A hardware reliability test method and system based on FMEDA combined with fault injection

Abstract

The application discloses a kind of hardware reliability test method and system based on FMEDA and the combination of fault injection, which comprises: the module division is carried out to power protection device hardware and combing BOM list;FMEDA analysis is executed, failure mode is identified, failure influence is analyzed, diagnostic mechanism is combed, diagnostic coverage is calculated, high-risk fault points are screened and list is formed;Formulate directional fault injection scheme based on the list;Build test environment and complete baseline test;High-risk fault is injected one by one, and response and recovery data are recorded;Compare diagnostic coverage theoretical value with measured value, optimize diagnostic mechanism and form closed-loop test process.The application realizes the closed loop of fault analysis-verification-optimization through the deep combination of FMEDA and fault injection, solves the problem that traditional test is weak in pertinence and diagnostic mechanism effectiveness cannot be measured and verified, improves the reliability of power protection device hardware, and meets the functional safety standard requirements.

Description

Technical Field

[0001] This invention relates to a hardware reliability testing method and system based on the combination of FMEDA and fault injection, belonging to the field of hardware reliability testing technology. Background Technology

[0002] As core equipment in a power system, the reliability of power protection devices directly affects the stable operation of the power system. If a hardware failure occurs and cannot be detected and recovered in a timely manner, it may lead to serious consequences such as the escalation of the power system fault and power outages. Therefore, conducting comprehensive and effective reliability testing on the hardware of power protection devices to verify their fault detection, fault tolerance, and recovery capabilities is crucial to ensuring the safety of the power system.

[0003] Currently, hardware reliability testing is mainly divided into two methods: fault injection testing and FMEDA (Failure Mode, Effects, and Diagnostic Analysis). FMEDA is primarily used to identify potential hardware failure modes, analyze the impact of failures, and evaluate the effectiveness of diagnostic mechanisms. It can quantify reliability indicators such as diagnostic coverage. However, FMEDA is only a theoretical analysis, and the accuracy of its results cannot be verified through actual testing. It may suffer from problems such as unreasonable diagnostic mechanism design and omission of high-risk failure points. Fault injection testing verifies system reliability by manually injecting faults. However, traditional fault injection is often random or blind, lacking specificity, resulting in low testing efficiency, inability to focus on high-risk failure points, and inability to effectively link with FMEDA analysis, making it difficult to optimize and iterate the diagnostic mechanism.

[0004] Meanwhile, existing testing methods lack a complete closed-loop process, failing to combine theoretical analysis results from FMEDA with measured fault injection data. This results in limited reference value of the test results, making it difficult to meet the hardware reliability requirements of functional safety standards such as IEC 61508 and GB / T20438.2 for power protection devices. Furthermore, the hardware configuration of existing testing systems lacks standardized definitions; the parameter specifications, interface types, and collaborative logic of each device are unclear, leading to cumbersome test environment setup and poor compatibility, further impacting testing efficiency and the consistency of test results. Therefore, there is an urgent need for a reliability testing method and system that can deeply integrate FMEDA and fault injection to form a closed-loop test, is highly targeted and quantifiable, and possesses standardized hardware configuration to address the shortcomings of existing technologies. Summary of the Invention

[0005] The purpose of this invention is to overcome the technical problems of existing technologies, such as the inability to verify FMEDA analysis results through actual testing, the lack of targeted fault injection, the absence of a complete closed-loop testing process, and the non-standardized hardware configuration, poor compatibility, and cumbersome setup of the testing system. This invention provides a hardware reliability testing method and system that combines FMEDA and fault injection, realizing a closed loop of fault analysis, verification, and optimization, clarifying the hardware specifications and collaborative logic of the testing system, improving the targeting and efficiency of testing, and ensuring that the reliability of the power protection device hardware meets functional safety requirements.

[0006] To achieve the above objectives / to solve the above technical problems, the present invention is implemented using the following technical solution:

[0007] First aspect: A hardware reliability testing method based on FMEDA combined with fault injection, the method comprising:

[0008] Step S1: Modularize the power protection device to obtain the hardware BOM list.

[0009] Step S2: Based on FMEDA analysis, identify the failure modes of each hardware module in the hardware BOM list and their impact on the device's functionality and safety performance, calculate the theoretical diagnostic coverage of each failure mode, and screen out high-risk failure points according to the failure impact level, theoretical diagnostic coverage and safety failure rate to form a high-risk failure list.

[0010] Step S3: Based on the list of high-risk faults, formulate a targeted hardware fault injection plan and set the qualification criteria after fault injection.

[0011] Step S4: Set up a test environment that includes the power protection device under test, the fault injection device, and the data acquisition and monitoring device, and perform initialization calibration and baseline status confirmation on the power protection device under test.

[0012] Step S5: Based on the established test environment, under fault-free injection conditions, control the power protection device under test to operate for at least one complete working cycle, record baseline operating data, and establish a reference benchmark for the normal operating status of the device.

[0013] Step S6: According to the directional hardware fault injection scheme, perform directional fault injection on the high-risk fault points of the power protection device under test one by one, and collect device response data and operating status in real time.

