Fault injection test method and system

Abstract

The invention provides a fault injection test method and system. First, a fault injection device sends a first excitation signal to a device under test, and sends a first measurement signal to a processing device, the first excitation signal being a signal indicating that the device under test is in a non-fault state. Second, in the event that the fault injection device receives an instruction to initiate fault injection, the fault injection device changes a signal transmitted to the device under test from a first excitation signal to a second excitation signal, and changes a signal transmitted to the processing device from a first measurement signal to a second measurement signal, the second excitation signal is a signal indicating that the device under test is in the first fault state. And finally, the processing device determines the moment when the signal sent by the fault injection device is changed from the first measurement signal to the second measurement signal as the fault injection starting moment of the measured system. By setting the excitation signal and the measurement signal which change synchronously, the starting time of fault injection can be accurately determined.

Description

Technical Field

[0001] The present application belongs to the field of system fault measurement and control, and in particular, relates to a fault injection test method and system. Background Art

[0002] Fault injection testing is a test method that artificially injects faults and errors into the system. It aims to evaluate the fault tolerance and recovery mechanism of the device under test and verify the behavior and performance of the system under fault conditions by simulating faults in different layers and components of the device under test. The fault detection time interval refers to the time interval from the occurrence of a fault to the detection of the fault by the device under test in the fault injection test. It is one of the important indicators to measure the fault detection capability of the system.

[0003] After completing the fault injection test, the device under test should be able to detect the occurrence of the fault in a timely manner and take appropriate measures to deal with it. The length of the fault detection time interval is affected by many factors, including system design, fault detection mechanism, type and intensity of fault injection, etc. In the current fault injection test method, the accurate measurement of the start time of fault injection has always been a difficult problem to solve. Summary of the invention

[0004] The present application provides a fault injection test method and system. The fault injection test method, system and computing device provided by the present application set synchronously changing excitation signals and measurement signals by controlling the enabling state of the switch, and indirectly determine the changing time of the excitation signal by detecting the changing time of the measurement signal, which can not only accurately determine the starting time and the ending time of the fault injection, and be used to obtain accurate fault detection time interval and fault recovery time interval, but also realize the function of performing fault injection test on various types of devices under test.

[0005] In the first aspect, a fault injection test method is proposed. The method is applied to a fault injection test system, and the fault injection test system includes a fault injection device and a processing device, wherein the fault injection device is connected to the processing device, and the fault injection device is connected to the device under test. First, the fault injection device sends a first excitation signal to the device under test, and sends a first measurement signal to the processing device, wherein the first excitation signal is a signal indicating that the device under test is in a non-fault state. Secondly, when the fault injection device receives an instruction to start fault injection, the fault injection device changes the signal sent to the device under test from the first excitation signal to the second excitation signal, and the fault injection device changes the signal sent to the processing device from the first measurement signal to the second measurement signal, wherein the second excitation signal is a signal indicating that the device under test is in a first fault state. Finally, the processing device determines the moment when the signal sent by the fault injection device changes from the first measurement signal to the second measurement signal as the start moment of the fault injection of the device under test. By confirming the moment when the first measurement signal changes to the second measurement signal as the target type signal

[0006] In some possible embodiments, the fault injection device may receive an instruction to start fault injection in a variety of ways. For example, the fault injection device may be a signal control device that switches the enable state of the control switch by receiving a digital signal or an analog signal. The fault injection device may also be an external physical switch that switches the enable state of the control switch by an operator toggling the physical switch. When the enable state of the control switch is switched from a non-enabled state to an enabled state, it can be regarded as receiving an instruction to start fault injection. Subsequently, the first excitation signal output by the fault injection device changes to a second excitation signal, and the first measurement signal changes to a second measurement signal. Similarly, when the enable state of the control switch is switched from an enabled state to a non-enabled state, it can be regarded as receiving an instruction to stop fault injection. Subsequently, the second excitation signal output by the fault injection device changes to a first excitation signal, and the second measurement signal changes to a first measurement signal.

[0007] In some possible embodiments, the signal sent by the fault injection device to the device under test changes from the first excitation signal to the second excitation signal, and the signal sent by the fault injection device to the processing device changes from the first measurement signal to the second measurement signal, which are performed synchronously. In more embodiments, the time difference between the switching of the two types of signals can be set to be less than the first time threshold, and the first time threshold is much smaller than the fault detection time interval, which can also achieve the improvement of the accuracy of confirming the fault injection time.

[0008] Before the fault injection device mentioned above changes the signal sent to the device under test from the first stimulus signal to the second stimulus signal, other forms of methods may also be included, for example, the fault injection device obtains the first stimulus signal and the second stimulus signal. The fault injection device selects the second stimulus signal from the first stimulus signal and the second stimulus signal according to the instruction to start the fault injection and sends it to the device under test.

[0009] Before the fault injection device mentioned above changes the signal sent to the processing device from the first measurement signal to the second measurement signal, other forms of methods may also be included, for example, the fault injection device obtains the first measurement signal and the second measurement signal. The fault injection device selects the second measurement signal from the first measurement signal and the second measurement signal according to the instruction to start the fault injection and sends it to the device under test.

[0010] In some possible embodiments, the first measurement signal and the second measurement signal are different signals generated according to the target type signal in the device under test, the first measurement signal, the second measurement signal and the target type signal belong to the same signal type, and the first measurement signal and the second measurement signal have different amplitudes. The target type signal may be selected from a certain type of signal among the multiple types of signals generated by the device under test, or, in the case where the device under test is part of a larger control system, the target type signal may also be selected from a certain type of signal among the multiple types of signals generated by other devices or modules of the control system. At the same time, the specific amplitudes of the first measurement signal and the second measurement signal are determined to be within the normal amplitude range of the target type signal emitted by the device under test, so the normal operation of the device under test and other possible related devices will not be affected during the fault injection test.

[0011] After the fault injection device mentioned above changes the signal sent to the processing device from the first measurement signal to the second measurement signal, the following steps may also be included. First, when the device under test detects the second excitation signal, the device under test sends a first response signal to the processing device. Second, the processing device determines the time when the device under test sends the first response signal as the start time of the fault confirmation of the device under test.

[0012] In some possible embodiments, the processing device determines the fault detection time interval of the device under test according to the fault injection start time and the fault confirmation start time. In some possible embodiments, the period of the fault injection device sending the first measurement signal to the processing device and the period of sending the second measurement signal to the processing device are both less than the fault detection time interval.

[0013] After the device under test sends the first response signal to the processing device as mentioned above, the following steps may also be included. First, the device under test sends a second response signal to the processing device, and the second signal indicates that the device under test has responded to the first fault state represented by the second excitation signal. Second, the processing device determines the time when the device under test sends the second response signal as the fault response time of the device under test.

