Method, computing unit and computer program for checking a logic gate unit

Abstract

The invention relates to a method for testing a logic gate unit (310), wherein the logic gate unit (310) has at least two inputs (311, 312) and one output (315), wherein the output (315) of the logic gate unit (310) is connected to an input (320) of a computing unit (320), wherein the logic gate unit (310) further has a control signal input (313), wherein this control signal input (313) is connected to a control signal output (322) of the computing unit (320), comprising the steps of: outputting, by the computing unit (320), a control signal (333) at the control signal output (322) of the computing unit (320); Receiving, by the computing unit (320), an output signal (335) output at the output (315) of the logic gate unit (310) at the input (322) of the computing unit (320);Checking, by the computing unit (320), whether there is an error in the logic gate unit (310), depending on the output control signal (333) and depending on the received output signal (335);

Description

The present invention relates to a method for checking a logic gate unit, and to a computing unit and a computer program for carrying it out.BACKGROUND OF THE INVENTIONLogic gate units such as AND gates, OR gates, NAND gates, NOR gates, XOR gates, XNOR gates etc. can be used in electronic control units, e.g. in control units in the (motor) vehicle sector. Faults of logic gate units of this type, for example a short circuit of a gate output to ground or a short circuit of a gate output to battery, often cannot be clearly detected. Depending on the field of application, however, it may be of great importance to be able to reliably identify such faults of logic gate units, for example in the vehicle or vehicle electronics sector, in which functional safety with the highest safety standards is often required.Disclosure of the InventionAccording to the invention, a method for checking a logic gate unit and a computing unit and a computer program for carrying it out are proposed, having the features of the independent patent claims. Advantageous embodiments are the subject matter of the dependent claims and of the following description.The logic gate unit has at least two inputs and one output. At each of these inputs, the logic gate unit may conveniently receive a respective input signal and, depending on the received input signals, the logic gate unit may output an output signal at the output.The output of the logic gate unit is connected to an input of a computing unit. Via this input, the arithmetic unit can receive the output signal output by the logic gate unit. In applications in the vehicle sector, the computing unit can be designed, for example, as a control unit or as a microcontroller.The logic gate unit further comprises a control signal input. This control signal input is connected to a control signal output of the arithmetic unit. In particular, an additional digital output signal can thus be fed back from the arithmetic unit to the logic gate unit.Within the scope of the invention, a control signal having a predetermined form, in particular a pulse sequence, is output at the control signal output by the computing unit. The logic gate unit receives this control signal at the control signal input. Depending on this received control signal and also, if appropriate, depending on input signals present at the inputs, the logic gate unit outputs a corresponding output signal at the output or is configured to output an output signal.The arithmetic unit receives the output signal output at the output of the logic gate unit at the input of the arithmetic unit. Depending on the control signal output and depending on the received output signal, the arithmetic unit checks whether a fault of the logic gate unit is present, e.g. a short circuit of the output to ground or a short circuit of the output to battery. In particular, it is expected that the logic gate unit responds in a certain manner to the control signal in a fault-free state and outputs a specific output signal. If the logic gate unit does not respond in this particular manner, this indicates in particular that a fault of the logic gate unit is present. With the aid of the fed-back control signal, the logic gate unit can thus be monitored for errors in a simple and reliable manner. The control signal can expediently be output at any time, in particular also during the operation of the logic gate unit, so that the logic gate unit can be checked for errors, in particular at any time.The present invention thus provides a possibility for carrying out tests, in particular cyclic tests, during the runtime of the logic gate unit and for being able to detect faults in the logic gate unit reliably and as quickly as possible. The logic gate unit may be tested regularly, e.g. cyclically, so that the diagnostic coverage level may be increased. The method can be used particularly expediently for safety-critical applications, for example in the vehicle or automobile sector.In a conventional manner, logic gates can often be dispensed with in order to avoid logic gate errors, and corresponding input signals can be connected directly to digital inputs of a respective arithmetic unit. However, as the number