[0014] Step S7: After each type of fault injection is completed, maintain the device in operation for a preset time, monitor and record the fault recovery status of the device and the operating parameters after recovery;

[0015] Step S8: Compare and analyze the acquired fault injection real-time acquisition device response data and the recovery operation parameters after fault injection with the theoretical diagnostic coverage. If the measured value is lower than the theoretical value or there are uncovered faults, optimize the hardware or software diagnostic mechanism until a closed-loop test result that meets the preset reliability requirements is formed.

[0016] Optionally, the calculation of the theoretical diagnostic coverage for each fault mode includes:

[0017] FMEDA analysis includes intra-module FMEDA analysis and inter-module interface FMEDA analysis. The two are combined to form module-level and system-level fault impact assessment and diagnostic coverage calculation.

[0018] Based on the hardware BOM list, fault modes are identified component by component. The fault modes include electrical faults, interface faults, and component-level faults. For each fault mode FM_i, its failure rate λ_i is calculated according to formula (1):

[0019] (1)

[0020] In the formula, This is the reference failure rate for the components. These are voltage stress factor, temperature stress factor, environmental factor, and quality factor, respectively.

[0021] When fault mode FM i When the fault mode is covered by n diagnostic mechanisms simultaneously, the theoretical diagnostic coverage DC is calculated by superimposing the results according to the probability parallel formula (2). i :

[0022] (2)

[0023] As can be seen from formula (2), the theoretical diagnostic coverage rate after multiple diagnostic mechanisms are superimposed in parallel is always greater than the coverage rate of any single mechanism, thus improving the diagnostic coverage rate through the synergy of soft and hard diagnostic mechanisms.

[0024] The theoretical diagnostic coverage of each fault mode within the module is weighted and summed according to formula (3) with the failure rate as the weight, to obtain the module-level diagnostic coverage DC of the module. 模块 :

[0025] (3)

[0026] In the formula, k is the index variable of the diagnostic mechanism, DCi,k is the single diagnostic coverage of the k-th diagnostic mechanism for the fault mode FMi, m is the total number of fault modes contained in the module, i is the index variable of the fault mode, and λi is the failure rate of the fault mode FMi.

[0027] Optionally, the impact on the device's functionality and safety performance includes:

[0028] The hardware diagnostic mechanism includes watchdog monitoring, voltage monitoring, current detection, redundancy design, and differential sampling; the software diagnostic mechanism includes checksum verification, periodic heartbeat detection, parameter rationality verification, and interlock logic verification.

[0029] Optionally, the fault injection scheme includes:

[0030] Pin fault injection, electrical parameter disturbance, timing and signal interference; the injection parameters include voltage fluctuation amplitude, fault injection duration, packet loss rate and clock jitter range.

[0031] Optionally, the qualification criteria after fault injection include:

[0032] After fault injection, the tested power protection device is free from irreversible damage, the fault detection time does not exceed the preset threshold, the fault recovery time does not exceed the preset threshold, the core protection functions are not lost, and the measured value of diagnostic coverage is not lower than the preset target value.

[0033] If irreversible damage occurs to the power protection device under test during the fault injection process, stop the subsequent injection of this type of fault, record the fault phenomenon and the degree of damage, and conduct cause analysis and optimization.

[0034] Optionally, the optimized hardware or software diagnostic mechanism includes:

[0035] Add hardware redundancy modules, optimize software diagnostic algorithms, adjust diagnostic thresholds, and add fault alarm logic.

[0036] Optionally, the method further includes:

[0037] After completing all fault injections and optimizations, the single-point fault index, potential fault index, and safety failure rate of the power protection device hardware are recalculated, and a hardware reliability test report is output.

[0038] The second aspect: a hardware reliability testing system based on a combination of FMEDA and fault injection, the system comprising:

[0039] Module partitioning unit: used to modularize the hardware of power protection devices to obtain a hardware BOM list;

[0040] FMEDA Analysis Unit: Used for FMEDA analysis to identify the failure modes of each hardware module in the hardware BOM and their impact on device functionality and safety performance, calculate the theoretical diagnostic coverage of each failure mode, and screen out high-risk failure points based on the failure impact level, theoretical diagnostic coverage and safety failure rate to form a high-risk failure list.

[0041] Fault Injection Scheme Formulation Unit: Used to formulate targeted hardware fault injection schemes based on a list of high-risk faults, and to set the acceptance criteria after fault injection.

[0042] Test environment setup unit: Used to set up a test environment that includes the power protection device under test, fault injection equipment and data acquisition and monitoring equipment, and to perform initialization calibration and baseline status confirmation on the power protection device under test;

[0043] Baseline test unit: Used to control the power protection device under test to operate for at least one complete working cycle under fault-free injection conditions based on the established test environment, record baseline operating data, and establish a reference benchmark for the normal operating status of the device;

[0044] Fault injection execution unit: used to inject high-risk faults into the tested power protection device one by one according to the directional hardware fault injection scheme, and to collect device response data and operating status in real time;

[0045] Data acquisition and monitoring unit: used to maintain the device in operation for a preset time after each type of fault injection is completed, monitor and record the fault recovery status of the device and the operating parameters after recovery;

[0046] Closed-loop optimization unit: It is used to compare and analyze the acquired fault injection real-time acquisition device response data and the recovery operation parameters after fault injection with the theoretical diagnostic coverage. If the measured value is lower than the theoretical value or there are uncovered faults, the hardware or software diagnostic mechanism is optimized until a closed-loop test result that meets the preset reliability requirements is formed.