[0014] In some possible embodiments, the processing device determines the fault response time interval of the device under test according to the fault response time and the fault confirmation start time.

[0015] After the fault injection device mentioned above changes the signal sent to the processing device from the first measurement signal to the second measurement signal, the following steps may also be included. First, when the fault injection device receives an instruction to stop fault injection, the fault injection device changes the signal sent to the device under test from the second excitation signal to the first excitation signal, and the fault injection device changes the signal sent to the processing device from the second measurement signal to the first measurement signal. Second, the processing device determines the moment when the signal sent by the fault injection device changes from the second measurement signal to the first measurement signal as the moment when the fault injection of the device under test ends.

[0016] After the fault injection device mentioned above changes the signal sent to the device under test from the second excitation signal to the first excitation signal, the following steps may also be included. First, the device under test stops sending the first response signal to the processing device. Second, the processing device determines the moment when the device under test stops sending the first response signal as the moment when the fault confirmation of the device under test ends.

[0017] In some possible embodiments, the processing device determines the fault recovery time interval of the device under test according to the fault injection end time and the fault confirmation end time.

[0018] In the second aspect, a fault injection test system is proposed, including the following functional devices:

[0019] First, there is a fault injection device, which is used to send a first excitation signal to the device under test and send a first measurement signal to the processing device, wherein the first excitation signal is a signal corresponding to indicating that the device under test is in a non-fault state.

[0020] The fault injection device is used to change the signal sent to the device under test from a first excitation signal to a second excitation signal when receiving an instruction to start fault injection, and the fault injection device changes the signal sent to the processing device from a first measurement signal to a second measurement signal, wherein the second excitation signal is a signal corresponding to indicating that the device under test is in a first fault state, the first fault state is one of multiple fault states that can be detected by the device under test, and starting fault injection includes instructing the fault injection device to inject the first fault state into the device under test.

[0021] The second is a processing device, which is used to determine the time when the first measurement signal sent by the fault injection device changes into the second measurement signal as the fault injection start time of the device under test.

[0022] In some possible embodiments, the fault injection test system may further include a fault stimulus device, which is used to generate and send a first stimulus signal and a second stimulus signal to the fault injection device. The second stimulus signal is a signal generated by the fault stimulus device according to the first fault type of the device under test, and the first stimulus signal is a signal generated by the fault stimulus device according to the device under test being in a non-fault state.

[0023] In some possible embodiments, the fault injection test system may further include a measuring device, which is used to generate and send a first measurement signal and a second measurement signal to the fault injection device. The first measurement signal and the second measurement signal are signals determined by the measuring device from one of the multiple signal types generated by the device under test, and the amplitudes of the first measurement signal and the second measurement signal.

[0024] In a third aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores instructions, and when the processor executes the instructions in the memory, the method of any embodiment of the first aspect can be implemented.

[0025] In a fourth aspect, a vehicle is proposed, comprising the computing device of the third aspect or the fault injection test system described in any embodiment of the second aspect.

[0026] In a fifth aspect, a non-volatile storage medium is proposed, comprising a plurality of instructions, which, when executed by a computing device, can implement the method required by any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the background technology, the drawings required for use in the embodiments of the present application or the background technology will be described below.

[0028] Figure 1 It is a structural schematic diagram of a fault injection test system provided by the present application;

[0029] Figure 2 It is a schematic diagram of a signal state waveform display of a fault injection test provided by the present application;

[0030] Figure 3 A flowchart of a fault injection testing method provided by this application;

[0031] Figure 4 A flowchart of another fault injection testing method provided by this application;

[0032] Figure 5 A schematic diagram of the structure of a computing device provided in this application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described through the implementation method with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0034] In the description of this application, unless otherwise clearly defined, words such as "setting" should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meaning of the above words in this application based on the specific content of the technical solution.

[0035] In the description of the present application, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific embodiments", or "some examples" means that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0036] There are two common fault injection test systems at present. The first is a fault injection test system based on hardware-in-the-Loop (HIL), and the second is a fault injection test system based on a test bench. The following will briefly introduce the composition of these two fault injection test systems, fault injection methods, and the shortcomings of each solution.

[0037] The first is a fault injection test system based on hardware-in-the-loop devices. This is a method for verifying and testing embedded systems. It uses a simulation environment to simulate the external environment and various fault conditions of the system, and conducts comprehensive fault simulation and testing of the system. Among them, the simulation environment is usually composed of models, simulators and emulators, which can simulate various input signals, sensor feedback and external conditions. In some specific instances, the hardware-in-the-loop device may include multiple components such as real-time simulation models, programmable power supplies, fault injection boards, I / O boards, communication boards, and real-time processors.

[0038] The fault injection test system based on hardware-in-the-loop equipment can include the following operation flow in the fault injection method. First, after establishing the simulation environment constructed by the real-time simulation model, the fault injection test system receives the test stimulus signal and records the moment T1 when the stimulus signal is received. Secondly, after the stimulus signal passes through the I / O board, the model signal conditioning operation is performed. Thirdly, the fault injection board simulates the fault stimulus and records the moment T2 when the signal of the fault stimulus is detected after the processor analysis completes the detection of the fault stimulus. Finally, when the difference between the fault injection start time T1 and the fault confirmation start time T2 is less than the preset standard fault detection time interval (Fault Detection Time Interval, FDTI), the fault injection test is terminated.

[0039] In the actual application of fault injection test systems based on hardware-in-the-loop devices, the number of fault injection types that can be performed by the loop device is limited. For hardware faults inside the system under test, flying probe injection or customized fault injection equipment (such as bed of needles tester, fault injection test cabinet, etc.) is often required for testing, and it is impossible to accurately complete the fault injection verification of all open-loop tests of the controller. In addition, during the fault injection test of the loop device, there is a certain signal delay when the detection stimulus signal passes through the fault injection. Therefore, for fault types with particularly short fault detection intervals (FDTI) of the system under test, the judgment error of the fault detection interval (FDTI) is relatively large. At the same time, the fault injection loop device needs to be customized according to the specific controlled system, and its reusability is low, so the cost is high.

[0040] The second is a fault injection test system based on a system bench. This is a test method used to test the reliability and robustness of a system. It injects faults into the system bench to simulate various faults that the system under test may encounter in actual operation, so as to verify the fault detection and recovery capabilities of the system under test. The system bench is a test platform that simulates the operating environment of the system under test. It can simulate various inputs and outputs of the system under test, including sensors, actuators, communication interfaces, etc. Performing fault injection tests on the system bench can more realistically simulate various faults that the system under test may encounter in actual operation, thereby more accurately evaluating the reliability and robustness of the system.

