CAN signal fault injection function safety test device based on vehicle integration
By designing a CAN signal fault injection functional safety test device based on vehicle integration, the problem of insufficient accuracy and controllability of CAN signal fault injection testing in the prior art is solved. It realizes efficient and accurate fault injection and safety status monitoring in a real vehicle environment, supports the complete fault model configuration of ISO26262 standard, and improves the objectivity and repeatability of the test.
Patent Information
- Application Number
- CN202610127167.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-29
- Publication Date
- 2026-05-01
AI Technical Summary
Existing CAN signal fault injection testing techniques lack accuracy and controllability in a vehicle integration environment, making it difficult to simulate complex fault scenarios without affecting the normal communication of the vehicle network. Furthermore, existing tools lack full support for the ISO26262 standard, making it difficult to guarantee the objectivity and accuracy of test results.
Design a vehicle-integrated CAN signal fault injection functional safety test device. Through the coordinated work of a dual-channel CAN interface module, a fault injection module, a safety monitoring module, and a timing processing module, it can achieve accurate fault injection and safety status monitoring of the ECU under test. It supports complete fault model configuration and high-precision timing according to the ISO26262 standard.
It enables controlled fault injection testing of the tested ECU in a real vehicle environment, improving the authenticity and engineering guidance value of the test results, ensuring the repeatability and accuracy of the test, and supporting automated simulation and monitoring of various complex fault scenarios.
Smart Images
Figure CN121956967A_ABST
Abstract
Description
A functional safety test device for CAN signal fault injection based on vehicle integration Technical Field
[0001] This invention relates to the field of automotive electronic system testing technology, and specifically to a safety testing device for CAN signal fault injection function based on vehicle integration. Background Technology
[0002] With the rapid advancement of automotive intelligence and connectivity, the number and complexity of electronic control units (ECUs) in modern vehicles have increased dramatically. These systems control numerous critical functions, ranging from powertrain and chassis safety to advanced driver assistance systems. Ensuring the functional safety of these electronic and electrical systems—that is, maintaining the vehicle's safety even in the event of a malfunction—has become a crucial aspect of automotive research and development. The international standard ISO 26262 provides a comprehensive framework for the development and evaluation of functional safety in automotive electronic and electrical systems, explicitly stating that functional safety testing during the vehicle integration phase is an indispensable verification activity. At this stage, the system is integrated into a real vehicle environment, exposing problems arising from complex interactions that cannot be detected during individual component testing. The Controller Area Network (CAN bus), as the main backbone network for real-time data exchange between various ECUs within the vehicle, directly impacts the functional safety of the entire vehicle. Therefore, during the vehicle integration phase, performing fault injection testing on the ECUs communicating via the CAN bus, simulating various anomalies that may occur in the communication link, and verifying whether the safety mechanisms of the ECUs and the entire vehicle system respond correctly, becomes a critical and highly challenging task in assessing the functional safety compliance of the final product.
[0003] However, current techniques for CAN signal fault injection testing in a vehicle integration environment have significant shortcomings and limitations. One common approach is laboratory stand-alone testing, which involves simulating the required CAN communication environment for a single ECU on a test bench and injecting faults. While this method offers controllable conditions, it completely deviates from the real vehicle network context and cannot reproduce the complex bus loads, multi-node interactions, random message contention, and specific network topology effects found in real vehicles. Therefore, the test results cannot fully reflect the ECU's safety performance in real-world usage scenarios. Another approach is to test directly in the actual vehicle network, for example, by using a generic CAN card connected in parallel on the bus to send interference messages. While this method provides a realistic environment, it has serious problems: parallel connection may alter network impedance characteristics, affecting communication quality; broadcast interference messages affect all nodes on the network, not just the tested ECU, compromising the test's specificity and controllability; more importantly, it is difficult to precisely control the timing and target of fault injection, and it is impossible to simulate complex fault scenarios such as specific message loss, precise delays, or message sequence errors without interfering with the normal operation of other nodes. Furthermore, existing testing tools often focus on network communication analysis or simple message simulation, lacking dedicated design and integration for functional safety testing. They typically do not support convenient configuration and injection of the complete series of communication fault models defined by the ISO 26262 standard, and struggle to achieve precise synchronization of fault injection timing, multi-channel automatic monitoring of safety status signals, and high-precision automatic measurement of critical parameter fault tolerance time intervals. These deficiencies lead to inefficiency in the vehicle-level functional safety verification process, difficulty in ensuring test coverage, and heavy reliance on manual operation and result interpretation by test personnel, posing significant challenges to the objectivity, accuracy, and repeatability of the tests. Summary of the Invention
[0004] The technical problem solved by this invention is to provide a CAN signal fault injection function safety test device based on vehicle integration, which can provide highly accurate and controllable dedicated fault injection test for real vehicle CAN network and support automated safety verification.