[0047] Optionally, the testing system further includes standardized hardware components to ensure the stability, compatibility, and accuracy of the testing environment. These standardized hardware components work in conjunction with each functional unit, specifically including:

[0048] Industrial control computer: As the core control hardware of the system, it establishes communication connections with the FMEDA analysis unit, fault injection scheme formulation unit, fault injection execution unit, data acquisition and monitoring unit, and index calculation and report output unit to realize unified control, data interaction and command issuance of each unit, support multi-device collaborative work, and ensure the automated advancement of the testing process;

[0049] Signal conditioning module: The input end is connected to the fault injection device and the power protection device under test, and the output end is connected to the data acquisition device. It is used to filter, amplify, and level-convert the fault injection signal and the response signal output by the device under test, remove signal interference, and condition the signal to the range that the data acquisition device can recognize.

[0050] Isolation coupling module: Connected in series between the fault injection device and the power protection device under test, and between the data acquisition device and the power protection device under test. It adopts opto-isolation technology, with an isolation voltage ≥2500V AC and an isolation resistance ≥100MΩ. It is used to prevent mutual interference between the fault injection signal and the acquisition signal, protect the power protection device under test and the test equipment from voltage surges, and ensure the safety of the test process.

[0051] Power supply module: Includes main power supply unit and backup power supply unit, input voltage is 220V AC, output voltage is 24VDC, 12V DC, 5V DC, output current ≤10A, ripple ≤50mV, providing stable power supply for the entire test system;

[0052] Data storage module: It consists of two parts: local storage and cloud backup. The local storage uses industrial-grade solid-state drives with a capacity of ≥1TB and a read / write speed of ≥500MB / s, which are used to store test data, fault injection parameters, response data and test reports in real time. The cloud backup module is connected to the industrial control computer via Ethernet, which supports automatic synchronous backup of test data to achieve data security and traceability.

[0053] Communication interface module: integrates Ethernet interface, RS485 interface, CAN bus interface and USB 3.0 interface. The Ethernet interface speed is ≥1000Mbps, used for high-speed data interaction between industrial control computer and various test equipment and functional units; RS485 interface and CAN bus interface are used to connect with the communication module of the power protection device under test to realize real-time monitoring of the operating status of the device under test and data reading; USB 3.0 interface is used to connect external storage devices and debugging equipment.

[0054] Optionally, the fault injection device includes a hardware fault injector, a signal generator, and a power disturbance device; the data acquisition device includes an oscilloscope, a data logger, and a bus analyzer; and the status monitoring device includes host computer monitoring software and status indicator lights.

[0055] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0056] 1. This invention achieves a complete closed loop of fault analysis, verification, and optimization, overcoming the shortcomings of existing technologies where FMEDA theory and fault injection testing are disconnected. Existing FMEDA is merely static theoretical analysis, and its diagnostic coverage and other indicators cannot be verified through testing. Existing fault injection methods are mostly random or blind, lacking linkage with FMEDA. This invention uses the high-risk fault list output by FMEDA as the targeted input for fault injection, and compares the measured diagnostic coverage value obtained from fault injection testing with the theoretical value, driving iterative optimization of the diagnostic mechanism until the preset reliability requirements are met. This creates an iterative and reproducible closed loop between theoretical analysis and experimental verification, significantly improving the reference value of the test results.

[0057] 2. A two-level fault analysis method combining intra-module FMEDA and inter-module interface FMEDA is proposed, solving the problem that existing technologies only analyze the internal structure of a single module and cannot identify inter-module fault propagation and common-cause failures. This invention constructs an inter-module interface matrix, uses the Fault Propagation and Classification (FPTC) method to analyze the propagation path of upstream module faults to downstream modules via interface signals, and employs the β-factor method to evaluate multi-module common-cause failures. This enables the complete identification of cross-module coupled faults (such as power module power failure simultaneously affecting the CPU, sampling, and communication modules), avoiding the omission of high-risk fault points.

[0058] 3. A formula for calculating diagnostic coverage by combining the probabilities of multiple diagnostic mechanisms in parallel is given, realizing the quantitative calculation of diagnostic coverage and solving the problem that the diagnostic coverage value of existing technologies is subjective and estimated based on only a single mechanism.

[0059] 4. High-risk fault points are screened based on a three-dimensional criterion of fault impact level, theoretical diagnostic coverage, and safety failure rate, making fault injection highly targeted and significantly improving testing efficiency. Compared with traditional random injection or full injection, this invention only performs targeted injection on fault points that are "dangerous faults with diagnostic coverage of less than 60% and undetectable dangerous failure rates greater than a threshold," which greatly reduces the number of invalid injections while ensuring test coverage, shortening the test cycle and reducing test costs.

[0060] 5. This invention clarifies the parameter specifications and collaborative logic of standardized hardware components for the testing system, resolving the problems of non-standard hardware configurations, poor compatibility, and cumbersome setup in existing testing systems. The invention clearly defines the input / output parameters, isolation indicators, capacity, and speed of the industrial control computer, signal conditioning module, isolation coupling module, power supply module, data storage module (including cloud backup), and communication interface module. It also provides a collaborative logic of "command issuance—fault injection—signal conditioning and isolation—response acquisition—real-time monitoring—data storage," enabling rapid setup, reproducibility, and traceability of the testing environment, ensuring consistency of results across different test batches.