[0041] The fault injection test system based on the system bench can include the following operation flow in the fault injection method. First, the actual hardware fault is injected into the system under test. Second, the flag bit of the fault register is sent out through software and the time T1 is recorded. Third, the time T2 is recorded after the system under test detects the fault. Finally, when the difference between the fault injection start time T1 and the fault confirmation start time T2 is less than the preset standard fault detection time interval, the fault injection test is terminated.

[0042] In the actual application of the fault injection test system based on hardware-in-the-loop equipment, the system determines the fault detection interval (FDTI) of the system under test after sending out the fault register flag of the safety mechanism through software. However, the actual start time of the fault injection at the hardware level will be delayed, so the fault detection interval (FDTI) tested by the system is smaller than the actual value, resulting in a large test error. In addition, when the control signal does not change or the control signal does not change significantly when the system under test fails, it is impossible to record the fault injection start time T1 by using an oscilloscope. For example, if the fault injection test of the fault detection interval (FDTI) of the low-level short circuit to ground fault, high-level short circuit to power fault, and stuck fault of the system under test is performed, the signal almost never changes and the specific fault injection start time T1 cannot be determined.

[0043] In order to solve the above-mentioned deficiencies of the prior art, the present application proposes a fault injection test method and system. The enabling state of the control switch is used to set the synchronously changing excitation signal and measurement signal, and the changing time of the excitation signal is indirectly determined by detecting the changing time of the measurement signal. Not only can the start time and the end time of the fault injection be accurately determined to obtain accurate fault detection time intervals and fault recovery time intervals, but also the function of performing fault injection tests on various types of devices under test can be realized.

[0044] To facilitate the understanding of the present invention by persons skilled in the relevant art, a fault injection test system provided by the present application is briefly described below through an embodiment.

[0045] See also Figure 1 , Figure 1 The fault injection test system provided in this embodiment includes an excitation device 110 , a measurement device 120 , a fault injection device 130 , a power supply device 140 , a device under test 150 , a bus device 160 and a processing device 170 .

[0046] First, the excitation device 110 is introduced. The excitation device 110 is used to determine a first excitation signal and a second excitation signal, and send the first excitation signal and the second excitation signal to the fault injection device 130. On the one hand, the first excitation signal acts as a control variable in the fault injection test, and can be a signal indicating that the device under test is in a non-fault state. When the device under test 150 receives the first excitation signal, the device under test 150 will not detect a system fault. On the other hand, the second excitation signal contains a fault excitation in the fault injection test, and can be a signal indicating that the device under test is in a first fault state. When the device under test 150 receives the second excitation signal, the device under test 150 will detect that the system has a first fault state. Among them, the first fault state can be one of one or more fault types that the device under test 150 can detect. Optionally, the excitation device 110 can generate different types of second excitation signals according to the different first fault states that the device under test 150 can detect, and inject fault excitation into the device under test 150 through the second excitation signal.

[0047] Next, the measuring device 120 is introduced. The measuring device 120 is used to determine the first measurement signal and the second measurement signal, and send the first measurement signal and the second measurement signal to the fault injection device 130. In the process of determining the first measurement signal and the second measurement signal, two aspects can be included. On the one hand, the first measurement signal and the second measurement signal are different values ​​of the same target type signal, and the target type signal can be a certain type of signal selected from the multiple types of signals generated by the device under test 150, or, when the device under test 150 is part of a larger control system, the target type signal can also be a certain type of signal selected from the multiple types of signals generated by other devices or modules in the control system except the device under test 150. On the other hand, the target type signal itself has a certain variable range when the device under test 150 is working normally, and the first measurement signal and the second measurement signal are both within the normal value range of the target type signal. Therefore, when the first measurement signal and the second measurement signal are sent to the internal communication network of the system to which the device under test 150 belongs through the bus device 160, the first measurement signal and the second measurement signal will not affect the device under test 150 and other devices or equipment other than the device under test 150 in the system to which the device under test 150 belongs, and ultimately a stable first measurement signal or a second measurement signal can be displayed on the processing device 170.

[0048] Next, the fault injection device 130 is introduced. The fault injection device 130 is used to send a first excitation signal to the device under test 150, and send a first measurement signal to the processing device 170, wherein the first excitation signal is a signal indicating that the device under test 150 is in a non-fault state. In the case where the fault injection device 130 receives an instruction to start fault injection, the fault injection device 130 changes the signal sent to the device under test 150 from the first excitation signal to the second excitation signal, and the fault injection device 130 changes the signal sent to the processing device 170 from the first measurement signal to the second measurement signal, wherein the second excitation signal is a signal indicating that the device under test 150 is in a first fault state. In the case where the fault injection device 130 receives an instruction to stop fault injection, the fault injection device 130 changes the signal sent to the device under test 150 from the second excitation signal to the first excitation signal, and the fault injection device 130 changes the signal sent to the device under test 150 from the second measurement signal to the first measurement signal.

[0049] The fault injection device 130 is also used to receive an instruction to start fault injection or stop fault injection. On the one hand, when the fault injection device 130 receives an instruction to start fault injection, the fault injection device 130 switches the first control switch 131 and the second control switch 132 to a disabled state synchronously, and the first control switch 131 in the disabled state uses the first excitation signal as an excitation signal output to the device under test 150, and the second control switch 132 in the disabled state uses the first excitation signal as a measurement signal output to the bus device 160. On the other hand, when the fault injection device 130 receives an instruction to stop fault injection, the fault injection device 130 switches the first control switch 131 and the second control switch 132 to an enabled state synchronously, and the first control switch 131 in the enabled state uses the second excitation signal as an excitation signal output to the device under test 150, and the second control switch 132 in the enabled state uses the second excitation signal as a measurement signal output to the bus device 160. In this embodiment, the synchronous switching between the first control switch 131 and the second control switch 132 provided can be achieved by setting a first threshold representing the enable switching time difference between the two control switches (which can be physical switches or virtual control switches). The enable switching time difference between the first control switch 131 and the second control switch 132 is within the first threshold range, which can be regarded as the synchronous switching of the excitation signal (including the first excitation signal and the second excitation signal) and the measurement signal (including the first measurement signal and the second measurement signal).

[0050] It can be understood that in this embodiment, the first control switch 131 and the second control switch of the fault injection device 130 are only an example, and the fault injection device 130 may receive instructions for starting fault injection or stopping fault injection in various forms. In this embodiment, the first control switch 131 and the second control switch 132 are two single-pole double-throw physical switches to switch the enable state of fault injection, and the first control switch 131 and the second control switch 132 are switched to enable state synchronously. In other possible embodiments, the first control switch 131 and the second control switch 132 provided in this embodiment may also be combined into a control switch, which is recorded as the third control switch. When the third control switch is set to the disabled state, the fault injection device 130 selects the first excitation signal and the first measurement signal as output; when the third control switch is set to the enabled state, the fault injection device 130 selects the second excitation signal and the second measurement signal as output. In addition, the fault injection device 130 may also receive instructions for fault injection or stopping fault injection through a virtual signal control switch, which is not limited here.