[0005] The basic solution provided by this invention is a safety testing device for CAN signal fault injection function based on vehicle integration. Its features include: an operating console and a test control board; the operating console includes a fault configuration module and an operation display module; the fault configuration module is used to configure the CAN signal fault type to be injected into the ECU under test and the fault injection target; the operation display module is used to send a fault trigger command to the test control board and receive and display the test results; the test control board includes a dual-channel CAN interface module, a fault injection module, a safety monitoring module, and a timing processing module; the dual-channel CAN interface module includes a first CAN interface and a second CAN interface, the first CAN interface being used to connect to the vehicle's CAN network, and the second CAN interface being used for... The system connects to the ECU under test; a fault injection module, used to forward CAN messages received by the vehicle's CAN network through the first CAN interface to the ECU under test through the second CAN interface when no fault trigger command is received, and to perform corresponding fault injection operations on the CAN messages during the forwarding process according to the configured fault type and fault injection object when a fault trigger command is received; a safety monitoring module, used to monitor the safety status signal fed back by the ECU under test in real time after the fault injection operation is executed; and a timing processing module, used to start timing from the execution of the fault injection operation and stop timing when the safety monitoring module detects the safety status signal, to obtain the fault handling time interval FHTI, and send the fault handling time interval FHTI as the test result to the operating console.
[0006] The principle and advantages of this invention are as follows: the test device is connected in series between the vehicle's CAN network and the ECU under test in a bridging manner, forming a physical connection path of "vehicle network - test device - ECU under test". The test control board has dual CAN interfaces, one connected to the real vehicle network and the other connected to the ECU under test. When no fault is triggered, the device operates in transparent forwarding mode, ensuring that all necessary vehicle messages are delivered to the ECU under test without loss, maintaining its normal function; when a fault is triggered, the device precisely modifies or interferes with the specified messages flowing through it according to the configuration before forwarding, thereby realizing fault injection under real driving conditions. Compared with the prior art, its outstanding advantage is that it realizes the leap from laboratory single-machine environment to real vehicle environment for fault injection testing. Existing methods either simulate simplified networks on a bench, which cannot reproduce the complexity of real bus load and interaction; or they require destructively connecting interference devices in parallel on the real bus, which may affect the normal communication of other nodes. This solution achieves fully controlled fault injection testing of a single ECU under test in a real network context without interfering with the normal operation of other parts of the vehicle network, through serial bridging and transparent forwarding. The authenticity of the test results and their engineering guidance value are significantly improved.
[0007] Furthermore, the fault types injected by the fault injection module include: information duplication: repeatedly sending a specified CAN message in the message forwarded by the ECU under test; information loss: discarding a specified CAN message from the vehicle's CAN network during forwarding, preventing it from reaching the ECU under test; information delay: causing the forwarding time of a specified CAN message to be delayed by more than a specified threshold compared to its reception time from the vehicle's CAN network; information forgery: forwarding a CAN message to the ECU under test whose CAN identifier does not match the original message; information address error: forwarding a CAN message to the ECU under test whose address identifier in the data content does not match the original definition; information order error: disrupting the original forwarding order of a group of CAN messages; information corruption: tampering with the data content of a specified CAN message before forwarding it.