of respective signals increases, the demand for digital inputs of the computing unit may increase, which may often prove difficult due to unavailability of free digital inputs.To conventionally detect logic gate faults, predefined control of the inputs on the logic circuit may be generated during system startup tests and the resulting effects analyzed. However, such testing only during start-up may result in a lower diagnostic coverage level. A lower degree of diagnostic coverage is often not sufficient, for example, for safety-critical vehicle applications with highest safety requirements.Furthermore, a logic gate can also be implemented redundantly in a conventional manner, e.g. a second logic gate having the same set of inputs can be used, so that the output of both logic gates can be connected to the digital input of a computing unit, e.g. of a microcontroller, and a plausibility check can be carried out between the outputs of the two logic gates in order to detect errors. However, this may be costly and costly since a redundant logic gate must be implemented in the hardware. Furthermore, it may also not be possible at all to implement a redundant logic gate, for example if the number of available digital inputs of the computing unit is limited.Such conventional solutions are often expensive and / or have less diagnostic coverage. In contrast, the logic gate unit can be reliably checked for errors with a high degree of diagnostic coverage in a cost-effective and low-complexity manner by the invention even during the runtime. In particular, it is not necessary to implement an additional, redundant logic gate unit or additional inputs, whereby costs, effort and installation space can be saved. In addition, a single output is sufficient for checking a plurality of logic gate units, since the same control signal can be applied to all control inputs.According to one embodiment, checking whether a fault of the logic gate unit exists comprises comparing the received output signal with an expected signal, wherein this expected signal is dependent on the output control signal. In a fault-free state, the logic gate unit should react in a predefined, expected manner to the received control signal and output the corresponding, expected signal. In the error-free state, the output signal should therefore coincide with the expected signal, in particular. If there is a fault in the logic gate unit, the logic gate unit does not react in the predefined, expected manner to the received control signal and in particular outputs an output signal which differs from the expected signal. By comparing the received output signal with the expected signal, errors of the logic gates can thus be deduced in a particularly reliable manner.According to one embodiment, the arithmetic unit determines, as a function of a result of the comparison of the received output signal with the expected signal, that a fault of the logic gate unit is present or that no fault of the logic gate unit is present. If the received output signal matches the expected signal, the computing unit determines in particular that there is no fault of the logic gate unit. If, on the other hand, the received output signal deviates from the expected signal, the computing unit determines in particular that a fault of the logic gate unit is present.According to one specific embodiment, the arithmetic unit carries out a predefined measure if it is detected that a fault of the logic gate unit is present. For example, the arithmetic unit can, as a predefined measure, transition the logic gate unit or a system having the logic gate unit into a safe state. Furthermore, the computing unit can output an error message as a predefined measure and / or create an entry in an error memory, for example.According to one embodiment, a periodic signal, in particular a cyclic pulse signal, is output as the control signal. For example, the pulse signal may include a cyclic pulse having a predetermined level of short duration, e.g., of at least 1 μs. By means of such a control signal, the logic gate unit can expediently be checked for errors regularly or cyclically during operation or at the runtime.According to one embodiment, it is checked whether a short circuit of the output to ground and / or a short circuit of the output to battery is present as the fault of the logic gate unit. Without using the control signal, such a short circuit cannot be easily detected on the basis of the output signal alone. However, by applying the control signal, such a short-circuit case can be reliably detected if the output signal output by the logic gate unit differs from the expected signal.According to one embodiment, the logic gate unit is configured to output the output signal at the output depending on signals present at the at least two inputs and at the control signal input. Depending on the specific configuration of the logic gate unit, an individual output signal is provided depending on the signals received. In the event of a fault in the logic gate unit, in particular in the event of a short circuit in the output, the output signal can be distorted. By using the control signal and analyzing the output signal, such a fault can be reliably detected.According to one embodiment, the logic