[0051] For the fault injection test system, two moments determined by the fault injection device 130 need to be paid attention to. First, when the control switch of the fault injection device 130 is switched from unenabled to enabled, the current moment is recorded as the fault injection start moment. Second, when the control switch of the fault injection device 130 is switched from enabled to unenabled, the current moment is recorded as the fault injection end moment.

[0052] In this embodiment, the fault injection device 130 receives the first stimulus signal and the second stimulus signal determined and sent by the stimulus device 110, and receives the first measurement signal and the second measurement signal determined and sent by the measurement device 120. Subsequently, the fault injection device 130 selects two of the four signals as outputs through the first control switch 131 and the second control switch 132, wherein the first control switch 131 is used to select one of the first stimulus signal and the second stimulus signal as the stimulus signal injected into the device under test 150, and the second control switch 132 is used to select one of the first measurement signal and the second measurement signal as the measurement signal sent to the bus device 160 and received by the processing device 170.

[0053] In other possible embodiments, the specific functions of the stimulus device 110 and the measurement device 120 introduced above can also be incorporated into the fault injection device 130. In this case, the fault injection device 130 is not only a device for determining whether to inject fault stimulus into the device under test 150, but can also be used to determine and generate the first stimulus signal and the second stimulus signal, as well as determine and generate the first measurement signal and the second measurement signal, and switch the enable state of the fault injection by means of the physical control switch or virtual signal control switch mentioned above.

[0054] The power supply device 140 is then introduced. The power supply device 140 provided in this embodiment can be used to provide the power required for fault injection to the fault injection device 130 and the device under test 150. In other possible embodiments, when the device under test 150 is part of a larger control system, the power supply device 140 may also be part of the control system. Therefore, the signal generated by the power supply device 140 can be acquired by the measuring device 120 and may be selected as the target signal type of the first measurement signal and the second measurement signal. Specifically, in the case of fault testing the battery management system (BMS) in a new energy vehicle, the low-voltage control signal and the high-voltage control signal generated by the power supply device 140 will become an ideal target signal type. For more relevant introductions, please refer to the specific content of the fault injection test method provided in this application below, which will not be repeated here.

[0055] The device under test 150 is introduced again. The device under test 150 provided in the present application is used to receive the first excitation signal or the second excitation signal sent from the fault injection device 130. The first situation is that when the device under test 150 receives the first excitation signal, since the first excitation signal indicates that the device under test 150 is in a non-fault state, the device under test 150 will not detect any fault state. The second situation is that when the signal received by the device under test 150 changes from the first excitation signal to the second excitation signal, since the second excitation signal indicates that the device under test 150 is in a first fault state, the device under test 150 will detect that the device under test 150 has detected the first fault state after a period of time, and send a first response signal to the bus device 160, wherein the first response signal indicates that the device under test 150 has detected the first fault state. The third situation is that when the signal received by the device under test 150 changes from the second excitation signal to the first excitation signal, the device under test 150 detects that the first fault state disappears, and stops sending the first response signal to the bus device 160. Moreover, when the device under test 150 detects the second excitation signal and the device under test 150 completes the response to the first fault state, a second response signal will be sent to the bus device 160 .

[0056] For the fault injection test system, three moments determined by the device under test 150 need to be paid attention to. First, when the device under test 150 detects the second excitation signal and sends the first response signal, the current moment is recorded as the fault confirmation start moment. Secondly, when the device under test 150 detects that the second excitation signal is transformed into the first excitation signal, the current moment is recorded as the fault confirmation end moment. Finally, when the device under test 150 completes the response to the first fault state and sends the second response signal, the current moment is recorded as the fault response moment.

[0057] In other possible embodiments, the device under test 150 can also receive the first stimulus signal or the second stimulus signal through the device under test (DUT) controller as an intermediate bridge for signal interaction. Specifically, the fault injection device sends the first stimulus signal or the second stimulus signal to the device under test controller, and then the device under test controller sends the signal containing / not containing the fault stimulus to the device under test, without limitation.

[0058] Next, the bus device 160 is introduced. The bus device 160 introduced in this embodiment can be not only in the form of a controller area network bus (CAN), but also in the form of a controller area network with flexible data rate (CANFD), a local serial network bus (LIN), an Ethernet bus, a FlexRay network bus, a media-oriented system transport bus, and one or more combinations of the above network buses, without limitation. Since in some possible embodiments, the device under test 150 can also be part of a larger control system, the device under test 150 can send the first response signal and the second response signal to the bus device 160 belonging to the same control system, and the fault injection device 130 can send the first measurement signal or the second measurement signal to the bus device 160 belonging to the same control system, and the processing device 170 detects the change time of the above signal, thereby reading the specific fault injection start time, fault injection end time, fault confirmation start time, fault confirmation end time and fault response time. Since the selected first measurement signal and the second measurement signal are both within the normal value range, the first measurement signal or the second measurement signal in the bus device 160 will not cause possible interference to other devices during the fault injection test, thereby affecting the timing judgment.

[0059] In some possible embodiments, the fault injection test method provided by the present application can be applied to some subsystems of the vehicle-mounted system, such as the battery management system mentioned above. The CAN network contained in the vehicle-mounted system is the bus device 160 shown in the present application. At this time, the subsystem will serve as the device under test 150 shown in this embodiment. However, the application scenario of the fault injection test system provided by the present application is not limited to fault injection in the field of vehicle systems. In other possible embodiments, the fault injection test system may also include other forms of bus devices 160 corresponding to the device under test, or it may also be a fault injection test system that does not include the bus device 160, which is not limited here.

[0060] Finally, the processing device 170 is introduced. The processing device 170 provided in this embodiment receives various types of signals related to the fault injection test sent by the fault injection device 130, the device under test 150, the stimulus device 110 and the measuring device 120 through the bus device 160. In some possible embodiments, the processing device 170 can be an oscilloscope capable of reading and displaying a signal waveform pattern, or can be a laptop computer, a host computer, a desktop computer (PC) and other electronic devices with signal reading and computing functions, which are not limited here.

[0061] To facilitate understanding by those skilled in the art, an example is given below to introduce the various signal waveforms displayed by the processing device and the meanings of the signal waveforms at certain node times in the fault injection test system provided by the present application.