[0008] The device incorporates a complete fault generation algorithm for information duplication, loss, delay, forgery, address errors, sequence errors, and corruption. When a fault is configured and triggered, the algorithm operates on the real-time CAN message stream flowing through the test device. For example, for "information sequence errors," the algorithm identifies and buffers a set of consecutive specific messages, then shuffles their original order before forwarding them to the ECU under test; for "information loss," the algorithm discards the target message upon detection, interrupting its transmission to the ECU under test. These seven types of faults comprehensively cover the communication failure modes defined in standards such as ISO 26262. The shortcoming of existing technologies is that general-purpose bus tools or simple repeaters can usually only achieve message sending, receiving, or very simple data modification, lacking system support for complex fault models defined in standards, especially those related to time and sequence. This solution embeds a complete standard fault library into a dedicated device, enabling testers to systematically and comprehensively complete all specified types of fault injection tests in a vehicle environment, without needing to combine multiple tools or write complex scripts. Furthermore, the test control board also includes an interrupt management module, which manages and responds to multiple hardware interrupts, including a first CAN interrupt, a second CAN interrupt, and a timer interrupt: the first CAN interrupt is used to respond to the first CAN interface receiving CAN messages from the vehicle's CAN network; the second CAN interrupt is used to respond to requests from the tested ECU to send CAN messages through the second CAN interface box; and the timer interrupt is used to provide a clock reference for the timed transmission of the fault injection module and the timely processing of the timing module.
[0009] The first CAN interrupt is dedicated to handling the massive influx of messages from the vehicle network, ensuring that data can be read in a timely manner without loss; the second CAN interrupt is responsible for controlling the precise timing of message forwarding to the ECU under test; and the timing interrupt provides a stable time base for the entire system, used for task scheduling and high-precision timing. These three work together to ensure that the device can reliably bridge communication in a high-speed, high-load real CAN network, and accurately insert fault events and record their times.
[0010] The limitation of existing solutions lies in the fact that using software polling to process dual-channel CAN data is prone to message processing delays, loss, or timing disorders under high vehicle network loads, making fault injection points uncontrollable and causing severe inaccuracies in FHTI timing. This solution achieves precise real-time response through a hard interrupt mechanism, fundamentally ensuring the accuracy of fault injection timing, the timeliness of message forwarding, and the reliability of FHTI timing in complex real-world environments.
[0011] Furthermore, the safety monitoring module includes an I / O signal monitoring module and a CAN message monitoring module; the I / O signal monitoring module is used to acquire the level signal output by the ECU under test in real time through a general input data interface, and compare the level signal with a preset safety state level configuration; the CAN message monitoring module is used to listen to the CAN messages sent by the ECU under test on the second CAN interface, and match the listened message identifier and data content with the preset safety state CAN message configuration; the timing and processing unit stops timing when the I / O signal monitoring module detects a matching level signal change, or the CAN message monitoring module listens to a matching specific CAN message.
[0012] Simultaneously, the safety status responses of the ECU under test are captured at both the hardware pin and software protocol levels. The I / O signal monitoring module is directly connected to the ECU's dedicated safety function pins, such as the high and low bit outputs used to indicate the "fail-safe" state, and monitors their level changes in real time. The CAN message monitoring module listens for special messages representing the safety status, such as specific fault code frames, emitted by the ECU on the CAN bus connected to the ECU. Once either module detects a signal that matches the preset conditions, it determines that the ECU has entered a safe state and immediately stops the FHIT timer.
[0013] Furthermore, the fault configuration module includes a vehicle identification module and a fault injection target selection module; the vehicle identification module is used to listen to and display a list of CAN messages received through the first CAN interface for vehicle network communication; the fault injection target selection module is used to select from the message list and configure the identifier, data field address identifier and transmission sequence segment number of the target message to be injected with fault.