[0061] 6. Outputs quantitative reliability indicators such as Single Point of Failure (SPFM), Latent Failure (LFM), and Safe Failure Rate (FIT), meeting the hardware reliability requirements of functional safety standards such as IEC 61508 and GB / T 20438.2 for power protection devices. The indicator values, after closed-loop optimization, can directly serve as objective evidence for functional safety assessment, improving the safety of power protection devices operating in the power system and reducing the risk of serious consequences such as fault escalation and power outages caused by undetected hardware faults. Attached Figure Description

[0062] Figure 1 This is an overall flowchart of the hardware reliability testing method combining FMEDA and fault injection in an embodiment of the present invention;

[0063] Figure 2 This is a detailed flowchart of the FMEDA analysis in an embodiment of the present invention;

[0064] Figure 3 This is a detailed flowchart of fault injection in an embodiment of the present invention;

[0065] Figure 4 This is a structural block diagram of the hardware reliability testing system in an embodiment of the present invention;

[0066] Figure 5 This is a schematic diagram of the logic of FMEDA analysis and fault injection closed-loop optimization in an embodiment of the present invention. Detailed Implementation

[0067] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0068] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are used only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0069] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art will understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0070] Example 1 discloses a hardware reliability testing method based on the combination of FMEDA and fault injection, applicable to power protection device hardware, including the following steps:

[0071] S1. Divide the hardware of the power protection device into modules, organize the hardware BOM list, and divide the hardware into power supply module, sampling module, CPU control module, communication module, storage module and IO interface module;

[0072] S2. Perform FMEDA analysis to identify all fault modes of each hardware module, analyze the impact of each fault mode on the function, safety performance and measurement accuracy of the power protection device, sort out the existing hardware diagnostic mechanisms and software diagnostic mechanisms of each hardware module, calculate the diagnostic coverage (DC) of each fault mode, screen out high-risk fault points, and form a high-risk fault list; the high-risk fault points are those with high fault impact level, low diagnostic coverage and high safety failure rate (FIT).

[0073] S3. Based on the high-risk fault list obtained in step S2, formulate a targeted hardware fault injection plan, clarify the fault injection method, injection parameters, injection timing and injection duration for each high-risk fault point, and set the qualification judgment criteria after fault injection.

[0074] S4. Set up a hardware fault injection test environment, including the power protection device under test, fault injection equipment, data acquisition equipment and status monitoring equipment, calibrate all test equipment, put the power protection device under test into normal working condition, record the initial operating parameters, and complete the test preparation.

[0075] S5. Perform baseline testing. Without fault injection, run the power protection device under test for at least one complete working cycle, record the baseline operating data, and confirm that the power protection device under test is free of abnormalities.

[0076] S6. According to the fault injection scheme formulated in step S3, high-risk fault points of the power protection device under test are injected one by one in a targeted manner. Only one type of fault is injected each time. During the fault injection process, the fault injection parameters and the response data of the power protection device under test are recorded by the data acquisition equipment, and the operating status of the power protection device under test is observed in real time by the status monitoring equipment.

[0077] S7. After each type of fault injection is completed, keep the tested power protection device running for a preset time, observe its fault recovery, and record the fault recovery time and the operating parameters after recovery; each type of fault should be injected at least 3 times to ensure the repeatability of the test results;

[0078] S8. Compare the theoretical diagnostic coverage value obtained from FMEDA analysis with the measured diagnostic coverage value obtained from fault injection, analyze the reasons for uncovered faults and invalid diagnoses, optimize the hardware diagnostic mechanism and software diagnostic mechanism, and re-execute steps S2 to S7 to form a closed-loop test process of analysis-verification-optimization.

[0079] S9. After completing all fault injections and optimizations, recalculate the single point of failure (SPFM), latent failure (LFM), and safe failure rate (FIT) of the power protection device hardware, and output a hardware reliability test report.

[0080] Furthermore, in step S2, the FMEDA analysis includes two levels: intra-module FMEDA analysis and inter-module interface FMEDA analysis. The two are combined to form a fault impact assessment and diagnostic coverage calculation at the module level and the whole machine level.

[0081] For each hardware module (power module, sampling module, CPU control module, communication module, storage module, IO interface module) divided in step S1, the fault mode is identified component by component according to the hardware BOM list. The fault modes include electrical faults, interface faults, and component-level faults. For each fault mode FM_i, its failure rate λ_i is calculated according to formula (1):

[0082] (1)

[0083] In the formula, This is the reference failure rate of the component. These are voltage stress factor, temperature stress factor, environmental factor, and quality factor, with values ​​for each factor obtained from the SN 29500 or IEC 62380 component failure rate database.

[0084] Using the six hardware modules defined in step S1 as nodes, an inter-module interface matrix is ​​constructed. This matrix records the interface signals, signal types, and interface fault modes between any two hardware modules that interact with each other via signals or energy. These fault modes include, but are not limited to, overvoltage / undervoltage / power failure on the power supply bus, data drift or loss, short circuit / open circuit / frame corruption on the control bus, and read / write errors on the storage bus. For each interface fault mode, forward propagation analysis along the signal flow is performed using the Fault Propagation and Classification (FPTC) method to determine the final safety impact of an upstream module fault propagating to the downstream module via the interface signal. Based on functional safety standards, this final safety impact is categorized into three types: safe faults, hazardous faults, and faults with no impact. Only hazardous faults are included in the safety failure rate λ. DU The calculation is as follows. Furthermore, for cases where multiple modules are simultaneously affected by the same upstream fault, the β factor method is used to assess common cause failures between modules. The β factor value is determined based on the degree of physical and electrical isolation between modules, and the value ranges from 10% to 20%.