[0062] See also Figure 2 , Figure 2 A schematic diagram of a signal state waveform display of a fault injection test provided by the present application. The five signal state waveforms displayed in this embodiment are Figure 1 The various related signals collected by the processing device 170 in the fault injection test system shown in the embodiment are generated, including Figure 2 There are various signal states or system states related to the fault injection test, including a control switch state 210 , an excitation signal state 220 , a measurement signal state 230 , a fault state 240 and a fault response state 250 . Figure 2 The figure also includes five key moments in the fault injection test, namely, fault injection start time 201, fault injection end time 202, fault confirmation start time 203, fault confirmation end time 204, and fault response time 205. It can be understood that the fault injection start time 201 mentioned in this embodiment corresponds to the fault injection start time T1 mentioned above, and the fault confirmation start time 203 mentioned in this embodiment corresponds to the fault confirmation start time T2 mentioned above.

[0063] Next, various concepts provided in this application are introduced in detail.

[0064] The control switch state 210, the excitation signal state 220, and the measurement signal state 230 are all states that change under the control of the control switch of the fault injection device. On the one hand, when the control switch of the fault injection device is in the disabled state, the control switch state 210 is not fault injected, and the excitation signal state 220 and the measurement signal state 230 of the signal output are the first excitation signal and the first measurement signal, respectively. On the other hand, after the fault injection device receives an instruction to start fault injection, the control switch switches from non-enabled to enabled, and the control switch state 210 is to start fault injection, and the excitation signal state 220 and the measurement signal state 230 of the signal output are the second excitation signal and the second measurement signal, respectively. At this time, the moment when the control switch switches from non-enabled to enabled is recorded as the fault injection start time 201. Thirdly, when the fault injection device receives an instruction to stop fault injection, the control switch switches from enabled to disabled, and the control switch state 210 is to stop fault injection. The excitation signal state 220 and the measurement signal state 230 of the signal output are respectively the first excitation signal and the first measurement signal. At this time, the moment when the control switch switches from enabled to disabled is recorded as the fault injection end moment 202.

[0065] Both the fault state 240 and the fault response state 250 are states that change as the device under test responds to the above-mentioned stimulus signal state 220. On the one hand, it takes a certain amount of time from when the second stimulus signal is sent to the device under test to when the device under test detects the first fault state contained in the second stimulus signal, and this time is called the Fault Detection Time Interval (FDTI). When the device under test detects the first fault state, it sends out a first response signal. Correspondingly, the fault state 240 is converted to a fault detection. At this time, the time when the first response signal is sent is recorded as the fault confirmation start time 203. On the other hand, it takes a certain amount of time from when the first stimulus signal is sent to the device under test to when the device under test detects that the system contained in the first stimulus signal is in a non-fault state. This time is called the Fault Restore Time Interval (FRSTI). When the device under test detects that the first fault state is eliminated, it stops sending out the first response signal. Correspondingly, the fault state 240 is converted to fault recovery. At this time, the time when the first response signal stops sending out is recorded as the fault confirmation end time 204. Moreover, it also takes a certain amount of time from when the device under test detects the first fault state to when the device under test responds to the first fault state. This time is called the fault response time interval (FRTI). When the device under test has responded to the first fault state and has transitioned to a safe state (for example, controlling operations such as contactor disconnection), a second response signal is issued, and the fault response state 250 is converted to responding to the fault. At this time, the moment when the second response signal is issued is recorded as the fault response moment 205.

[0066] From the above introduction to the fault detection time interval and the fault response time interval, it can be seen that the accurate fault injection start time 201 and the fault injection end time 202 can be determined by the first measurement signal and the second measurement signal, which can only be achieved if the transmission period of the first measurement signal and the second measurement signal is much smaller than the fault detection time interval and the fault response time interval. Therefore, when selecting the target signal type of the first measurement signal and the second measurement signal, the calibrated transmission period of the signal is also an important selection criterion.

[0067] It can be seen that through Figure 1The fault injection test system shown in the figure uses the fault injection device 130 to synchronously switch the excitation signal state 220 and the measurement signal state 230, so that the processing device 170 can accurately determine the fault injection start time 201 and the fault injection end time 202, so that the fault detection time interval (FDTI) and the fault recovery time interval (FRSTI) can be accurately measured, and by setting the measurement signal state 230 for measurement, more types of fault injection tests can be completed when the excitation signal state 220 is difficult to be accurately obtained.

[0068] Next, two embodiments are used to introduce the fault injection testing method provided by the present application.

[0069] See also Figure 3 , Figure 3 This is a flow chart of a fault injection test method provided by the present application. This embodiment introduces the fault injection test method of the present application by converting the control switch of the fault injection device from unenabled to enabled, which can be achieved Figure 1 The fault injection test system shown and Figure 2 The following are some of the functions for measuring and determining the various moments and time intervals shown.

[0070] S301: The fault injection device sends a first stimulus signal to the device under test, and sends a first measurement signal to the processing device.

[0071] This step is implemented by the fault injection device in the fault injection test system. For a detailed introduction to the fault injection device, please refer to Figure 1 More content in the embodiments. The first excitation signal is a signal indicating that the device under test is in a non-fault state. The fault injection device sends the first excitation signal to the device under test and sends the first measurement signal to the processing device when the control switch is disabled, and the fault excitation has not yet been injected into the device under test.

[0072] In practical applications, since the excitation signal state (including the first excitation signal and the second excitation signal) in some fault injection tests is difficult to obtain, the method provided in the present application can indirectly measure the start time and the end time of the fault injection by setting the measurement signal state (including the first measurement signal and the second measurement signal) and setting the synchronous transformation of the excitation signal state and the measurement signal state through the fault injection device.

[0073] The selection of the first measurement signal and the second measurement signal is also a critical operation. First, the first measurement signal and the second measurement signal are different signals generated according to the target type signal in the device under test. The first measurement signal, the second measurement signal and the target type signal belong to the same signal type, and the first measurement signal and the second measurement signal have different amplitudes. Secondly, the selection of the target type signal can be performed by the measuring device in the fault injection test system, and can also be performed by the fault injection device when the function of the measuring device is incorporated into the fault injection device. Thirdly, the target type signal is usually determined from one of the multiple system signals in the system to which the device under test belongs. The target type signal has a certain normal value range, and the values ​​of the first measurement signal and the second measurement signal are both within the normal value range. By selecting the target type signal as a signal within the normal value range of the system to which the device under test belongs, it can be ensured that during the fault injection test, the first measurement signal and the second measurement signal will not have a possible impact on other devices.

[0074] In some specific embodiments, for example, in the fault injection test of the battery management system in the automotive field, after determining the electronic fault type corresponding to the first fault state, a programmable power supply module capable of controlling the voltage selects the target signal type of the measurement signal (at this time, the low-voltage power supply signal KL30C corresponding to the battery management system can be selected) and provides the first measurement signal and the second measurement signal (at this time, the values ​​of the two measurement signals can be two different normal values ​​of the low-voltage power supply signal KL30C). In other specific embodiments, in the fault injection test of the electronic and electrical safety control system (such as the signal control system, the motor control system, the charging and discharging system, the pressure monitoring system and the temperature monitoring system, etc.), similar operations for determining the target signal type and signal amplitude of the measurement signal can also be performed.