gate unit is configured to output a signal having a predetermined first level when a signal having a predetermined second level is present at the control signal input. In other words, a specific output signal level can thus be forced with a predetermined second level at the control signal input, e.g. high or low, whereas the output signal is determined according to the logic function and the input signals present at the inputs if no signal having the predetermined second level is present at the control signal input. The first and second levels may be the same or different.According to an embodiment, the first level is selected to correspond to a level of the output signal indicative of an error derived from error signals present at the inputs. In this way, it can be achieved in particular that a short circuit of the logic gate output is detected which would cover such an error signal.According to one embodiment, the logic gate unit is configured to receive an error signal at each of the at least two inputs. These error signals may each characterize an error in a system including the logic gate unit. For example, the logic gate unit may be provided to forward corresponding error signals to the computing unit, so that the computing unit may react to an error in the system. For example, when used in the vehicle sector, the fault signals can each indicate a fault in a part of a converter, and the arithmetic unit, which is designed as a microcontroller or control unit, for example, can react as a safety system to a detected fault. In such a case, it is particularly important to be able to reliably detect a fault of the logic gate unit, since otherwise faults of the respective system can no longer be reliably detected.According to an embodiment, the predetermined first level is selected to correspond to a level of an output signal of the logic gate in an error derived from error signals present at the inputs. In this way, it can be achieved in particular that a short circuit of the logic gate output can be detected, which would distort the gate output signal in such a way that an error characterized by the error signals would be covered.According to one embodiment, the logic gate unit is formed as an AND gate, an OR gate, a NAND gate, a NOR gate, an XOR gate or an XNOR gate. Further, the logic gate unit may also be formed as a composite unit of one or more such gates.The invention is particularly suitable for use in the (motor) vehicle sector and makes it particularly expedient to meet the high requirements for functional safety (safety) in the vehicle or vehicle electronics sector. The computing unit can be designed in particular as a microcontroller or control device in a (motor) vehicle and can be provided, for example, for executing safety-critical functions which are executed for safe operation and for controlling the vehicle, for example in the course of motor control or in the course of driving assistance functions, etc. In particular, safety requirements in the (motor) vehicle area can be fulfilled by the method, as are specified, for example, in the standard ISO 26262 or, in particular, by the so-called "Automotive Safety Integrity Level" (ASIL), a safety requirement level specified by the ISO 26262 for safety-relevant systems in motor vehicles. For example, the invention is particularly suitable for high-voltage projects with high functional safety requirements, such as, for example, drive converters for motor vehicles.A computing unit according to the invention, e.g. a control device of a motor vehicle, is configured, in particular by programming, to carry out a method according to the invention.The implementation of a method according to the invention in the form of a computer program or computer program product with program code for carrying out all method steps is also advantageous since this causes particularly low costs, in particular if an executing control device is also used for further tasks and is therefore present in any case. Finally, a machine-readable storage medium is provided with a computer program stored thereon, as described above. Suitable storage media or data carriers for providing the computer program are, in particular, magnetic, optical and electrical memories, such as hard disks, flash memories, EEPROMs, DVDs, among others. Download of a program via computer networks (Internet, intranet, etc.) is also possible. Such a download can be effected in a wired or wired or wireless manner (e.g. via a WLAN network, a 3G, 4G, 5G or 6G connection, etc.).Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawing.The invention is schematically illustrated in the drawing on the basis of exemplary embodiments and is described below with reference to the drawing.Brief Description of the DrawingsFIGS. 1a to d schematically show a system comprising a logic gate unit and a computing unit and input and output signals of this system according to the prior art. FIGS. 2a to d schematically show a system comprising a logic gate unit and a computing unit and input and output signals of this system according to the prior art. FIGS. 3a to c schematically show a system of a logic gate unit and a computing unit as well as input and output signals of this system, according to an embodiment of the invention.Embodiment(s) of the InventionFIG. 