[0014] Furthermore, the operation display module includes a test sequence management module, an automated execution module, and a report generation module. The test sequence management module is used to configure and store continuous test sequences containing multiple different fault types, different fault injection objects, and corresponding triggering logic. The automated execution module is used to automatically execute multiple fault injection tests according to the continuous test sequences, and automatically record the fault type, fault injection object, and measured fault handling time interval (FHTI) for each test. The report generation module is used to compare and display the results of multiple automated tests in the form of a structured list or chart, and generate a test report based on the test results. Attached Figure Description
[0015] Figure 1 is a working diagram of the vehicle CAN network test device according to an embodiment of the vehicle-integrated CAN signal fault injection function safety test device of the present invention; Figure 2 is a structural block diagram of the vehicle CAN network test device according to an embodiment of the vehicle-integrated CAN signal fault injection function safety test device of the present invention; Figure 3 is a hardware architecture diagram of the test control board according to an embodiment of the vehicle-integrated CAN signal fault injection function safety test device of the present invention; Figure 4 is a software architecture diagram of the test control board according to an embodiment of the vehicle-integrated CAN signal fault injection function safety test device of the present invention; Figure 5 is a main scheduling workflow diagram according to an embodiment of the vehicle-integrated CAN signal fault injection function safety test device of the present invention; Figure 6 is an RS232 workflow diagram according to an embodiment of the vehicle-integrated CAN signal fault injection function safety test device of the present invention; Figure 7 is a vehicle-integrated fault injection workflow diagram according to an embodiment of the vehicle-integrated CAN signal fault injection function safety test device of the present invention; Figure 8 is a design diagram of the operation console interface according to an embodiment of the vehicle-integrated CAN signal fault injection function safety test device of the present invention. Detailed Implementation
[0016] The following detailed description of the specific implementation method is as follows: The embodiment is basically shown in Figures 1 and 2: A CAN signal fault injection functional safety test device based on vehicle integration includes an operating console and a test control board. The operating console includes a fault configuration module and an operation display module. In Figure 1, the test device is the present invention, and the EECUC is the device under test. The test device needs to consider forwarding message data in the vehicle's CAN network. ECUA, ECUB, and ECUD are other ECUs on the vehicle network.
[0017] The fault configuration module is used to configure the CAN model fault type to be injected into the ECU under test and the fault injection target.
[0018] The operation display module is used to send fault trigger commands to the test control board and receive and display test results. The test control board includes a dual-channel CAN interface module, a fault injection module, a safety monitoring module, and a timing processing module. The dual-channel CAN interface module includes a first CAN interface and a second CAN interface. The first CAN interface is used to connect to the vehicle's CAN network, and the second CAN interface is used to connect to the ECU under test. The fault injection module is used to forward CAN messages received by the vehicle's CAN network through the first CAN interface to the ECU under test through the second CAN interface when there is no fault trigger command. When a fault trigger command is received, the module performs corresponding fault injection operations on the CAN messages during the forwarding process according to the configured fault type and fault injection object.
[0019] The fault types injected by the fault injection module include: message duplication: repeatedly sending a specified CAN message in the message forwarded by the ECU under test; message loss: discarding a specified CAN message from the vehicle CAN network during forwarding, preventing it from reaching the ECU under test; message delay: causing the forwarding time of a specified CAN message to be delayed by more than a specified threshold compared to its reception time from the vehicle CAN network; message forgery: forwarding a CAN message to the ECU under test whose CAN identifier does not match the original message; message address error: forwarding a CAN message to the ECU under test whose address identifier in the data content does not match the original definition.
[0020] Information sequence error: Disrupts the original forwarding order of a group of CAN messages; Information corruption: Modifies the data content of a specified CAN message before forwarding it.
[0021] The safety monitoring module is used to monitor the safety status signal fed back by the ECU under test in real time after the fault injection operation is performed; the timing processing module is used to start timing when the fault injection operation is performed and stop timing when the safety monitoring module detects the safety status signal, to obtain the fault handling time interval FHTI, and send the fault handling time interval FHTI as the test result to the operating console.