[0075] S302: When the fault injection device receives an instruction to start fault injection, the fault injection device changes the signal sent to the device under test from the first stimulus signal to the second stimulus signal, and the fault injection device changes the signal sent to the processing device from the first measurement signal to the second measurement signal.

[0076] This step is implemented by the fault injection device in the fault injection test system. For a detailed introduction to the fault injection device, please refer to Figure 1 More content in the embodiments. The second excitation signal is a signal indicating that the device under test is in a first fault state, wherein the first fault state may be one of one or more fault types that can be detected by the device under test. The fault injection device sends the second excitation signal to the device under test and sends the second measurement signal to the processing device when the control switch is enabled, and the fault excitation is injected into the device under test.

[0077] In other possible embodiments, the first excitation signal, the second excitation signal, the first measurement signal, and the second measurement signal emitted by the fault injection device may be obtained from the outside. The fault injection device selects the second excitation signal from the first excitation signal and the second excitation signal and sends it to the device under test, and selects the second measurement signal from the first measurement signal and the second measurement signal and sends it to the device under test according to the instruction to start the fault injection.

[0078] When the control switch of the fault injection device is switched from unenabled to enabled, the signal sent by the fault injection device to the device under test changes from the first excitation signal to the second excitation signal, and the signal sent by the fault injection device to the processing device changes from the first measurement signal to the second measurement signal, which is synchronously executed. In practical applications, synchronous execution can be achieved by setting a first threshold representing the enable switching time difference of the control switch for the two signals. When the enable switching time difference of the control switch for the two signals is within the first threshold range, it can be regarded as the switching of the synchronous execution signal state.

[0079] S303: The processing device determines the time when the signal sent by the fault injection device changes from the first measurement signal to the second measurement signal as the fault injection start time of the system under test.

[0080] This step is implemented by the processing device in the fault injection test system. For a detailed introduction to the processing device, please refer to Figure 1 More content in the embodiments. In theory, the fault injection start time is the moment when the control switch changes its enable state from non-enabled to enabled after receiving an instruction to start fault injection. Since the moment when the fault injection device enables the control switch is difficult to determine, the present application obtains the first measurement signal or the second measurement signal from the fault injection device through a processing device, and determines the fault injection start time by the moment when the first measurement signal is converted into the second measurement signal. In the actual test process, the time difference between the switching of the control switch enabled by the fault injection device to the transition of the measurement signal state detected by the processing device is extremely short, so the delay error generated by obtaining the measurement signal state through the processing device can be basically ignored.

[0081] S304: When the device under test detects the second excitation signal, the device under test sends a first response signal to the processing device.

[0082] This step is implemented by the device under test in the fault injection test system. For a detailed introduction to the device under test, please refer to Figure 1More content in the embodiments. The device under test sends a first response signal when detecting the first fault state included in the second excitation signal, and the first response signal indicates that the device under test is in the first fault state.

[0083] S305: The processing device determines the time when the device under test sends the first response signal as the fault confirmation start time of the device under test.

[0084] This step is implemented by the processing device in the fault injection test system. For a detailed introduction to the processing device, please refer to Figure 1 More content in the embodiments. In theory, the fault confirmation start time is the time when the device under test sends out the first response signal after detecting the first fault state. Since the time when the device under test detects the first fault state is difficult to determine, the present application determines the fault confirmation start time by the time when the device under test sends out the first response signal and the processing device obtains the first response signal from the device under test. In the actual test process, the time difference from the device under test sending out the first response signal to the processing device detecting the first response signal is extremely short, so the delay error generated by the first response signal from the processing device can be basically ignored.

[0085] By reading the fault injection start time and the fault confirmation start time from the processing device and obtaining the time difference between the two times, the fault detection time interval (FDTI) can be obtained.

[0086] S306: The device under test sends a second response signal to the processing device, where the second signal indicates that the device under test has responded to the first fault state indicated by the second excitation signal.

[0087] This step is implemented by the device under test in the fault injection test system. For a detailed introduction to the device under test, please refer to Figure 1 More content in the embodiments. When the device under test responds to the first fault state and has transitioned to a safe state (eg, controlling operations such as disconnection of a contactor), the device under test sends a second response signal, which indicates that the device under test has completed responding to the first fault state.

[0088] S307: The processing device determines the time when the device under test sends the second response signal as the fault response time of the device under test.

[0089] This step is implemented by the processing device in the fault injection test system. For a detailed introduction to the processing device, please refer to Figure 1More content in the embodiments. In theory, the fault response time is the time when the device under test responds to the first fault state and transitions to a safe state. Since the time when the device under test responds to the first fault state and transitions to a safe state is difficult to determine, the present application determines the fault response time by the time when the device under test sends a second response signal and the processing device obtains the second response signal from the device under test. In the actual test process, the time difference from when the device under test sends the second response signal to when the processing device detects the second response signal is extremely short, so the delay error generated by the processing device obtaining the second response signal can be basically ignored.

[0090] By reading the fault confirmation start time and the fault response time from the processing device and obtaining the time difference between the two times, the fault response time interval (FRTI) can be obtained.

[0091] Next, another fault injection test method is introduced. It can be understood that the fault injection method introduced in these two embodiments can fully implement Figure 1 All relevant functions of the fault injection test system shown and Figure 2 All relevant content of the waveform changes shown.

[0092] See also Figure 4 , Figure 4 This is a flow chart of another fault injection test method provided by the present application. This embodiment introduces the fault injection test method of the present application by switching the control switch of the fault injection device from enabled to disabled, which can be achieved Figure 1 The fault injection test system shown and Figure 2 The steps S401 to S405 shown in this embodiment can be regarded as a continuation of steps S301 to S307. The specific steps are as follows:

[0093] S401: The fault injection device sends a second stimulus signal to the device under test, and sends a second measurement signal to the processing device.

[0094] This step is implemented by the fault injection device in the fault injection test system. For a detailed introduction to the fault injection device, please refer to Figure 1 More details in the embodiments. The fault injection device is in an enabled state at this time and continues to inject faults into the device under test. For more details, please refer to Figure 1 and Figure 2 The detailed description of the illustrated embodiment and steps S301 to S307 will not be repeated here.

[0095] S402: When the fault injection device receives an instruction to stop fault injection, the fault injection device changes the signal sent to the device under test from the second stimulus signal to the first stimulus signal, and changes the signal sent to the processing device from the second measurement signal to the first measurement signal.