1 aschematically illustrates a system 100 comprising a logic gate unit 110 and a computing unit 120 according to the prior art. For example, the logic gate unit 110 is designed as an OR gate and has two inputs 111 and 112 and an output 115. This output 115 of the OR gate 110 is connected to an input 121 of the arithmetic unit 120. For example, the computing unit 120 may be depicted as a microcontroller in a vehicle.At the inputs 111, 112, the OR gate 110 can receive input signals 131 and 132, respectively, which can be, for example, fault signals, which each indicate a fault in a part of a converter. Depending on the received input signals 131, 132, the OR gate 110 outputs an output signal 135 at the output 115.FIG. 1b schematically shows examples of the input signals 131' and 132' that can be received by the OR gate 110 at the inputs 111 and 112, respectively. The input signals 131' and 132' are, for example, pulse signals having a low level "0" and a high level "1". Furthermore, FIG. 1b shows an example of the output signal 135' as it can be output by the OR gate 110 in a fault-free case depending on the received input signals 131' and 132'.FIG. 1c schematically shows the input signals 131' and 132' corresponding to FIG. 1b. Furthermore, FIG. 1 cshows an example of the output signal 135" as it can be output by the OR gate 110 if a fault 150 of the gate is present in the form of a short circuit of the output 115 to ground. This faulty output signal 135" permanently has a low level "0", so that faults which are indicated by the input signals 131' and 132' can no longer be detected by the microcontroller 120 on the basis of the output signal 135".FIG. 1d schematically shows the input signals 131' and 132' corresponding to FIGS. 1b and 1c. Furthermore, FIG. 1 d shows an example of the output signal 135"' as it can be output by the OR gate 110 if a fault 160 is present in the form of a short circuit of the output 115 to the battery. After the occurrence of the short circuit 160, this faulty output signal 135''' permanently has a high level "1". On the basis of this faulty output signal 135''', microcontroller 120 could conclude that there is a fault of the converter system that is permanently indicated by input signals 131' and 132', although there may be no fault at all in this system.Also schematically depicted in FIG. 2 ais a conventional system 200 comprising a logic gate unit 210 and a computing unit 220 according to the prior art. For example, the logic gate unit 210 is designed as an AND gate having two inputs 211 and 212 and an output 215. This output 215 is connected to the input 221 of the computing unit 220, for example of a microcontroller in a vehicle. At the inputs 211, 212 an input signal 231 or 232 can be received, for example fault signals, which indicate a fault in a converter. Depending on the received input signals 231, 232, the AND gate 210 outputs an output signal 235 at the output 215.FIG. 2b schematically shows examples of the input signals 231' and 232' that the AND gate 210 can receive at the inputs 211, 212. Furthermore, FIG. 2b shows an example of the output signal 235' as it can be output by the AND gate 210 in a fault-free state depending on the received input signals 231' and 232'.FIG. 2 cschematically illustrates the input signals 231' and 232' from FIG. 2 b, as well as an example of the output signal 235" as may be output by the AND gate 210 in a faulted case in the form of a short circuit 250 of the output 215 to ground. After the occurrence of the short circuit 250, the faulty output signal 235" permanently has a low level "0". On the basis of this error-containing output signal 235''', microcontroller 220 could infer a permanent error of the converter, although possibly no such error is present at all.FIG. 2d schematically shows input signals 231' and 232' as well as an example of output signal 235''', as may be output by AND gate 210 in the event of a short circuit 260 of output 215 to the battery. This faulty output signal 235''' permanently has a high level "1", so that errors indicated by the input signals 231' and 232' can no longer be detected on the basis of the output signal 235''.In order to be able to reliably detect such faults of a logic gate unit with a high degree of diagnostic coverage, the invention proposes to return a control signal from the respective arithmetic unit to the logic gate unit, as will be explained below with reference to FIG. 3.FIG. 3 aschematically illustrates a system 300 comprising a logic gate unit 310 and a computing unit 320, which is configured to perform an embodiment of the method according to the invention.The logic gate unit 310 is designed, for example, as an OR gate and has two inputs 311 and 312 and an output 315, the output 315 being connected to an input 321 of the arithmetic unit 320. The computing unit 320 is depicted, for example, as a microcontroller in a vehicle. The OR gate 310 may receive an input signal 331 and 332, respectively, at the inputs 311, 312, e.g. fault signals, which indicate a fault in an inverter, respectively.The logic gate unit 310 further has a control signal input 313, wherein this control signal input 313 is connected to a control signal output 322 of