[0022] To meet the aforementioned test scenarios and fault types, this embodiment selects a single MCU with dual-channel CAN as the core control unit of the test control board; a laptop computer with dedicated test software is selected as the operation console; the operation console and the test control board are connected via a USB-to-RS232 cable. The test control board and the device under test (DUT) are connected via an I / O interface cable to read the safety status signals emitted by the DUT's EECUC.
[0023] The hardware design of the test control board is shown in Figure 3. The test control hardware supports dual-channel CAN transceiver, which makes it easy to insert between the vehicle CAN and the CAN network of the device under test in the whole vehicle network test environment. It supports transparent transmission mode, which can ensure the normal operation of the device under test on the one hand, and insert set faults by changing the transparent transmission data packets to enter the CAN signal fault injection test.
[0024] The test control board is required to be able to set the high and low status bits of the safety state signal and the CAN message, so that it can respond to the safety state signal and the safety CAN message during the test, test the FHTI time interval, and transmit the test data back to the operation console for display via the RS232 interface.
[0025] The high and low status bits of the safety state and the CAN message are configured through the safety state configuration function on the operation console.
[0026] The test control board also includes an interrupt management module, which manages and responds to multiple hardware interrupts, including a first CAN interrupt, a second CAN interrupt, and a timer interrupt: the first CAN interrupt is used to respond to the first CAN interface receiving CAN messages from the vehicle's CAN network; the second CAN interrupt is used to respond to the request from the tested ECU to send CAN messages through the second CAN interface box; and the timer interrupt is used to provide a clock reference for the timed transmission of the fault injection module and the timely processing of the timing module.
[0027] Specifically, the software design architecture is shown in Figure 4. The dynamic task body of the entire software contains four main running task bodies, and the functions of each task body are shown in Table 1: Table 1
[0028] The software also has four interrupt tasks: RS232 interrupt, used to interact with the control console to transmit data; CAN1 interrupt, used to receive data from the vehicle's CAN network; CAN2 interrupt, used to forward CAN data packets to the device under test; and timer interrupt, used to generate clock signals.
[0029] The main scheduling workflow is shown in Figure 5. The main scheduling workflow begins with device startup. The system first performs initialization steps, completing the setting of various operating parameters and the configuration of interrupt resources. The process then enters a cyclic scheduling phase centered on timer data Ti. The main scheduler continuously reads the value of timer Ti and uses this value to make conditional judgments to determine which task body to call. First, it checks if the value of Ti is a multiple of 10, corresponding to a 1-millisecond time period. When the condition is met, the scheduler sequentially calls three core task bodies with a 1-millisecond period: the RS232 task body responsible for data communication with the host computer, the injection test task body executing fault injection core logic, and the storage task body handling configuration data reading, writing, and management. If the value of Ti is not a multiple of 10, the scheduler continues to check if it is a multiple of 100, corresponding to a 10-millisecond time period. When this condition is met, the scheduler calls the watchdog task body with a 10-millisecond period. This task is responsible for monitoring the system's operating status and preventing abnormal situations such as program crashes. The entire scheduling process, through this polling and judgment mechanism based on a strict time benchmark, enables reliable management and orderly execution of multiple critical tasks with different execution cycles, thereby ensuring the stable and coordinated operation of various functions of the testing device.
[0030] The RS232 task workflow is shown in Figure 6. Starting from the beginning, the raw data temporarily stored in the RS232 interrupt buffer is transferred to the protocol packet data area dedicated to protocol processing. The task then verifies the integrity of the protocol packet data; if the packet is incomplete, the current task flow ends. If the packet is complete, the task proceeds to the next step, parsing and extracting the core control words from the protocol packet. Next, the task checks the validity of the parsed control words; if the control word is invalid, the process also ends. Once the control word is confirmed as valid, the task executes the corresponding specific operations according to the instructions defined by that control word. These operations mainly include determining the specific fault injection command word to be triggered, configuring signal parameters related to the safety status response of the device under test, and configuring various objects and strategies required for fault injection testing. After all configuration operations are completed, the RS232 task flow ends.