[0096] This step is implemented by the fault injection device in the fault injection test system. For a detailed introduction to the fault injection device, please refer to Figure 1 More content in the embodiment. At this time, the fault injection device changes the enabling state of the control switch from enabled to disabled, and the fault injection device stops injecting faults into the device under test. For more related content, please refer to Figure 1 and Figure 2 The detailed description of the illustrated embodiment and steps S301 to S307 will not be repeated here.

[0097] S403: The processing device determines the moment when the signal sent by the fault injection device changes from the second measurement signal to the first measurement signal as the moment when the fault injection of the system under test ends.

[0098] This step is implemented by the processing device in the fault injection test system. For a detailed introduction to the processing device, please refer to Figure 1 More content in the embodiments. In theory, the end time of fault injection is the moment when the control switch changes its enable state from enabled to disabled after receiving an instruction to stop fault injection. Since the moment when the fault injection device enables the control switch is difficult to determine, the present application obtains the first measurement signal or the second measurement signal from the fault injection device through a processing device, and determines the end time of fault injection by the moment when the second measurement signal is converted into the first measurement signal. In the actual testing process, the time difference between the enabling switch of the control switch by the fault injection device and the detection of the transition of the measurement signal state by the processing device is extremely short, so the delay error generated by obtaining the measurement signal state through the processing device can be basically ignored. For more related content, please refer to Figure 1 and Figure 2 The detailed description of the illustrated embodiment and steps S301 to S307 will not be repeated here.

[0099] S404: When the device under test detects the first excitation signal, the device under test stops sending the first response signal to the processing device.

[0100] This step is implemented by the device under test in the fault injection test system. For a detailed introduction to the device under test, please refer to Figure 1More content in the embodiment. When the signal received by the device under test changes from the second excitation signal to the first excitation signal, the device under test will no longer receive the signal containing the first fault state. When the device under test detects that the first fault state is eliminated, it stops sending the first response signal. For more related content, please refer to Figure 1 and Figure 2 The detailed description of the illustrated embodiment and steps S301 to S307 will not be repeated here.

[0101] S405: The processing device determines the time when the device under test stops sending the first response signal as the time when the fault confirmation of the device under test ends.

[0102] This step is implemented by the processing device in the fault injection test system. For a detailed introduction to the processing device, please refer to Figure 1 More content in the embodiments. In theory, the fault confirmation end time is the moment when the device under test detects that the first fault state disappears and stops sending the first response signal. Since the moment when the device under test detects that the first fault state disappears is difficult to determine, the present application determines the fault confirmation end time by the moment when the device under test stops sending the first response signal and the processing device detects that the first response signal disappears. In the actual test process, the time difference from when the device under test stops sending the first response signal to when the processing device detects that the first response signal disappears is extremely short, so the delay error caused by the processing device detecting that the first response signal disappears can be basically ignored.

[0103] After obtaining the fault confirmation end time, the fault recovery time interval (FRSTI) can be obtained by reading the fault injection end time and the fault confirmation end time read by the processing device and obtaining the time difference between the two times. The fault injection test method provided by S301 to S307 and steps S401 to S405 can not only accurately determine the start time and end time of the fault injection, which is used to obtain accurate fault detection time interval and fault recovery time interval, but also realize the function of performing fault injection testing on various types of devices under test.

[0104] Combined with the above Figures 1 to 4 , describes in detail the fault injection test method and system provided by the present application, and will be combined with Figure 5 A computing device provided according to the present application is described.

[0105] Figure 5 is a schematic diagram of a computing device provided by the present application, the computing device may be an electronic device with independent computing resources in the fault injection test system in the aforementioned content, for implementing the following Figure 1 The relevant functional operation of the fault injection test system shown, and Figure 2The related functions of reading or displaying multiple signal states shown in the figure, and the specific process implementation of the fault injection test method shown in steps S301 to S307 and steps S401 to S405.

[0106] Furthermore, the computing device includes a processor 501, a storage unit 502, a storage medium 503 and a communication interface 504, wherein the processor 501, the storage unit 502, the storage medium 503 and the communication interface 504 communicate via a bus 505, and also communicate via other means such as wireless transmission.

[0107] The processor 501 is composed of one or more general-purpose processors, such as a CPU, an NPU, or a combination of a CPU and a hardware chip. The above-mentioned hardware chip is an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The above-mentioned PLD is a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), a data processing unit (DPU), a system on chip (SoC), or any combination thereof. The processor 501 executes various types of digital storage instructions, such as software or firmware programs stored in the storage unit 502, which enables the computing device to provide a wider variety of services.

[0108] In a specific implementation, as an embodiment, the processor 501 includes one or more CPUs, such as Figure 5 CPU0 and CPU1 are shown in the figure.

[0109] In a specific implementation, as an embodiment, the computing device also includes multiple processors, such as Figure 5 501 and 506 are shown in FIG. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). A processor here refers to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0110] The storage unit 502 is used to store program codes, and is controlled by the processor 501 to execute the above Figures 1 to 4The processing steps of the fault injection test method and system in any embodiment of the present invention. The program code includes one or more software units. The one or more software units are Figure 1 Specific functions of the stimulation device 110 , the measurement device 120 , the fault injection device 130 , the power supply device 140 , the device under test 150 and the processing device 170 in the embodiment.

[0111] The storage unit 502 includes a read-only memory and a random access memory, and provides instructions and data to the processor 501. The storage unit 502 also includes a non-volatile random access memory. The storage unit 502 is a volatile memory or a non-volatile memory, or includes both volatile and non-volatile memories. Among them, the non-volatile memory is a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory is a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are used, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct rambus RAM (DR RAM). It can also be a hard disk, a universal serial bus (USB), a flash memory, a secure digital memory card (SD card), a memory stick, etc. The hard disk is a hard disk drive (HDD), a solid state disk (SSD), a mechanical hard disk (HDD), etc., and this application does not make specific limitations.

[0112] The storage medium 503 is a carrier for storing data, such as a hard disk, a USB flash drive (universal serialbus), a flash memory, a secure digital memory card (SD card), a memory stick, etc. The hard disk can be a hard disk drive (HDD), a solid state disk (SSD), a mechanical hard disk (HDD), etc., and this application does not make specific limitations.

[0113] The communication interface 504 is a wired interface (such as an Ethernet interface), an internal interface (such as a high-speed serial computer expansion bus (Peripheral Component Interconnect express, PCIe) bus interface), a wired interface (such as an Ethernet interface) or a wireless interface (such as a cellular network interface or a wireless local area network interface) for communicating with other servers or units.

[0114] The bus 505 is a Peripheral Component Interconnect Express (PCIe) bus, an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), etc. The bus 505 is divided into an address bus, a data bus, a control bus, etc.