[0085] FM for each fault mode i This paper reviews existing hardware and software diagnostic mechanisms. The hardware diagnostic mechanisms include watchdog monitoring, voltage monitoring, current detection, redundancy design, and differential sampling. The software diagnostic mechanisms include checksum verification, periodic heartbeat detection, parameter rationality verification, and interlock logic verification. Based on the diagnostic coverage level table in Appendix C / D of the functional safety standard IEC 61508-6, the coverage of each diagnostic mechanism for fault mode FM is determined. i Diagnostic coverage DC i k, the gear positions include DC=0 (no diagnostic coverage, 0%), DC=a (simple diagnostics, 60%), DC=b (more comprehensive diagnostics, 90%), and DC=c (comprehensive diagnostics, 99%). When the fault mode is FM... i When the fault mode is covered by n diagnostic mechanisms simultaneously, the theoretical diagnostic coverage DC is calculated by superimposing the results according to the probability parallel formula (2). i :

[0086] (2)

[0087] As can be seen from formula (2), the theoretical diagnostic coverage rate after multiple diagnostic mechanisms are superimposed in parallel is always greater than the coverage rate of any single mechanism, thus improving the diagnostic coverage rate through the synergy of soft and hard diagnostic mechanisms.

[0088] The theoretical diagnostic coverage of each fault mode within the module is weighted and summed according to formula (3) with the failure rate as the weight, to obtain the module-level diagnostic coverage DC of the module. 模块 :

[0089] (3)

[0090] In the formula, m is the total number of fault modes contained in the module. The overall diagnostic coverage rate is obtained by weighting the module-level diagnostic coverage rates of each module according to the failure rate of each module, and is mapped to four levels according to the level mapping rules of IEC 61508-2: None, Low (60%), Medium (90%), and High (99%), which are used to determine the hardware margin requirements of the safety integrity level of the power protection device hardware.

[0091] The critical faults obtained from intra-module FMEDA analysis and inter-module interface FMEDA analysis are merged and deduplicated. High-risk fault points are selected according to the following criteria: the fault impact is a critical fault, and the theoretical diagnostic coverage (DC) is high. i Less than 60% (i.e., below the Low level) and an undetectable hazardous failure rate λ DU,i Greater than the preset failure rate threshold λ th The fault modes are included in the high-risk fault list and used as input for step S3 to formulate a targeted hardware fault injection plan.

[0092] In this embodiment, in step S2, the hardware diagnostic mechanism includes watchdog monitoring, voltage monitoring, current detection, redundancy design, and differential sampling; the software diagnostic mechanism includes checksum verification, periodic heartbeat detection, parameter rationality verification, and interlock logic verification.

[0093] In this embodiment, in step S3, the fault injection method includes pin fault injection, electrical parameter disturbance, timing and signal interference; the injection parameters include voltage fluctuation amplitude, fault injection duration, packet loss rate and clock jitter range.

[0094] In this embodiment, the qualification criteria in step S3 include: after fault injection, the tested power protection device has no irreversible damage, the fault detection time does not exceed a preset threshold, the fault recovery time does not exceed a preset threshold, the core protection function is not lost, and the measured value of diagnostic coverage is not lower than a preset target value.

[0095] In this embodiment, in step S6, if the power protection device under test suffers irreversible damage during the fault injection process, the subsequent injection of such faults is stopped, the fault phenomenon and the degree of damage are recorded, and the process proceeds to step S8 for cause analysis and optimization.

[0096] In this embodiment, step S8 includes adding hardware redundancy modules, optimizing software diagnostic algorithms, adjusting diagnostic thresholds, and adding fault alarm logic.

[0097] 1. Hardware Module Division (S1): The hardware of the device under test is divided into six major modules: power supply, sampling, CPU control, communication, storage, and IO interface. The hardware BOM list is compiled to lay the foundation for subsequent analysis.

[0098] 2. FMEDA Analysis (S2): According to Figure 2 The process shown identifies electrical, interface, and component-level fault modes of each module, analyzes the impact of faults, sorts out hardware and software diagnostic mechanisms, calculates diagnostic coverage, and filters out high-risk fault points such as ADC anomalies and power supply undervoltage to form a list.

[0099] 3. Fault Injection Plan Formulation (S3): Based on the list of high-risk faults, clarify the injection method, parameters and timing for each fault point, and set qualification criteria such as fault detection and recovery time;

[0100] 4. Test environment setup and baseline testing (S4, S5): Set up a test environment including fault injection equipment, data acquisition equipment and standardized hardware components, calibrate the equipment and complete the baseline test to confirm that the device under test and the test equipment are free of abnormalities.

[0101] 5. Fault injection execution (S6, S7): Refer to Figure 3 The process shown involves injecting high-risk faults one by one in a targeted manner, injecting only one type of fault each time, repeating the injection three times, and collecting injection parameters, response data, and recovery data in real time to ensure test repeatability.