the microcontroller 320. The microcontroller 320 can feed back a control signal 333 from this control signal output 322 to the control signal input 313 of the OR gate 310. Depending on the signals received at the inputs 311 and 312 and at the control signal input 313, the OR gate 310 outputs an output signal 335 at its output 315.The microcontroller 320 is configured, in particular by programming, to carry out an embodiment of the method according to the invention. During this, microcontroller 320 outputs control signal 333 at control signal output 322. OR gate 310 receives control signal 333 at control signal input 313. Depending on the input signals 331 and 332 received at the inputs 311 and 312 and also depending on the control signal 333 received at the control signal input 313, the OR gate 310 outputs the output signal 335 at the output 315. Microcontroller 320 receives this output signal 335 at input 321. Depending on this received output signal 335 and depending on the output control signal 333, microcontroller 320 checks whether an error of OR gate 310 is present.In a fault-free state, the OR gate 310 should react in a predefined, expected manner to the control signal 333 and output an expected signal as an output signal. Microcontroller 320 therefore checks whether received output signal 335 matches this expected signal. If the received output 335 matches the expected signal, the microcontroller 320 determines that there is no fault of the gate 310. If the received output signal 335 deviates from the expected signal, the microcontroller 320 determines that there is an error in the OR gate 310. In the latter case of a detected fault, microcontroller 320 performs a predefined measure. For example, as such a measure, microcontroller 320 may transition system 300 to a safe state, issue an error message, create an entry in an error memory, etc.FIG. 3b schematically shows examples of the input signals 331' and 332' which can be received at the inputs 311 and 312 of the OR gate 310, respectively. Furthermore, FIG. 3b shows an example of the control signal 333'. For example, the control signal 333' can be a periodic signal, e.g. a cyclical pulse signal with cyclical high pulses of short duration, e.g. of at least 1 μs. By means of such a cyclic control signal 333, the gate 310 can be checked for errors cyclically during the running time.The OR gate 310 is configured in particular to output a signal having a predetermined first level, e.g. a high level, as an output signal at the output 315 if a signal having a predetermined second level is present at the control signal input 313, e.g. likewise a high level. Thus, when a control signal of this predetermined second level is output from the microcontroller 320, a certain output signal level of the OR gate 310 may be forced. If, on the other hand, no signal having the predetermined second level is present at the control signal input 313, the output signal of the OR gate 310 is determined according to the logic function and the input signals present at the inputs 311, 312.If the control signal 333' is therefore a cyclical pulse signal with cyclical high pulses (i.e. the predetermined second level), it is expected that the output signal of the OR gate 310 also has corresponding high levels (i.e. the first predetermined level) in a fault-free case. Microcontroller 320 thus compares the output of OR gate 310 with a corresponding expected signal.FIG. 3 bfurther shows an example of the output signal 335" as it can be output by the OR gate 310 if a short circuit of the gate output 315 to ground is present as the fault 350. In this case, the faulty output signal 335" permanently has a low level "0" after the occurrence of the short circuit 350. After the occurrence of this short circuit 350, the output signal 335" does not have a high level (i.e. the predetermined first level) if the control signal has the high level (i.e. the predetermined second level). In this case, the microcontroller 320 can detect this short circuit 350 to ground by comparing the received output signal 335" with the expected signal.In FIG. 3c, too, corresponding to FIG. 3b, examples of the input signals 331' and 332' and of the control signal 333' are shown. FIG. 3 cfurther shows an example of the output signal 335"' as it can be output by the OR gate 310 if a short circuit of the gate output 315 to the battery exists as the fault 360. In this example, the faulty output signal 335''' permanently has a high level "1" after the occurrence of the short circuit 360, that is to say permanently has the predetermined first level.The first level is selected as a high level such that it corresponds to a level of the output signal if an error were to be derived from error signals present at the inputs 311, 312. In this way, it can be achieved in particular that the short circuit 360 of the logic gate output 315 can be detected, which would distort the gate output signal in such a way that an error characterized by the error signals would be covered.The invention thus provides a possibility for carrying out cyclic tests with a high degree of diagnostic coverage during the runtime of the logic gate unit 310, so that faults in the logic gate unit 310 can be detected reliably and as quickly as possible.

