 2, characterized in that: The preset model includes: Engine model, transmission model, vehicle model and scenario module; The engine model is used to collect the injection pulse width and throttle opening to determine the engine speed; The transmission model is used to convert the engine speed into torque; The scene module is used to determine scene information; The vehicle model is used to control the operating conditions of the vehicle and the engine based on the scenario information and the torque.

4. The engine controller functional safety verification system according to claim 2, characterized in that: The acquisition board includes: a first board and a second board; The first board is used to collect analog signals; The second board is used to collect digital signals.

5. The engine controller functional safety verification system according to claim 3, characterized in that: The scene information includes: Location, road conditions and visibility.

6. The engine controller functional safety verification system according to claim 1, characterized in that: The feedback signal includes: Hardwire, bus or internal flag bit transition.

7. The engine controller functional safety verification system according to claim 1, characterized in that: The test tool includes a calibration measurement tool and a bus tool; The calibration measurement tool is used to read and modify internal variables of the engine controller; The bus tool is used to communicate with the engine controller.

8. The engine controller functional safety verification system according to claim 1, characterized in that: The preset faults include electrical faults and network faults; The electrical fault includes a sensor voltage fault or a sensor signal fault; The network failure includes a message loss failure, a signal failure or a verification error.

9. The engine controller functional safety verification system according to claim 1, characterized in that: Also includes: Junction boxes and load banks; The junction box is used for wiring harness transfer; The load box is used to connect to the injector and the throttle.

10. A method for functional safety verification of an engine controller, characterized in that: The engine controller functional safety verification system applied to any one of claims 1 to 9 comprises: Build a test case library for functional safety of engine control systems; Based on the test case library, setting the operating conditions of the vehicle and the engine in the safety verification device, and injecting preset faults; collecting a feedback signal generated by the engine controller based on the preset fault to determine a fault response time; Functional safety of the engine controller is verified based on the fault response time.

Images