[0102] 6. Closed-loop optimization (S8): Based on Figure 5 The closed-loop logic shown compares the theoretical and measured values ​​of FMEDA diagnostic coverage to analyze the reasons for the lack of coverage, optimizes the diagnostic mechanism (such as adjusting the diagnostic threshold), and re-executes FMEDA analysis and fault injection until the measured value meets the standard.

[0103] 7. Indicator Calculation and Report Output (S9): Calculate reliability indicators such as SPFM, LFM, and FIT, output test reports, and confirm that the device under test meets the functional safety standard requirements.

[0104] This invention scores each diagnostic mechanism according to the level table of IEC 61508-6, and then applies the following formula: The coverage of hardware diagnostic mechanisms and software diagnostic mechanisms is quantitatively superimposed. The resulting diagnostic coverage is always greater than that of any single mechanism, which can objectively reflect the true capability of hardware-software collaborative diagnosis and provide a quantifiable basis for determining the hardware margin of Security Integrity Level (SIL).

[0105] Example 2 discloses that the present invention also provides a hardware reliability testing system based on the combination of FMEDA and fault injection, for implementing the above-mentioned testing method, including:

[0106] Module partitioning unit: used to partition the hardware of the power protection device into modules and compile the hardware BOM list;

[0107] FMEDA Analysis Unit: Used to perform FMEDA analysis, identify the failure modes of each hardware module, analyze the impact of failures, sort out the diagnostic mechanisms, calculate diagnostic coverage, screen high-risk failure points and form a list of high-risk failures;

[0108] Fault Injection Scheme Development Unit: Used to develop targeted hardware fault injection schemes based on a list of high-risk faults and to set qualification criteria;

[0109] (1) Test environment setup unit: used to set up a hardware fault injection test environment, calibrate the test equipment, preprocess the power protection device under test and record the initial operating parameters;

[0110] (2) Baseline test unit: used to perform baseline tests, record baseline operation data, and confirm that the tested power protection device is free from abnormalities;

[0111] (3) Fault injection execution unit: used to perform targeted fault injection on high-risk fault points according to the fault injection scheme, and control the fault injection parameters, timing and duration;

[0112] (4) Data acquisition and monitoring unit: used to record fault injection parameters, response data and recovery data of the power protection device under test, and to monitor the operating status of the power protection device under test in real time;

[0113] (5) Closed-loop optimization unit: used to compare the theoretical value and the measured value of diagnostic coverage, analyze the cause of the fault, optimize the diagnostic mechanism, and drive the FMEDA analysis unit and the fault injection execution unit to repeatedly execute the relevant steps;

[0114] (6) Indicator Calculation and Report Output Unit: Used to calculate hardware reliability indicators and output hardware reliability test reports.

[0115] The fault injection device includes a hardware fault injector, a signal generator, and a power disturbance device; the data acquisition device includes an oscilloscope, a data logger, and a bus analyzer; and the status monitoring device includes host computer monitoring software and status indicator lights.

[0116] The testing system also includes standardized hardware components to ensure the stability, compatibility, and accuracy of the testing environment. These standardized hardware components work in conjunction with various functional units, specifically including:

[0117] (1) Industrial control computer: As the core control hardware of the system, it establishes communication connections with the FMEDA analysis unit, fault injection scheme formulation unit, fault injection execution unit, data acquisition and monitoring unit and index calculation and report output unit respectively, so as to realize unified control, data interaction and instruction issuance of each unit, support the collaborative work of multiple devices, and ensure the automated advancement of the test process;

[0118] (2) Signal conditioning module: The input end is connected to the fault injection device and the power protection device under test, and the output end is connected to the data acquisition device. It is used to filter, amplify and level-convert the fault injection signal and the response signal output by the device under test, remove signal interference, and condition the signal to the range that the data acquisition device can recognize (0-10V analog signal, TTL digital signal) to improve the accuracy of data acquisition.

[0119] (3) Isolation coupling module: It is connected in series between the fault injection device and the power protection device under test, and between the data acquisition device and the power protection device under test. It adopts opto-isolation technology, with an isolation voltage ≥2500V AC and an isolation resistance ≥100MΩ. It is used to prevent the fault injection signal and the acquisition signal from interfering with each other, protect the power protection device under test and the test equipment from voltage surges, and ensure the safety of the test process.

[0120] (4) Power supply module: including main power supply unit and backup power supply unit, input voltage is 220V AC, output voltage is 24V DC, 12V DC, 5V DC, output current ≤10A, ripple ≤50mV, providing stable power supply for the entire test system (fault injection equipment, data acquisition equipment, industrial control computer, etc.);

[0121] (5) Data storage module: It includes two parts: local storage and cloud backup. The local storage uses industrial-grade solid-state drives (SSDs) with a capacity of ≥1TB and a read / write speed of ≥500MB / s. It is used to store test data, fault injection parameters, response data and test reports in real time. The cloud backup module is connected to the industrial control computer via Ethernet and supports automatic synchronous backup of test data to ensure data security and traceability.