[0031] The basic fault injection workflow for the entire vehicle is shown in Figure 7. The workflow begins with reading and parsing the data frame received from the CAN1 interface. The system first verifies the integrity of the data frame; if the frame data is incomplete, the current processing flow ends. If the data is complete, it continues reading the currently set fault injection command word. The validity of the command word is then judged. If the command word is invalid, it enters transparent forwarding mode, directly transmitting the original data packet from CAN1 to the CAN2 interface without loss. If the command word is valid, it enters the fault injection execution stage, where the data packet needs to be processed according to the pre-configured specific fault strategy. Selectable fault configuration strategies include various types such as incorrect information address, duplicate transmission, information delay, information loss, out-of-order transmission, information forgery, and information destruction. Based on the currently active fault configuration strategy, the system performs corresponding operations such as tampering, delaying, discarding, reordering, or content destruction on the original data packet received from CAN1, and finally forwards the processed fault data packet through the CAN2 interface. After completing the above operations, the fault injection workflow for this single data packet ends, and the system prepares to process the next data packet.
[0032] The safety monitoring module includes an I / O signal monitoring module and a CAN message monitoring module. The I / O signal monitoring module is used to acquire the level signal output by the ECU under test in real time through a general input data interface and compare the level signal with a preset safety state level configuration. The CAN message monitoring module is used to listen to the CAN messages sent by the ECU under test on the second CAN interface and match the listener message identifier and data content with the preset safety state CAN message configuration. The timing and processing unit stops timing when the I / O signal monitoring module detects a matching level signal change or the CAN message monitoring module listens to a matching specific CAN message.
[0033] The interface design of the control panel is shown in Figure 8.
[0034] The fault configuration module includes a vehicle identification module and a fault injection target selection module. The vehicle identification module is used to listen to and display a list of CAN messages received through the first CAN interface from the vehicle network communication. The fault injection target selection module is used to select from the message list and configure the identifier, data field address identifier, and transmission sequence segment number of the target message to be injected with the fault.
[0035] The operation display module includes a test sequence management module, an automated execution module, and a report generation module. The test sequence management module is used to configure and store continuous test sequences containing multiple different fault types, different fault injection objects, and corresponding triggering logic. The automated execution module is used to automatically execute multiple fault injection tests according to the continuous test sequences, and automatically record the fault type, fault injection object, and measured fault handling time interval (FHTI) for each test. The report generation module is used to compare and display the results of multiple automated tests in the form of a structured list or chart, and generate a test report based on the test results.
[0036] The interface in this embodiment includes three work areas: a signal configuration area for safe status, a configuration area for fault injection objects, and a display area for various fault triggers and test results.
[0037] The operation console was a laptop running Windows 11, and the testing software was developed using object-oriented Visual C++. The testing software's functions include: 1. Triggering functions for various fault injections, supporting 7 types of fault injection; 2. Fault injection object configuration functions, used to select the CAN-ID and DATA-ID of the data packets to be injected, and also to configure the sequence segment number of the data packets to be injected; 3. Safety status signal configuration functions, used to set the safety status signals and related CAN messages of the device under test.
[0038] To support the above functions, the operation console is also required to have RS232 driver functionality and test data acquisition and display capabilities.
[0039] The above are merely embodiments of the present invention. Commonly known structures and characteristics are not described in detail here. Those skilled in the art are aware of all common technical knowledge in the field prior to the application date or priority date, are aware of all existing technologies in that field, and have the ability to apply conventional experimental methods prior to that date. Those skilled in the art can, under the guidance of this application, improve and implement this solution in combination with their own capabilities. Some typical known structures or methods should not be obstacles for those skilled in the art to implement this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the structure of the present invention. These should also be considered within the scope of protection of the present invention, and will not affect the effectiveness of the implementation of the present invention or the practicality of the patent. The scope of protection claimed in this application should be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.