[0115] In addition to the data bus, the bus 505 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are labeled as bus 505 in the figure. In some possible embodiments, the bus 505 may correspond to Figure 1 The bus device 160 in the illustrated embodiment.

[0116] Need to explain, Figure 5 This is only one possible implementation of the embodiment of the present application. In actual applications, the computing device may also include more or fewer components, which is not limited here. Figures 1 to 4 The relevant explanations in the embodiments will not be repeated here.

[0117] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device performs a fault injection test method.

[0118] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a high-density digital video disc (DVD)), or a semiconductor medium (for example, a solid-state hard disk), etc. The computer-readable storage medium includes instructions that instruct the computing device to perform a fault injection test method, or instruct the computing device to perform a fault injection test method.

[0119] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product includes a plurality of computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function according to the embodiment of the present invention is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0120] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent repairs or replacements within the technical scope disclosed by the present invention, and these repairs or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A fault injection testing method, characterized in that: Applied to a fault injection test system, the fault injection test system comprises a fault injection device and a processing device, the fault injection device is connected to the processing device, the fault injection device is connected to the device under test, and comprises: The fault injection device sends a first excitation signal to the device under test, and sends a first measurement signal to the processing device, wherein the first excitation signal is a signal indicating that the device under test is in a non-fault state; In the case where the fault injection device receives an instruction to start fault injection, the fault injection device changes the signal sent to the device under test from the first excitation signal to a second excitation signal, and the fault injection device changes the signal sent to the processing device from the first measurement signal to a second measurement signal, wherein the second excitation signal is a signal indicating that the device under test is in a first fault state; The processing device determines the time when the signal emitted by the fault injection device changes from the first measurement signal to the second measurement signal as the fault injection start time of the device under test.

2. The method according to claim 1, characterized in that: The signal sent by the fault injection device to the device under test changes from the first excitation signal to the second excitation signal, and the signal sent by the fault injection device to the processing device changes from the first measurement signal to the second measurement signal, which are performed synchronously.

3. The method according to claim 1 or 2, characterized in that: Before the fault injection device changes the signal sent to the device under test from the first excitation signal to the second excitation signal, the method further includes: the fault injection device acquires the first excitation signal and the second excitation signal; The fault injection device changes the signal sent to the processing device from the first stimulus signal to the second stimulus signal, including: The fault injection device selects the second excitation signal from the first excitation signal and the second excitation signal according to the instruction to start the fault injection, and sends the second excitation signal to the device under test.

4. The method according to any one of claims 1 to 3, characterized in that Before the fault injection device changes the signal sent to the processing device from the first measurement signal to the second measurement signal, the method further includes: the fault injection device acquiring the first measurement signal and the second measurement signal; The fault injection device changes the signal sent to the processing device from the first measurement signal to a second measurement signal, including: The fault injection device selects the second measurement signal from the first measurement signal and the second measurement signal according to the instruction to start the fault injection, and sends the second measurement signal to the device under test.

5. The method according to any one of claims 1 to 4, characterized in that The first measurement signal and the second measurement signal are different signals generated according to a target type signal in the device under test, the first measurement signal, the second measurement signal and the target type signal belong to the same signal type, and the first measurement signal and the second measurement signal have different amplitudes.

6. The method according to any one of claims 1 to 5, characterized in that After the fault injection device changes the signal sent to the processing device from the first measurement signal to a second measurement signal, the method further includes: When the device under test detects the second excitation signal, the device under test sends a first response signal to the processing device; The processing device determines the time when the device under test sends the first response signal as the fault confirmation start time of the device under test.

7. The method according to claim 6, characterized in that The method further includes: the processing device determining a fault detection time interval of the device under test according to the fault injection start time and the fault confirmation start time.

8. The method according to any one of claims 7, characterized in that A period for the fault injection device to send the first measurement signal to the processing device and a period for sending the second measurement signal to the processing device are both shorter than the fault detection time interval.

9. The method according to any one of claims 6 to 8, characterized in that: After the device under test sends a first response signal to the processing device, the method further includes: The device under test sends a second response signal to the processing device, wherein the second signal indicates that the device under test has responded to the first fault state represented by the second excitation signal; The processing device determines the time when the device under test sends the second response signal as the fault response time of the device under test.

10. The method according to claim 9, characterized in that The method further comprises: The processing device determines the fault response time interval of the device under test according to the fault response time and the fault confirmation start time.

11. The method according to any one of claims 6 to 10, characterized in that After the fault injection device changes the signal sent to the processing device from the first measurement signal to a second measurement signal, the method further includes: When the fault injection device receives an instruction to stop fault injection, the fault injection device changes the signal sent to the device under test from the second stimulus signal to the first stimulus signal, and the fault injection device changes the signal sent to the processing device from the second measurement signal to the first measurement signal; The processing device determines the time when the signal emitted by the fault injection device changes from the second measurement signal to the first measurement signal as the fault injection end time of the device under test.

12. The method according to claim 11, characterized in that After the fault injection device changes the signal sent to the device under test from the second stimulus signal to the first stimulus signal, the method further includes: The device under test stops sending the first response signal to the processing device; The processing device determines the time when the device under test stops sending the first response signal as the fault confirmation end time of the device under test.

13. The method according to claim 12, characterized in that The method further comprises: The processing device determines a fault recovery time interval of the device under test according to the fault injection end time and the fault confirmation end time.

14. A fault injection test system, characterized in that: include: A fault injection device, configured to send a first excitation signal to the device under test, and send a first measurement signal to the processing device, wherein the first excitation signal is a signal corresponding to indicating that the device under test is in a non-fault state; The fault injection device is used to, upon receiving an instruction to start fault injection, change the signal sent to the device under test from a first excitation signal to a second excitation signal, and the fault injection device changes the signal sent to the processing device from the first measurement signal to a second measurement signal, wherein the second excitation signal is a signal corresponding to indicating that the device under test is in a first fault state, the first fault state being one of a plurality of fault states that can be detected by the device under test, and the starting of fault injection includes instructing the fault injection device to inject the first fault state into the device under test; The processing device is used to determine the time when the first measurement signal sent by the fault injection device changes into the second measurement signal as the fault injection start time of the device under test.

15. A computing device, characterized in that: The method comprises a memory and a processor, wherein the memory stores instructions, and when the processor executes the instructions in the memory, the method according to any one of claims 1 to 13 can be implemented.

16. A vehicle, characterized in that: Includes the computing device according to claim 15 or the fault injection test system according to claim 14.

17. A non-volatile storage medium, characterized in that: The method comprises a plurality of instructions, and when the instructions are executed by a processor, the method according to any one of claims 1 to 13 can be implemented.

Images