[0122] (6) Communication interface module: integrates Ethernet interface (RJ45), RS485 interface, CAN bus interface and USB 3.0 interface. The Ethernet interface rate is ≥1000Mbps, which is used for high-speed data interaction between industrial control computer and various test equipment and functional units; RS485 interface and CAN bus interface are used to connect with the communication module of the power protection device under test to realize real-time monitoring of the operating status of the device under test and data reading; USB 3.0 interface is used to connect external storage devices and debugging equipment to facilitate data export and system debugging.

[0123] The collaborative logic of each hardware component is as follows: The industrial control computer sends a fault injection command to the fault injection execution unit, which controls the fault injection device to generate a target fault signal. After processing by the isolation coupling module and the signal conditioning module, the signal is injected into the power protection device under test. The response signal of the power protection device under test is processed by the signal conditioning module and the isolation coupling module and then transmitted to the data acquisition device. The data acquisition device converts the acquired signal into a digital signal and transmits it to the industrial control computer. The data acquisition and monitoring unit performs real-time analysis and recording. The status monitoring device obtains the operating status of the device under test and each test device through the industrial control computer and provides real-time feedback on abnormal information. The power supply module provides a stable power supply to all hardware components and functional units, and the data storage module synchronously stores all test-related data to ensure that the test process is traceable and reproducible.

[0124] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A hardware reliability testing method based on the combination of FMEDA and fault injection, characterized in that, The method includes: Step S1: Modularize the power protection device to obtain the hardware BOM list; Step S2: Based on FMEDA analysis, identify the failure modes of each hardware module in the hardware BOM list and their impact on the device's functionality and safety performance, calculate the theoretical diagnostic coverage of each failure mode, and screen out high-risk failure points according to the failure impact level, theoretical diagnostic coverage and safety failure rate to form a high-risk failure list. Step S3: Based on the list of high-risk faults, formulate a targeted hardware fault injection plan and set the qualification criteria after fault injection. Step S4: Set up a test environment that includes the power protection device under test, the fault injection device, and the data acquisition and monitoring device, and perform initialization calibration and baseline status confirmation on the power protection device under test. Step S5: Based on the established test environment, under fault-free injection conditions, control the power protection device under test to operate for at least one complete working cycle, record baseline operating data, and establish a reference benchmark for the normal operating status of the device. Step S6: According to the directional hardware fault injection scheme, perform directional fault injection on the high-risk fault points of the power protection device under test one by one, and collect device response data and operating status in real time. Step S7: After each type of fault injection is completed, maintain the device in operation for a preset time, monitor and record the fault recovery status of the device and the operating parameters after recovery; Step S8: Compare and analyze the acquired fault injection real-time acquisition device response data and the recovery operation parameters after fault injection with the theoretical diagnostic coverage. If the measured value is lower than the theoretical value or there are uncovered faults, optimize the hardware or software diagnostic mechanism until a closed-loop test result that meets the preset reliability requirements is formed.

2. The hardware reliability testing method based on FMEDA and fault injection as described in claim 1, characterized in that, The calculation of the theoretical diagnostic coverage for each fault mode includes: FMEDA analysis includes intra-module FMEDA analysis and inter-module interface FMEDA analysis. The two are combined to form module-level and system-level fault impact assessment and diagnostic coverage calculation. Based on the hardware BOM list, fault modes are identified component by component. The fault modes include electrical faults, interface faults, and component-level faults. For each fault mode FM_i, its failure rate λ_i is calculated according to formula (1): (1) In the formula, This is the reference failure rate for the components. These are voltage stress factor, temperature stress factor, environmental factor, and quality factor, respectively. When fault mode FM i When the fault mode is covered by n diagnostic mechanisms simultaneously, the theoretical diagnostic coverage DC is calculated by superimposing the results according to the probability parallel formula (2). i : (2) As can be seen from formula (2), the theoretical diagnostic coverage rate after multiple diagnostic mechanisms are superimposed in parallel is always greater than the coverage rate of any single mechanism, thus improving the diagnostic coverage rate through the synergy of soft and hard diagnostic mechanisms. The theoretical diagnostic coverage of each fault mode within the module is weighted and summed according to formula (3) with the failure rate as the weight, to obtain the module-level diagnostic coverage DC of the module. 模块 : （3） In the formula, k is the index variable of the diagnostic mechanism, DCi,k is the single diagnostic coverage of the k-th diagnostic mechanism for the fault mode FMi, m is the total number of fault modes contained in the module, i is the index variable of the fault mode, and λi is the failure rate of the fault mode FMi.

3. The hardware reliability testing method based on FMEDA and fault injection as described in claim 1, characterized in that, The impact on the device's functionality and safety performance includes: The hardware diagnostic mechanism includes watchdog monitoring, voltage monitoring, current detection, redundancy design, and differential sampling; the software diagnostic mechanism includes checksum verification, periodic heartbeat detection, parameter rationality verification, and interlock logic verification.

4. The hardware reliability testing method based on the combination of FMEDA and fault injection as described in claim 1, characterized in that, The fault injection scheme includes: Pin fault injection, electrical parameter disturbance, timing and signal interference; the injection parameters include voltage fluctuation amplitude, fault injection duration, packet loss rate and clock jitter range.