Claims
1. A functional safety test device for CAN signal fault injection based on vehicle integration, characterized in that: It includes an operating console and a test control board, wherein the operating console includes a fault configuration module and an operation display module; The fault configuration module is used to configure the CAN fault type to be injected into the ECU under test and the fault injection target; the operation display module is used to send fault trigger commands to the test control board and receive and display test results; the test control board includes a dual-channel CAN interface module, a fault injection module, a safety monitoring module and a timing processing module; The dual-channel CAN interface module includes a first CAN interface and a second CAN interface. The first CAN interface is used to connect to the vehicle's CAN network, and the second CAN interface is used to connect to the ECU under test. The fault injection module is used to forward CAN messages received by the vehicle's CAN network through the first CAN interface to the ECU under test through the second CAN interface when there is no fault trigger command. When a fault trigger command is received, the module performs the corresponding fault injection operation on the CAN message during the forwarding process according to the configured fault type and fault injection object. The safety monitoring module is used to monitor the safety status signal fed back by the ECU under test in real time after the fault injection operation is performed; the timing processing module is used to start timing when the fault injection operation is performed and stop timing when the safety monitoring module detects the safety status signal, to obtain the fault handling time interval FHTI, and send the fault handling time interval FHTI as the test result to the operating console.
2. The CAN signal fault injection functional safety test device based on vehicle integration as described in claim 1, characterized in that: The fault types injected by the fault injection module include: Information duplication: repeatedly sending a specified CAN message in the message forwarded by the ECU under test; Information loss: discarding a specified CAN message from the vehicle's CAN network during forwarding, preventing it from reaching the ECU under test; Information delay: causing the forwarding time of a specified CAN message to be delayed by more than a specified threshold compared to its reception time from the vehicle's CAN network; Information forgery: forwarding a CAN message to the ECU under test whose CAN identifier does not match the original message; Information address error: forwarding a CAN message to the ECU under test whose address identifier in the data content does not match the original definition; Information order error: disrupting the original forwarding order of a group of CAN messages; Information corruption: tampering with the data content of a specified CAN message before forwarding it.
3. The CAN signal fault injection functional safety test device based on vehicle integration as described in claim 1, characterized in that: The test control board also includes an interrupt management module, which manages and responds to multiple hardware interrupts, including a first CAN interrupt, a second CAN interrupt, and a timer interrupt: the first CAN interrupt is used to respond to the first CAN interface receiving CAN messages from the vehicle's CAN network; The second CAN interrupt is used to respond to a request from the tested ECU to send a CAN message through the second CAN interface box; The timer interrupt is used to provide a clock reference for the timed transmission of the fault injection module and the timely processing of the timing module.
4. The CAN signal fault injection functional safety test device based on vehicle integration according to claim 1, characterized in that: The safety monitoring module includes an I / O signal monitoring module and a CAN message monitoring module. The I / O signal monitoring module is used to acquire the level signal output by the ECU under test in real time through a general input data interface and compare the level signal with a preset safety state level configuration. The CAN message monitoring module is used to listen to the CAN messages sent by the ECU under test on the second CAN interface and match the listener message identifier and data content with the preset safety state CAN message configuration. The timing and processing unit stops timing when the I / O signal monitoring module detects a matching level signal change or the CAN message monitoring module listens to a matching specific CAN message.
5. The CAN signal fault injection functional safety test device based on vehicle integration according to claim 1, characterized in that: The fault configuration module includes a vehicle identification module and a fault injection object selection module; the vehicle identification module is used to listen to and display a list of CAN messages received through the first CAN interface from the vehicle network communication. The fault injection target selection module is used to select and configure the identifier, data field address identifier, and transmission sequence fragment number of the target message to be injected with fault from the message list.
6. The CAN signal fault injection functional safety test device based on vehicle integration according to claim 5, characterized in that: The operation display module includes a test sequence management module, an automated execution module, and a report generation module; The test sequence management module is used to configure and store continuous test sequences containing multiple different fault types, different fault injection objects, and corresponding triggering logic; An automated execution module is used to automatically execute multiple fault injection tests according to the continuous test sequence, and automatically record the fault type, fault injection object and measured fault handling time interval (FHTI) for each test. The report generation module is used to compare and display the results of multiple automated tests in the form of structured lists or charts, and generate test reports based on the test results.