Claims

Method for checking a logic gate unit (310), wherein the logic gate unit (310) has at least two inputs (311, 312) and an output (315), wherein the output (315) of the logic gate unit (310) is connected to an input (320) of a computing unit (320), wherein the logic gate unit (310) further has a control signal input (313), wherein this control signal input (313) is connected to a control signal output (322) of the computing unit (320), comprising the steps: outputting, by the computing unit (320), a control signal (333, 333') at the control signal output (322) of the computing unit (320); receiving, by the arithmetic unit (320), an output signal (335, 335", 335"') output at the output (315) of the logic gate unit (310) at the input (322) of the arithmetic unit (320); checking, by the arithmetic unit (320), whether a fault of the logic gate unit (310) exists, depending on the control signal (333, 333') output and depending on the received output signal (335, 335", 335"').The method according to claim 1, wherein checking whether a fault of the logic gate unit (310) is present comprises: comparing, by the computing unit (320), the received output signal (335, 335", 335"') with an expected signal, wherein this expected signal is dependent on the output control signal (333, 333').The method of claim 2, wherein checking whether a fault of the logic gate unit (310) is present further comprises: determining, by the computing unit (320), that a fault of the logic gate unit (310) is present or that no fault of the logic gate unit (310) is present, depending on a result of the comparison of the received output signal (335, 335", 335"') with the expected signal.The method according to any one of the preceding claims, further comprising: performing, by the computing unit (320), a predetermined measure when it is detected that a fault of the logic gate unit (310) is present.Method according to one of the preceding claims, wherein a periodic signal, in particular a pulse signal, in particular a cyclic pulse signal, is output as the control signal (333, 333').Method according to one of the preceding claims, wherein it is checked whether a short circuit (350) of the output (315) of the logic gate unit (310) to ground and / or a short circuit (360) of the output (315) of the logic gate unit (310) to battery is present as the fault of the logic gate unit (310).Method according to one of the preceding claims, wherein the logic gate unit (310) is configured to output the output signal (335, 335", 335"') at the output (335) as a function of signals present at the at least two inputs (311, 312) and at the control signal input (313).Method according to one of the preceding claims, wherein the logic gate unit (310) is configured to output a signal with a predetermined first level at the output (315) as an output signal if a signal with a predetermined second level is present at the control signal input (313).Method according to one of the preceding claims, wherein the logic gate unit (310) is configured to receive an error signal (331, 331', 332, 332') at the at least two inputs (311, 312), respectively.The method of claims 8 and 9, wherein the predetermined first level is selected to correspond to a level of an output signal of the logic gate (310) that would indicate an error resulting from error signals present at the at least two inputs (311, 312).Method according to one of the preceding claims, wherein the logic gate unit (310) is formed as an AND gate, an OR gate, a NAND gate, a NOR gate, an XOR gate or an XNOR gate.Arithmetic unit (320) which is configured to carry out all method steps of a method according to one of the preceding claims.Computer program which causes a computing unit (320) to carry out all method steps of a method according to one of Claims 1 to 11 when it is executed on the computing unit (320).A machine readable storage medium having stored thereon a computer program according to claim 13.

Images