5. The hardware reliability testing method based on FMEDA and fault injection as described in claim 1, characterized in that, The established criteria for determining the success of fault injection include: After fault injection, the tested power protection device is free from irreversible damage, the fault detection time does not exceed the preset threshold, the fault recovery time does not exceed the preset threshold, the core protection functions are not lost, and the measured value of diagnostic coverage is not lower than the preset target value. If irreversible damage occurs to the power protection device under test during the fault injection process, stop the subsequent injection of this type of fault, record the fault phenomenon and the degree of damage, and conduct cause analysis and optimization.

6. The hardware reliability testing method based on FMEDA and fault injection as described in claim 1, characterized in that, The optimized hardware or software diagnostic mechanism includes: Add hardware redundancy modules, optimize software diagnostic algorithms, adjust diagnostic thresholds, and add fault alarm logic.

7. The hardware reliability testing method based on the combination of FMEDA and fault injection according to claim 1, characterized in that, The method further includes: After completing all fault injections and optimizations, the single-point fault index, potential fault index, and safety failure rate of the power protection device hardware are recalculated, and a hardware reliability test report is output.

8. A hardware reliability testing system based on a combination of FMEDA and fault injection, characterized in that, The system includes: Module partitioning unit: used to modularize the hardware of power protection devices to obtain a hardware BOM list; FMEDA Analysis Unit: Used for FMEDA analysis to identify the failure modes of each hardware module in the hardware BOM and their impact on device functionality and safety performance, calculate the theoretical diagnostic coverage of each failure mode, and screen out high-risk failure points based on the failure impact level, theoretical diagnostic coverage and safety failure rate to form a high-risk failure list. Fault Injection Scheme Formulation Unit: Used to formulate targeted hardware fault injection schemes based on a list of high-risk faults, and to set the acceptance criteria after fault injection. Test environment setup unit: Used to set up a test environment that includes the power protection device under test, fault injection equipment and data acquisition and monitoring equipment, and to perform initialization calibration and baseline status confirmation on the power protection device under test; Baseline test unit: Used to control the power protection device under test to operate for at least one complete working cycle under fault-free injection conditions based on the established test environment, record baseline operating data, and establish a reference benchmark for the normal operating status of the device; Fault injection execution unit: used to inject high-risk faults into the tested power protection device one by one according to the directional hardware fault injection scheme, and to collect device response data and operating status in real time; Data acquisition and monitoring unit: used to maintain the device in operation for a preset time after each type of fault injection is completed, monitor and record the fault recovery status of the device and the operating parameters after recovery; Closed-loop optimization unit: It is used to compare and analyze the acquired fault injection real-time acquisition device response data and the recovery operation parameters after fault injection with the theoretical diagnostic coverage. If the measured value is lower than the theoretical value or there are uncovered faults, the hardware or software diagnostic mechanism is optimized until a closed-loop test result that meets the preset reliability requirements is formed.

9. The hardware reliability testing system based on FMEDA and fault injection as described in claim 8, characterized in that, The testing system also includes standardized hardware components to ensure the stability, compatibility, and accuracy of the testing environment. These standardized hardware components work in conjunction with various functional units, specifically including: Industrial control computer: As the core control hardware of the system, it establishes communication connections with the FMEDA analysis unit, fault injection scheme formulation unit, fault injection execution unit, data acquisition and monitoring unit, and index calculation and report output unit to realize unified control, data interaction and command issuance of each unit, support multi-device collaborative work, and ensure the automated advancement of the testing process; Signal conditioning module: The input end is connected to the fault injection device and the power protection device under test, and the output end is connected to the data acquisition device. It is used to filter, amplify, and level-convert the fault injection signal and the response signal output by the device under test, remove signal interference, and condition the signal to the range that the data acquisition device can recognize. Isolation coupling module: Connected in series between the fault injection device and the power protection device under test, and between the data acquisition device and the power protection device under test. It adopts opto-isolation technology, with an isolation voltage ≥2500V AC and an isolation resistance ≥100MΩ. It is used to prevent mutual interference between the fault injection signal and the acquisition signal, protect the power protection device under test and the test equipment from voltage surges, and ensure the safety of the test process. Power supply module: Includes main power supply unit and backup power supply unit, input voltage is 220V AC, output voltage is 24V DC, 12V DC, 5V DC, output current ≤10A, ripple ≤50mV, providing stable power supply for the entire test system; Data storage module: It consists of two parts: local storage and cloud backup. The local storage uses industrial-grade solid-state drives with a capacity of ≥1TB and a read / write speed of ≥500MB / s, which are used to store test data, fault injection parameters, response data and test reports in real time. The cloud backup module is connected to the industrial control computer via Ethernet, which supports automatic synchronous backup of test data to achieve data security and traceability. Communication interface module: integrates Ethernet interface, RS485 interface, CAN bus interface and USB 3.0 interface. The Ethernet interface speed is ≥1000Mbps, used for high-speed data interaction between industrial control computer and various test equipment and functional units; RS485 interface and CAN bus interface are used to connect with the communication module of the power protection device under test to realize real-time monitoring of the operating status of the device under test and data reading; USB 3.0 interface is used to connect external storage devices and debugging equipment.

10. The hardware reliability testing system based on FMEDA and fault injection as described in claim 8, characterized in that, The fault injection device includes a hardware fault injector, a signal generator, and a power disturbance device; the data acquisition device includes an oscilloscope, a data logger, and a bus analyzer; and the status monitoring device includes host computer monitoring software and status indicator lights.

Images